clerk init writes keys to the wrong env file in Vite-family projects #581

clerk init writes keys to an env file chosen in Next.js's load order, whatever the framework. In Vite-family projects (React Router, Astro, Vue, and others), that can be a file the app reads after another one, so the app runs on stale keys. It can also be a file the project commits.

Example. A React Router project has .env.local and a committed .env.development that sets another app's publishable key. clerk init links app X and writes X's keys to .env.local. Vite loads .env.development before .env.local, so the app runs on the old publishable key with X's secret key.

Cause. findExistingEnvFile in lib/dotenv.ts returns the first file that exists from .env.development.local, .env.local, .env.development, .env. That is Next.js's order. Vite reads .env.development before .env.local.

Related case. In a Vite project that has only .env.development and .env, clerk init writes the secret key into .env.development, a file Vite projects usually commit.

Proposed change

Have clerk init choose its file with the same rule clerk env pull uses after #577. That rule follows each framework's load order and writes a .local file when a file read earlier may still set a Clerk key. Today init passes its own file to pull, which skips that rule, so the two commands can write keys to different files in the same project.

Drafted by Claude, reviewed by Shane