@keynv/cli 0.1.0-rc.9 → 0.1.0

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import 'crypto';
+import { randomBytes } from 'crypto';
 import { readFileSync, existsSync, statSync, writeFileSync, unlinkSync, mkdirSync, rmSync, readdirSync } from 'fs';
-import { homedir } from 'os';
-import { isAbsolute, resolve, join, dirname, basename } from 'path';
+import { hostname, platform, homedir } from 'os';
+import { relative, isAbsolute, resolve, join, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
 import { styleText } from 'util';
 import j2, { stdin, stdout } from 'process';
@@ -579,16 +579,16 @@ var require_lib = __commonJS({
     }
     var TypeAssertionError = class extends Error {
       constructor({ errors } = {}) {
-        let errorMessage = `Type mismatch`;
+        let errorMessage2 = `Type mismatch`;
         if (errors && errors.length > 0) {
-          errorMessage += `
+          errorMessage2 += `
 `;
           for (const error of errors) {
-            errorMessage += `
+            errorMessage2 += `
 - ${error}`;
           }
         }
-        super(errorMessage);
+        super(errorMessage2);
       }
     };
     function assert(val, validator) {
@@ -1056,7 +1056,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.9" ;
+    VERSION = "0.1.0" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -1146,10 +1146,10 @@ var init_parser = __esm({
   "../../packages/core/dist/reference/parser.js"() {
     PROJECT_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
     ENV_RE = /^[a-z0-9][a-z0-9-]{0,23}$/;
-    KEY_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+    KEY_RE = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
     TRAILING_BOUNDARY = "(?!\\w|\\.[a-z0-9])";
-    TEXT_FIND_SOURCE = `(?<![\\w.@/])@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-z0-9][a-z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
-    ARGV_FIND_SOURCE = `@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-z0-9][a-z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
+    TEXT_FIND_SOURCE = `(?<![\\w.@/])@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
+    ARGV_FIND_SOURCE = `@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
     TEXT_FIND_RE = new RegExp(TEXT_FIND_SOURCE, "g");
     ARGV_FIND_RE = new RegExp(ARGV_FIND_SOURCE, "g");
   }
@@ -1695,15 +1695,15 @@ var init_parseUtil = __esm({
           message: issueData.message
         };
       }
-      let errorMessage = "";
+      let errorMessage2 = "";
       const maps = errorMaps.filter((m) => !!m).slice().reverse();
       for (const map of maps) {
-        errorMessage = map(fullIssue, { data, defaultError: errorMessage }).message;
+        errorMessage2 = map(fullIssue, { data, defaultError: errorMessage2 }).message;
       }
       return {
         ...issueData,
         path: fullPath,
-        message: errorMessage
+        message: errorMessage2
       };
     };
     EMPTY_PATH = [];
@@ -5415,6 +5415,12 @@ var init_payload_schemas = __esm({
       }).strict(),
       "project.deleted": external_exports.object({ project_id: projectId, name: external_exports.string() }).strict(),
       "project.dek_rotated": external_exports.object({ project_id: projectId }).strict(),
+      "environment.created": external_exports.object({
+        project_id: projectId,
+        environment: external_exports.string().min(1),
+        tier: external_exports.enum(["production", "non-production"]),
+        require_approval: external_exports.boolean()
+      }).strict(),
       "member.added": external_exports.object({ project_id: projectId, target_user_id: userId, role }).strict(),
       "member.removed": external_exports.object({ project_id: projectId, target_user_id: userId }).strict(),
       "member.role_changed": external_exports.object({ project_id: projectId, target_user_id: userId, role }).strict(),
@@ -5530,7 +5536,15 @@ function clearCredentialsFile() {
   if (existsSync(legacy)) rmSync(legacy, { force: true });
   try {
     entry().deletePassword();
-  } catch {
+    return true;
+  } catch (err) {
+    process.stderr.write(
+      `keynv: warning \u2014 could not remove OS keychain entry (${err instanceof Error ? err.message : String(err)}).
+  You may need to remove the '${SERVICE}' / '${KEY_ACCOUNT}' entry manually
+  via your OS credential manager (Windows Credential Manager, macOS Keychain, or libsecret).
+`
+    );
+    return false;
   }
 }
 var SERVICE, KEY_ACCOUNT;
@@ -5573,8 +5587,9 @@ async function saveCredentials(creds) {
   cache = creds;
 }
 function clearCredentials() {
-  clearCredentialsFile();
+  const ok = clearCredentialsFile();
   cache = null;
+  return ok;
 }
 var cache;
 var init_store = __esm({
@@ -5584,6 +5599,9 @@ var init_store = __esm({
 });
 
 // src/client/http.ts
+function isClientError(err) {
+  return err instanceof Error && typeof err.status === "number";
+}
 function clientError(status, code, message, details) {
   const err = Object.assign(new Error(message), { status, code, details });
   return err;
@@ -5598,6 +5616,7 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function tryRefresh(creds) {
+  if (creds.auth_kind === "cli_token" || creds.refresh_token.length === 0) return null;
   const res = await fetch(buildUrl(creds.server_url, "/v1/auth/refresh"), {
     method: "POST",
     headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
@@ -5637,7 +5656,16 @@ var init_http = __esm({
         return this.creds;
       }
       async ensureHydrated() {
-        if (this.hydrated) await this.hydrated;
+        if (this.hydrated) {
+          try {
+            await this.hydrated;
+          } catch (err) {
+            process.stderr.write(
+              `${err instanceof Error ? err.message : `keynv: credential load failed \u2014 ${String(err)}`}
+`
+            );
+          }
+        }
       }
       async setCredentials(creds) {
         this.creds = creds;
@@ -5659,21 +5687,40 @@ var init_http = __esm({
           headers.authorization = `Bearer ${this.creds.access_token}`;
         }
         const url = this.creds ? buildUrl(this.creds.server_url, path, opts.query) : path;
-        let res = await fetch(url, {
-          method: opts.method ?? "GET",
-          headers,
-          ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
-        });
+        let res;
+        try {
+          res = await fetch(url, {
+            method: opts.method ?? "GET",
+            headers,
+            ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+          });
+        } catch (err) {
+          const cause = err instanceof Error ? err.message : String(err);
+          const serverUrl = this.creds?.server_url ?? url;
+          throw new Error(
+            `keynv: cannot reach server '${serverUrl}' \u2014 ${cause}
+       Check the server is running: curl ${serverUrl}/v1/health`
+          );
+        }
         if (res.status === 401 && this.creds && opts.authed !== false) {
           const refreshed = await tryRefresh(this.creds);
           if (refreshed) {
             this.creds = refreshed;
             headers.authorization = `Bearer ${refreshed.access_token}`;
-            res = await fetch(url, {
-              method: opts.method ?? "GET",
-              headers,
-              ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
-            });
+            try {
+              res = await fetch(url, {
+                method: opts.method ?? "GET",
+                headers,
+                ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+              });
+            } catch (err) {
+              const cause = err instanceof Error ? err.message : String(err);
+              const serverUrl = this.creds?.server_url ?? url;
+              throw new Error(
+                `keynv: cannot reach server '${serverUrl}' \u2014 ${cause}
+       Check the server is running: curl ${serverUrl}/v1/health`
+              );
+            }
           }
         }
         if (res.status === 204) return void 0;
@@ -5712,8 +5759,38 @@ function fmtError(err) {
   const status = err.status ? ` (${err.status})` : "";
   return `keynv:${code}${status} ${err.message}`;
 }
+function handleExecError(stderr, err) {
+  if (isClientError(err)) {
+    const code = err.code ? `[${err.code}] ` : "";
+    stderr.write(`keynv: ${code}${err.message}
+`);
+  } else if (err instanceof Error) {
+    stderr.write(`keynv: ${err.message}
+`);
+  } else {
+    stderr.write(`keynv: unexpected error
+`);
+  }
+  return 1;
+}
 var init_format = __esm({
   "src/ui/format.ts"() {
+    init_http();
+  }
+});
+function walkUp(startDir, predicate) {
+  let dir = resolve(startDir);
+  for (let i = 0; i < 64; i++) {
+    const result = predicate(dir);
+    if (result !== null && result !== void 0) return result;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+var init_fs = __esm({
+  "src/util/fs.ts"() {
   }
 });
 function parseEnvFile(content, filename) {
@@ -5742,7 +5819,7 @@ function parseEnvFile(content, filename) {
         `invalid key '${name}' (must match /^[A-Za-z_][A-Za-z0-9_]*$/)`
       );
     }
-    let valueRaw = body.slice(eq + 1);
+    const valueRaw = body.slice(eq + 1);
     let value;
     const valueLeading = valueRaw.replace(/^\s+/, "");
     const firstCh = valueLeading.charAt(0);
@@ -5774,20 +5851,14 @@ function parseEnvFile(content, filename) {
   return entries;
 }
 function findEnvFile(startDir) {
-  let dir = resolve(startDir);
-  for (let i = 0; i < 64; i++) {
+  return walkUp(startDir, (dir) => {
     const candidate = join(dir, ENV_FILE_BASENAME);
-    if (existsSync(candidate)) {
-      try {
-        if (statSync(candidate).isFile()) return candidate;
-      } catch {
-      }
+    try {
+      if (statSync(candidate).isFile()) return candidate;
+    } catch {
     }
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
+    return null;
+  });
 }
 function loadEnvFile(opts) {
   if (opts.disabled) return null;
@@ -5812,6 +5883,7 @@ var MAX_FILE_BYTES, KEY_RE2, ENV_FILE_BASENAME, EnvFileParseError, EnvFileNotFou
 var init_envFile = __esm({
   "src/exec/envFile.ts"() {
     init_dist();
+    init_fs();
     MAX_FILE_BYTES = 1e6;
     KEY_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
     ENV_FILE_BASENAME = ".keynv.env";
@@ -5848,16 +5920,129 @@ var init_envFile = __esm({
   }
 });
 
-// src/ui/helpers/tty.ts
-var tty_exports = {};
-__export(tty_exports, {
-  isInteractive: () => isInteractive
-});
-function isInteractive() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+// src/init/heuristics.ts
+function shannonEntropyBits(s) {
+  if (s.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let h2 = 0;
+  for (const c2 of counts.values()) {
+    const p2 = c2 / s.length;
+    h2 -= p2 * Math.log2(p2);
+  }
+  return h2;
 }
-var init_tty = __esm({
-  "src/ui/helpers/tty.ts"() {
+function nameMatchesLiteralPrefix(name) {
+  const upper = name.toUpperCase();
+  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
+}
+function nameMatchesSecretSuffix(name) {
+  const upper = name.toUpperCase();
+  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
+    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
+      return { matched: true, hint };
+    }
+  }
+  return { matched: false, hint: "" };
+}
+function classifyEntry(name, value) {
+  const upper = name.toUpperCase();
+  if (NAME_FRAMEWORK_MANAGED.has(upper)) {
+    return { verdict: "skip", hint: "framework/shell-managed" };
+  }
+  if (NAME_LITERAL_EXACT.has(upper)) {
+    return { verdict: "literal", hint: "common config var" };
+  }
+  if (nameMatchesLiteralPrefix(name)) {
+    return { verdict: "literal", hint: "public env, build-time bundled" };
+  }
+  if (value.length === 0) {
+    return { verdict: "literal", hint: "empty" };
+  }
+  for (const { re, hint } of VALUE_PATTERNS) {
+    if (re.test(value)) return { verdict: "secret", hint };
+  }
+  const suffix = nameMatchesSecretSuffix(name);
+  if (suffix.matched) {
+    return { verdict: "secret", hint: suffix.hint };
+  }
+  if (NAME_DB_URL.test(name)) {
+    return { verdict: "secret", hint: "database URL" };
+  }
+  if (value.length >= 32) {
+    const bits = shannonEntropyBits(value);
+    if (bits >= 3.5) {
+      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
+    }
+  }
+  return { verdict: "ambiguous", hint: "" };
+}
+function previewValue(value, max = 40) {
+  if (value.length === 0) return "(empty)";
+  if (value.length <= max) return value;
+  return `${value.slice(0, max - 1)}\u2026`;
+}
+var NAME_FRAMEWORK_MANAGED, NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
+var init_heuristics = __esm({
+  "src/init/heuristics.ts"() {
+    NAME_FRAMEWORK_MANAGED = /* @__PURE__ */ new Set([
+      "NODE_ENV",
+      "PORT",
+      "HOST",
+      "HOSTNAME",
+      "PATH",
+      "HOME",
+      "USER",
+      "SHELL",
+      "PWD",
+      "CI"
+    ]);
+    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
+      "DEBUG",
+      "LOG_LEVEL",
+      "LOGLEVEL",
+      "TZ",
+      "LANG",
+      "LC_ALL",
+      "NODE_OPTIONS",
+      "NPM_CONFIG_LOGLEVEL",
+      "TS_NODE_PROJECT"
+    ]);
+    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
+    NAME_SECRET_SUFFIXES = [
+      { suffix: "PRIVATE_KEY", hint: "private key" },
+      { suffix: "API_KEY", hint: "API key" },
+      { suffix: "ACCESS_KEY", hint: "access key" },
+      { suffix: "SECRET_KEY", hint: "secret key" },
+      { suffix: "SECRET", hint: "secret" },
+      { suffix: "PASSWORD", hint: "password" },
+      { suffix: "PASSPHRASE", hint: "passphrase" },
+      { suffix: "TOKEN", hint: "token" },
+      { suffix: "KEY", hint: "key" },
+      { suffix: "CREDENTIALS", hint: "credentials" },
+      { suffix: "AUTH", hint: "auth" },
+      { suffix: "DSN", hint: "connection string" }
+    ];
+    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
+    VALUE_PATTERNS = [
+      { re: /^sk-proj-/, hint: "OpenAI project key" },
+      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
+      { re: /^sk_live_/, hint: "Stripe live key" },
+      { re: /^sk_test_/, hint: "Stripe test key" },
+      { re: /^pk_live_/, hint: "Stripe publishable \u2014 often public, double-check" },
+      { re: /^xoxb-/, hint: "Slack bot token" },
+      { re: /^xoxp-/, hint: "Slack user token" },
+      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
+      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
+      { re: /^gho_/, hint: "GitHub OAuth token" },
+      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
+      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
+      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
+      { re: /^ya29\./, hint: "Google OAuth access token" },
+      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
+      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
+      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
+    ];
   }
 });
 
@@ -7015,23 +7200,109 @@ ${c2}
     } }).prompt();
   }
 });
+function aiContextBody() {
+  return `## keynv (secrets)
+
+This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
+
+### Mental model
+
+- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
+- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
+- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
+- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
+
+### What you should do
+
+When the user asks about secrets or env vars, follow this decision tree:
+
+| User intent | Run / suggest |
+|---|---|
+| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
+| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
+| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
+| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
+| "Rotate this key" | \`keynv secret rotate @alias\` |
+| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
+| "Who has access?" | \`keynv member list <project>\` |
+
+### Hard rules \u2014 do not violate
+
+1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
+2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
+3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
+4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
+5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
+6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
+
+### Quick reference
+
+\`\`\`bash
+keynv                       # interactive TUI menu (pick projects, secrets, members)
+keynv exec -- <cmd>         # run cmd with .keynv.env loaded
+keynv secret create         # walk through creating a new secret
+keynv secret list <project> # list aliases (no values)
+keynv whoami                # who am I logged in as
+keynv --help                # full command list
+\`\`\`
+
+If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
+}
+function renderKeynvBlock() {
+  return `${KEYNV_BLOCK_START}
+${aiContextBody()}
+${KEYNV_BLOCK_END}`;
+}
+function writeAiContext(rootPath) {
+  const path = join(rootPath, AGENTS_FILE_BASENAME);
+  const block = renderKeynvBlock();
+  if (!existsSync(path)) {
+    const initial = `# Agent guidance for this project
+
+${block}
+`;
+    writeFileSync(path, initial);
+    return "created";
+  }
+  const existing = readFileSync(path, "utf8");
+  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
+  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
+  if (startIdx >= 0 && endIdx > startIdx) {
+    const before = existing.slice(0, startIdx);
+    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
+    const next = `${before}${block}${after}`;
+    if (next === existing) return "unchanged";
+    writeFileSync(path, next);
+    return "updated";
+  }
+  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
+  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
+`);
+  return "appended";
+}
+var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
+var init_aiContext = __esm({
+  "src/init/aiContext.ts"() {
+    AGENTS_FILE_BASENAME = "AGENTS.md";
+    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
+    KEYNV_BLOCK_END = "<!-- keynv:end -->";
+  }
+});
 function findProjectRoot(startDir) {
-  let dir = resolve(startDir);
-  for (let i = 0; i < 64; i++) {
+  const result = walkUp(startDir, (dir) => {
     for (const marker of PROJECT_MARKERS) {
-      const candidate = join(dir, marker);
-      if (existsSync(candidate)) {
-        return buildRoot(dir, marker);
+      if (existsSync(join(dir, marker))) {
+        return { dir, marker };
       }
     }
     if (existsSync(join(dir, GIT_MARKER))) {
-      return buildRoot(dir, GIT_MARKER);
+      return { dir, marker: GIT_MARKER };
     }
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
+    return null;
+  });
+  if (!result) return null;
+  return buildRoot(result.dir, result.marker);
 }
 function buildRoot(dir, marker) {
   let suggestedName = basename(dir);
@@ -7045,16 +7316,20 @@ function buildRoot(dir, marker) {
       }
       if (pkg.scripts && typeof pkg.scripts === "object") {
         scripts = Object.fromEntries(
-          Object.entries(pkg.scripts).filter(
-            ([, v2]) => typeof v2 === "string"
-          )
+          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
         );
       }
     } catch {
       invalid = true;
     }
   }
-  return { path: dir, suggestedName, marker, packageJsonScripts: scripts, packageJsonInvalid: invalid };
+  return {
+    path: dir,
+    suggestedName,
+    marker,
+    packageJsonScripts: scripts,
+    packageJsonInvalid: invalid
+  };
 }
 function findEnvFiles(rootDir) {
   let entries;
@@ -7112,6 +7387,7 @@ function hasExistingKeynvEnv(rootDir) {
 var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
 var init_detect = __esm({
   "src/init/detect.ts"() {
+    init_fs();
     PROJECT_MARKERS = [
       "package.json",
       "pyproject.toml",
@@ -7124,220 +7400,10 @@ var init_detect = __esm({
     ];
     GIT_MARKER = ".git";
     ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
-    ENV_EXAMPLE = /^\.env\.(example|sample|template)$/;
+    ENV_EXAMPLE = /^\.env\.(example|sample|template|dist|defaults)$/;
     KEYNV_ENV_BASENAME = ".keynv.env";
   }
 });
-function aiContextBody() {
-  return `## keynv (secrets)
-
-This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
-
-### Mental model
-
-- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
-- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
-- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
-- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
-
-### What you should do
-
-When the user asks about secrets or env vars, follow this decision tree:
-
-| User intent | Run / suggest |
-|---|---|
-| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
-| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
-| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
-| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
-| "Rotate this key" | \`keynv secret rotate @alias\` |
-| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
-| "Who has access?" | \`keynv member list <project>\` |
-
-### Hard rules \u2014 do not violate
-
-1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
-2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
-3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
-4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
-5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
-6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
-
-### Quick reference
-
-\`\`\`bash
-keynv                       # interactive TUI menu (pick projects, secrets, members)
-keynv exec -- <cmd>         # run cmd with .keynv.env loaded
-keynv secret create         # walk through creating a new secret
-keynv secret list <project> # list aliases (no values)
-keynv whoami                # who am I logged in as
-keynv --help                # full command list
-\`\`\`
-
-If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
-}
-function renderKeynvBlock() {
-  return `${KEYNV_BLOCK_START}
-${aiContextBody()}
-${KEYNV_BLOCK_END}`;
-}
-function writeAiContext(rootPath) {
-  const path = join(rootPath, AGENTS_FILE_BASENAME);
-  const block = renderKeynvBlock();
-  if (!existsSync(path)) {
-    const initial = `# Agent guidance for this project
-
-${block}
-`;
-    writeFileSync(path, initial);
-    return "created";
-  }
-  const existing = readFileSync(path, "utf8");
-  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
-  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
-  if (startIdx >= 0 && endIdx > startIdx) {
-    const before = existing.slice(0, startIdx);
-    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
-    const next = `${before}${block}${after}`;
-    if (next === existing) return "unchanged";
-    writeFileSync(path, next);
-    return "updated";
-  }
-  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
-  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
-`);
-  return "appended";
-}
-var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
-var init_aiContext = __esm({
-  "src/init/aiContext.ts"() {
-    AGENTS_FILE_BASENAME = "AGENTS.md";
-    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
-    KEYNV_BLOCK_END = "<!-- keynv:end -->";
-  }
-});
-
-// src/init/heuristics.ts
-function shannonEntropyBits(s) {
-  if (s.length === 0) return 0;
-  const counts = /* @__PURE__ */ new Map();
-  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  let h2 = 0;
-  for (const c2 of counts.values()) {
-    const p2 = c2 / s.length;
-    h2 -= p2 * Math.log2(p2);
-  }
-  return h2;
-}
-function nameMatchesLiteralPrefix(name) {
-  const upper = name.toUpperCase();
-  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
-}
-function nameMatchesSecretSuffix(name) {
-  const upper = name.toUpperCase();
-  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
-    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
-      return { matched: true, hint };
-    }
-  }
-  return { matched: false, hint: "" };
-}
-function classifyEntry(name, value) {
-  const upper = name.toUpperCase();
-  if (NAME_LITERAL_EXACT.has(upper)) {
-    return { verdict: "literal", hint: "common config var" };
-  }
-  if (nameMatchesLiteralPrefix(name)) {
-    return { verdict: "literal", hint: "public env (build-time bundled)" };
-  }
-  if (value.length === 0) {
-    return { verdict: "literal", hint: "empty" };
-  }
-  for (const { re, hint } of VALUE_PATTERNS) {
-    if (re.test(value)) return { verdict: "secret", hint };
-  }
-  const suffix = nameMatchesSecretSuffix(name);
-  if (suffix.matched) {
-    return { verdict: "secret", hint: suffix.hint };
-  }
-  if (NAME_DB_URL.test(name)) {
-    return { verdict: "secret", hint: "database URL" };
-  }
-  if (value.length >= 32) {
-    const bits = shannonEntropyBits(value);
-    if (bits >= 3.5) {
-      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
-    }
-  }
-  return { verdict: "ambiguous", hint: "" };
-}
-function previewValue(value, max = 40) {
-  if (value.length === 0) return "(empty)";
-  if (value.length <= max) return value;
-  return `${value.slice(0, max - 1)}\u2026`;
-}
-var NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
-var init_heuristics = __esm({
-  "src/init/heuristics.ts"() {
-    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
-      "NODE_ENV",
-      "PORT",
-      "HOST",
-      "HOSTNAME",
-      "DEBUG",
-      "LOG_LEVEL",
-      "LOGLEVEL",
-      "TZ",
-      "LANG",
-      "LC_ALL",
-      "PATH",
-      "HOME",
-      "USER",
-      "SHELL",
-      "PWD",
-      "CI",
-      "NODE_OPTIONS",
-      "NPM_CONFIG_LOGLEVEL",
-      "TS_NODE_PROJECT"
-    ]);
-    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
-    NAME_SECRET_SUFFIXES = [
-      { suffix: "PRIVATE_KEY", hint: "private key" },
-      { suffix: "API_KEY", hint: "API key" },
-      { suffix: "ACCESS_KEY", hint: "access key" },
-      { suffix: "SECRET_KEY", hint: "secret key" },
-      { suffix: "SECRET", hint: "secret" },
-      { suffix: "PASSWORD", hint: "password" },
-      { suffix: "PASSPHRASE", hint: "passphrase" },
-      { suffix: "TOKEN", hint: "token" },
-      { suffix: "KEY", hint: "key" },
-      { suffix: "CREDENTIALS", hint: "credentials" },
-      { suffix: "AUTH", hint: "auth" },
-      { suffix: "DSN", hint: "connection string" }
-    ];
-    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
-    VALUE_PATTERNS = [
-      { re: /^sk-proj-/, hint: "OpenAI project key" },
-      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
-      { re: /^sk_live_/, hint: "Stripe live key" },
-      { re: /^sk_test_/, hint: "Stripe test key" },
-      { re: /^pk_live_/, hint: "Stripe publishable (often public, double-check)" },
-      { re: /^xoxb-/, hint: "Slack bot token" },
-      { re: /^xoxp-/, hint: "Slack user token" },
-      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
-      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
-      { re: /^gho_/, hint: "GitHub OAuth token" },
-      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
-      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
-      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
-      { re: /^ya29\./, hint: "Google OAuth access token" },
-      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
-      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
-      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
-    ];
-  }
-});
 
 // src/init/scriptWrap.ts
 function analyzeScript(name, command) {
@@ -7571,14 +7637,14 @@ async function runInitFlow(client, opts) {
     R2.warn(`package.json at ${root.path} is not valid JSON \u2014 script wrapping will be skipped.`);
   }
   const envFiles = findEnvFiles(root.path);
-  if (envFiles.length === 0 && !hasExistingKeynvEnv(root.path)) {
+  const intoExisting = hasExistingKeynvEnv(root.path);
+  if (envFiles.length === 0 && !intoExisting) {
     R2.info(
       `No .env files found in ${root.path}. There's nothing to migrate yet \u2014 create a .keynv.env by hand or run \`keynv exec\` once you have one.`
     );
     ye("Nothing to do.");
     return { exitCode: 0 };
   }
-  const intoExisting = hasExistingKeynvEnv(root.path);
   Se(
     [
       `Project root: ${root.path}`,
@@ -7588,43 +7654,79 @@ async function runInitFlow(client, opts) {
     ].filter(Boolean).join("\n"),
     "Detected"
   );
-  const merged = mergeEnvFiles(envFiles);
-  if (merged.length === 0) {
-    R2.info("All env files were empty (only comments/blanks). Nothing to upload.");
-    ye("Done.");
-    return { exitCode: 0 };
-  }
   const projectChoice = await pickOrCreateProject(client, root.suggestedName);
   if (projectChoice === null) {
     me("No project selected.");
     return { exitCode: 130 };
   }
-  const envName = await pickEnvForUpload(client, projectChoice, envFiles);
-  if (envName === null) {
-    me("No environment selected.");
+  const fileMapping = await pickFileEnvMapping(envFiles, projectChoice);
+  if (fileMapping === null) {
+    me("No env mapping selected.");
     return { exitCode: 130 };
   }
-  const choices = merged.map((e2) => {
-    const verdict = classifyEntry(e2.name, e2.value);
-    const hint = verdict.hint || (e2.isAlias ? "looks like an alias literal" : "no signal");
-    const preview2 = e2.isAlias ? e2.value : previewValue(e2.value, 32);
-    return {
-      name: e2.name,
-      value: e2.value,
-      isAlias: e2.isAlias,
-      verdict: verdict.verdict,
-      label: `${e2.name}  ${preview2}`,
-      hint,
-      sourceLine: e2.sourceLine,
-      source: e2.source
-    };
-  });
-  const initialSecretSelection = choices.filter((c2) => c2.verdict === "secret" && !c2.isAlias).map((c2) => c2.name);
-  const selectedSecretNames = unwrap(
+  const distinctEnvs = [...new Set(fileMapping.map((m) => m.envName))];
+  const perEnv = parseAndMergePerEnv(fileMapping);
+  const skipped = [];
+  for (const env2 of distinctEnvs) {
+    const before = perEnv.get(env2) ?? [];
+    const kept = [];
+    for (const e2 of before) {
+      if (classifyEntry(e2.name, e2.value).verdict === "skip") {
+        skipped.push({ env: env2, entry: e2 });
+      } else {
+        kept.push(e2);
+      }
+    }
+    perEnv.set(env2, kept);
+  }
+  if (skipped.length > 0) {
+    const names = [...new Set(skipped.map((s) => s.entry.name))];
+    R2.info(
+      `Skipped ${skipped.length} framework/shell-managed entr${skipped.length === 1 ? "y" : "ies"}: ${names.join(", ")}`
+    );
+  }
+  for (const env2 of distinctEnvs) {
+    const shadowed = (perEnv.get(env2) ?? []).filter((e2) => e2.shadowedBy.length > 0);
+    if (shadowed.length === 0) continue;
+    const detail = shadowed.map((e2) => `  [${env2}] ${e2.name}: ${e2.source} \u2192 ${e2.shadowedBy[e2.shadowedBy.length - 1]}`).join("\n");
+    R2.warn(
+      `Some keys appear in multiple env files mapped to the same env; using the last value (dotenv convention):
+${detail}`
+    );
+  }
+  const totalEntries = [...perEnv.values()].reduce((n, arr) => n + arr.length, 0);
+  if (totalEntries === 0) {
+    R2.info(
+      "All env files were empty or only contained framework-managed vars. Nothing to upload."
+    );
+    ye("Done.");
+    return { exitCode: 0 };
+  }
+  const choices = [];
+  for (const env2 of distinctEnvs) {
+    for (const e2 of perEnv.get(env2) ?? []) {
+      const c2 = classifyEntry(e2.name, e2.value);
+      const hint = c2.hint || (e2.isAlias ? "looks like an alias literal" : "no signal");
+      const preview2 = e2.isAlias ? e2.value : previewValue(e2.value, 28);
+      const envTag = distinctEnvs.length > 1 ? `[${env2}] ` : "";
+      choices.push({
+        composite: `${env2}|${e2.name}`,
+        env: env2,
+        name: e2.name,
+        value: e2.value,
+        isAlias: e2.isAlias,
+        verdict: c2.verdict,
+        label: `${envTag}${e2.name}  ${preview2}`,
+        hint
+      });
+    }
+  }
+  const initialSecretSelection = choices.filter((c2) => c2.verdict === "secret" && !c2.isAlias).map((c2) => c2.composite);
+  const selectedComposites = unwrap(
     await ve({
       message: "Mark which keys are secrets (vault-uploaded). Unchecked keys stay as literals.",
       options: choices.map((c2) => ({
-        value: c2.name,
+        value: c2.composite,
         label: c2.label,
         hint: c2.isAlias ? `${c2.hint} \u2014 already aliased; will pass through` : c2.hint
       })),
@@ -7632,50 +7734,26 @@ async function runInitFlow(client, opts) {
       required: false
     })
   );
-  const selected = new Set(selectedSecretNames);
+  const selected = new Set(selectedComposites);
+  const defaultEnv = pickDefaultEnv(distinctEnvs);
   let scriptWrapSelection = [];
-  let scriptPlan = root.packageJsonScripts ? planScriptWrap(root.packageJsonScripts) : null;
+  const scriptPlan = root.packageJsonScripts ? planScriptWrap(root.packageJsonScripts) : null;
   if (!opts.noScripts && scriptPlan && scriptPlan.recommended.length > 0) {
-    const wrapAnswer = unwrap(
-      await ve({
-        message: "Wrap package.json scripts with `keynv exec`? (recommended)",
-        options: [
-          ...scriptPlan.recommended.map((a) => ({
-            value: a.name,
-            label: `${a.name}  \u2192  ${a.wrapped}`,
-            hint: a.hint
-          })),
-          ...scriptPlan.unknown.map((a) => ({
-            value: a.name,
-            label: `${a.name}  \u2192  ${a.wrapped}`,
-            hint: `unknown tool \u2014 opt in if you know it reads env`
-          }))
-        ],
-        initialValues: scriptPlan.recommended.map((a) => a.name),
-        required: false
-      })
-    );
-    scriptWrapSelection = wrapAnswer;
-  } else if (opts.noScripts) {
-    scriptPlan = null;
-  }
-  const envFileFateRaw = unwrap(
-    await Ee({
-      message: "After upload, what about the original .env files?",
-      options: [
-        { value: "delete", label: "Delete (recommended \u2014 eliminates the leak vector)" },
-        { value: "gitignore", label: "Keep but make sure .gitignore covers them" }
-      ],
-      initialValue: "delete"
-    })
-  );
+    scriptWrapSelection = scriptPlan.recommended.map((a) => a.name);
+  }
+  const perEnvCounts = distinctEnvs.map((env2) => {
+    const entries = perEnv.get(env2) ?? [];
+    const sec = entries.filter((e2) => selected.has(`${env2}|${e2.name}`)).length;
+    const lit = entries.length - sec;
+    return `  ${env2}: ${sec} secrets, ${lit} literals${env2 === defaultEnv ? " (default \u2014 written to .keynv.env)" : ""}`;
+  }).join("\n");
   const planSummary = [
-    `Project:          ${projectChoice.name}${projectChoice.created ? " (will be created)" : ""}`,
-    `Environment:      ${envName}`,
-    `Secrets to vault: ${selected.size}`,
-    `Literals in file: ${merged.length - selected.size}`,
-    `Script wraps:     ${scriptWrapSelection.length}`,
-    `Original .env:    ${envFileFateRaw === "delete" ? "delete" : "keep + gitignore"}`,
+    `Project:           ${projectChoice.name}${projectChoice.created ? " (will be created)" : ""}`,
+    `Environments:      ${distinctEnvs.join(", ")}`,
+    "Per-env breakdown:",
+    perEnvCounts,
+    `Script wraps:      ${scriptWrapSelection.length}`,
+    "Original .env:     delete after upload",
     opts.dryRun ? "Dry-run: no changes will be made." : ""
   ].filter(Boolean).join("\n");
   Se(planSummary, "About to apply");
@@ -7688,82 +7766,106 @@ async function runInitFlow(client, opts) {
     ye("Dry-run complete \u2014 no changes were made.");
     return { exitCode: 0 };
   }
-  let projectId2;
-  if (projectChoice.created) {
-    const s = ft();
-    s.start(`Creating project "${projectChoice.name}"`);
-    try {
-      const created = await client.request("/v1/projects", {
-        method: "POST",
-        body: {
-          name: projectChoice.name,
-          environments: [{ name: envName, tier: "non-production", require_approval: false }]
-        }
-      });
-      projectId2 = created.id;
-      s.stop(`Created project ${created.name}`);
-    } catch (err) {
-      s.error(`Failed to create project: ${err instanceof Error ? err.message : String(err)}`);
-      return { exitCode: 1 };
-    }
-  } else {
-    projectId2 = projectChoice.id;
-  }
-  const uploaded = [];
+  const projectId2 = await ensureProjectAndEnvs(client, projectChoice, distinctEnvs);
+  if (projectId2 === null) return { exitCode: 1 };
+  const uploadedByEnv = /* @__PURE__ */ new Map();
   const failed = [];
-  if (selected.size > 0) {
+  const totalToUpload = selected.size;
+  if (totalToUpload > 0) {
     const s = ft();
-    s.start(`Uploading ${selected.size} secrets`);
+    s.start(`Uploading ${totalToUpload} secret${totalToUpload === 1 ? "" : "s"}`);
     let i = 0;
-    for (const entry2 of merged) {
-      if (!selected.has(entry2.name)) continue;
-      i++;
-      s.message(`Uploading (${i}/${selected.size}) ${entry2.name}`);
-      const aliasKey = entry2.name.toLowerCase().replace(/_/g, "-");
-      try {
-        await client.request(`/v1/projects/${projectId2}/secrets`, {
-          method: "POST",
-          body: { env: envName, key: aliasKey, value: entry2.value }
-        });
-        const alias2 = buildAlias({ project: projectChoice.name, environment: envName, key: aliasKey });
-        if (alias2 === null) {
+    for (const env2 of distinctEnvs) {
+      const envUploaded = /* @__PURE__ */ new Map();
+      uploadedByEnv.set(env2, envUploaded);
+      for (const e2 of perEnv.get(env2) ?? []) {
+        if (!selected.has(`${env2}|${e2.name}`)) continue;
+        i++;
+        s.message(`Uploading (${i}/${totalToUpload}) [${env2}] ${e2.name}`);
+        const aliasKey = e2.name.toLowerCase().replace(/_/g, "-");
+        try {
+          await client.request(`/v1/projects/${projectId2}/secrets`, {
+            method: "POST",
+            body: { env: env2, key: aliasKey, value: e2.value }
+          });
+          const alias2 = buildAlias({
+            project: projectChoice.name,
+            environment: env2,
+            key: aliasKey
+          });
+          if (alias2 === null) {
+            failed.push({
+              env: env2,
+              name: e2.name,
+              reason: `produced an invalid alias for project=${projectChoice.name} env=${env2} key=${aliasKey}`
+            });
+          } else {
+            envUploaded.set(e2.name, alias2.literal);
+          }
+        } catch (err) {
           failed.push({
-            name: entry2.name,
-            reason: `produced an invalid alias for project=${projectChoice.name} env=${envName} key=${aliasKey}`
+            env: env2,
+            name: e2.name,
+            reason: err instanceof Error ? err.message : String(err)
           });
-        } else {
-          uploaded.push({ name: entry2.name, aliasLiteral: alias2.literal });
         }
-      } catch (err) {
-        failed.push({ name: entry2.name, reason: err instanceof Error ? err.message : String(err) });
       }
     }
     if (failed.length === 0) {
-      s.stop(`Uploaded ${uploaded.length} secrets`);
+      s.stop(`Uploaded ${totalToUpload} secret${totalToUpload === 1 ? "" : "s"}`);
     } else {
-      s.error(`${uploaded.length}/${selected.size} uploaded; ${failed.length} failed`);
-      for (const f of failed) R2.warn(`  ${f.name}: ${f.reason}`);
+      s.error(
+        `${totalToUpload - failed.length}/${totalToUpload} uploaded; ${failed.length} failed`
+      );
+      for (const f of failed) R2.warn(`  [${f.env}] ${f.name}: ${f.reason}`);
     }
   }
-  const literals = merged.filter((e2) => !selected.has(e2.name));
-  const successUploads = new Map(uploaded.map((u) => [u.name, u.aliasLiteral]));
+  const defaultUploaded = uploadedByEnv.get(defaultEnv) ?? /* @__PURE__ */ new Map();
+  const defaultLiterals = (perEnv.get(defaultEnv) ?? []).filter(
+    (e2) => !selected.has(`${defaultEnv}|${e2.name}`)
+  );
   const keynvEnvPath = join(root.path, ".keynv.env");
-  let writtenLines;
   try {
-    writtenLines = composeKeynvEnv({
-      uploadedAliases: successUploads,
-      literals,
+    const lines = composeKeynvEnv({
+      uploadedAliases: defaultUploaded,
+      literals: defaultLiterals,
       mergeWithExisting: intoExisting ? readFileSync(keynvEnvPath, "utf8") : null
     });
-    writeFileSync(keynvEnvPath, `${writtenLines.join("\n")}
+    writeFileSync(keynvEnvPath, `${lines.join("\n")}
 `);
     R2.success(
-      `${intoExisting ? "Updated" : "Wrote"} ${keynvEnvPath} (${successUploads.size + literals.length} entries)`
+      `${intoExisting ? "Updated" : "Wrote"} ${keynvEnvPath} (${defaultUploaded.size + defaultLiterals.length} entries from "${defaultEnv}")`
     );
   } catch (err) {
     R2.error(`Failed to write .keynv.env: ${err instanceof Error ? err.message : String(err)}`);
     return { exitCode: 1 };
   }
+  const otherEnvsWithAliases = distinctEnvs.filter(
+    (env2) => env2 !== defaultEnv && (uploadedByEnv.get(env2)?.size ?? 0) > 0
+  );
+  for (const env2 of otherEnvsWithAliases) {
+    const envUploaded = uploadedByEnv.get(env2) ?? /* @__PURE__ */ new Map();
+    const envLiterals = (perEnv.get(env2) ?? []).filter(
+      (e2) => !selected.has(`${env2}|${e2.name}`)
+    );
+    const envFilePath = join(root.path, `.keynv.${env2}.env`);
+    try {
+      const lines = composeKeynvEnv({
+        uploadedAliases: envUploaded,
+        literals: envLiterals,
+        mergeWithExisting: null
+      });
+      writeFileSync(envFilePath, `${lines.join("\n")}
+`);
+      R2.success(
+        `Wrote .keynv.${env2}.env (${envUploaded.size} secret alias${envUploaded.size === 1 ? "" : "es"} from "${env2}")`
+      );
+    } catch (err) {
+      R2.warn(
+        `Could not write .keynv.${env2}.env: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
   try {
     const outcome = writeAiContext(root.path);
     if (outcome === "created") R2.success("Wrote AGENTS.md (so AI agents understand keynv)");
@@ -7779,66 +7881,37 @@ async function runInitFlow(client, opts) {
         root.packageJsonScripts,
         scriptWrapSelection
       );
-      R2.success(`Wrapped ${scriptWrapSelection.length} script(s) in package.json`);
+      R2.success(
+        `Wrapped ${scriptWrapSelection.length} script${scriptWrapSelection.length === 1 ? "" : "s"} in package.json`
+      );
     } catch (err) {
       R2.warn(
         `Could not update package.json scripts: ${err instanceof Error ? err.message : String(err)}`
       );
     }
   }
-  if (envFileFateRaw === "delete") {
-    for (const f of envFiles) {
-      try {
-        unlinkSync(f.path);
-        R2.success(`Removed ${f.name}`);
-      } catch (err) {
-        R2.warn(`Could not remove ${f.name}: ${err instanceof Error ? err.message : String(err)}`);
-      }
-    }
-  } else {
-    const gitignorePath = join(root.path, ".gitignore");
+  for (const f of envFiles) {
     try {
-      ensureGitignoreEntries(gitignorePath, envFiles.map((f) => f.name));
-      R2.success(`Updated .gitignore (${envFiles.length} entries ensured)`);
+      unlinkSync(f.path);
+      R2.success(`Removed ${f.name}`);
     } catch (err) {
-      R2.warn(`Could not update .gitignore: ${err instanceof Error ? err.message : String(err)}`);
+      R2.warn(`Could not remove ${f.name}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
+  const otherEnvs = distinctEnvs.filter((e2) => e2 !== defaultEnv);
+  if (otherEnvs.length > 0) {
+    const lines = otherEnvs.map((env2) => {
+      const count = uploadedByEnv.get(env2)?.size ?? 0;
+      const hasFile = count > 0;
+      return hasFile ? `  ${env2}: ${count} secret${count === 1 ? "" : "s"} \u2192 .keynv.${env2}.env (use \`keynv exec --from .keynv.${env2}.env -- <cmd>\`)` : `  ${env2}: 0 secrets in vault (no alias file written)`;
+    });
+    Se(lines.join("\n"), "Secrets in other envs");
+  }
   ye(
-    failed.length > 0 ? `Done with ${failed.length} failure(s) \u2014 see warnings above.` : `Done. Try: ${scriptWrapSelection.includes("dev") ? "npm run dev" : "keynv exec -- <your command>"}`
+    failed.length > 0 ? `Done with ${failed.length} failure(s) \u2014 see warnings above.` : `Done. Try: ${scriptWrapSelection.includes("dev") ? "pnpm dev" : "keynv exec -- <your command>"}`
   );
   return { exitCode: failed.length > 0 ? 1 : 0 };
 }
-function mergeEnvFiles(files) {
-  const map = /* @__PURE__ */ new Map();
-  for (const f of files) {
-    let entries;
-    try {
-      entries = parseEnvFile(readFileSync(f.path, "utf8"), f.path);
-    } catch (err) {
-      R2.warn(`${f.name}: ${err instanceof Error ? err.message : String(err)} \u2014 skipping file`);
-      continue;
-    }
-    for (const e2 of entries) {
-      const existing = map.get(e2.name);
-      if (existing) {
-        existing.shadowedBy.push(f.name);
-        existing.value = e2.value;
-        existing.isAlias = e2.isAlias;
-      } else {
-        map.set(e2.name, {
-          name: e2.name,
-          value: e2.value,
-          isAlias: e2.isAlias,
-          source: f.name,
-          sourceLine: e2.line,
-          shadowedBy: []
-        });
-      }
-    }
-  }
-  return [...map.values()];
-}
 async function pickOrCreateProject(client, suggestedName) {
   const projects = await listProjects(client);
   const value = unwrap(
@@ -7858,53 +7931,156 @@ async function pickOrCreateProject(client, suggestedName) {
         validate: (v2) => v2 && /^[a-z0-9][a-z0-9-]{0,47}$/.test(v2) ? void 0 : "lowercase letters, digits, dashes; up to 48 chars"
       })
     );
-    return { id: "", name, created: true };
+    return { id: "", name, created: true, existingEnvs: [] };
   }
   const match = projects.find((p2) => p2.id === value);
   if (!match) return null;
-  return { id: match.id, name: match.name, created: false };
+  const detail = await client.request(`/v1/projects/${match.id}`);
+  return {
+    id: match.id,
+    name: match.name,
+    created: false,
+    existingEnvs: detail.environments
+  };
 }
-async function pickEnvForUpload(client, project, envFiles) {
-  const firstSuffix = envFiles[0]?.suffix ?? null;
-  const suggested = suggestedEnvForSuffix(firstSuffix);
-  if (project.created) {
-    const value2 = unwrap(
-      await Re({
-        message: "Environment to create",
-        initialValue: suggested,
-        validate: (v2) => v2 && /^[a-z0-9][a-z0-9-]{0,23}$/.test(v2) ? void 0 : "lowercase letters, digits, dashes; up to 24 chars"
+async function pickFileEnvMapping(files, project) {
+  if (files.length === 0) return [];
+  const existingEnvNames = new Set(project.existingEnvs.map((e2) => e2.name));
+  if (files.length === 1) {
+    const onlyFile = files[0];
+    if (!onlyFile) return [];
+    const suggested = suggestedEnvForSuffix(onlyFile.suffix);
+    return [{ file: onlyFile, envName: suggested }];
+  }
+  const assignments = [];
+  for (const f of files) {
+    const suggested = suggestedEnvForSuffix(f.suffix);
+    const opts = [];
+    opts.push({
+      value: suggested,
+      label: suggested,
+      hint: existingEnvNames.has(suggested) ? "existing env" : project.created ? "will be created with project" : "will be added to project"
+    });
+    for (const e2 of project.existingEnvs) {
+      if (e2.name === suggested) continue;
+      opts.push({ value: e2.name, label: e2.name, hint: e2.tier });
+    }
+    opts.push({ value: "__custom", label: "+ Custom env name\u2026" });
+    let envName = unwrap(
+      await Ee({
+        message: `Map ${f.name} to which keynv env?`,
+        options: opts,
+        initialValue: suggested
       })
     );
-    return value2;
+    if (envName === "__custom") {
+      envName = unwrap(
+        await Re({
+          message: "New env name",
+          validate: (v2) => v2 && /^[a-z0-9][a-z0-9-]{0,23}$/.test(v2) ? void 0 : "lowercase letters, digits, dashes; up to 24 chars"
+        })
+      );
+    }
+    assignments.push({ file: f, envName });
   }
-  const detail = await client.request(`/v1/projects/${project.id}`);
-  if (detail.environments.length === 0) {
-    me(
-      `Project "${project.name}" has no environments yet, and we can't add one from init in this version. Create one with \`keynv project create\` (or pick a different project).`
-    );
-    return null;
+  return assignments;
+}
+function parseAndMergePerEnv(mapping) {
+  const acc = /* @__PURE__ */ new Map();
+  for (const { file, envName } of mapping) {
+    let entries;
+    try {
+      entries = parseEnvFile(readFileSync(file.path, "utf8"), file.path);
+    } catch (err) {
+      R2.warn(`${file.name}: ${err instanceof Error ? err.message : String(err)} \u2014 skipping file`);
+      continue;
+    }
+    let envMap = acc.get(envName);
+    if (!envMap) {
+      envMap = /* @__PURE__ */ new Map();
+      acc.set(envName, envMap);
+    }
+    for (const e2 of entries) {
+      const existing = envMap.get(e2.name);
+      if (existing) {
+        existing.shadowedBy.push(file.name);
+        existing.value = e2.value;
+        existing.isAlias = e2.isAlias;
+      } else {
+        envMap.set(e2.name, {
+          name: e2.name,
+          value: e2.value,
+          isAlias: e2.isAlias,
+          source: file.name,
+          sourceLine: e2.line,
+          shadowedBy: []
+        });
+      }
+    }
   }
-  if (detail.environments.length === 1) {
-    return detail.environments[0]?.name ?? null;
+  const out = /* @__PURE__ */ new Map();
+  for (const [env2, m] of acc) out.set(env2, [...m.values()]);
+  return out;
+}
+function pickDefaultEnv(envs) {
+  if (envs.length === 0) return "dev";
+  if (envs.includes("dev")) return "dev";
+  return envs[0];
+}
+async function ensureProjectAndEnvs(client, projectChoice, distinctEnvs) {
+  if (projectChoice.created) {
+    const s2 = ft();
+    s2.start(`Creating project "${projectChoice.name}" with ${distinctEnvs.length} env(s)`);
+    try {
+      const created = await client.request("/v1/projects", {
+        method: "POST",
+        body: {
+          name: projectChoice.name,
+          environments: distinctEnvs.map((name) => envBodyFor(name))
+        }
+      });
+      s2.stop(`Created project ${created.name}`);
+      return created.id;
+    } catch (err) {
+      s2.error(`Failed to create project: ${err instanceof Error ? err.message : String(err)}`);
+      return null;
+    }
   }
-  const value = unwrap(
-    await Ee({
-      message: "Upload to which environment?",
-      options: detail.environments.map((e2) => ({
-        value: e2.name,
-        label: e2.name,
-        hint: e2.tier
-      })),
-      initialValue: detail.environments.find((e2) => e2.name === suggested)?.name
-    })
-  );
-  return value;
+  const existing = new Set(projectChoice.existingEnvs.map((e2) => e2.name));
+  const missing = distinctEnvs.filter((e2) => !existing.has(e2));
+  if (missing.length === 0) return projectChoice.id;
+  const s = ft();
+  s.start(`Adding ${missing.length} missing env(s) to project "${projectChoice.name}"`);
+  for (const envName of missing) {
+    try {
+      await client.request(`/v1/projects/${projectChoice.id}/environments`, {
+        method: "POST",
+        body: envBodyFor(envName)
+      });
+    } catch (err) {
+      s.error(
+        `Failed to add env "${envName}": ${err instanceof Error ? err.message : String(err)}`
+      );
+      return null;
+    }
+  }
+  s.stop(`Added env(s): ${missing.join(", ")}`);
+  return projectChoice.id;
+}
+function envBodyFor(name) {
+  const isProd = name === "prod" || name === "production";
+  return {
+    name,
+    tier: isProd ? "production" : "non-production",
+    require_approval: isProd
+  };
 }
 function composeKeynvEnv(opts) {
   const { uploadedAliases, literals, mergeWithExisting } = opts;
   const lines = [];
   if (mergeWithExisting !== null) {
-    const trimmed = mergeWithExisting.replace(/\n+$/, "");
+    const normalized = mergeWithExisting.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+    const trimmed = normalized.replace(/\n+$/, "");
     if (trimmed.length > 0) {
       lines.push(...trimmed.split("\n"));
       lines.push("");
@@ -7931,7 +8107,7 @@ function composeKeynvEnv(opts) {
     }
   }
   if (mergeWithExisting !== null) {
-    lines.push(`# <<< keynv init <<<`);
+    lines.push("# <<< keynv init <<<");
   }
   return lines;
 }
@@ -7950,23 +8126,13 @@ function updatePackageJsonScripts(path, originalScripts, selectedNames) {
   writeFileSync(path, trailingNewline ? `${out}
 ` : out);
 }
-function ensureGitignoreEntries(path, basenames) {
-  let existing = "";
-  if (existsSync(path)) existing = readFileSync(path, "utf8");
-  const existingLines = new Set(existing.split("\n").map((l) => l.trim()));
-  const toAdd = basenames.filter((n) => !existingLines.has(n));
-  if (toAdd.length === 0) return;
-  const sep = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
-  const block = ["", "# added by keynv init", ...toAdd, ""].join("\n");
-  writeFileSync(path, `${existing}${sep}${block}`);
-}
 var init_init = __esm({
   "src/ui/flows/init.ts"() {
-    init_dist();
     init_dist5();
+    init_dist();
     init_envFile();
-    init_detect();
     init_aiContext();
+    init_detect();
     init_heuristics();
     init_scriptWrap();
     init_cancel();
@@ -7974,30 +8140,122 @@ var init_init = __esm({
   }
 });
 
-// src/ui/helpers/pickSecret.ts
-async function listSecrets(client, projectId2) {
-  const data = await client.request(
-    `/v1/projects/${projectId2}/secrets`
-  );
-  return data.secrets;
+// src/ui/helpers/tty.ts
+var tty_exports = {};
+__export(tty_exports, {
+  isInteractive: () => isInteractive
+});
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
-async function pickSecret(client, projectId2, message = "Secret:") {
-  const secrets = await listSecrets(client, projectId2);
-  if (secrets.length === 0) return null;
-  const value = await Ee({
-    message,
-    options: secrets.map((s) => ({
-      value: s.alias,
-      label: s.alias,
-      hint: `v${s.version}`
-    }))
+var init_tty = __esm({
+  "src/ui/helpers/tty.ts"() {
+  }
+});
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function errorMessage(res, fallback) {
+  const text = await res.text();
+  if (!text) return fallback;
+  try {
+    const parsed = JSON.parse(text);
+    return parsed.error?.message ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+function openBrowser(url) {
+  try {
+    const os = platform();
+    const command = os === "win32" ? "cmd" : os === "darwin" ? "open" : "xdg-open";
+    const args = os === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function runBrowserAuth(serverUrl) {
+  const startRes = await fetch(new URL("/v1/auth/cli/browser/start", serverUrl).toString(), {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+    body: JSON.stringify({ device_name: hostname() })
   });
-  if (q(value)) return null;
-  return secrets.find((s) => s.alias === value) ?? null;
+  if (!startRes.ok) {
+    throw new BrowserAuthError(
+      await errorMessage(startRes, `Browser auth failed to start (${startRes.status}).`)
+    );
+  }
+  const start = await startRes.json();
+  const opened = openBrowser(start.verification_uri_complete);
+  if (opened) {
+    process.stderr.write(
+      `
+  Your code: ${start.user_code}
+  Complete auth in your browser, then return here.
+
+`
+    );
+  } else {
+    process.stderr.write(
+      `
+  Could not open a browser automatically.
+  Open this URL manually:
+
+    ${start.verification_uri_complete}
+
+  Your code: ${start.user_code}
+  Waiting for you to complete auth in the browser...
+
+`
+    );
+  }
+  const deadline = Date.now() + start.expires_in * 1e3;
+  const intervalMs = Math.max(1, start.interval) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const pollRes = await fetch(new URL("/v1/auth/cli/browser/poll", serverUrl).toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+      body: JSON.stringify({ device_code: start.device_code })
+    });
+    if (pollRes.status === 202) continue;
+    if (!pollRes.ok) {
+      throw new BrowserAuthError(
+        await errorMessage(pollRes, `Browser auth failed (${pollRes.status}).`)
+      );
+    }
+    const data = await pollRes.json();
+    return {
+      auth_kind: "session",
+      server_url: serverUrl,
+      user_id: data.user.id,
+      email: data.user.email,
+      org_id: data.user.org_id,
+      org_role: data.user.org_role,
+      access_token: data.access_token,
+      refresh_token: data.refresh_token,
+      access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
+    };
+  }
+  throw new BrowserAuthError("Browser auth timed out. Run `keynv login` to try again.");
 }
-var init_pickSecret = __esm({
-  "src/ui/helpers/pickSecret.ts"() {
-    init_dist5();
+var BrowserAuthError;
+var init_browser_auth = __esm({
+  "src/client/browser-auth.ts"() {
+    init_version();
+    BrowserAuthError = class extends Error {
+    };
+  }
+});
+
+// src/client/defaults.ts
+var DEFAULT_SERVER_URL;
+var init_defaults = __esm({
+  "src/client/defaults.ts"() {
+    DEFAULT_SERVER_URL = "https://api.keynv.dev";
   }
 });
 
@@ -8025,6 +8283,33 @@ var init_pickEnv = __esm({
     init_dist5();
   }
 });
+
+// src/ui/helpers/pickSecret.ts
+async function listSecrets(client, projectId2) {
+  const data = await client.request(
+    `/v1/projects/${projectId2}/secrets`
+  );
+  return data.secrets;
+}
+async function pickSecret(client, projectId2, message = "Secret:") {
+  const secrets = await listSecrets(client, projectId2);
+  if (secrets.length === 0) return null;
+  const value = await Ee({
+    message,
+    options: secrets.map((s) => ({
+      value: s.alias,
+      label: s.alias,
+      hint: `v${s.version}`
+    }))
+  });
+  if (q(value)) return null;
+  return secrets.find((s) => s.alias === value) ?? null;
+}
+var init_pickSecret = __esm({
+  "src/ui/helpers/pickSecret.ts"() {
+    init_dist5();
+  }
+});
 async function runSecretsFlow(client, project) {
   let target = project;
   if (!target) {
@@ -8088,7 +8373,10 @@ async function runSecretMenu(client, project, alias2) {
       }
     } else if (choice === "rotate") {
       const newValue = unwrap(
-        await Ce({ message: "New value", validate: (v2) => v2 && v2.length ? void 0 : "required" })
+        await Ce({
+          message: "New value",
+          validate: (v2) => v2?.length ? void 0 : "required"
+        })
       );
       const data = await client.request(`${path}/rotate`, {
         method: "POST",
@@ -8096,9 +8384,7 @@ async function runSecretMenu(client, project, alias2) {
       });
       R2.success(`Rotated ${data.alias} \u2192 v${data.version}`);
     } else if (choice === "delete") {
-      const confirmed = unwrap(
-        await ue({ message: `Delete ${alias2}?`, initialValue: false })
-      );
+      const confirmed = unwrap(await ue({ message: `Delete ${alias2}?`, initialValue: false }));
       if (!confirmed) continue;
       await client.request(path, { method: "DELETE" });
       R2.success(`Deleted ${alias2}`);
@@ -8107,11 +8393,13 @@ async function runSecretMenu(client, project, alias2) {
   }
 }
 async function copyToClipboard(value) {
-  const platform = process.platform;
-  const cmd = platform === "darwin" ? ["pbcopy", []] : platform === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
+  const platform2 = process.platform;
+  const cmd = platform2 === "darwin" ? ["pbcopy", []] : platform2 === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
   return new Promise((resolve3) => {
     try {
-      const child = spawn(cmd[0], cmd[1], { stdio: ["pipe", "ignore", "ignore"] });
+      const child = spawn(cmd[0], cmd[1], {
+        stdio: ["pipe", "ignore", "ignore"]
+      });
       child.on("error", () => resolve3(false));
       child.on("exit", (code) => resolve3(code === 0));
       child.stdin.end(value);
@@ -8138,7 +8426,7 @@ async function promptNewSecret(client, project) {
       }),
       value: () => Ce({
         message: "Value (hidden)",
-        validate: (v2) => v2 && v2.length ? void 0 : "required"
+        validate: (v2) => v2?.length ? void 0 : "required"
       })
     },
     {
@@ -8167,8 +8455,8 @@ async function createSecretInteractive(client, project) {
 }
 var init_secret = __esm({
   "src/ui/flows/secret.ts"() {
-    init_dist();
     init_dist5();
+    init_dist();
     init_cancel();
     init_pickEnv();
     init_pickProject();
@@ -28501,7 +28789,7 @@ var require_utils_webcrypto = __commonJS({
     var nodeCrypto = __require("crypto");
     module.exports = {
       postgresMd5PasswordHash,
-      randomBytes,
+      randomBytes: randomBytes2,
       deriveKey,
       sha256,
       hashByName,
@@ -28511,7 +28799,7 @@ var require_utils_webcrypto = __commonJS({
     var webCrypto = nodeCrypto.webcrypto || globalThis.crypto;
     var subtleCrypto = webCrypto.subtle;
     var textEncoder = new TextEncoder();
-    function randomBytes(length) {
+    function randomBytes2(length) {
       return webCrypto.getRandomValues(Buffer.alloc(length));
     }
     async function md5(string) {
@@ -28907,11 +29195,11 @@ var require_pg_connection_string = __commonJS({
         config.client_encoding = result.searchParams.get("encoding");
         return config;
       }
-      const hostname = dummyHost ? "" : result.hostname;
+      const hostname2 = dummyHost ? "" : result.hostname;
       if (!config.host) {
-        config.host = decodeURIComponent(hostname);
-      } else if (hostname && /^%2f/i.test(hostname)) {
-        result.pathname = hostname + result.pathname;
+        config.host = decodeURIComponent(hostname2);
+      } else if (hostname2 && /^%2f/i.test(hostname2)) {
+        result.pathname = hostname2 + result.pathname;
       }
       if (!config.port) {
         config.port = result.port;
@@ -40017,9 +40305,9 @@ var require_cluster = __commonJS({
           }
         });
       }
-      resolveSrv(hostname) {
+      resolveSrv(hostname2) {
         return new Promise((resolve3, reject) => {
-          this.options.resolveSrv(hostname, (err, records) => {
+          this.options.resolveSrv(hostname2, (err, records) => {
             if (err) {
               return reject(err);
             }
@@ -40041,14 +40329,14 @@ var require_cluster = __commonJS({
           });
         });
       }
-      dnsLookup(hostname) {
+      dnsLookup(hostname2) {
         return new Promise((resolve3, reject) => {
-          this.options.dnsLookup(hostname, (err, address) => {
+          this.options.dnsLookup(hostname2, (err, address) => {
             if (err) {
-              debug2("failed to resolve hostname %s to IP: %s", hostname, err.message);
+              debug2("failed to resolve hostname %s to IP: %s", hostname2, err.message);
               reject(err);
             } else {
-              debug2("resolved hostname %s to IP %s", hostname, address);
+              debug2("resolved hostname %s to IP %s", hostname2, address);
               resolve3(address);
             }
           });
@@ -42373,85 +42661,27 @@ var init_audit2 = __esm({
 });
 
 // src/ui/flows/login.ts
-async function runLoginFlow(client) {
-  const answers = await he(
-    {
-      server: () => Re({
-        message: "Server URL",
-        placeholder: "http://localhost:8080",
-        defaultValue: "http://localhost:8080"
-      }),
-      email: () => Re({
-        message: "Email",
-        validate: (v2) => v2 && v2.includes("@") ? void 0 : "enter an email"
-      }),
-      password: () => Ce({
-        message: "Password",
-        validate: (v2) => v2 && v2.length >= 1 ? void 0 : "required"
-      })
-    },
-    {
-      onCancel: () => {
-        throw new UserCancelled();
-      }
-    }
-  );
-  const server = answers.server || "http://localhost:8080";
+async function runLoginFlow(client, options = {}) {
+  const server = options.server ?? DEFAULT_SERVER_URL;
   const s = ft();
-  s.start("Authenticating");
-  let res;
+  s.start("Waiting for authorization");
+  let creds;
   try {
-    res = await fetch(new URL("/v1/auth/login", server).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
-      body: JSON.stringify({ email: answers.email, password: answers.password })
-    });
+    creds = await runBrowserAuth(server);
   } catch (err) {
-    s.error("Network error");
-    me(err instanceof Error ? err.message : "unreachable");
+    s.error("Browser login failed");
+    me(err instanceof Error ? err.message : "Unable to authenticate.");
     return false;
   }
-  if (!res.ok) {
-    let msg = `login failed (${res.status})`;
-    try {
-      const parsed = await res.json();
-      msg = parsed.error?.message ?? msg;
-    } catch {
-    }
-    s.error(msg);
-    return false;
-  }
-  const data = await res.json();
-  await saveCredentials({
-    server_url: server,
-    user_id: data.user.id,
-    email: data.user.email,
-    org_id: data.user.org_id,
-    org_role: data.user.org_role,
-    access_token: data.access_token,
-    refresh_token: data.refresh_token,
-    access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
-  });
-  await client.setCredentials({
-    server_url: server,
-    user_id: data.user.id,
-    email: data.user.email,
-    org_id: data.user.org_id,
-    org_role: data.user.org_role,
-    access_token: data.access_token,
-    refresh_token: data.refresh_token,
-    access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
-  });
-  s.stop(`Logged in as ${data.user.email}`);
+  await client.setCredentials(creds);
+  s.stop(`Logged in as ${creds.email}`);
   return true;
 }
 var init_login = __esm({
   "src/ui/flows/login.ts"() {
     init_dist5();
-    init_http();
-    init_store();
-    init_version();
-    init_cancel();
+    init_browser_auth();
+    init_defaults();
   }
 });
 
@@ -42510,7 +42740,7 @@ async function addMemberInteractive(client, project) {
     {
       email: () => Re({
         message: "Email",
-        validate: (v2) => v2 && v2.includes("@") ? void 0 : "enter an email"
+        validate: (v2) => v2?.includes("@") ? void 0 : "enter an email"
       }),
       role: () => Ee({
         message: "Role",
@@ -42609,8 +42839,11 @@ function printDetail(detail) {
   const envLines = detail.environments.map(
     (e2) => `  ${e2.name}  (tier=${e2.tier}, approval=${e2.require_approval})`
   );
-  Se(`${detail.name}  (${detail.id})
-${envLines.join("\n") || "  (no environments)"}`, "Project");
+  Se(
+    `${detail.name}  (${detail.id})
+${envLines.join("\n") || "  (no environments)"}`,
+    "Project"
+  );
 }
 async function createProjectInteractive(client) {
   const answers = await he(
@@ -42669,6 +42902,7 @@ async function runMenu() {
   ge(`keynv ${VERSION}`);
   const client = new ApiClient();
   await client.ensureHydrated();
+  let didLogin = false;
   if (!client.isLoggedIn) {
     R2.info("Not logged in.");
     try {
@@ -42677,6 +42911,7 @@ async function runMenu() {
         ye("Login cancelled.");
         return 1;
       }
+      didLogin = true;
     } catch (err) {
       if (err instanceof UserCancelled) {
         me("Login cancelled.");
@@ -42688,6 +42923,20 @@ async function runMenu() {
     const u = client.currentUser;
     if (u) R2.message(`${u.email} (${u.org_role}) @ ${u.server_url}`);
   }
+  if (didLogin) {
+    const root = findProjectRoot(process.cwd());
+    const alreadyInitialized = root !== null && hasExistingKeynvEnv(root.path);
+    if (!alreadyInitialized) {
+      const setup = await ue({
+        message: "Set up this project now?",
+        initialValue: true
+      });
+      if (!q(setup) && setup) {
+        const { runInitFlow: runInitFlow2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+        await runInitFlow2(client, { cwd: process.cwd(), dryRun: false, noScripts: false });
+      }
+    }
+  }
   while (true) {
     let choice;
     try {
@@ -42754,15 +43003,16 @@ var init_menu = __esm({
   "src/ui/menu.ts"() {
     init_dist5();
     init_http();
+    init_detect();
     init_store();
-    init_format();
-    init_cancel();
+    init_version();
     init_audit2();
     init_login();
     init_member();
     init_project();
     init_secret();
-    init_version();
+    init_format();
+    init_cancel();
   }
 });
 
@@ -43443,11 +43693,11 @@ var reducers = {
       return { ...state, options: [{ name: `-c`, value: String(command) }] };
     }
   },
-  setError: (state, segment, segmentIndex, errorMessage) => {
+  setError: (state, segment, segmentIndex, errorMessage2) => {
     if (segment === SpecialToken.EndOfInput || segment === SpecialToken.EndOfPartialInput) {
-      return { ...state, errorMessage: `${errorMessage}.` };
+      return { ...state, errorMessage: `${errorMessage2}.` };
     } else {
-      return { ...state, errorMessage: `${errorMessage} ("${segment}").` };
+      return { ...state, errorMessage: `${errorMessage2} ("${segment}").` };
     }
   },
   setOptionArityError: (state, segment) => {
@@ -44480,44 +44730,48 @@ var AuditListCommand = class extends Command {
   sinceId = options_exports.String("--since-id");
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request(
-      "/v1/audit",
-      {
-        query: {
-          event_type: this.eventType,
-          limit: this.limit,
-          since_id: this.sinceId
+    try {
+      const client = new ApiClient();
+      const data = await client.request(
+        "/v1/audit",
+        {
+          query: {
+            event_type: this.eventType,
+            limit: this.limit,
+            since_id: this.sinceId
+          }
         }
-      }
-    );
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+      );
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    if (data.entries.length === 0) {
-      this.context.stdout.write("no audit entries\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["id", "ts", "actor", "agent", "event"],
-        data.entries.map((e2) => [
-          String(e2.id),
-          e2.ts,
-          e2.actor_user_id ?? "(none)",
-          e2.actor_agent,
-          e2.event_type
-        ])
-      )}
+        return 0;
+      }
+      if (data.entries.length === 0) {
+        this.context.stdout.write("no audit entries\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["id", "ts", "actor", "agent", "event"],
+          data.entries.map((e2) => [
+            String(e2.id),
+            e2.ts,
+            e2.actor_user_id ?? "(none)",
+            e2.actor_agent,
+            e2.event_type
+          ])
+        )}
 `
-    );
-    if (data.next_cursor) {
-      this.context.stdout.write(`(next: --since-id ${data.next_cursor})
+      );
+      if (data.next_cursor) {
+        this.context.stdout.write(`(next: --since-id ${data.next_cursor})
 `);
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var AuditVerifyCommand = class extends Command {
@@ -44527,23 +44781,27 @@ var AuditVerifyCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/audit/verify", { method: "POST" });
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const data = await client.request("/v1/audit/verify", { method: "POST" });
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return data.ok ? 0 : 1;
-    }
-    if (data.ok) {
-      this.context.stdout.write(`OK: ${data.checked} entries verified
+        return data.ok ? 0 : 1;
+      }
+      if (data.ok) {
+        this.context.stdout.write(`OK: ${data.checked} entries verified
 `);
-      return 0;
-    }
-    this.context.stdout.write(
-      `FAIL: chain broken at id ${data.broken_at_id} (${data.reason}); ${data.checked} entries verified before break
+        return 0;
+      }
+      this.context.stdout.write(
+        `FAIL: chain broken at id ${data.broken_at_id} (${data.reason}); ${data.checked} entries verified before break
 `
-    );
-    return 1;
+      );
+      return 1;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 
@@ -44584,11 +44842,10 @@ async function resolveAllAliases(client, argv2, extraStrings = []) {
   return resolved;
 }
 function substitute(text, resolved) {
+  const sorted = [...resolved].sort((a, b2) => b2.alias.literal.length - a.alias.literal.length);
   let out = text;
-  for (const r of resolved) {
-    if (out.includes(r.alias.literal)) {
-      out = out.split(r.alias.literal).join(r.value);
-    }
+  for (const r of sorted) {
+    out = out.split(r.alias.literal).join(r.value);
   }
   return out;
 }
@@ -44691,10 +44948,18 @@ var BUILTIN_LINE_PATTERNS = BUILTIN_PATTERNS.filter((p2) => !p2.multiline);
 
 // ../../packages/redactor/dist/entropy.js
 var TOKEN_BOUNDARY_RE = /[\s,;:'"<>(){}[\]=]+/;
+var DEFAULT_EXCLUDE_PREFIXES = [
+  "sha1-",
+  "sha256:",
+  "sha256-",
+  "sha384-",
+  "sha512-"
+];
 var DEFAULTS = {
   enabled: true,
   minLength: 24,
-  minBitsPerChar: 4.5
+  minBitsPerChar: 4.5,
+  excludePrefixes: DEFAULT_EXCLUDE_PREFIXES
 };
 function shannonEntropy(s) {
   if (s.length === 0)
@@ -44727,9 +44992,13 @@ function findEntropyMatches(text, opts = {}) {
     const end = i;
     const token = text.slice(start, end);
     if (token.length >= cfg.minLength) {
-      const h2 = shannonEntropy(token);
-      if (h2 >= cfg.minBitsPerChar) {
-        matches.push({ start, end, token });
+      const lower = token.toLowerCase();
+      const excluded = cfg.excludePrefixes.some((p2) => lower.startsWith(p2));
+      if (!excluded) {
+        const h2 = shannonEntropy(token);
+        if (h2 >= cfg.minBitsPerChar) {
+          matches.push({ start, end, token });
+        }
       }
     }
   }
@@ -44873,7 +45142,19 @@ var ENV_ALLOWLIST = [
   "PWD",
   "OLDPWD",
   "TMPDIR",
-  "SSH_AUTH_SOCK"
+  "SSH_AUTH_SOCK",
+  // Windows-specific
+  "USERPROFILE",
+  "USERNAME",
+  "COMPUTERNAME",
+  "TEMP",
+  "TMP",
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "APPDATA",
+  "LOCALAPPDATA"
 ];
 function spawnPrivileged(opts) {
   const startedAt = Date.now();
@@ -44886,7 +45167,32 @@ function spawnPrivileged(opts) {
     for (const [k2, v2] of Object.entries(opts.injectedEnv)) env2[k2] = v2;
   }
   const stdio = ["inherit", "pipe", "pipe"];
-  const child = spawn(opts.command, opts.args, {
+  const WIN_BUILTINS = /* @__PURE__ */ new Set([
+    "echo",
+    "dir",
+    "type",
+    "copy",
+    "del",
+    "move",
+    "ren",
+    "md",
+    "mkdir",
+    "rd",
+    "rmdir",
+    "cd",
+    "cls",
+    "set",
+    "pause",
+    "find",
+    "where"
+  ]);
+  let spawnCmd = opts.command;
+  let spawnArgs = opts.args;
+  if (process.platform === "win32" && WIN_BUILTINS.has(opts.command.toLowerCase())) {
+    spawnCmd = process.env.COMSPEC ?? "cmd.exe";
+    spawnArgs = ["/d", "/s", "/c", opts.command, ...opts.args];
+  }
+  const child = spawn(spawnCmd, spawnArgs, {
     env: env2,
     stdio,
     detached: false
@@ -44953,10 +45259,7 @@ to load a specific file, or set KEYNV_ENV_FILE in the environment.
 spelled \`--from\` to avoid the collision.)
 `,
     examples: [
-      [
-        "Auto-load .keynv.env from cwd or parents",
-        "$0 exec -- next dev"
-      ],
+      ["Auto-load .keynv.env from cwd or parents", "$0 exec -- next dev"],
       [
         "Run mysql with the alias substituted at fork-exec time",
         "$0 exec -- mysql -p@billing.dev.db_pass -h db.example.com"
@@ -45020,7 +45323,18 @@ spelled \`--from\` to avoid the collision.)
 `);
         return 2;
       }
-      throw err;
+      this.context.stderr.write(
+        `keynv: unexpected error loading env file: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 2;
+    }
+    if (!envFileLoaded && !this.noEnvFile && !this.envFile && !process.env.KEYNV_ENV_FILE) {
+      this.context.stderr.write(
+        `keynv: no ${ENV_FILE_BASENAME} found in this directory or any parent.
+       Run \`keynv init\` in your project root to migrate secrets and create one.
+`
+      );
     }
     const viaEnvSpecs = [];
     for (const spec of this.viaEnv ?? []) {
@@ -45092,11 +45406,18 @@ spelled \`--from\` to avoid the collision.)
       injectedEnv[spec.name] = value;
     }
     if (envFileLoaded && !this.quiet) {
-      const total = envFileLoaded.entries.length;
-      const aliasCount = envFileLoaded.entries.filter((e2) => e2.isAlias).length;
+      const aliasEntries = envFileLoaded.entries.filter((e2) => e2.isAlias);
+      const plainEntries = envFileLoaded.entries.filter((e2) => !e2.isAlias);
+      const displayPath = relative(process.cwd(), envFileLoaded.path) || envFileLoaded.path;
+      const parts = [];
+      if (aliasEntries.length > 0) {
+        parts.push(aliasEntries.map((e2) => `${e2.name}=${e2.value}`).join(", ") + " (vault)");
+      }
+      if (plainEntries.length > 0) {
+        parts.push(plainEntries.map((e2) => e2.name).join(", ") + " (plain)");
+      }
       this.context.stderr.write(
-        `keynv: loaded ${total} var${total === 1 ? "" : "s"} from ${envFileLoaded.path} (${aliasCount} resolved from vault)
-`
+        `keynv: loaded ${displayPath}` + (parts.length > 0 ? ` \u2014 ${parts.join("; ")}` : "") + "\n"
       );
     }
     const timeoutS = this.timeout ? Number.parseInt(this.timeout, 10) : void 0;
@@ -45136,10 +45457,158 @@ function signalNumber(sig) {
 }
 
 // src/commands/init.ts
+init_dist();
 init_http();
-init_tty();
+init_envFile();
+init_heuristics();
 init_init();
 init_cancel();
+init_tty();
+
+// src/commands/project.ts
+init_http();
+init_format();
+function isProjectId(input) {
+  return input.startsWith("p_") || /^[a-f0-9]{20,}$/i.test(input);
+}
+async function resolveProjectId(client, input) {
+  if (isProjectId(input)) {
+    return input;
+  }
+  const data = await client.request("/v1/projects");
+  const match = data.projects.find((p2) => p2.name === input);
+  if (!match) throw new Error(`project not found: ${input}`);
+  return match.id;
+}
+var ProjectListCommand = class extends Command {
+  static paths = [["project", "list"]];
+  static usage = Command.Usage({
+    description: "List projects visible to the current user."
+  });
+  json = options_exports.Boolean("--json", false);
+  async execute() {
+    try {
+      const client = new ApiClient();
+      const data = await client.request("/v1/projects");
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+        return 0;
+      }
+      if (data.projects.length === 0) {
+        this.context.stdout.write("no projects\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["name", "id", "created_at"],
+          data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
+        )}
+`
+      );
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
+  }
+};
+var ProjectCreateCommand = class extends Command {
+  static paths = [["project", "create"]];
+  static usage = Command.Usage({
+    description: "Create a new project with one or more environments.",
+    examples: [["Two envs", "$0 project create billing --env dev --env prod:production:approval"]]
+  });
+  name = options_exports.String();
+  envs = options_exports.Array("--env", {
+    description: 'Environment spec: name[:tier[:approval]]. Tier \u2208 {production,non-production}; "approval" sets require_approval=true.'
+  });
+  async execute() {
+    try {
+      const envs = (this.envs ?? ["dev"]).map((spec) => {
+        const [name, tier, approval] = spec.split(":");
+        return {
+          name: name ?? "",
+          tier: tier ?? "non-production",
+          require_approval: approval === "approval"
+        };
+      });
+      const client = new ApiClient();
+      const result = await client.request("/v1/projects", {
+        method: "POST",
+        body: { name: this.name, environments: envs }
+      });
+      this.context.stdout.write(`created project ${result.name} (${result.id})
+`);
+      for (const e2 of envs) {
+        this.context.stdout.write(
+          `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+`
+        );
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
+  }
+};
+var ProjectDescribeCommand = class extends Command {
+  static paths = [["project", "describe"]];
+  static usage = Command.Usage({
+    description: "Show metadata for one project.",
+    examples: [
+      ["By ID", "$0 project describe p_go6rqgwz0wlokdsl55ikn"],
+      ["By name", "$0 project describe myproject"]
+    ]
+  });
+  id = options_exports.String();
+  json = options_exports.Boolean("--json", false);
+  async execute() {
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.id);
+      const data = await client.request(`/v1/projects/${projectId2}`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+        return 0;
+      }
+      this.context.stdout.write(`project: ${data.name} (${data.id})
+`);
+      for (const e2 of data.environments) {
+        this.context.stdout.write(
+          `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+`
+        );
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
+  }
+};
+var ProjectDeleteCommand = class extends Command {
+  static paths = [["project", "delete"]];
+  static usage = Command.Usage({ description: "Soft-delete a project." });
+  id = options_exports.String();
+  force = options_exports.Boolean("--force", false);
+  async execute() {
+    if (!this.force) {
+      this.context.stderr.write("keynv: refusing to delete without --force\n");
+      return 2;
+    }
+    try {
+      const client = new ApiClient();
+      await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
+      this.context.stdout.write(`deleted project ${this.id}
+`);
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
+  }
+};
+
+// src/commands/init.ts
 var InitCommand = class extends Command {
   static paths = [["init"]];
   static usage = Command.Usage({
@@ -45153,6 +45622,11 @@ package.json scripts with \`keynv exec\`.
 Safe to re-run: existing .keynv.env entries are preserved; new
 entries are appended below a marker.
 
+--dry-run prints the secrets that would be uploaded and the alias
+mappings that would be written to .keynv.env, then exits without
+touching any files or making any network calls. Use it to preview
+what init will do before committing.
+
 Requires an interactive terminal (clack TUI). For scripted
 migration, use the lower-level \`keynv project\` and \`keynv secret\`
 commands directly.
@@ -45160,28 +45634,47 @@ commands directly.
     examples: [
       ["Walk the current project", "$0 init"],
       ["Preview without writing or uploading", "$0 init --dry-run"],
-      ["Skip the package.json script-wrapping step", "$0 init --no-scripts"]
+      ["Skip the package.json script-wrapping step", "$0 init --no-scripts"],
+      ["Non-interactive (CI/CD)", "$0 init --env-file .env --project myproject --env dev"]
     ]
   });
   dryRun = options_exports.Boolean("--dry-run", false, {
-    description: "Show what would be done without writing files or uploading secrets."
+    description: "Scan .env files and print the secrets that would be uploaded and the alias mappings that would be written \u2014 no files written, no vault calls made."
   });
   noScripts = options_exports.Boolean("--no-scripts", false, {
     description: "Skip the package.json script-wrapping step."
   });
+  envFile = options_exports.String("--env-file", {
+    description: "Path to .env file to migrate (non-interactive mode)."
+  });
+  project = options_exports.String("--project", {
+    description: "Project name or ID (non-interactive mode)."
+  });
+  env = options_exports.String("--env", {
+    description: "Environment name for --env-file (default: dev)."
+  });
+  secret = options_exports.Array("--secret", {
+    description: "KEY=value secret to upload (non-interactive). Can be specified multiple times."
+  });
   async execute() {
-    if (!isInteractive()) {
-      this.context.stderr.write(
-        "keynv init requires an interactive terminal. Use the lower-level commands (`keynv project`, `keynv secret`) for scripted setup.\n"
-      );
-      return 1;
-    }
     const client = new ApiClient();
     await client.ensureHydrated();
     if (!client.isLoggedIn) {
       this.context.stderr.write("keynv: not logged in. Run `keynv login` first.\n");
       return 1;
     }
+    const hasEnvFile = this.envFile != null;
+    const hasSecrets = this.secret != null && this.secret.length > 0;
+    const isNonInteractive = hasEnvFile || hasSecrets;
+    if (isNonInteractive) {
+      return this.runNonInteractive(client);
+    }
+    if (!isInteractive()) {
+      this.context.stderr.write(
+        "keynv init requires an interactive terminal. Use --env-file or --secret for scripted setup.\n"
+      );
+      return 1;
+    }
     try {
       const outcome = await runInitFlow(client, {
         cwd: process.cwd(),
@@ -45197,9 +45690,102 @@ commands directly.
       return 1;
     }
   }
+  async runNonInteractive(client) {
+    const projectName = this.project;
+    if (!projectName) {
+      this.context.stderr.write("keynv: --project is required in non-interactive mode.\n");
+      return 1;
+    }
+    const resolved = await resolveProjectId(client, projectName);
+    if (!resolved) {
+      this.context.stderr.write(`keynv: project not found: ${projectName}
+`);
+      return 1;
+    }
+    const projectId2 = resolved;
+    const envName = this.env ?? "dev";
+    const secrets = [];
+    if (this.envFile) {
+      try {
+        const content = readFileSync(this.envFile, "utf8");
+        const entries = parseEnvFile(content, this.envFile);
+        for (const e2 of entries) {
+          if (classifyEntry(e2.name, e2.value).verdict === "secret") {
+            secrets.push({ name: e2.name, value: e2.value });
+          }
+        }
+      } catch (err) {
+        this.context.stderr.write(
+          `keynv: cannot read ${this.envFile}: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+        return 1;
+      }
+    }
+    if (this.secret) {
+      for (const spec of this.secret) {
+        const eq = spec.indexOf("=");
+        if (eq <= 0) {
+          this.context.stderr.write(`keynv: invalid --secret '${spec}', expected KEY=value
+`);
+          return 1;
+        }
+        const name = spec.slice(0, eq);
+        const value = spec.slice(eq + 1);
+        secrets.push({ name, value });
+      }
+    }
+    if (secrets.length === 0) {
+      this.context.stdout.write("keynv: nothing to migrate.\n");
+      return 0;
+    }
+    if (this.dryRun) {
+      this.context.stdout.write(
+        `keynv: dry-run \u2014 would upload ${secrets.length} secret(s) to project ${projectName} (${projectId2}) in env ${envName}
+`
+      );
+      for (const { name } of secrets) {
+        const aliasKey = name.toLowerCase().replace(/_/g, "-");
+        this.context.stdout.write(`  ${name}=@${projectName}.${envName}.${aliasKey}
+`);
+      }
+      return 0;
+    }
+    let uploaded = 0;
+    const failed = [];
+    for (const { name, value } of secrets) {
+      const aliasKey = name.toLowerCase().replace(/_/g, "-");
+      const alias2 = buildAlias({ project: projectName, environment: envName, key: aliasKey });
+      if (!alias2) {
+        failed.push(`${name} (invalid alias key: ${aliasKey})`);
+        continue;
+      }
+      try {
+        await client.request(`/v1/projects/${projectId2}/secrets`, {
+          method: "POST",
+          body: { env: envName, key: aliasKey, value }
+        });
+        uploaded++;
+      } catch (err) {
+        failed.push(`${name}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    this.context.stdout.write(
+      `keynv: uploaded ${uploaded}/${secrets.length} secret(s) to ${projectName}.${envName}
+`
+    );
+    if (failed.length > 0) {
+      for (const f of failed) this.context.stderr.write(`  failed: ${f}
+`);
+      return 1;
+    }
+    return 0;
+  }
 };
 
 // src/commands/login.ts
+init_browser_auth();
+init_defaults();
 init_http();
 init_store();
 init_format();
@@ -45260,25 +45846,63 @@ var LoginCommand = class extends Command {
   static usage = Command.Usage({
     description: "Authenticate against a keynv server.",
     examples: [
-      ["Interactive", "$0 login --server http://localhost:8080"],
+      ["Browser login", "$0 login"],
+      ["Self-hosted browser login", "$0 login --server http://localhost:8080"],
+      ["Headless token login", "$0 login --server http://... --token kt_..."],
       ["Non-interactive", "$0 login --server http://... --email a@b.com --password ..."]
     ]
   });
   server = options_exports.String("--server", { description: "Server base URL." });
+  token = options_exports.String("--token", { description: "CLI token for headless auth." });
   email = options_exports.String("--email", { description: "Email address." });
   password = options_exports.String("--password", {
     description: "Password (use stdin to avoid argv leak)."
   });
   async execute() {
-    const serverUrl = this.server ?? await promptLine("server URL [http://localhost:8080]: ") ?? "";
-    const finalServerUrl = serverUrl.length > 0 ? serverUrl : "http://localhost:8080";
+    const finalServerUrl = this.server ?? DEFAULT_SERVER_URL;
+    try {
+      new URL(finalServerUrl);
+    } catch {
+      this.context.stderr.write(`keynv: invalid server URL '${finalServerUrl}'
+`);
+      return 1;
+    }
+    if (this.token) {
+      return this.loginWithToken(finalServerUrl, this.token);
+    }
+    if (!this.email && !this.password) {
+      this.context.stdout.write(`Opening browser for ${finalServerUrl} ...
+`);
+      try {
+        const creds = await runBrowserAuth(finalServerUrl);
+        await saveCredentials(creds);
+        this.context.stdout.write(`logged in as ${creds.email} (${creds.org_role})
+`);
+        return 0;
+      } catch (err) {
+        this.context.stderr.write(
+          `keynv: ${err instanceof Error ? err.message : "browser login failed"}
+`
+        );
+        return 1;
+      }
+    }
     const email2 = this.email ?? await promptLine("email: ");
     const password = this.password ?? await promptHidden("password: ");
-    const res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
-      body: JSON.stringify({ email: email2, password })
-    });
+    let res;
+    try {
+      res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+        body: JSON.stringify({ email: email2, password })
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: cannot reach server '${finalServerUrl}' \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
     if (!res.ok) {
       const text = await res.text();
       let msg = `login failed (${res.status})`;
@@ -45302,6 +45926,7 @@ var LoginCommand = class extends Command {
     const data = await res.json();
     try {
       await saveCredentials({
+        auth_kind: "session",
         server_url: finalServerUrl,
         user_id: data.user.id,
         email: data.user.email,
@@ -45319,6 +45944,63 @@ var LoginCommand = class extends Command {
       return 1;
     }
     this.context.stdout.write(`logged in as ${data.user.email} (${data.user.org_role})
+`);
+    return 0;
+  }
+  async loginWithToken(serverUrl, token) {
+    let res;
+    try {
+      res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
+        headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: cannot reach server '${serverUrl}' \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
+    if (!res.ok) {
+      const text = await res.text();
+      let msg = `token login failed (${res.status})`;
+      try {
+        const parsed = JSON.parse(text);
+        msg = parsed.error?.message ?? msg;
+        this.context.stderr.write(
+          `${fmtError({
+            status: res.status,
+            ...parsed.error?.code ? { code: parsed.error.code } : {},
+            message: msg
+          })}
+`
+        );
+      } catch {
+        this.context.stderr.write(`keynv: ${msg}
+`);
+      }
+      return 1;
+    }
+    const data = await res.json();
+    try {
+      await saveCredentials({
+        auth_kind: "cli_token",
+        server_url: serverUrl,
+        user_id: data.id,
+        email: data.email,
+        org_id: data.org_id,
+        org_role: data.org_role,
+        access_token: token,
+        refresh_token: "",
+        access_expires_at: "9999-12-31T23:59:59.999Z"
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: failed to persist credentials: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
+    this.context.stdout.write(`logged in as ${data.email} (${data.org_role})
 `);
     return 0;
   }
@@ -45355,48 +46037,46 @@ var WhoamiCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    if (!client.isLoggedIn) {
-      this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
-      return 1;
-    }
-    const data = await client.request("/v1/whoami");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      if (!client.isLoggedIn) {
+        this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
+        return 1;
+      }
+      const data = await client.request("/v1/whoami");
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    this.context.stdout.write(`user:    ${data.email} (${data.id})
+        return 0;
+      }
+      this.context.stdout.write(`user:    ${data.email} (${data.id})
 `);
-    this.context.stdout.write(`org:     ${data.org_id}
+      const orgDisplay = data.org_name ? `${data.org_name} (${data.org_id})` : data.org_id;
+      this.context.stdout.write(`org:     ${orgDisplay}
 `);
-    this.context.stdout.write(`role:    ${data.org_role}
+      this.context.stdout.write(`role:    ${data.org_role}
 `);
-    if (data.memberships.length === 0) {
-      this.context.stdout.write("memberships: (none)\n");
-    } else {
-      this.context.stdout.write("memberships:\n");
-      for (const m of data.memberships) {
-        this.context.stdout.write(`  ${m.project_id}: ${m.role}
+      if (data.memberships.length === 0) {
+        this.context.stdout.write("memberships: (none)\n");
+      } else {
+        this.context.stdout.write("memberships:\n");
+        for (const m of data.memberships) {
+          const proj = m.project_name ? `${m.project_name} (${m.project_id})` : m.project_id;
+          this.context.stdout.write(`  ${proj}: ${m.role}
 `);
+        }
       }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 
 // src/commands/member.ts
 init_http();
 init_format();
-async function findProjectIdByName(client, name) {
-  const data = await client.request(
-    "/v1/projects"
-  );
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
 var MemberAddCommand = class extends Command {
   static paths = [["member", "add"]];
   static usage = Command.Usage({
@@ -45412,15 +46092,19 @@ var MemberAddCommand = class extends Command {
       this.context.stderr.write("keynv: --role must be one of lead, developer, reader\n");
       return 1;
     }
-    const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
-    await client.request(`/v1/projects/${projectId2}/members`, {
-      method: "POST",
-      body: { email: this.email, role: role2 }
-    });
-    this.context.stdout.write(`added ${this.email} to ${this.project} as ${role2}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      await client.request(`/v1/projects/${projectId2}/members`, {
+        method: "POST",
+        body: { email: this.email, role: role2 }
+      });
+      this.context.stdout.write(`added ${this.email} to ${this.project} as ${role2}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var MemberRemoveCommand = class extends Command {
@@ -45429,21 +46113,25 @@ var MemberRemoveCommand = class extends Command {
   project = options_exports.String();
   email = options_exports.String();
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
-    const members = await client.request(`/v1/projects/${projectId2}/members`);
-    const target = members.members.find((m) => m.email === this.email);
-    if (!target) {
-      this.context.stderr.write(`keynv: ${this.email} is not a member of ${this.project}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      const members = await client.request(`/v1/projects/${projectId2}/members`);
+      const target = members.members.find((m) => m.email === this.email);
+      if (!target) {
+        this.context.stderr.write(`keynv: ${this.email} is not a member of ${this.project}
 `);
-      return 1;
-    }
-    await client.request(`/v1/projects/${projectId2}/members/${target.user_id}`, {
-      method: "DELETE"
-    });
-    this.context.stdout.write(`removed ${this.email} from ${this.project}
+        return 1;
+      }
+      await client.request(`/v1/projects/${projectId2}/members/${target.user_id}`, {
+        method: "DELETE"
+      });
+      this.context.stdout.write(`removed ${this.email} from ${this.project}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var MemberListCommand = class extends Command {
@@ -45452,134 +46140,30 @@ var MemberListCommand = class extends Command {
   project = options_exports.String();
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
-    const data = await client.request(`/v1/projects/${projectId2}/members`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
-`);
-      return 0;
-    }
-    if (data.members.length === 0) {
-      this.context.stdout.write("no members\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["email", "role", "granted_at"],
-        data.members.map((m) => [m.email, m.role, m.granted_at])
-      )}
-`
-    );
-    return 0;
-  }
-};
-
-// src/commands/project.ts
-init_http();
-init_format();
-var ProjectListCommand = class extends Command {
-  static paths = [["project", "list"]];
-  static usage = Command.Usage({
-    description: "List projects visible to the current user."
-  });
-  json = options_exports.Boolean("--json", false);
-  async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/projects");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
-`);
-      return 0;
-    }
-    if (data.projects.length === 0) {
-      this.context.stdout.write("no projects\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["name", "id", "created_at"],
-        data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
-      )}
-`
-    );
-    return 0;
-  }
-};
-var ProjectCreateCommand = class extends Command {
-  static paths = [["project", "create"]];
-  static usage = Command.Usage({
-    description: "Create a new project with one or more environments.",
-    examples: [["Two envs", "$0 project create billing --env dev --env prod:production:approval"]]
-  });
-  name = options_exports.String();
-  envs = options_exports.Array("--env", {
-    description: 'Environment spec: name[:tier[:approval]]. Tier \u2208 {production,non-production}; "approval" sets require_approval=true.'
-  });
-  async execute() {
-    const envs = (this.envs ?? ["dev"]).map((spec) => {
-      const [name, tier, approval] = spec.split(":");
-      return {
-        name: name ?? "",
-        tier: tier ?? "non-production",
-        require_approval: approval === "approval"
-      };
-    });
-    const client = new ApiClient();
-    const result = await client.request("/v1/projects", {
-      method: "POST",
-      body: { name: this.name, environments: envs }
-    });
-    this.context.stdout.write(`created project ${result.name} (${result.id})
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      const data = await client.request(`/v1/projects/${projectId2}/members`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-    for (const e2 of envs) {
+        return 0;
+      }
+      if (data.members.length === 0) {
+        this.context.stdout.write("no members\n");
+        return 0;
+      }
       this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+        `${table(
+          ["email", "role", "granted_at"],
+          data.members.map((m) => [m.email, m.role, m.granted_at])
+        )}
 `
       );
-    }
-    return 0;
-  }
-};
-var ProjectDescribeCommand = class extends Command {
-  static paths = [["project", "describe"]];
-  static usage = Command.Usage({ description: "Show metadata for one project." });
-  id = options_exports.String();
-  json = options_exports.Boolean("--json", false);
-  async execute() {
-    const client = new ApiClient();
-    const data = await client.request(`/v1/projects/${this.id}`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
-`);
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    this.context.stdout.write(`project: ${data.name} (${data.id})
-`);
-    for (const e2 of data.environments) {
-      this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
-`
-      );
-    }
-    return 0;
-  }
-};
-var ProjectDeleteCommand = class extends Command {
-  static paths = [["project", "delete"]];
-  static usage = Command.Usage({ description: "Soft-delete a project." });
-  id = options_exports.String();
-  force = options_exports.Boolean("--force", false);
-  async execute() {
-    if (!this.force) {
-      this.context.stderr.write("keynv: refusing to delete without --force\n");
-      return 2;
-    }
-    const client = new ApiClient();
-    await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
-    this.context.stdout.write(`deleted project ${this.id}
-`);
-    return 0;
   }
 };
 var RedactCommand = class extends Command {
@@ -45624,11 +46208,9 @@ var RedactStreamCommand = class extends Command {
   static usage = Command.Usage({
     description: "Stream stdin through the line-buffered redactor to stdout.",
     details: `
-Used as a hook handler by per-agent integrations (e.g., Claude Code's
-PostToolUse hook): \`keynv redact-stream\` reads its tool output on
-stdin and writes a redacted version on stdout, preserving the original
-line structure. Multi-line patterns are NOT applied here (see the
-streaming-mode limitation in @keynv/redactor).
+Pipe any output through the line-buffered redactor to stdout.
+Preserves original line structure. Multi-line patterns are NOT applied
+here (see the streaming-mode limitation in the redactor package).
 `
   });
   async execute() {
@@ -45643,18 +46225,13 @@ streaming-mode limitation in @keynv/redactor).
 // src/commands/secret.ts
 init_dist();
 init_http();
+init_secret();
 init_format();
-init_tty();
 init_cancel();
 init_pickProject();
 init_pickSecret();
-init_secret();
-async function findProjectIdByName2(client, name) {
-  const data = await client.request("/v1/projects");
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
+init_tty();
+var ALIAS_FORMAT_HINT = "Format: @<project>.<env>.<KEY>  (project/env: lowercase kebab-case; key: letters, digits, _ or -)";
 function missingAlias(stderr) {
   stderr.write("keynv: missing <alias> (TTY required for interactive prompt).\n");
   return 1;
@@ -45685,45 +46262,50 @@ var SecretCreateCommand = class extends Command {
   });
   stdin = options_exports.Boolean("--stdin", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    let value = this.value;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        const built = await promptNewSecret(client);
-        if (!built) return 1;
-        alias2 = built.alias;
-        value = built.value;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      let value = this.value;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          const built = await promptNewSecret(client);
+          if (!built) return 1;
+          alias2 = built.alias;
+          value = built.value;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
       }
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'. Expected @project.env.key.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    if (this.stdin) {
-      const chunks = [];
-      for await (const chunk of this.context.stdin) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        return 1;
       }
-      value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-    } else if (value === void 0) {
-      value = await promptHidden("value: ");
-    }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
-    await client.request(`/v1/projects/${projectId2}/secrets`, {
-      method: "POST",
-      body: { env: parsed.environment, key: parsed.key, value }
-    });
-    this.context.stdout.write(`created ${parsed.literal}
+      if (this.stdin) {
+        const chunks = [];
+        for await (const chunk of this.context.stdin) {
+          chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+      } else if (value === void 0) {
+        value = await promptHidden("value: ");
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      await client.request(`/v1/projects/${projectId2}/secrets`, {
+        method: "POST",
+        body: { env: parsed.environment, key: parsed.key, value }
+      });
+      this.context.stdout.write(`created ${parsed.literal}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var SecretGetCommand = class extends Command {
@@ -45734,39 +46316,44 @@ var SecretGetCommand = class extends Command {
   alias = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
-    const data = await client.request(
-      `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
-    );
-    if (this.json) {
-      this.context.stdout.write(
-        `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
-`
+        return 1;
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      const data = await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
       );
-    } else {
-      this.context.stdout.write(`${data.value}
+      if (this.json) {
+        this.context.stdout.write(
+          `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
+`
+        );
+      } else {
+        this.context.stdout.write(`${data.value}
 `);
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var SecretListCommand = class extends Command {
@@ -45777,42 +46364,47 @@ var SecretListCommand = class extends Command {
   project = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let projectName = this.project;
-    if (!projectName) {
-      if (!isInteractive()) {
-        this.context.stderr.write("keynv: missing <project>.\n");
-        return 1;
-      }
-      try {
-        const picked = await pickProject(client, "Project");
-        if (!picked) return 1;
-        projectName = picked.name;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let projectName = this.project;
+      if (!projectName) {
+        if (!isInteractive()) {
+          this.context.stderr.write("keynv: missing <project>.\n");
+          return 1;
+        }
+        try {
+          const picked = await pickProject(client, "Project");
+          if (!picked) return 1;
+          projectName = picked.name;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
       }
-    }
-    const projectId2 = await findProjectIdByName2(client, projectName);
-    const data = await client.request(`/v1/projects/${projectId2}/secrets`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+      const resolvedProjectName = projectName.startsWith("@") ? projectName.slice(1).split(".")[0] ?? projectName : projectName;
+      const projectId2 = await resolveProjectId(client, resolvedProjectName);
+      const data = await client.request(`/v1/projects/${projectId2}/secrets`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
+        return 0;
+      }
+      if (data.secrets.length === 0) {
+        this.context.stdout.write("no secrets\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["alias", "version", "created_at"],
+          data.secrets.map((s) => [s.alias, String(s.version), s.created_at])
+        )}
+`
+      );
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    if (data.secrets.length === 0) {
-      this.context.stdout.write("no secrets\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["alias", "version", "created_at"],
-        data.secrets.map((s) => [s.alias, String(s.version), s.created_at])
-      )}
-`
-    );
-    return 0;
   }
 };
 var SecretRotateCommand = class extends Command {
@@ -45822,45 +46414,50 @@ var SecretRotateCommand = class extends Command {
   value = options_exports.String("--value");
   stdin = options_exports.Boolean("--stdin", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    let value;
-    if (this.stdin) {
-      const chunks = [];
-      for await (const chunk of this.context.stdin) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        return 1;
       }
-      value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-    } else if (this.value !== void 0) {
-      value = this.value;
-    } else {
-      value = await promptHidden("new value: ");
-    }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
-    const data = await client.request(
-      `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
-      { method: "POST", body: { new_value: value } }
-    );
-    this.context.stdout.write(`rotated ${data.alias} \u2192 v${data.version}
+      let value;
+      if (this.stdin) {
+        const chunks = [];
+        for await (const chunk of this.context.stdin) {
+          chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+      } else if (this.value !== void 0) {
+        value = this.value;
+      } else {
+        value = await promptHidden("new value: ");
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      const data = await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
+        { method: "POST", body: { new_value: value } }
+      );
+      this.context.stdout.write(`rotated ${data.alias} \u2192 v${data.version}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var SecretDeleteCommand = class extends Command {
@@ -45868,31 +46465,170 @@ var SecretDeleteCommand = class extends Command {
   static usage = Command.Usage({ description: "Soft-delete a secret." });
   alias = options_exports.String({ required: false });
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
+        return 1;
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
+        method: "DELETE"
+      });
+      this.context.stdout.write(`deleted ${parsed.literal}
+`);
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
-    await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
-      method: "DELETE"
-    });
-    this.context.stdout.write(`deleted ${parsed.literal}
+  }
+};
+function generateSecret(bytes = 32) {
+  return randomBytes(bytes).toString("base64");
+}
+var ServerInitCommand = class extends Command {
+  static paths = [["server", "init"]];
+  static usage = Command.Usage({
+    description: "Generate secrets and deployment files for a new keynv server.",
+    details: `
+Interactive onboarding wizard that generates the configuration
+a fresh keynv server needs: JWT signing secret, master encryption
+key, and deployment templates.
+
+Outputs:
+  \u2022 A .keynv-server.env file you feed into your deployment
+    (Docker Compose, Coolify, or bare-metal).
+  \u2022 Optionally a docker-compose.yml in the current directory.
+
+Non-interactive with --yes to skip prompts.
+`,
+    examples: [
+      ["Interactive wizard", "$0 server init"],
+      ["Non-interactive (CI/scripts)", "$0 server init --yes"],
+      ["Docker Compose output", "$0 server init --compose"],
+      ["Custom output path", "$0 server init --out ./config/env"]
+    ]
+  });
+  yes = options_exports.Boolean("--yes", false, {
+    description: "Skip all prompts (non-interactive)."
+  });
+  compose = options_exports.Boolean("--compose", false, {
+    description: "Also write a docker-compose.yml to the current directory."
+  });
+  out = options_exports.String("--out", {
+    description: "Write server env file to this path (default: .keynv-server.env)."
+  });
+  async execute() {
+    const jwtSecret = generateSecret(48);
+    const masterKey = generateSecret(32);
+    const webSessionSecret = generateSecret(48);
+    const outPath = this.out ?? ".keynv-server.env";
+    const contents = [
+      "# Generated by `keynv server init`.",
+      "# Keep this file secret \u2014 it contains cryptographic key material.",
+      `KEYNV_JWT_SECRET=${jwtSecret}`,
+      `KEYNV_MASTER_KEY=${masterKey}`,
+      "",
+      "# Web dashboard session secret (required for Next.js JWE session tokens).",
+      `KEYNV_WEB_SESSION_SECRET=${webSessionSecret}`,
+      "",
+      "# Server configuration (uncomment and adjust):",
+      "# KEYNV_PORT=8080",
+      "# KEYNV_WEB_URL=https://keynv.example.com",
+      "# KEYNV_PUBLIC_REGISTRATION=false",
+      "# KEYNV_DB_PATH=./keynv.db",
+      "# KEYNV_MASTER_KEY_FILE=./master.key",
+      "# KEYNV_RATE_LIMIT_PER_MINUTE=120",
+      "# KEYNV_ARGON2_MEMORY_KIB=46080",
+      "# KEYNV_ARGON2_TIME_COST=3"
+    ].join("\n");
+    const { writeFileSync: writeFileSync4 } = await import('fs');
+    writeFileSync4(outPath, `${contents}
 `);
+    this.context.stdout.write(`Wrote ${outPath}
+
+`);
+    this.context.stdout.write("Generated secrets:\n");
+    this.context.stdout.write(
+      `  KEYNV_JWT_SECRET         ${jwtSecret.slice(0, 8)}... (base64, 48 bytes)
+`
+    );
+    this.context.stdout.write(
+      `  KEYNV_MASTER_KEY         ${masterKey.slice(0, 8)}... (base64, 32 bytes)
+`
+    );
+    this.context.stdout.write(
+      `  KEYNV_WEB_SESSION_SECRET ${webSessionSecret.slice(0, 8)}... (base64, 48 bytes)
+`
+    );
+    this.context.stdout.write("\nNext steps:\n");
+    this.context.stdout.write(`  1. Feed ${outPath} into your deployment:
+`);
+    this.context.stdout.write("     docker compose --env-file .keynv-server.env up -d\n");
+    this.context.stdout.write("     or load it into Coolify as environment variables.\n");
+    this.context.stdout.write("  2. Bootstrap the first owner:\n");
+    this.context.stdout.write(
+      "     docker exec -it <server-container> node dist/bootstrap.js \\\n"
+    );
+    this.context.stdout.write("       --owner-email alice@example.com \\\n");
+    this.context.stdout.write('       --owner-password "<a long random password>" \\\n');
+    this.context.stdout.write('       --org-name "Acme Inc"\n');
+    this.context.stdout.write("  3. Install the CLI and log in:\n");
+    this.context.stdout.write("     npm install -g @keynv/cli\n");
+    this.context.stdout.write("     keynv login --server https://keynv.example.com\n");
+    this.context.stdout.write("  4. Onboard your first project:\n");
+    this.context.stdout.write("     cd your-project && keynv init\n");
+    if (this.compose) {
+      const composeContent = `# keynv server + Litestream sidecar
+# Generated by \`keynv server init\`.
+# Load with: docker compose --env-file .keynv-server.env up -d
+
+services:
+  server:
+    image: ghcr.io/keynv-labs/keynv-server:latest
+    restart: unless-stopped
+    ports:
+      - '8080:8080'
+    env_file:
+      - .keynv-server.env
+    volumes:
+      - keynv-data:/data
+
+  litestream:
+    image: litestream/litestream:latest
+    restart: unless-stopped
+    volumes:
+      - keynv-data:/data
+    command: replicate
+    environment:
+      LITESTREAM_DB_PATH: /data/keynv.db
+      LITESTREAM_REPLICA_URL: s3://your-bucket/keynv
+      AWS_ACCESS_KEY_ID: \${LITESTREAM_AWS_ACCESS_KEY_ID}
+      AWS_SECRET_ACCESS_KEY: \${LITESTREAM_AWS_SECRET_ACCESS_KEY}
+
+volumes:
+  keynv-data:
+`;
+      writeFileSync4("docker-compose.yml", composeContent);
+      this.context.stdout.write(
+        "\nWrote docker-compose.yml (update Litestream S3 config before deploying).\n"
+      );
+    }
     return 0;
   }
 };
@@ -46248,18 +46984,9 @@ var TESTERS = [
   sshTester,
   httpTester
 ];
-function findTester(type) {
-  return TESTERS.find((t) => t.type === type) ?? null;
-}
 
 // src/commands/test.ts
 init_http();
-async function findProjectIdByName3(client, name) {
-  const data = await client.request("/v1/projects");
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
 function parseTargets(specs) {
   const out = {};
   for (const spec of specs) {
@@ -46313,12 +47040,17 @@ the error message.
       );
       return 2;
     }
-    const tester = findTester(this.as);
+    const tester = TESTERS.find((t) => t.type === this.as);
     if (!tester) {
       this.context.stderr.write(`keynv: unknown tester '${this.as}'
 `);
       return 1;
     }
+    const timeoutMs = this.timeout ? Number.parseInt(this.timeout, 10) * 1e3 : void 0;
+    if (this.timeout && (timeoutMs === void 0 || Number.isNaN(timeoutMs))) {
+      this.context.stderr.write("keynv: invalid --timeout (expected integer seconds)\n");
+      return 2;
+    }
     let target;
     try {
       target = parseTargets(this.targets ?? []);
@@ -46335,7 +47067,7 @@ the error message.
     }
     let value;
     try {
-      const projectId2 = await findProjectIdByName3(client, parsedAlias.project);
+      const projectId2 = await resolveProjectId(client, parsedAlias.project);
       const data = await client.request(
         `/v1/projects/${projectId2}/secrets/${parsedAlias.environment}/${parsedAlias.key}`
       );
@@ -46346,11 +47078,6 @@ the error message.
 `);
       return 1;
     }
-    const timeoutMs = this.timeout ? Number.parseInt(this.timeout, 10) * 1e3 : void 0;
-    if (this.timeout && (timeoutMs === void 0 || Number.isNaN(timeoutMs))) {
-      this.context.stderr.write("keynv: invalid --timeout (expected integer seconds)\n");
-      return 2;
-    }
     const result = await runTest({
       tester,
       secret: { alias: parsedAlias.literal, value },
@@ -46392,25 +47119,6 @@ the error message.
   }
 };
 
-// src/commands/ui.ts
-init_menu();
-init_tty();
-var UICommand = class extends Command {
-  static paths = [["ui"]];
-  static usage = Command.Usage({
-    description: "Open the interactive menu (also runs by default when no args are given)."
-  });
-  async execute() {
-    if (!isInteractive()) {
-      this.context.stdout.write(
-        "keynv \u2014 AI-safe secrets management.\nRun `keynv --help` for the full command list, or run `keynv` in an interactive\nterminal to open the menu.\n"
-      );
-      return 0;
-    }
-    return runMenu();
-  }
-};
-
 // src/index.ts
 init_format();
 init_version();
@@ -46444,7 +47152,7 @@ cli.register(InitCommand);
 cli.register(RedactCommand);
 cli.register(RedactStreamCommand);
 cli.register(TestCommand);
-cli.register(UICommand);
+cli.register(ServerInitCommand);
 var argv = process.argv.slice(2);
 if (argv.length === 0) {
   const { runMenu: runMenu2 } = await Promise.resolve().then(() => (init_menu(), menu_exports));