@keynv/cli 0.1.0-rc.7 → 0.1.0-rc.8

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import 'crypto';
-import { readFileSync, existsSync, statSync, mkdirSync, writeFileSync, rmSync } from 'fs';
+import { readFileSync, existsSync, statSync, writeFileSync, unlinkSync, mkdirSync, rmSync, readdirSync } from 'fs';
 import { homedir } from 'os';
-import { isAbsolute, resolve, join, dirname } from 'path';
+import { isAbsolute, resolve, join, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
 import { styleText } from 'util';
 import j2, { stdin, stdout } from 'process';
@@ -1056,7 +1056,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.7" ;
+    VERSION = "0.1.0-rc.8" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -5716,6 +5716,137 @@ var init_format = __esm({
   "src/ui/format.ts"() {
   }
 });
+function parseEnvFile(content, filename) {
+  const normalized = content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+  const lines = normalized.split(/\r?\n/);
+  const entries = [];
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i] ?? "";
+    const lineNo = i + 1;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) continue;
+    if (trimmed.startsWith("#")) continue;
+    let body = trimmed;
+    if (body.startsWith("export ")) {
+      body = body.slice("export ".length).trimStart();
+    }
+    const eq = body.indexOf("=");
+    if (eq <= 0) {
+      throw new EnvFileParseError(filename, lineNo, "expected 'KEY=value'");
+    }
+    const name = body.slice(0, eq).trim();
+    if (!KEY_RE2.test(name)) {
+      throw new EnvFileParseError(
+        filename,
+        lineNo,
+        `invalid key '${name}' (must match /^[A-Za-z_][A-Za-z0-9_]*$/)`
+      );
+    }
+    let valueRaw = body.slice(eq + 1);
+    let value;
+    const valueLeading = valueRaw.replace(/^\s+/, "");
+    const firstCh = valueLeading.charAt(0);
+    if (firstCh === '"' || firstCh === "'") {
+      const close = valueLeading.lastIndexOf(firstCh);
+      if (close === 0) {
+        throw new EnvFileParseError(filename, lineNo, `unclosed ${firstCh} quote`);
+      }
+      const after = valueLeading.slice(close + 1).trim();
+      if (after.length > 0) {
+        throw new EnvFileParseError(
+          filename,
+          lineNo,
+          `unexpected content after closing ${firstCh}`
+        );
+      }
+      value = valueLeading.slice(1, close);
+    } else {
+      value = valueRaw.replace(/\s+$/, "");
+      value = value.replace(/^\s+/, "");
+    }
+    entries.push({
+      name,
+      value,
+      isAlias: parseAlias(value) !== null,
+      line: lineNo
+    });
+  }
+  return entries;
+}
+function findEnvFile(startDir) {
+  let dir = resolve(startDir);
+  for (let i = 0; i < 64; i++) {
+    const candidate = join(dir, ENV_FILE_BASENAME);
+    if (existsSync(candidate)) {
+      try {
+        if (statSync(candidate).isFile()) return candidate;
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+function loadEnvFile(opts) {
+  if (opts.disabled) return null;
+  const pickExplicit = opts.explicitPath ?? opts.envVarOverride;
+  let path = null;
+  if (pickExplicit !== void 0) {
+    path = isAbsolute(pickExplicit) ? pickExplicit : resolve(opts.cwd, pickExplicit);
+    if (!existsSync(path)) throw new EnvFileNotFoundError(path);
+  } else {
+    path = findEnvFile(opts.cwd);
+  }
+  if (path === null) return null;
+  const stat = statSync(path);
+  if (stat.size > MAX_FILE_BYTES) {
+    throw new EnvFileTooLargeError(path, stat.size);
+  }
+  const content = readFileSync(path, "utf8");
+  const entries = parseEnvFile(content, path);
+  return { path, entries };
+}
+var MAX_FILE_BYTES, KEY_RE2, ENV_FILE_BASENAME, EnvFileParseError, EnvFileNotFoundError, EnvFileTooLargeError;
+var init_envFile = __esm({
+  "src/exec/envFile.ts"() {
+    init_dist();
+    MAX_FILE_BYTES = 1e6;
+    KEY_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
+    ENV_FILE_BASENAME = ".keynv.env";
+    EnvFileParseError = class extends Error {
+      constructor(file, line, reason) {
+        super(`${file}:${line}: ${reason}`);
+        this.file = file;
+        this.line = line;
+        this.reason = reason;
+        this.name = "EnvFileParseError";
+      }
+      file;
+      line;
+      reason;
+    };
+    EnvFileNotFoundError = class extends Error {
+      constructor(path) {
+        super(`env file not found: ${path}`);
+        this.path = path;
+        this.name = "EnvFileNotFoundError";
+      }
+      path;
+    };
+    EnvFileTooLargeError = class extends Error {
+      constructor(path, bytes) {
+        super(`env file ${path} is ${bytes} bytes (max ${MAX_FILE_BYTES})`);
+        this.path = path;
+        this.bytes = bytes;
+        this.name = "EnvFileTooLargeError";
+      }
+      path;
+      bytes;
+    };
+  }
+});
 
 // src/ui/helpers/tty.ts
 var tty_exports = {};
@@ -6095,7 +6226,7 @@ var require_src = __commonJS({
     var ESC2 = "\x1B";
     var CSI2 = `${ESC2}[`;
     var beep = "\x07";
-    var cursor2 = {
+    var cursor = {
       to(x, y) {
         if (!y) return `${CSI2}${x + 1}G`;
         return `${CSI2}${y + 1};${x + 1}H`;
@@ -6134,13 +6265,13 @@ var require_src = __commonJS({
       lines(count) {
         let clear = "";
         for (let i = 0; i < count; i++)
-          clear += this.line + (i < count - 1 ? cursor2.up() : "");
+          clear += this.line + (i < count - 1 ? cursor.up() : "");
         if (count)
-          clear += cursor2.left;
+          clear += cursor.left;
         return clear;
       }
     };
-    module.exports = { cursor: cursor2, scroll, erase, beep };
+    module.exports = { cursor, scroll, erase, beep };
   }
 });
 function d(r, t, s) {
@@ -6884,6 +7015,413 @@ ${c2}
     } }).prompt();
   }
 });
+function findProjectRoot(startDir) {
+  let dir = resolve(startDir);
+  for (let i = 0; i < 64; i++) {
+    for (const marker of PROJECT_MARKERS) {
+      const candidate = join(dir, marker);
+      if (existsSync(candidate)) {
+        return buildRoot(dir, marker);
+      }
+    }
+    if (existsSync(join(dir, GIT_MARKER))) {
+      return buildRoot(dir, GIT_MARKER);
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+function buildRoot(dir, marker) {
+  let suggestedName = basename(dir);
+  let scripts = null;
+  let invalid = false;
+  if (marker === "package.json" || existsSync(join(dir, "package.json"))) {
+    try {
+      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      if (typeof pkg.name === "string" && pkg.name.length > 0) {
+        suggestedName = pkg.name.replace(/^@[^/]+\//, "");
+      }
+      if (pkg.scripts && typeof pkg.scripts === "object") {
+        scripts = Object.fromEntries(
+          Object.entries(pkg.scripts).filter(
+            ([, v2]) => typeof v2 === "string"
+          )
+        );
+      }
+    } catch {
+      invalid = true;
+    }
+  }
+  return { path: dir, suggestedName, marker, packageJsonScripts: scripts, packageJsonInvalid: invalid };
+}
+function findEnvFiles(rootDir) {
+  let entries;
+  try {
+    entries = readdirSync(rootDir);
+  } catch {
+    return [];
+  }
+  const hits = [];
+  for (const name of entries) {
+    if (!ENV_GLOB.test(name)) continue;
+    if (ENV_EXAMPLE.test(name)) continue;
+    if (name === KEYNV_ENV_BASENAME) continue;
+    const full = join(rootDir, name);
+    try {
+      if (!statSync(full).isFile()) continue;
+    } catch {
+      continue;
+    }
+    const suffixMatch = name.match(/^\.env\.(.+)$/);
+    const suffix = suffixMatch ? suffixMatch[1] : null;
+    hits.push({ path: full, name, suffix, suggestedEnv: suggestedEnvForSuffix(suffix) });
+  }
+  hits.sort((a, b2) => {
+    if (a.suffix === null) return -1;
+    if (b2.suffix === null) return 1;
+    return a.name.localeCompare(b2.name);
+  });
+  return hits;
+}
+function suggestedEnvForSuffix(suffix) {
+  if (suffix === null) return "dev";
+  switch (suffix) {
+    case "local":
+    case "development":
+    case "dev":
+      return "dev";
+    case "production":
+    case "prod":
+      return "prod";
+    case "staging":
+    case "stage":
+      return "staging";
+    case "test":
+      return "test";
+    case "preview":
+      return "preview";
+    default:
+      return suffix;
+  }
+}
+function hasExistingKeynvEnv(rootDir) {
+  return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
+}
+var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
+var init_detect = __esm({
+  "src/init/detect.ts"() {
+    PROJECT_MARKERS = [
+      "package.json",
+      "pyproject.toml",
+      "Cargo.toml",
+      "go.mod",
+      "pnpm-workspace.yaml",
+      "deno.json",
+      "deno.jsonc",
+      "requirements.txt"
+    ];
+    GIT_MARKER = ".git";
+    ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
+    ENV_EXAMPLE = /^\.env\.(example|sample|template)$/;
+    KEYNV_ENV_BASENAME = ".keynv.env";
+  }
+});
+
+// src/init/heuristics.ts
+function shannonEntropyBits(s) {
+  if (s.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let h2 = 0;
+  for (const c2 of counts.values()) {
+    const p2 = c2 / s.length;
+    h2 -= p2 * Math.log2(p2);
+  }
+  return h2;
+}
+function nameMatchesLiteralPrefix(name) {
+  const upper = name.toUpperCase();
+  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
+}
+function nameMatchesSecretSuffix(name) {
+  const upper = name.toUpperCase();
+  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
+    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
+      return { matched: true, hint };
+    }
+  }
+  return { matched: false, hint: "" };
+}
+function classifyEntry(name, value) {
+  const upper = name.toUpperCase();
+  if (NAME_LITERAL_EXACT.has(upper)) {
+    return { verdict: "literal", hint: "common config var" };
+  }
+  if (nameMatchesLiteralPrefix(name)) {
+    return { verdict: "literal", hint: "public env (build-time bundled)" };
+  }
+  if (value.length === 0) {
+    return { verdict: "literal", hint: "empty" };
+  }
+  for (const { re, hint } of VALUE_PATTERNS) {
+    if (re.test(value)) return { verdict: "secret", hint };
+  }
+  const suffix = nameMatchesSecretSuffix(name);
+  if (suffix.matched) {
+    return { verdict: "secret", hint: suffix.hint };
+  }
+  if (NAME_DB_URL.test(name)) {
+    return { verdict: "secret", hint: "database URL" };
+  }
+  if (value.length >= 32) {
+    const bits = shannonEntropyBits(value);
+    if (bits >= 3.5) {
+      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
+    }
+  }
+  return { verdict: "ambiguous", hint: "" };
+}
+function previewValue(value, max = 40) {
+  if (value.length === 0) return "(empty)";
+  if (value.length <= max) return value;
+  return `${value.slice(0, max - 1)}\u2026`;
+}
+var NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
+var init_heuristics = __esm({
+  "src/init/heuristics.ts"() {
+    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
+      "NODE_ENV",
+      "PORT",
+      "HOST",
+      "HOSTNAME",
+      "DEBUG",
+      "LOG_LEVEL",
+      "LOGLEVEL",
+      "TZ",
+      "LANG",
+      "LC_ALL",
+      "PATH",
+      "HOME",
+      "USER",
+      "SHELL",
+      "PWD",
+      "CI",
+      "NODE_OPTIONS",
+      "NPM_CONFIG_LOGLEVEL",
+      "TS_NODE_PROJECT"
+    ]);
+    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
+    NAME_SECRET_SUFFIXES = [
+      { suffix: "PRIVATE_KEY", hint: "private key" },
+      { suffix: "API_KEY", hint: "API key" },
+      { suffix: "ACCESS_KEY", hint: "access key" },
+      { suffix: "SECRET_KEY", hint: "secret key" },
+      { suffix: "SECRET", hint: "secret" },
+      { suffix: "PASSWORD", hint: "password" },
+      { suffix: "PASSPHRASE", hint: "passphrase" },
+      { suffix: "TOKEN", hint: "token" },
+      { suffix: "KEY", hint: "key" },
+      { suffix: "CREDENTIALS", hint: "credentials" },
+      { suffix: "AUTH", hint: "auth" },
+      { suffix: "DSN", hint: "connection string" }
+    ];
+    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
+    VALUE_PATTERNS = [
+      { re: /^sk-proj-/, hint: "OpenAI project key" },
+      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
+      { re: /^sk_live_/, hint: "Stripe live key" },
+      { re: /^sk_test_/, hint: "Stripe test key" },
+      { re: /^pk_live_/, hint: "Stripe publishable (often public, double-check)" },
+      { re: /^xoxb-/, hint: "Slack bot token" },
+      { re: /^xoxp-/, hint: "Slack user token" },
+      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
+      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
+      { re: /^gho_/, hint: "GitHub OAuth token" },
+      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
+      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
+      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
+      { re: /^ya29\./, hint: "Google OAuth access token" },
+      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
+      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
+      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
+    ];
+  }
+});
+
+// src/init/scriptWrap.ts
+function analyzeScript(name, command) {
+  const trimmed = command.trim();
+  if (trimmed.startsWith("keynv ") || trimmed.startsWith("keynv	")) {
+    return {
+      name,
+      original: command,
+      wrapped: command,
+      verdict: "skip-already-wrapped",
+      hint: "already wrapped"
+    };
+  }
+  const firstWord = extractFirstCommandWord(trimmed);
+  if (firstWord === null) {
+    return {
+      name,
+      original: command,
+      wrapped: `${KEYNV_PREFIX} ${command}`,
+      verdict: "skip-unknown",
+      hint: "cannot parse"
+    };
+  }
+  const wrapped = `${KEYNV_PREFIX} ${command}`;
+  if (ENV_AWARE_TOOLS.has(firstWord)) {
+    return { name, original: command, wrapped, verdict: "wrap", hint: `${firstWord} reads env` };
+  }
+  if (NON_ENV_TOOLS.has(firstWord)) {
+    return {
+      name,
+      original: command,
+      wrapped,
+      verdict: "skip-no-env-tool",
+      hint: `${firstWord} doesn't need env`
+    };
+  }
+  return {
+    name,
+    original: command,
+    wrapped,
+    verdict: "skip-unknown",
+    hint: `unrecognized: ${firstWord}`
+  };
+}
+function extractFirstCommandWord(s) {
+  const tokens = s.split(/\s+/).filter((t) => t.length > 0);
+  let i = 0;
+  while (i < tokens.length) {
+    const t = tokens[i];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
+      i++;
+      continue;
+    }
+    if (t === "cross-env") {
+      i++;
+      while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i++;
+      continue;
+    }
+    if (t === "dotenv") {
+      const dashDash = tokens.indexOf("--", i + 1);
+      if (dashDash >= 0) {
+        i = dashDash + 1;
+        continue;
+      }
+      i++;
+      while (i < tokens.length && tokens[i].startsWith("-")) i++;
+      continue;
+    }
+    if (t === "sh" || t === "bash" || t === "zsh") {
+      return null;
+    }
+    return t.replace(/^.*\//, "");
+  }
+  return null;
+}
+function planScriptWrap(scripts) {
+  const recommended = [];
+  const skipped = [];
+  const unknown = [];
+  for (const [name, command] of Object.entries(scripts)) {
+    const analysis = analyzeScript(name, command);
+    switch (analysis.verdict) {
+      case "wrap":
+        recommended.push(analysis);
+        break;
+      case "skip-unknown":
+        unknown.push(analysis);
+        break;
+      default:
+        skipped.push(analysis);
+    }
+  }
+  return { recommended, skipped, unknown };
+}
+function applyWraps(original, selectedScriptNames) {
+  const out = { ...original };
+  const selection = new Set(selectedScriptNames);
+  for (const [name, command] of Object.entries(original)) {
+    if (!selection.has(name)) continue;
+    const trimmed = command.trim();
+    if (trimmed.startsWith("keynv ") || trimmed.startsWith("keynv	")) continue;
+    out[name] = `${KEYNV_PREFIX} ${command}`;
+  }
+  return out;
+}
+var KEYNV_PREFIX, ENV_AWARE_TOOLS, NON_ENV_TOOLS;
+var init_scriptWrap = __esm({
+  "src/init/scriptWrap.ts"() {
+    KEYNV_PREFIX = "keynv exec --";
+    ENV_AWARE_TOOLS = /* @__PURE__ */ new Set([
+      "node",
+      "tsx",
+      "ts-node",
+      "bun",
+      "deno",
+      "next",
+      "nuxt",
+      "vite",
+      "remix",
+      "astro",
+      "gatsby",
+      "nest",
+      "webpack",
+      "rollup",
+      "parcel",
+      "vitest",
+      "jest",
+      "mocha",
+      "cypress",
+      "playwright",
+      "storybook",
+      "tsc-watch",
+      "pm2",
+      "forever",
+      "nodemon",
+      "concurrently",
+      "pytest",
+      "python",
+      "python3",
+      "gunicorn",
+      "uvicorn",
+      "celery",
+      "flask",
+      "django-admin",
+      "manage.py",
+      "rails",
+      "rake",
+      "go",
+      "cargo",
+      "air"
+    ]);
+    NON_ENV_TOOLS = /* @__PURE__ */ new Set([
+      "eslint",
+      "biome",
+      "prettier",
+      "tsc",
+      "tslint",
+      "stylelint",
+      "rm",
+      "cp",
+      "mv",
+      "mkdir",
+      "echo",
+      "cat",
+      "find",
+      "grep",
+      "sort",
+      "uniq",
+      "sed",
+      "awk"
+    ]);
+  }
+});
 
 // src/ui/helpers/cancel.ts
 function unwrap(value) {
@@ -6925,6 +7463,419 @@ var init_pickProject = __esm({
   }
 });
 
+// src/ui/flows/init.ts
+var init_exports = {};
+__export(init_exports, {
+  UserCancelled: () => UserCancelled,
+  runInitFlow: () => runInitFlow
+});
+async function runInitFlow(client, opts) {
+  ge("keynv init");
+  const root = findProjectRoot(opts.cwd);
+  if (root === null) {
+    me(
+      "Couldn't find a project root (no package.json, pyproject.toml, Cargo.toml, go.mod, or .git anywhere up the tree). Run `keynv init` inside a project directory."
+    );
+    return { exitCode: 1 };
+  }
+  if (root.packageJsonInvalid) {
+    R2.warn(`package.json at ${root.path} is not valid JSON \u2014 script wrapping will be skipped.`);
+  }
+  const envFiles = findEnvFiles(root.path);
+  if (envFiles.length === 0 && !hasExistingKeynvEnv(root.path)) {
+    R2.info(
+      `No .env files found in ${root.path}. There's nothing to migrate yet \u2014 create a .keynv.env by hand or run \`keynv exec\` once you have one.`
+    );
+    ye("Nothing to do.");
+    return { exitCode: 0 };
+  }
+  const intoExisting = hasExistingKeynvEnv(root.path);
+  Se(
+    [
+      `Project root: ${root.path}`,
+      `Marker: ${root.marker}`,
+      envFiles.length > 0 ? `Found env files: ${envFiles.map((f) => f.name).join(", ")}` : "Found env files: (none)",
+      intoExisting ? "Existing .keynv.env detected \u2014 will merge new entries in." : ""
+    ].filter(Boolean).join("\n"),
+    "Detected"
+  );
+  const merged = mergeEnvFiles(envFiles);
+  if (merged.length === 0) {
+    R2.info("All env files were empty (only comments/blanks). Nothing to upload.");
+    ye("Done.");
+    return { exitCode: 0 };
+  }
+  const projectChoice = await pickOrCreateProject(client, root.suggestedName);
+  if (projectChoice === null) {
+    me("No project selected.");
+    return { exitCode: 130 };
+  }
+  const envName = await pickEnvForUpload(client, projectChoice, envFiles);
+  if (envName === null) {
+    me("No environment selected.");
+    return { exitCode: 130 };
+  }
+  const choices = merged.map((e2) => {
+    const verdict = classifyEntry(e2.name, e2.value);
+    const hint = verdict.hint || (e2.isAlias ? "looks like an alias literal" : "no signal");
+    const preview2 = e2.isAlias ? e2.value : previewValue(e2.value, 32);
+    return {
+      name: e2.name,
+      value: e2.value,
+      isAlias: e2.isAlias,
+      verdict: verdict.verdict,
+      label: `${e2.name}  ${preview2}`,
+      hint,
+      sourceLine: e2.sourceLine,
+      source: e2.source
+    };
+  });
+  const initialSecretSelection = choices.filter((c2) => c2.verdict === "secret" && !c2.isAlias).map((c2) => c2.name);
+  const selectedSecretNames = unwrap(
+    await ve({
+      message: "Mark which keys are secrets (vault-uploaded). Unchecked keys stay as literals.",
+      options: choices.map((c2) => ({
+        value: c2.name,
+        label: c2.label,
+        hint: c2.isAlias ? `${c2.hint} \u2014 already aliased; will pass through` : c2.hint
+      })),
+      initialValues: initialSecretSelection,
+      required: false
+    })
+  );
+  const selected = new Set(selectedSecretNames);
+  let scriptWrapSelection = [];
+  let scriptPlan = root.packageJsonScripts ? planScriptWrap(root.packageJsonScripts) : null;
+  if (!opts.noScripts && scriptPlan && scriptPlan.recommended.length > 0) {
+    const wrapAnswer = unwrap(
+      await ve({
+        message: "Wrap package.json scripts with `keynv exec`? (recommended)",
+        options: [
+          ...scriptPlan.recommended.map((a) => ({
+            value: a.name,
+            label: `${a.name}  \u2192  ${a.wrapped}`,
+            hint: a.hint
+          })),
+          ...scriptPlan.unknown.map((a) => ({
+            value: a.name,
+            label: `${a.name}  \u2192  ${a.wrapped}`,
+            hint: `unknown tool \u2014 opt in if you know it reads env`
+          }))
+        ],
+        initialValues: scriptPlan.recommended.map((a) => a.name),
+        required: false
+      })
+    );
+    scriptWrapSelection = wrapAnswer;
+  } else if (opts.noScripts) {
+    scriptPlan = null;
+  }
+  const envFileFateRaw = unwrap(
+    await Ee({
+      message: "After upload, what about the original .env files?",
+      options: [
+        { value: "delete", label: "Delete (recommended \u2014 eliminates the leak vector)" },
+        { value: "gitignore", label: "Keep but make sure .gitignore covers them" }
+      ],
+      initialValue: "delete"
+    })
+  );
+  const planSummary = [
+    `Project:          ${projectChoice.name}${projectChoice.created ? " (will be created)" : ""}`,
+    `Environment:      ${envName}`,
+    `Secrets to vault: ${selected.size}`,
+    `Literals in file: ${merged.length - selected.size}`,
+    `Script wraps:     ${scriptWrapSelection.length}`,
+    `Original .env:    ${envFileFateRaw === "delete" ? "delete" : "keep + gitignore"}`,
+    opts.dryRun ? "Dry-run: no changes will be made." : ""
+  ].filter(Boolean).join("\n");
+  Se(planSummary, "About to apply");
+  const proceed = unwrap(await ue({ message: "Proceed?", initialValue: true }));
+  if (!proceed) {
+    me("Aborted.");
+    return { exitCode: 130 };
+  }
+  if (opts.dryRun) {
+    ye("Dry-run complete \u2014 no changes were made.");
+    return { exitCode: 0 };
+  }
+  let projectId2;
+  if (projectChoice.created) {
+    const s = ft();
+    s.start(`Creating project "${projectChoice.name}"`);
+    try {
+      const created = await client.request("/v1/projects", {
+        method: "POST",
+        body: {
+          name: projectChoice.name,
+          environments: [{ name: envName, tier: "non-production", require_approval: false }]
+        }
+      });
+      projectId2 = created.id;
+      s.stop(`Created project ${created.name}`);
+    } catch (err) {
+      s.error(`Failed to create project: ${err instanceof Error ? err.message : String(err)}`);
+      return { exitCode: 1 };
+    }
+  } else {
+    projectId2 = projectChoice.id;
+  }
+  const uploaded = [];
+  const failed = [];
+  if (selected.size > 0) {
+    const s = ft();
+    s.start(`Uploading ${selected.size} secrets`);
+    let i = 0;
+    for (const entry2 of merged) {
+      if (!selected.has(entry2.name)) continue;
+      i++;
+      s.message(`Uploading (${i}/${selected.size}) ${entry2.name}`);
+      const aliasKey = entry2.name.toLowerCase().replace(/_/g, "-");
+      try {
+        await client.request(`/v1/projects/${projectId2}/secrets`, {
+          method: "POST",
+          body: { env: envName, key: aliasKey, value: entry2.value }
+        });
+        const alias2 = buildAlias({ project: projectChoice.name, environment: envName, key: aliasKey });
+        if (alias2 === null) {
+          failed.push({
+            name: entry2.name,
+            reason: `produced an invalid alias for project=${projectChoice.name} env=${envName} key=${aliasKey}`
+          });
+        } else {
+          uploaded.push({ name: entry2.name, aliasLiteral: alias2.literal });
+        }
+      } catch (err) {
+        failed.push({ name: entry2.name, reason: err instanceof Error ? err.message : String(err) });
+      }
+    }
+    if (failed.length === 0) {
+      s.stop(`Uploaded ${uploaded.length} secrets`);
+    } else {
+      s.error(`${uploaded.length}/${selected.size} uploaded; ${failed.length} failed`);
+      for (const f of failed) R2.warn(`  ${f.name}: ${f.reason}`);
+    }
+  }
+  const literals = merged.filter((e2) => !selected.has(e2.name));
+  const successUploads = new Map(uploaded.map((u) => [u.name, u.aliasLiteral]));
+  const keynvEnvPath = join(root.path, ".keynv.env");
+  let writtenLines;
+  try {
+    writtenLines = composeKeynvEnv({
+      uploadedAliases: successUploads,
+      literals,
+      mergeWithExisting: intoExisting ? readFileSync(keynvEnvPath, "utf8") : null
+    });
+    writeFileSync(keynvEnvPath, `${writtenLines.join("\n")}
+`);
+    R2.success(
+      `${intoExisting ? "Updated" : "Wrote"} ${keynvEnvPath} (${successUploads.size + literals.length} entries)`
+    );
+  } catch (err) {
+    R2.error(`Failed to write .keynv.env: ${err instanceof Error ? err.message : String(err)}`);
+    return { exitCode: 1 };
+  }
+  if (scriptWrapSelection.length > 0 && root.packageJsonScripts) {
+    try {
+      updatePackageJsonScripts(
+        join(root.path, "package.json"),
+        root.packageJsonScripts,
+        scriptWrapSelection
+      );
+      R2.success(`Wrapped ${scriptWrapSelection.length} script(s) in package.json`);
+    } catch (err) {
+      R2.warn(
+        `Could not update package.json scripts: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  if (envFileFateRaw === "delete") {
+    for (const f of envFiles) {
+      try {
+        unlinkSync(f.path);
+        R2.success(`Removed ${f.name}`);
+      } catch (err) {
+        R2.warn(`Could not remove ${f.name}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  } else {
+    const gitignorePath = join(root.path, ".gitignore");
+    try {
+      ensureGitignoreEntries(gitignorePath, envFiles.map((f) => f.name));
+      R2.success(`Updated .gitignore (${envFiles.length} entries ensured)`);
+    } catch (err) {
+      R2.warn(`Could not update .gitignore: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  ye(
+    failed.length > 0 ? `Done with ${failed.length} failure(s) \u2014 see warnings above.` : `Done. Try: ${scriptWrapSelection.includes("dev") ? "npm run dev" : "keynv exec -- <your command>"}`
+  );
+  return { exitCode: failed.length > 0 ? 1 : 0 };
+}
+function mergeEnvFiles(files) {
+  const map = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    let entries;
+    try {
+      entries = parseEnvFile(readFileSync(f.path, "utf8"), f.path);
+    } catch (err) {
+      R2.warn(`${f.name}: ${err instanceof Error ? err.message : String(err)} \u2014 skipping file`);
+      continue;
+    }
+    for (const e2 of entries) {
+      const existing = map.get(e2.name);
+      if (existing) {
+        existing.shadowedBy.push(f.name);
+        existing.value = e2.value;
+        existing.isAlias = e2.isAlias;
+      } else {
+        map.set(e2.name, {
+          name: e2.name,
+          value: e2.value,
+          isAlias: e2.isAlias,
+          source: f.name,
+          sourceLine: e2.line,
+          shadowedBy: []
+        });
+      }
+    }
+  }
+  return [...map.values()];
+}
+async function pickOrCreateProject(client, suggestedName) {
+  const projects = await listProjects(client);
+  const value = unwrap(
+    await Ee({
+      message: "Use which keynv project?",
+      options: [
+        { value: "__new", label: `+ Create new: "${suggestedName}"` },
+        ...projects.map((p2) => ({ value: p2.id, label: p2.name, hint: p2.id }))
+      ]
+    })
+  );
+  if (value === "__new") {
+    const name = unwrap(
+      await Re({
+        message: "Project name",
+        initialValue: suggestedName,
+        validate: (v2) => v2 && /^[a-z0-9][a-z0-9-]{0,47}$/.test(v2) ? void 0 : "lowercase letters, digits, dashes; up to 48 chars"
+      })
+    );
+    return { id: "", name, created: true };
+  }
+  const match = projects.find((p2) => p2.id === value);
+  if (!match) return null;
+  return { id: match.id, name: match.name, created: false };
+}
+async function pickEnvForUpload(client, project, envFiles) {
+  const firstSuffix = envFiles[0]?.suffix ?? null;
+  const suggested = suggestedEnvForSuffix(firstSuffix);
+  if (project.created) {
+    const value2 = unwrap(
+      await Re({
+        message: "Environment to create",
+        initialValue: suggested,
+        validate: (v2) => v2 && /^[a-z0-9][a-z0-9-]{0,23}$/.test(v2) ? void 0 : "lowercase letters, digits, dashes; up to 24 chars"
+      })
+    );
+    return value2;
+  }
+  const detail = await client.request(`/v1/projects/${project.id}`);
+  if (detail.environments.length === 0) {
+    me(
+      `Project "${project.name}" has no environments yet, and we can't add one from init in this version. Create one with \`keynv project create\` (or pick a different project).`
+    );
+    return null;
+  }
+  if (detail.environments.length === 1) {
+    return detail.environments[0]?.name ?? null;
+  }
+  const value = unwrap(
+    await Ee({
+      message: "Upload to which environment?",
+      options: detail.environments.map((e2) => ({
+        value: e2.name,
+        label: e2.name,
+        hint: e2.tier
+      })),
+      initialValue: detail.environments.find((e2) => e2.name === suggested)?.name
+    })
+  );
+  return value;
+}
+function composeKeynvEnv(opts) {
+  const { uploadedAliases, literals, mergeWithExisting } = opts;
+  const lines = [];
+  if (mergeWithExisting !== null) {
+    const trimmed = mergeWithExisting.replace(/\n+$/, "");
+    if (trimmed.length > 0) {
+      lines.push(...trimmed.split("\n"));
+      lines.push("");
+    }
+    lines.push(`# >>> keynv init  ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)} >>>`);
+  } else {
+    lines.push("# .keynv.env \u2014 alias references to vault secrets.");
+    lines.push("# Safe to commit: this file contains references, not values.");
+    lines.push("# Auto-loaded by `keynv exec`. See https://keynv.dev/docs/keynv-env");
+    lines.push("");
+  }
+  if (uploadedAliases.size > 0) {
+    lines.push("# Vault-resolved (real values live on the keynv server)");
+    for (const [name, alias2] of uploadedAliases) {
+      lines.push(`${name}=${alias2}`);
+    }
+  }
+  if (literals.length > 0) {
+    if (uploadedAliases.size > 0) lines.push("");
+    lines.push("# Plain literals (passed through unchanged)");
+    for (const e2 of literals) {
+      const value = needsQuoting(e2.value) ? `"${e2.value.replace(/"/g, '\\"')}"` : e2.value;
+      lines.push(`${e2.name}=${value}`);
+    }
+  }
+  if (mergeWithExisting !== null) {
+    lines.push(`# <<< keynv init <<<`);
+  }
+  return lines;
+}
+function needsQuoting(value) {
+  return /\s/.test(value) || value.includes("#") || value.length === 0;
+}
+function updatePackageJsonScripts(path, originalScripts, selectedNames) {
+  const raw = readFileSync(path, "utf8");
+  const indentMatch = raw.match(/^([ \t]+)"/m);
+  const indent = indentMatch ? indentMatch[1] : "  ";
+  const trailingNewline = raw.endsWith("\n");
+  const pkg = JSON.parse(raw);
+  const updated = applyWraps(originalScripts, selectedNames);
+  pkg.scripts = updated;
+  const out = JSON.stringify(pkg, null, indent);
+  writeFileSync(path, trailingNewline ? `${out}
+` : out);
+}
+function ensureGitignoreEntries(path, basenames) {
+  let existing = "";
+  if (existsSync(path)) existing = readFileSync(path, "utf8");
+  const existingLines = new Set(existing.split("\n").map((l) => l.trim()));
+  const toAdd = basenames.filter((n) => !existingLines.has(n));
+  if (toAdd.length === 0) return;
+  const sep = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+  const block = ["", "# added by keynv init", ...toAdd, ""].join("\n");
+  writeFileSync(path, `${existing}${sep}${block}`);
+}
+var init_init = __esm({
+  "src/ui/flows/init.ts"() {
+    init_dist();
+    init_dist5();
+    init_envFile();
+    init_detect();
+    init_heuristics();
+    init_scriptWrap();
+    init_cancel();
+    init_pickProject();
+  }
+});
+
 // src/ui/helpers/pickSecret.ts
 async function listSecrets(client, projectId2) {
   const data = await client.request(
@@ -7060,14 +8011,14 @@ async function runSecretMenu(client, project, alias2) {
 async function copyToClipboard(value) {
   const platform = process.platform;
   const cmd = platform === "darwin" ? ["pbcopy", []] : platform === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     try {
       const child = spawn(cmd[0], cmd[1], { stdio: ["pipe", "ignore", "ignore"] });
-      child.on("error", () => resolve2(false));
-      child.on("exit", (code) => resolve2(code === 0));
+      child.on("error", () => resolve3(false));
+      child.on("exit", (code) => resolve3(code === 0));
       child.stdin.end(value);
     } catch {
-      resolve2(false);
+      resolve3(false);
     }
   });
 }
@@ -7187,24 +8138,24 @@ var require_lib2 = __commonJS({
       const currentChar = sql.charCodeAt(position);
       const nextChar = sql.charCodeAt(position + 1);
       if (currentChar === charCode.singleQuote) {
-        for (let cursor2 = position + 1; cursor2 < sql.length; cursor2++) {
-          if (sql.charCodeAt(cursor2) === charCode.backslash)
-            cursor2++;
-          else if (sql.charCodeAt(cursor2) === charCode.singleQuote)
-            return cursor2 + 1;
+        for (let cursor = position + 1; cursor < sql.length; cursor++) {
+          if (sql.charCodeAt(cursor) === charCode.backslash)
+            cursor++;
+          else if (sql.charCodeAt(cursor) === charCode.singleQuote)
+            return cursor + 1;
         }
         return sql.length;
       }
       if (currentChar === charCode.backtick) {
         const length = sql.length;
-        for (let cursor2 = position + 1; cursor2 < length; cursor2++) {
-          if (sql.charCodeAt(cursor2) !== charCode.backtick)
+        for (let cursor = position + 1; cursor < length; cursor++) {
+          if (sql.charCodeAt(cursor) !== charCode.backtick)
             continue;
-          if (sql.charCodeAt(cursor2 + 1) === charCode.backtick) {
-            cursor2++;
+          if (sql.charCodeAt(cursor + 1) === charCode.backtick) {
+            cursor++;
             continue;
           }
-          return cursor2 + 1;
+          return cursor + 1;
         }
         return length;
       }
@@ -7247,11 +8198,11 @@ var require_lib2 = __commonJS({
         if (lower === 115 && matchesWord(sql, position, "set", length))
           return position + 3;
         if (lower === 107 && matchesWord(sql, position, "key", length)) {
-          let cursor2 = position + 3;
-          while (cursor2 < length && isWhitespace(sql.charCodeAt(cursor2)))
-            cursor2++;
-          if (matchesWord(sql, cursor2, "update", length))
-            return cursor2 + 6;
+          let cursor = position + 3;
+          while (cursor < length && isWhitespace(sql.charCodeAt(cursor)))
+            cursor++;
+          if (matchesWord(sql, cursor, "update", length))
+            return cursor + 6;
         }
       }
       return -1;
@@ -23813,7 +24764,7 @@ var require_named_placeholders = __commonJS({
         }
         return s;
       }
-      function join8(tree) {
+      function join5(tree) {
         if (tree.length === 1) {
           return tree;
         }
@@ -23839,7 +24790,7 @@ var require_named_placeholders = __commonJS({
         if (cache2 && (tree = cache2.get(query))) {
           return toArrayParams(tree, paramsObj);
         }
-        tree = join8(parse(query));
+        tree = join5(parse(query));
         if (cache2) {
           cache2.set(query, tree);
         }
@@ -23995,11 +24946,11 @@ var require_connection = __commonJS({
             const config = this.config;
             tracePromise(
               connectChannel,
-              () => new Promise((resolve2, reject) => {
+              () => new Promise((resolve3, reject) => {
                 let onConnect, onError;
                 onConnect = (param) => {
                   this.removeListener("error", onError);
-                  resolve2(param);
+                  resolve3(param);
                 };
                 onError = (err) => {
                   this.removeListener("connect", onConnect);
@@ -24424,9 +25375,9 @@ var require_connection = __commonJS({
         } else if (shouldTrace(queryChannel)) {
           tracePromise(
             queryChannel,
-            () => new Promise((resolve2, reject) => {
+            () => new Promise((resolve3, reject) => {
               cmdQuery.once("error", reject);
-              cmdQuery.once("end", () => resolve2());
+              cmdQuery.once("end", () => resolve3());
               this.addCommand(cmdQuery);
             }),
             () => {
@@ -24573,12 +25524,12 @@ var require_connection = __commonJS({
         } else if (shouldTrace(executeChannel)) {
           tracePromise(
             executeChannel,
-            () => new Promise((resolve2, reject) => {
+            () => new Promise((resolve3, reject) => {
               prepareAndExecute((err) => {
                 executeCommand.emit("error", err);
               });
               executeCommand.once("error", reject);
-              executeCommand.once("end", () => resolve2());
+              executeCommand.once("end", () => resolve3());
             }),
             () => {
               const server = getServerContext(this.config);
@@ -24843,13 +25794,13 @@ var require_capture_local_err = __commonJS({
 var require_make_done_cb = __commonJS({
   "../../node_modules/.pnpm/mysql2@3.22.3_@types+node@24.12.3/node_modules/mysql2/lib/promise/make_done_cb.js"(exports, module) {
     var { applyCapturedStack } = require_capture_local_err();
-    function makeDoneCb(resolve2, reject, stackHolder) {
+    function makeDoneCb(resolve3, reject, stackHolder) {
       return function(err, rows, fields) {
         if (err) {
           applyCapturedStack(err, stackHolder);
           reject(err);
         } else {
-          resolve2([rows, fields]);
+          resolve3([rows, fields]);
         }
       };
     }
@@ -24872,8 +25823,8 @@ var require_prepared_statement_info = __commonJS({
         const stackHolder = captureStackHolder(
           _PromisePreparedStatementInfo.prototype.execute
         );
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           if (parameters) {
             s.execute(parameters, done);
           } else {
@@ -24882,9 +25833,9 @@ var require_prepared_statement_info = __commonJS({
         });
       }
       close() {
-        return new this.Promise((resolve2) => {
+        return new this.Promise((resolve3) => {
           this.statement.close();
-          resolve2();
+          resolve3();
         });
       }
     };
@@ -24955,8 +25906,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           if (params !== void 0) {
             c2.query(query, params, done);
           } else {
@@ -24972,8 +25923,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           if (params !== void 0) {
             c2.execute(query, params, done);
           } else {
@@ -24982,8 +25933,8 @@ var require_connection2 = __commonJS({
         });
       }
       end() {
-        return new this.Promise((resolve2) => {
-          this.connection.end(resolve2);
+        return new this.Promise((resolve3) => {
+          this.connection.end(resolve3);
         });
       }
       async [Symbol.asyncDispose]() {
@@ -24996,16 +25947,16 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.beginTransaction
         );
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           c2.beginTransaction(done);
         });
       }
       commit() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.commit);
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           c2.commit(done);
         });
       }
@@ -25014,21 +25965,21 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.rollback
         );
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           c2.rollback(done);
         });
       }
       ping() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.ping);
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           c2.ping((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve2(true);
+              resolve3(true);
             }
           });
         });
@@ -25036,13 +25987,13 @@ var require_connection2 = __commonJS({
       reset() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.reset);
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           c2.reset((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve2();
+              resolve3();
             }
           });
         });
@@ -25050,13 +26001,13 @@ var require_connection2 = __commonJS({
       connect() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.connect);
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           c2.connect((err, param) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve2(param);
+              resolve3(param);
             }
           });
         });
@@ -25065,7 +26016,7 @@ var require_connection2 = __commonJS({
         const c2 = this.connection;
         const promiseImpl = this.Promise;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.prepare);
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           c2.prepare(options, (err, statement) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
@@ -25075,7 +26026,7 @@ var require_connection2 = __commonJS({
                 statement,
                 promiseImpl
               );
-              resolve2(wrappedStatement);
+              resolve3(wrappedStatement);
             }
           });
         });
@@ -25085,13 +26036,13 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.changeUser
         );
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           c2.changeUser(options, (err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve2();
+              resolve3();
             }
           });
         });
@@ -25553,12 +26504,12 @@ var require_pool2 = __commonJS({
       }
       getConnection() {
         const corePool = this.pool;
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           corePool.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve2(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve3(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -25574,8 +26525,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           if (args !== void 0) {
             corePool.query(sql, args, done);
           } else {
@@ -25591,8 +26542,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           if (args) {
             corePool.execute(sql, args, done);
           } else {
@@ -25603,13 +26554,13 @@ var require_pool2 = __commonJS({
       end() {
         const corePool = this.pool;
         const stackHolder = captureStackHolder(_PromisePool.prototype.end);
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           corePool.end((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve2();
+              resolve3();
             }
           });
         });
@@ -26034,12 +26985,12 @@ var require_pool_cluster2 = __commonJS({
       }
       getConnection() {
         const corePoolNamespace = this.poolNamespace;
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           corePoolNamespace.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve2(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve3(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -26054,8 +27005,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           corePoolNamespace.query(sql, values, done);
         });
       }
@@ -26069,8 +27020,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           corePoolNamespace.execute(sql, values, done);
         });
       }
@@ -26108,9 +27059,9 @@ var require_promise = __commonJS({
           "no Promise implementation available.Use promise-enabled node version or pass userland Promise implementation as parameter, for example: { Promise: require('bluebird') }"
         );
       }
-      return new thePromise((resolve2, reject) => {
+      return new thePromise((resolve3, reject) => {
         coreConnection.once("connect", () => {
-          resolve2(new PromiseConnection(coreConnection, thePromise));
+          resolve3(new PromiseConnection(coreConnection, thePromise));
         });
         coreConnection.once("error", (err) => {
           applyCapturedStack(err, stackHolder);
@@ -26137,7 +27088,7 @@ var require_promise = __commonJS({
       }
       getConnection(pattern, selector) {
         const corePoolCluster = this.poolCluster;
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           corePoolCluster.getConnection(
             pattern,
             selector,
@@ -26145,7 +27096,7 @@ var require_promise = __commonJS({
               if (err) {
                 reject(err);
               } else {
-                resolve2(new PromisePoolConnection(coreConnection, this.Promise));
+                resolve3(new PromisePoolConnection(coreConnection, this.Promise));
               }
             }
           );
@@ -26159,8 +27110,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           corePoolCluster.query(sql, args, done);
         });
       }
@@ -26174,8 +27125,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve2, reject) => {
-          const done = makeDoneCb(resolve2, reject, stackHolder);
+        return new this.Promise((resolve3, reject) => {
+          const done = makeDoneCb(resolve3, reject, stackHolder);
           corePoolCluster.execute(sql, args, done);
         });
       }
@@ -26188,13 +27139,13 @@ var require_promise = __commonJS({
       end() {
         const corePoolCluster = this.poolCluster;
         const stackHolder = captureStackHolder(_PromisePoolCluster.prototype.end);
-        return new this.Promise((resolve2, reject) => {
+        return new this.Promise((resolve3, reject) => {
           corePoolCluster.end((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve2();
+              resolve3();
             }
           });
         });
@@ -29269,7 +30220,7 @@ var require_dist = __commonJS({
     function parse(stream, callback) {
       const parser = new parser_1.Parser();
       stream.on("data", (buffer) => parser.parse(buffer, callback));
-      return new Promise((resolve2) => stream.on("end", () => resolve2()));
+      return new Promise((resolve3) => stream.on("end", () => resolve3()));
     }
     exports.parse = parse;
   }
@@ -29994,12 +30945,12 @@ var require_client2 = __commonJS({
           this._connect(callback);
           return;
         }
-        return new this._Promise((resolve2, reject) => {
+        return new this._Promise((resolve3, reject) => {
           this._connect((error) => {
             if (error) {
               reject(error);
             } else {
-              resolve2(this);
+              resolve3(this);
             }
           });
         });
@@ -30345,8 +31296,8 @@ var require_client2 = __commonJS({
           readTimeout = config.query_timeout || this.connectionParameters.query_timeout;
           query = new Query2(config, values, callback);
           if (!query.callback) {
-            result = new this._Promise((resolve2, reject) => {
-              query.callback = (err, res) => err ? reject(err) : resolve2(res);
+            result = new this._Promise((resolve3, reject) => {
+              query.callback = (err, res) => err ? reject(err) : resolve3(res);
             }).catch((err) => {
               Error.captureStackTrace(err);
               throw err;
@@ -30423,8 +31374,8 @@ var require_client2 = __commonJS({
         if (cb) {
           this.connection.once("end", cb);
         } else {
-          return new this._Promise((resolve2) => {
-            this.connection.once("end", resolve2);
+          return new this._Promise((resolve3) => {
+            this.connection.once("end", resolve3);
           });
         }
       }
@@ -30472,8 +31423,8 @@ var require_pg_pool = __commonJS({
       const cb = function(err, client) {
         err ? rej(err) : res(client);
       };
-      const result = new Promise2(function(resolve2, reject) {
-        res = resolve2;
+      const result = new Promise2(function(resolve3, reject) {
+        res = resolve3;
         rej = reject;
       }).catch((err) => {
         Error.captureStackTrace(err);
@@ -30534,7 +31485,7 @@ var require_pg_pool = __commonJS({
         if (typeof Promise2.try === "function") {
           return Promise2.try(f);
         }
-        return new Promise2((resolve2) => resolve2(f()));
+        return new Promise2((resolve3) => resolve3(f()));
       }
       _isFull() {
         return this._clients.length >= this.options.max;
@@ -30926,8 +31877,8 @@ var require_query4 = __commonJS({
     NativeQuery.prototype._getPromise = function() {
       if (this._promise) return this._promise;
       this._promise = new Promise(
-        function(resolve2, reject) {
-          this._once("end", resolve2);
+        function(resolve3, reject) {
+          this._once("end", resolve3);
           this._once("error", reject);
         }.bind(this)
       );
@@ -31104,12 +32055,12 @@ var require_client3 = __commonJS({
         this._connect(callback);
         return;
       }
-      return new this._Promise((resolve2, reject) => {
+      return new this._Promise((resolve3, reject) => {
         this._connect((error) => {
           if (error) {
             reject(error);
           } else {
-            resolve2(this);
+            resolve3(this);
           }
         });
       });
@@ -31133,8 +32084,8 @@ var require_client3 = __commonJS({
         query = new NativeQuery(config, values, callback);
         if (!query.callback) {
           let resolveOut, rejectOut;
-          result = new this._Promise((resolve2, reject) => {
-            resolveOut = resolve2;
+          result = new this._Promise((resolve3, reject) => {
+            resolveOut = resolve3;
             rejectOut = reject;
           }).catch((err) => {
             Error.captureStackTrace(err);
@@ -31194,8 +32145,8 @@ var require_client3 = __commonJS({
       }
       let result;
       if (!cb) {
-        result = new this._Promise(function(resolve2, reject) {
-          cb = (err) => err ? reject(err) : resolve2();
+        result = new this._Promise(function(resolve3, reject) {
+          cb = (err) => err ? reject(err) : resolve3();
         });
       }
       this.native.end(function() {
@@ -36302,7 +37253,7 @@ var require_Command = __commonJS({
         }
       }
       initPromise() {
-        const promise = new Promise((resolve2, reject) => {
+        const promise = new Promise((resolve3, reject) => {
           if (!this.transformed) {
             this.transformed = true;
             const transformer = _Command._transformer.argument[this.name];
@@ -36311,7 +37262,7 @@ var require_Command = __commonJS({
             }
             this.stringifyArguments();
           }
-          this.resolve = this._convertValue(resolve2);
+          this.resolve = this._convertValue(resolve3);
           this.reject = (err) => {
             this._clearTimers();
             if (this.errorStack) {
@@ -36344,11 +37295,11 @@ var require_Command = __commonJS({
       /**
        * Convert the value from buffer to the target encoding.
        */
-      _convertValue(resolve2) {
+      _convertValue(resolve3) {
         return (value) => {
           try {
             this._clearTimers();
-            resolve2(this.transformReply(value));
+            resolve3(this.transformReply(value));
             this.isResolved = true;
           } catch (err) {
             this.reject(err);
@@ -36626,13 +37577,13 @@ var require_autoPipelining = __commonJS({
       if (client.isCluster && !client.slots.length) {
         if (client.status === "wait")
           client.connect().catch(lodash_1.noop);
-        return (0, standard_as_callback_1.default)(new Promise(function(resolve2, reject) {
+        return (0, standard_as_callback_1.default)(new Promise(function(resolve3, reject) {
           client.delayUntilReady((err) => {
             if (err) {
               reject(err);
               return;
             }
-            executeWithAutoPipelining(client, functionName, commandName, args, null).then(resolve2, reject);
+            executeWithAutoPipelining(client, functionName, commandName, args, null).then(resolve3, reject);
           });
         }), callback);
       }
@@ -36653,13 +37604,13 @@ var require_autoPipelining = __commonJS({
         pipeline[exports.kExec] = true;
         setImmediate(executeAutoPipeline, client, slotKey);
       }
-      const autoPipelinePromise = new Promise(function(resolve2, reject) {
+      const autoPipelinePromise = new Promise(function(resolve3, reject) {
         pipeline[exports.kCallbacks].push(function(err, value) {
           if (err) {
             reject(err);
             return;
           }
-          resolve2(value);
+          resolve3(value);
         });
         if (functionName === "call") {
           args.unshift(commandName);
@@ -36894,8 +37845,8 @@ var require_Pipeline = __commonJS({
           this[name] = redis[name];
           this[name + "Buffer"] = redis[name + "Buffer"];
         });
-        this.promise = new Promise((resolve2, reject) => {
-          this.resolve = resolve2;
+        this.promise = new Promise((resolve3, reject) => {
+          this.resolve = resolve3;
           this.reject = reject;
         });
         const _this = this;
@@ -37195,13 +38146,13 @@ var require_transaction = __commonJS({
           if (this.isCluster && !this.redis.slots.length) {
             if (this.redis.status === "wait")
               this.redis.connect().catch(utils_1.noop);
-            return (0, standard_as_callback_1.default)(new Promise((resolve2, reject) => {
+            return (0, standard_as_callback_1.default)(new Promise((resolve3, reject) => {
               this.redis.delayUntilReady((err) => {
                 if (err) {
                   reject(err);
                   return;
                 }
-                this.exec(pipeline).then(resolve2, reject);
+                this.exec(pipeline).then(resolve3, reject);
               });
             }), callback);
           }
@@ -38330,7 +39281,7 @@ var require_cluster = __commonJS({
        * Connect to a cluster
        */
       connect() {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           if (this.status === "connecting" || this.status === "connect" || this.status === "ready") {
             reject(new Error("Redis is already connecting/connected"));
             return;
@@ -38359,7 +39310,7 @@ var require_cluster = __commonJS({
               this.retryAttempts = 0;
               this.executeOfflineCommands();
               this.resetNodesRefreshInterval();
-              resolve2();
+              resolve3();
             };
             let closeListener = void 0;
             const refreshListener = () => {
@@ -38969,7 +39920,7 @@ var require_cluster = __commonJS({
         });
       }
       resolveSrv(hostname) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           this.options.resolveSrv(hostname, (err, records) => {
             if (err) {
               return reject(err);
@@ -38983,7 +39934,7 @@ var require_cluster = __commonJS({
               if (!group.records.length) {
                 sortedKeys.shift();
               }
-              self2.dnsLookup(record.name).then((host) => resolve2({
+              self2.dnsLookup(record.name).then((host) => resolve3({
                 host,
                 port: record.port
               }), tryFirstOne);
@@ -38993,14 +39944,14 @@ var require_cluster = __commonJS({
         });
       }
       dnsLookup(hostname) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           this.options.dnsLookup(hostname, (err, address) => {
             if (err) {
               debug2("failed to resolve hostname %s to IP: %s", hostname, err.message);
               reject(err);
             } else {
               debug2("resolved hostname %s to IP %s", hostname, address);
-              resolve2(address);
+              resolve3(address);
             }
           });
         });
@@ -39155,7 +40106,7 @@ var require_StandaloneConnector = __commonJS({
         if (options.tls) {
           Object.assign(connectionOptions, options.tls);
         }
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           process.nextTick(() => {
             if (!this.connecting) {
               reject(new Error(utils_1.CONNECTION_CLOSED_ERROR_MSG));
@@ -39174,7 +40125,7 @@ var require_StandaloneConnector = __commonJS({
             this.stream.once("error", (err) => {
               this.firstError = err;
             });
-            resolve2(this.stream);
+            resolve3(this.stream);
           });
         });
       }
@@ -39330,7 +40281,7 @@ var require_SentinelConnector = __commonJS({
             const error = new Error(errorMsg);
             if (typeof retryDelay === "number") {
               eventEmitter("error", error);
-              await new Promise((resolve2) => setTimeout(resolve2, retryDelay));
+              await new Promise((resolve3) => setTimeout(resolve3, retryDelay));
               return connectToNext();
             } else {
               throw error;
@@ -40647,7 +41598,7 @@ var require_Redis = __commonJS({
        * if the connection fails, times out, or if Redis is already connecting/connected.
        */
       connect(callback) {
-        const promise = new Promise((resolve2, reject) => {
+        const promise = new Promise((resolve3, reject) => {
           if (this.status === "connecting" || this.status === "connect" || this.status === "ready") {
             reject(new Error("Redis is already connecting/connected"));
             return;
@@ -40726,7 +41677,7 @@ var require_Redis = __commonJS({
             }
             const connectionReadyHandler = function() {
               _this.removeListener("close", connectionCloseHandler);
-              resolve2();
+              resolve3();
             };
             var connectionCloseHandler = function() {
               _this.removeListener("ready", connectionReadyHandler);
@@ -40820,10 +41771,10 @@ var require_Redis = __commonJS({
           monitor: true,
           lazyConnect: false
         });
-        return (0, standard_as_callback_1.default)(new Promise(function(resolve2, reject) {
+        return (0, standard_as_callback_1.default)(new Promise(function(resolve3, reject) {
           monitorInstance.once("error", reject);
           monitorInstance.once("monitoring", function() {
-            resolve2(monitorInstance);
+            resolve3(monitorInstance);
           });
         }), callback);
       }
@@ -41645,6 +42596,7 @@ async function runMenu() {
       const value = await Ee({
         message: "What now?",
         options: [
+          { value: "init", label: "Initialize this project (migrate .env)", hint: "keynv init" },
           { value: "projects", label: "Projects" },
           { value: "secrets", label: "Secrets" },
           { value: "members", label: "Members" },
@@ -41683,7 +42635,10 @@ async function runMenu() {
         ye("Logged out.");
         return 0;
       }
-      if (choice === "projects") await runProjectsFlow(client);
+      if (choice === "init") {
+        const { runInitFlow: runInitFlow2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+        await runInitFlow2(client, { cwd: process.cwd(), dryRun: false, noScripts: false });
+      } else if (choice === "projects") await runProjectsFlow(client);
       else if (choice === "secrets") await runSecretsFlow(client);
       else if (choice === "members") await runMembersFlow(client);
       else if (choice === "audit") await runAuditFlow(client);
@@ -43496,134 +44451,7 @@ var AuditVerifyCommand = class extends Command {
 
 // src/commands/exec.ts
 init_http();
-
-// src/exec/envFile.ts
-init_dist();
-var MAX_FILE_BYTES = 1e6;
-var KEY_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var ENV_FILE_BASENAME = ".keynv.env";
-var EnvFileParseError = class extends Error {
-  constructor(file, line, reason) {
-    super(`${file}:${line}: ${reason}`);
-    this.file = file;
-    this.line = line;
-    this.reason = reason;
-    this.name = "EnvFileParseError";
-  }
-  file;
-  line;
-  reason;
-};
-var EnvFileNotFoundError = class extends Error {
-  constructor(path) {
-    super(`env file not found: ${path}`);
-    this.path = path;
-    this.name = "EnvFileNotFoundError";
-  }
-  path;
-};
-var EnvFileTooLargeError = class extends Error {
-  constructor(path, bytes) {
-    super(`env file ${path} is ${bytes} bytes (max ${MAX_FILE_BYTES})`);
-    this.path = path;
-    this.bytes = bytes;
-    this.name = "EnvFileTooLargeError";
-  }
-  path;
-  bytes;
-};
-function parseEnvFile(content, filename) {
-  const normalized = content.charCodeAt(0) === 65279 ? content.slice(1) : content;
-  const lines = normalized.split(/\r?\n/);
-  const entries = [];
-  for (let i = 0; i < lines.length; i++) {
-    const raw = lines[i] ?? "";
-    const lineNo = i + 1;
-    const trimmed = raw.trim();
-    if (trimmed.length === 0) continue;
-    if (trimmed.startsWith("#")) continue;
-    let body = trimmed;
-    if (body.startsWith("export ")) {
-      body = body.slice("export ".length).trimStart();
-    }
-    const eq = body.indexOf("=");
-    if (eq <= 0) {
-      throw new EnvFileParseError(filename, lineNo, "expected 'KEY=value'");
-    }
-    const name = body.slice(0, eq).trim();
-    if (!KEY_RE2.test(name)) {
-      throw new EnvFileParseError(
-        filename,
-        lineNo,
-        `invalid key '${name}' (must match /^[A-Za-z_][A-Za-z0-9_]*$/)`
-      );
-    }
-    let valueRaw = body.slice(eq + 1);
-    let value;
-    const valueLeading = valueRaw.replace(/^\s+/, "");
-    const firstCh = valueLeading.charAt(0);
-    if (firstCh === '"' || firstCh === "'") {
-      const close = valueLeading.lastIndexOf(firstCh);
-      if (close === 0) {
-        throw new EnvFileParseError(filename, lineNo, `unclosed ${firstCh} quote`);
-      }
-      const after = valueLeading.slice(close + 1).trim();
-      if (after.length > 0) {
-        throw new EnvFileParseError(
-          filename,
-          lineNo,
-          `unexpected content after closing ${firstCh}`
-        );
-      }
-      value = valueLeading.slice(1, close);
-    } else {
-      value = valueRaw.replace(/\s+$/, "");
-      value = value.replace(/^\s+/, "");
-    }
-    entries.push({
-      name,
-      value,
-      isAlias: parseAlias(value) !== null,
-      line: lineNo
-    });
-  }
-  return entries;
-}
-function findEnvFile(startDir) {
-  let dir = resolve(startDir);
-  for (let i = 0; i < 64; i++) {
-    const candidate = join(dir, ENV_FILE_BASENAME);
-    if (existsSync(candidate)) {
-      try {
-        if (statSync(candidate).isFile()) return candidate;
-      } catch {
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
-}
-function loadEnvFile(opts) {
-  if (opts.disabled) return null;
-  const pickExplicit = opts.explicitPath ?? opts.envVarOverride;
-  let path = null;
-  if (pickExplicit !== void 0) {
-    path = isAbsolute(pickExplicit) ? pickExplicit : resolve(opts.cwd, pickExplicit);
-    if (!existsSync(path)) throw new EnvFileNotFoundError(path);
-  } else {
-    path = findEnvFile(opts.cwd);
-  }
-  if (path === null) return null;
-  const stat = statSync(path);
-  if (stat.size > MAX_FILE_BYTES) {
-    throw new EnvFileTooLargeError(path, stat.size);
-  }
-  const content = readFileSync(path, "utf8");
-  const entries = parseEnvFile(content, path);
-  return { path, entries };
-}
+init_envFile();
 
 // src/exec/resolve.ts
 init_dist();
@@ -43984,14 +44812,14 @@ function spawnPrivileged(opts) {
     }, opts.timeoutS * 1e3);
     timer.unref();
   }
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     child.on("error", (err) => {
       if (timer) clearTimeout(timer);
       reject(err);
     });
     child.on("close", (code, signal) => {
       if (timer) clearTimeout(timer);
-      resolve2({
+      resolve3({
         exitCode: code ?? 0,
         signal,
         durationMs: Date.now() - startedAt
@@ -44209,552 +45037,67 @@ function signalNumber(sig) {
   return map[sig] ?? null;
 }
 
-// ../../packages/integrations/dist/file-deny-list.js
-var KEYNV_FILE_DENY_PATTERNS = [
-  // dotenv variants
-  ".env",
-  ".env.*",
-  "*.env",
-  "**/.env",
-  "**/.env.*",
-  "**/*.env",
-  // raw key material
-  "*.pem",
-  "*.key",
-  "*.p12",
-  "*.pfx",
-  "**/*.pem",
-  "**/*.key",
-  "**/*.p12",
-  "**/*.pfx",
-  // SSH private keys
-  "id_rsa",
-  "id_rsa.*",
-  "id_ed25519",
-  "id_ed25519.*",
-  "id_ecdsa",
-  "id_ecdsa.*",
-  "**/id_rsa",
-  "**/id_rsa.*",
-  "**/id_ed25519",
-  "**/id_ed25519.*",
-  "**/id_ecdsa",
-  "**/id_ecdsa.*",
-  // Generic credential containers
-  "*credentials*",
-  "*.kdbx",
-  "**/*credentials*",
-  "**/*.kdbx",
-  // Cloud provider credential paths (typically under ~/, but also
-  // appear at project roots in dev setups)
-  ".aws/credentials",
-  "**/.aws/credentials",
-  ".aws/config",
-  "**/.aws/config",
-  ".gcp/**/key.json",
-  "**/.gcp/**/key.json",
-  "**/google-services.json",
-  "**/service-account*.json",
-  ".azure/**",
-  "**/.azure/**",
-  ".kube/config",
-  "**/.kube/config",
-  ".docker/config.json",
-  "**/.docker/config.json"
-];
-var KEYNV_FILE_ALLOW_PATTERNS = [
-  ".keynv.env",
-  "**/.keynv.env"
-];
-function gitignoreBlock() {
-  return [...KEYNV_FILE_DENY_PATTERNS, ...KEYNV_FILE_ALLOW_PATTERNS.map((p2) => `!${p2}`)];
-}
-var KEYNV_BEGIN = "# >>> keynv >>>";
-var KEYNV_END = "# <<< keynv <<<";
-function readJsonOrEmpty(path) {
-  if (!existsSync(path))
-    return {};
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function ensureDir(path) {
-  const dir = dirname(path);
-  if (!existsSync(dir))
-    mkdirSync(dir, { recursive: true });
-}
-function writeJson(path, value) {
-  ensureDir(path);
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, { mode: 420 });
-}
-function ensureKeynvBlock(path, lines) {
-  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
-  const marked = existing.split("\n");
-  const beginIdx = marked.findIndex((l) => l.trim() === KEYNV_BEGIN);
-  const endIdx = marked.findIndex((l) => l.trim() === KEYNV_END);
-  const block = [KEYNV_BEGIN, ...lines, KEYNV_END];
-  let next;
-  if (beginIdx >= 0 && endIdx > beginIdx) {
-    next = [...marked.slice(0, beginIdx), ...block, ...marked.slice(endIdx + 1)];
-  } else {
-    next = existing.length > 0 && !existing.endsWith("\n") ? [...marked, "", ...block] : [...marked[marked.length - 1] === "" ? marked.slice(0, -1) : marked, ...block, ""];
-  }
-  const out = next.join("\n");
-  if (out === existing)
-    return false;
-  ensureDir(path);
-  writeFileSync(path, out, { mode: 420 });
-  return true;
-}
-function removeKeynvBlock(path) {
-  if (!existsSync(path))
-    return false;
-  const lines = readFileSync(path, "utf8").split("\n");
-  const beginIdx = lines.findIndex((l) => l.trim() === KEYNV_BEGIN);
-  const endIdx = lines.findIndex((l) => l.trim() === KEYNV_END);
-  if (beginIdx < 0 || endIdx <= beginIdx)
-    return false;
-  const next = [...lines.slice(0, beginIdx), ...lines.slice(endIdx + 1)];
-  while (next.length > 0 && next[next.length - 1] === "")
-    next.pop();
-  writeFileSync(path, `${next.join("\n")}${next.length ? "\n" : ""}`, { mode: 420 });
-  return true;
-}
-
-// ../../packages/integrations/dist/aider.js
-var AIDER_IGNORE_REL = ".aiderignore";
-var aider = {
-  name: "aider",
-  displayName: "Aider",
-  async detect(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    return existsSync(join(cwd, AIDER_IGNORE_REL)) || existsSync(join(cwd, ".aider.conf.yml")) || existsSync(join(homedir(), ".aider.conf.yml"));
-  },
-  async install(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, AIDER_IGNORE_REL);
-    if (opts.dryRun) {
-      return {
-        agent: "aider",
-        applied: false,
-        changes: [{ path, action: "update" }],
-        summary: `[dry-run] would write ${path}`
-      };
-    }
-    const changed = ensureKeynvBlock(path, gitignoreBlock());
-    return {
-      agent: "aider",
-      applied: true,
-      changes: [{ path, action: changed ? "update" : "skip" }],
-      summary: changed ? `wrote ${KEYNV_FILE_DENY_PATTERNS.length} patterns to ${AIDER_IGNORE_REL}` : "unchanged"
-    };
-  },
-  async uninstall(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, AIDER_IGNORE_REL);
-    if (opts.dryRun) {
-      return {
-        agent: "aider",
-        applied: false,
-        changes: [{ path, action: "update" }],
-        summary: `[dry-run] would remove keynv block from ${AIDER_IGNORE_REL}`
-      };
-    }
-    const changed = removeKeynvBlock(path);
-    return {
-      agent: "aider",
-      applied: true,
-      changes: [{ path, action: changed ? "update" : "skip" }],
-      summary: changed ? "removed keynv block" : "no keynv block found"
-    };
-  }
-};
-var SETTINGS_PATH_REL = ".claude/settings.local.json";
-var KEYNV_DENY_TAG = "__keynv_managed__";
-function denyEntriesForReadTool() {
-  return KEYNV_FILE_DENY_PATTERNS.map((p2) => `Read(${p2})`);
-}
-function allowEntriesForReadTool() {
-  return KEYNV_FILE_ALLOW_PATTERNS.map((p2) => `Read(${p2})`);
-}
-var claudeCode = {
-  name: "claude-code",
-  displayName: "Claude Code",
-  async detect(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    return existsSync(join(cwd, ".claude"));
-  },
-  async install(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, SETTINGS_PATH_REL);
-    const settings = readJsonOrEmpty(path);
-    const denyToAdd = denyEntriesForReadTool();
-    const allowToAdd = allowEntriesForReadTool();
-    const existingDeny = new Set(settings.permissions?.deny ?? []);
-    const existingAllow = new Set(settings.permissions?.allow ?? []);
-    const newlyAdded = [];
-    for (const entry2 of denyToAdd) {
-      if (!existingDeny.has(entry2)) {
-        existingDeny.add(entry2);
-        newlyAdded.push(entry2);
-      }
-    }
-    for (const entry2 of allowToAdd) {
-      if (!existingAllow.has(entry2)) {
-        existingAllow.add(entry2);
-      }
-    }
-    settings.permissions = {
-      ...settings.permissions,
-      allow: [...existingAllow].sort((a, b2) => a.localeCompare(b2)),
-      deny: [...existingDeny].sort((a, b2) => a.localeCompare(b2))
-    };
-    settings.hooks = settings.hooks ?? {};
-    const post = settings.hooks["PostToolUse"] ?? [];
-    const alreadyHooked = post.some((entry2) => (entry2.hooks ?? []).some((h2) => h2.command?.includes("keynv redact-stream")));
-    if (!alreadyHooked) {
-      post.push({
-        matcher: "Bash",
-        hooks: [{ type: "command", command: "keynv redact-stream" }]
-      });
-      settings.hooks["PostToolUse"] = post;
-    }
-    settings[KEYNV_DENY_TAG] = {
-      deny_added: denyToAdd,
-      allow_added: allowToAdd,
-      hook_added: true
-    };
-    const changes = [];
-    if (opts.dryRun) {
-      changes.push({
-        path,
-        action: existsSync(path) ? "update" : "create",
-        note: `would add ${newlyAdded.length} deny entries${alreadyHooked ? "" : " + PostToolUse(Bash) \u2192 keynv redact-stream"}`
-      });
-    } else {
-      writeJson(path, settings);
-      changes.push({
-        path,
-        action: existsSync(path) ? "update" : "create",
-        note: `${newlyAdded.length} new deny entries${alreadyHooked ? "" : " + redact hook"}`
-      });
-    }
-    return {
-      agent: "claude-code",
-      applied: !opts.dryRun,
-      changes,
-      summary: opts.dryRun ? `[dry-run] ${path}: would add ${newlyAdded.length} permission denies + redact hook` : `installed: ${newlyAdded.length} new denies; redact hook ${alreadyHooked ? "kept" : "added"}.`
-    };
-  },
-  async uninstall(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, SETTINGS_PATH_REL);
-    if (!existsSync(path)) {
-      return {
-        agent: "claude-code",
-        applied: false,
-        changes: [{ path, action: "skip", note: "no settings file" }],
-        summary: "nothing to uninstall"
-      };
-    }
-    const settings = readJsonOrEmpty(path);
-    const tracker = settings[KEYNV_DENY_TAG];
-    const removedDeny = [];
-    const permissions = settings.permissions;
-    if (tracker?.deny_added && permissions && Array.isArray(permissions.deny)) {
-      const remove = new Set(tracker.deny_added);
-      const before = permissions.deny;
-      permissions.deny = before.filter((entry2) => {
-        if (remove.has(entry2)) {
-          removedDeny.push(entry2);
-          return false;
-        }
-        return true;
-      });
-      if (permissions.deny.length === 0)
-        delete permissions.deny;
-    }
-    if (tracker?.allow_added && permissions && Array.isArray(permissions.allow)) {
-      const remove = new Set(tracker.allow_added);
-      permissions.allow = permissions.allow.filter((entry2) => !remove.has(entry2));
-      if (permissions.allow.length === 0)
-        delete permissions.allow;
-    }
-    const hooks = settings.hooks;
-    if (tracker?.hook_added && hooks && Array.isArray(hooks.PostToolUse)) {
-      const filtered = hooks.PostToolUse.filter((entry2) => !(entry2.hooks ?? []).some((h2) => h2.command?.includes("keynv redact-stream")));
-      hooks.PostToolUse = filtered;
-      if (filtered.length === 0)
-        delete hooks.PostToolUse;
-    }
-    delete settings[KEYNV_DENY_TAG];
-    if (opts.dryRun) {
-      return {
-        agent: "claude-code",
-        applied: false,
-        changes: [
-          { path, action: "update", note: `would remove ${removedDeny.length} denies + hook` }
-        ],
-        summary: `[dry-run] would remove ${removedDeny.length} denies`
-      };
-    }
-    writeJson(path, settings);
-    return {
-      agent: "claude-code",
-      applied: true,
-      changes: [{ path, action: "update" }],
-      summary: `removed ${removedDeny.length} denies + hook`
-    };
-  }
-};
-var CODEX_IGNORE_REL = ".codex/.deny";
-var codexCli = {
-  name: "codex",
-  displayName: "Codex CLI",
-  async detect(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    return existsSync(join(cwd, ".codex")) || existsSync(join(homedir(), ".codex"));
-  },
-  async install(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, CODEX_IGNORE_REL);
-    if (opts.dryRun) {
-      return {
-        agent: "codex",
-        applied: false,
-        changes: [{ path, action: "update" }],
-        summary: `[dry-run] would write ${CODEX_IGNORE_REL}`
-      };
-    }
-    const changed = ensureKeynvBlock(path, gitignoreBlock());
-    return {
-      agent: "codex",
-      applied: true,
-      changes: [{ path, action: changed ? "update" : "skip" }],
-      summary: changed ? `wrote ${CODEX_IGNORE_REL}; consider adding 'alias codex="keynv exec -- codex"' to your shell rc` : "unchanged"
-    };
-  },
-  async uninstall(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, CODEX_IGNORE_REL);
-    if (opts.dryRun) {
-      return {
-        agent: "codex",
-        applied: false,
-        changes: [{ path, action: "update" }],
-        summary: `[dry-run] would remove keynv block from ${CODEX_IGNORE_REL}`
-      };
-    }
-    const changed = removeKeynvBlock(path);
-    return {
-      agent: "codex",
-      applied: true,
-      changes: [{ path, action: changed ? "update" : "skip" }],
-      summary: changed ? "removed keynv block" : "no keynv block found"
-    };
-  }
-};
-var CURSOR_IGNORE_REL = ".cursorignore";
-var cursor = {
-  name: "cursor",
-  displayName: "Cursor",
-  async detect(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    return existsSync(join(cwd, ".cursor")) || existsSync(join(cwd, ".cursorrules"));
-  },
-  async install(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, CURSOR_IGNORE_REL);
-    if (opts.dryRun) {
-      return {
-        agent: "cursor",
-        applied: false,
-        changes: [
-          {
-            path,
-            action: "update",
-            note: `would add ${KEYNV_FILE_DENY_PATTERNS.length} ignore patterns`
-          }
-        ],
-        summary: `[dry-run] would write ${path}`
-      };
-    }
-    const changed = ensureKeynvBlock(path, gitignoreBlock());
-    return {
-      agent: "cursor",
-      applied: true,
-      changes: [{ path, action: changed ? "update" : "skip" }],
-      summary: changed ? `wrote ${KEYNV_FILE_DENY_PATTERNS.length} patterns to ${CURSOR_IGNORE_REL}` : "unchanged"
-    };
-  },
-  async uninstall(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, CURSOR_IGNORE_REL);
-    if (opts.dryRun) {
-      return {
-        agent: "cursor",
-        applied: false,
-        changes: [{ path, action: "update" }],
-        summary: `[dry-run] would remove keynv block from ${CURSOR_IGNORE_REL}`
-      };
-    }
-    const changed = removeKeynvBlock(path);
-    return {
-      agent: "cursor",
-      applied: true,
-      changes: [{ path, action: changed ? "update" : "skip" }],
-      summary: changed ? "removed keynv block" : "no keynv block found"
-    };
-  }
-};
-var OPENCODE_IGNORE_REL = ".opencode/.keynv-deny";
-var opencode = {
-  name: "opencode",
-  displayName: "OpenCode",
-  async detect(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    return existsSync(join(cwd, ".opencode")) || existsSync(join(homedir(), ".opencode"));
-  },
-  async install(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, OPENCODE_IGNORE_REL);
-    if (opts.dryRun) {
-      return {
-        agent: "opencode",
-        applied: false,
-        changes: [{ path, action: "update" }],
-        summary: `[dry-run] would write ${OPENCODE_IGNORE_REL}`
-      };
-    }
-    const changed = ensureKeynvBlock(path, gitignoreBlock());
-    return {
-      agent: "opencode",
-      applied: true,
-      changes: [{ path, action: changed ? "update" : "skip" }],
-      summary: changed ? `wrote ${OPENCODE_IGNORE_REL}; full hook/MCP integration TBD` : "unchanged"
-    };
-  },
-  async uninstall(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const path = join(cwd, OPENCODE_IGNORE_REL);
-    if (opts.dryRun) {
-      return {
-        agent: "opencode",
-        applied: false,
-        changes: [{ path, action: "update" }],
-        summary: `[dry-run] would remove keynv block from ${OPENCODE_IGNORE_REL}`
-      };
-    }
-    const changed = removeKeynvBlock(path);
-    return {
-      agent: "opencode",
-      applied: true,
-      changes: [{ path, action: changed ? "update" : "skip" }],
-      summary: changed ? "removed keynv block" : "no keynv block found"
-    };
-  }
-};
-
-// ../../packages/integrations/dist/index.js
-var REGISTRY = [claudeCode, cursor, opencode, codexCli, aider];
-function findIntegration(name) {
-  return REGISTRY.find((i) => i.name === name) ?? null;
-}
-
-// src/commands/install.ts
-function printReport(stdout, report) {
-  stdout.write(`[${report.agent}] ${report.summary}
-`);
-  for (const change of report.changes) {
-    const note = change.note ? `: ${change.note}` : "";
-    stdout.write(`  ${change.action.padEnd(7)} ${change.path}${note}
-`);
-  }
-}
-var InstallCommand = class extends Command {
-  static paths = [["install"]];
+// src/commands/init.ts
+init_http();
+init_tty();
+init_init();
+init_cancel();
+var InitCommand = class extends Command {
+  static paths = [["init"]];
   static usage = Command.Usage({
-    description: "Install per-agent file deny lists, hooks, and config templates.",
+    description: "Migrate an existing project from .env to keynv.",
     details: `
-Each integration writes a small, idempotent set of files. Re-running
-yields the same state. Use --dry-run to preview changes before they
-land.
+Walks the current directory's .env files, prompts you to mark which
+keys are real secrets, uploads those to the keynv vault, writes a
+.keynv.env file with alias references, and (optionally) wraps your
+package.json scripts with \`keynv exec\`.
+
+Safe to re-run: existing .keynv.env entries are preserved; new
+entries are appended below a marker.
+
+Requires an interactive terminal (clack TUI). For scripted
+migration, use the lower-level \`keynv project\` and \`keynv secret\`
+commands directly.
 `,
     examples: [
-      ["Install Claude Code", "$0 install claude-code"],
-      ["Preview the change", "$0 install claude-code --dry-run"],
-      ["Install all detected", "$0 install --all"],
-      ["List supported integrations", "$0 install list"]
+      ["Walk the current project", "$0 init"],
+      ["Preview without writing or uploading", "$0 init --dry-run"],
+      ["Skip the package.json script-wrapping step", "$0 init --no-scripts"]
     ]
   });
-  agent = options_exports.String({ required: false });
-  dryRun = options_exports.Boolean("--dry-run", false);
-  all = options_exports.Boolean("--all", false);
+  dryRun = options_exports.Boolean("--dry-run", false, {
+    description: "Show what would be done without writing files or uploading secrets."
+  });
+  noScripts = options_exports.Boolean("--no-scripts", false, {
+    description: "Skip the package.json script-wrapping step."
+  });
   async execute() {
-    if (this.agent === "list") {
-      this.context.stdout.write("Supported integrations:\n");
-      for (const i of REGISTRY) {
-        this.context.stdout.write(`  ${i.name.padEnd(14)} ${i.displayName}
-`);
-      }
-      return 0;
-    }
-    if (this.all) {
-      const cwd = process.cwd();
-      let any = false;
-      for (const integration2 of REGISTRY) {
-        const detected = await integration2.detect({ cwd });
-        if (!detected) continue;
-        any = true;
-        const report2 = await integration2.install({ cwd, dryRun: this.dryRun });
-        printReport(this.context.stdout, report2);
-      }
-      if (!any) {
-        this.context.stdout.write("no integrations detected in this directory\n");
-      }
-      return 0;
-    }
-    if (!this.agent) {
+    if (!isInteractive()) {
       this.context.stderr.write(
-        "keynv: usage: keynv install <agent> | keynv install --all | keynv install list\n"
+        "keynv init requires an interactive terminal. Use the lower-level commands (`keynv project`, `keynv secret`) for scripted setup.\n"
       );
-      return 2;
+      return 1;
     }
-    const integration = findIntegration(this.agent);
-    if (!integration) {
-      this.context.stderr.write(
-        `keynv: unknown integration '${this.agent}'. Try \`keynv install list\`.
-`
-      );
+    const client = new ApiClient();
+    await client.ensureHydrated();
+    if (!client.isLoggedIn) {
+      this.context.stderr.write("keynv: not logged in. Run `keynv login` first.\n");
       return 1;
     }
-    const report = await integration.install({ cwd: process.cwd(), dryRun: this.dryRun });
-    printReport(this.context.stdout, report);
-    return 0;
-  }
-};
-var UninstallCommand = class extends Command {
-  static paths = [["uninstall"]];
-  static usage = Command.Usage({
-    description: "Remove keynv-managed entries written by an earlier `keynv install`."
-  });
-  agent = options_exports.String();
-  dryRun = options_exports.Boolean("--dry-run", false);
-  async execute() {
-    const integration = findIntegration(this.agent);
-    if (!integration) {
-      this.context.stderr.write(
-        `keynv: unknown integration '${this.agent}'. Try \`keynv install list\`.
-`
-      );
+    try {
+      const outcome = await runInitFlow(client, {
+        cwd: process.cwd(),
+        dryRun: this.dryRun,
+        noScripts: this.noScripts
+      });
+      return outcome.exitCode;
+    } catch (err) {
+      if (err instanceof UserCancelled) return 130;
+      const e2 = err;
+      this.context.stderr.write(`keynv: ${e2.message}
+`);
       return 1;
     }
-    const report = await integration.uninstall({ cwd: process.cwd(), dryRun: this.dryRun });
-    printReport(this.context.stdout, report);
-    return 0;
   }
 };
 
@@ -44770,7 +45113,7 @@ async function promptHidden(prompt) {
   process.stdin.setRawMode(true);
   process.stdin.resume();
   process.stdin.setEncoding("utf8");
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let buf = "";
     const onData = (chunk) => {
       for (const ch of chunk) {
@@ -44779,7 +45122,7 @@ async function promptHidden(prompt) {
           process.stdin.pause();
           process.stdin.removeListener("data", onData);
           process.stdout.write("\n");
-          resolve2(buf);
+          resolve3(buf);
           return;
         }
         if (ch === "") {
@@ -44797,10 +45140,10 @@ async function promptHidden(prompt) {
 }
 async function promptLine(prompt) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve2(answer.trim());
+      resolve3(answer.trim());
     });
   });
 }
@@ -45191,9 +45534,9 @@ streaming-mode limitation in @keynv/redactor).
 `
   });
   async execute() {
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const transform = createRedactStream();
-      this.context.stdin.pipe(transform).pipe(this.context.stdout).on("error", reject).on("finish", () => resolve2(0));
+      this.context.stdin.pipe(transform).pipe(this.context.stdout).on("error", reject).on("finish", () => resolve3(0));
       this.context.stdin.on("error", reject);
     });
   }
@@ -45683,7 +46026,7 @@ var sshTester = {
   async test(secret, target) {
     const start = Date.now();
     const { Client: Client2 } = await import('ssh2');
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const client = new Client2();
       let settled = false;
       const settle = (result) => {
@@ -45694,7 +46037,7 @@ var sshTester = {
           client.end();
         } catch {
         }
-        resolve2(result);
+        resolve3(result);
       };
       client.once("ready", () => {
         client.exec("true", (err, stream) => {
@@ -45760,12 +46103,12 @@ function sanitizeResult(result, secret) {
 
 // ../../packages/testers/dist/run.js
 function withTimeout(promise, ms) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const t = setTimeout(() => reject(new Error(`tester timed out after ${ms}ms`)), ms);
     t.unref();
     promise.then((v2) => {
       clearTimeout(t);
-      resolve2(v2);
+      resolve3(v2);
     }, (err) => {
       clearTimeout(t);
       reject(err);
@@ -45999,10 +46342,9 @@ cli.register(MemberListCommand);
 cli.register(AuditListCommand);
 cli.register(AuditVerifyCommand);
 cli.register(ExecCommand);
+cli.register(InitCommand);
 cli.register(RedactCommand);
 cli.register(RedactStreamCommand);
-cli.register(InstallCommand);
-cli.register(UninstallCommand);
 cli.register(TestCommand);
 cli.register(UICommand);
 var argv = process.argv.slice(2);