@dotenc/cli 0.6.0 → 0.7.0

package/dist/cli.js

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@dotenc/cli",
-    version: "0.6.0",
+    version: "0.7.0",
     description: "🔐 Git-native encrypted environments powered by your SSH keys",
     author: "Ivan Filho <i@ivanfilho.com>",
     license: "MIT",
@@ -901,11 +901,32 @@ var init_encryptEnvironment = __esm(() => {
   init_getPublicKeys();
 });
 
+// src/helpers/validateKeyName.ts
+var validateKeyName = (name) => {
+  if (!name) {
+    return { valid: false, reason: "Key name must not be empty." };
+  }
+  if (name === "." || name === "..") {
+    return { valid: false, reason: `Invalid key name "${name}".` };
+  }
+  if (!/^[a-zA-Z0-9._-]+$/.test(name)) {
+    return {
+      valid: false,
+      reason: `Invalid key name "${name}". Only letters, numbers, dots, hyphens, and underscores are allowed.`
+    };
+  }
+  return { valid: true };
+};
+
 // src/helpers/getPublicKeyByName.ts
 import crypto8 from "node:crypto";
 import fs5 from "node:fs/promises";
 import path5 from "node:path";
 var getPublicKeyByName = async (name) => {
+  const keyNameValidation = validateKeyName(name);
+  if (!keyNameValidation.valid) {
+    throw new Error(keyNameValidation.reason);
+  }
   const filePath = path5.join(process.cwd(), ".dotenc", `${name}.pub`);
   let publicKeyInput;
   try {
@@ -949,12 +970,16 @@ var init_getEnvironments = () => {};
 
 // src/prompts/chooseEnvironment.ts
 import inquirer from "inquirer";
-var chooseEnvironmentPrompt = async (message) => {
-  const environments = await getEnvironments();
+var defaultDeps, _runChooseEnvironmentPrompt = async (message, depsOverrides = {}) => {
+  const deps = {
+    ...defaultDeps,
+    ...depsOverrides
+  };
+  const environments = await deps.getEnvironments();
   if (!environments.length) {
-    console.log('No environment files found. To create a new environment, run "dotenc env create"');
+    deps.logInfo('No environment files found. To create a new environment, run "dotenc env create"');
   }
-  const result = await inquirer.prompt([
+  const result = await deps.prompt([
     {
       type: "list",
       name: "environment",
@@ -963,25 +988,42 @@ var chooseEnvironmentPrompt = async (message) => {
     }
   ]);
   return result.environment;
+}, chooseEnvironmentPrompt = async (message) => {
+  return _runChooseEnvironmentPrompt(message);
 };
 var init_chooseEnvironment = __esm(() => {
   init_getEnvironments();
+  defaultDeps = {
+    getEnvironments,
+    prompt: inquirer.prompt,
+    logInfo: (message) => console.log(message)
+  };
 });
 
 // src/prompts/choosePublicKey.ts
 import inquirer2 from "inquirer";
 async function _runChoosePublicKeyPrompt(message, multiple, depsOverrides = {}) {
   const deps = {
-    ...defaultDeps,
+    ...defaultDeps2,
     ...depsOverrides
   };
   const publicKeys = await deps.getPublicKeys();
-  const result = await deps.prompt([
+  const prompt = deps.prompt;
+  const result = await prompt([
     {
       type: multiple ? "checkbox" : "list",
       name: "key",
       message,
-      choices: publicKeys.map((key) => key.name.replace(".pub", ""))
+      choices: publicKeys.map((key) => key.name.replace(".pub", "")),
+      validate: (input) => {
+        if (!multiple) {
+          return true;
+        }
+        if (Array.isArray(input) && input.length > 0) {
+          return true;
+        }
+        return "Select at least one public key.";
+      }
     }
   ]);
   if (multiple) {
@@ -998,10 +1040,10 @@ async function choosePublicKeyPrompt(message, multiple) {
   }
   return _runChoosePublicKeyPrompt(message, false);
 }
-var defaultDeps;
+var defaultDeps2;
 var init_choosePublicKey = __esm(() => {
   init_getPublicKeys();
-  defaultDeps = {
+  defaultDeps2 = {
     prompt: inquirer2.prompt,
     getPublicKeys
   };
@@ -1148,22 +1190,42 @@ var init_homeConfig = __esm(() => {
 });
 
 // src/commands/config.ts
-var configCommand = async (key, value, options) => {
-  const config = await getHomeConfig();
+import chalk7 from "chalk";
+var SUPPORTED_CONFIG_KEYS, defaultDeps3, getSupportedConfigKey = (key) => {
+  if (SUPPORTED_CONFIG_KEYS.includes(key)) {
+    return { valid: true, key };
+  }
+  return { valid: false };
+}, configCommand = async (key, value, options, deps = defaultDeps3) => {
+  const keyValidation = getSupportedConfigKey(key);
+  if (!keyValidation.valid) {
+    deps.logError(`${chalk7.red("Error:")} unsupported config key "${key}". Supported keys: ${SUPPORTED_CONFIG_KEYS.join(", ")}.`);
+    deps.exit(1);
+  }
+  const config = await deps.getHomeConfig();
+  const configKey = keyValidation.key;
   if (options.remove) {
-    delete config[key];
-    await setHomeConfig(config);
+    delete config[configKey];
+    await deps.setHomeConfig(config);
     return;
   }
-  if (value) {
-    config[key] = value;
-    await setHomeConfig(config);
+  if (value !== undefined) {
+    config[configKey] = value;
+    await deps.setHomeConfig(config);
     return;
   }
-  console.log(config[key]);
+  deps.log(config[configKey] ?? "");
 };
 var init_config = __esm(() => {
   init_homeConfig();
+  SUPPORTED_CONFIG_KEYS = ["editor"];
+  defaultDeps3 = {
+    getHomeConfig,
+    setHomeConfig,
+    log: (message) => console.log(message),
+    logError: (message) => console.error(message),
+    exit: (code) => process.exit(code)
+  };
 });
 
 // src/helpers/getCurrentKeyName.ts
@@ -1206,19 +1268,19 @@ var init_parseEnv = __esm(() => {
 
 // src/commands/run.ts
 import { spawn } from "node:child_process";
-import chalk7 from "chalk";
+import chalk8 from "chalk";
 var defaultRunCommandDeps, runCommand = async (command, args, options, _command, deps = defaultRunCommandDeps) => {
   const environmentName = options.env || process.env.DOTENC_ENV;
   if (!environmentName) {
     deps.logError(`No environment provided. Use -e or set DOTENC_ENV to the environment you want to run the command in.
-To start a new environment, use "dotenc init [environment]".`);
+To initialize dotenc, run "dotenc init --name <your-name>". To add environments later, use "dotenc env create <environment>".`);
     deps.exit(1);
   }
   const environments = environmentName.split(",");
   for (const env of environments) {
     const validation = deps.validateEnvironmentName(env);
     if (!validation.valid) {
-      deps.logError(`${chalk7.red("Error:")} ${validation.reason}`);
+      deps.logError(`${chalk8.red("Error:")} ${validation.reason}`);
       deps.exit(1);
     }
   }
@@ -1236,11 +1298,15 @@ To start a new environment, use "dotenc init [environment]".`);
     return decryptedEnv2;
   }));
   if (failureCount === environments.length) {
-    deps.logError(`${chalk7.red("Error:")} All environments failed to load.`);
+    deps.logError(`${chalk8.red("Error:")} All environments failed to load.`);
     deps.exit(1);
   }
   if (failureCount > 0) {
-    deps.logError(`${chalk7.yellow("Warning:")} ${failureCount} of ${environments.length} environment(s) failed to load.`);
+    if (options.strict) {
+      deps.logError(`${chalk8.red("Error:")} ${failureCount} of ${environments.length} environment(s) failed to load and strict mode is enabled.`);
+      deps.exit(1);
+    }
+    deps.logError(`${chalk8.yellow("Warning:")} ${failureCount} of ${environments.length} environment(s) failed to load.`);
   }
   const decryptedEnv = decryptedEnvs.reduce((acc, env) => {
     return { ...acc, ...env };
@@ -1268,7 +1334,7 @@ var init_run = __esm(() => {
 });
 
 // src/commands/dev.ts
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 import inquirer3 from "inquirer";
 var defaultSelect = async (message, choices) => {
   const { selected } = await inquirer3.prompt([
@@ -1283,7 +1349,7 @@ var defaultSelect = async (message, choices) => {
 }, defaultDevCommandDeps, devCommand = async (command, args, deps = defaultDevCommandDeps) => {
   const keyNames = await deps.getCurrentKeyName();
   if (keyNames.length === 0) {
-    deps.logError(`${chalk8.red("Error:")} could not resolve your identity. Run ${chalk8.gray("dotenc init")} first.`);
+    deps.logError(`${chalk9.red("Error:")} could not resolve your identity. Run ${chalk9.gray("dotenc init")} first.`);
     deps.exit(1);
   }
   let keyName;
@@ -1342,12 +1408,12 @@ var init_createEnvironment = () => {};
 // src/commands/env/create.ts
 import fs8 from "node:fs/promises";
 import path8 from "node:path";
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 var _getRunUsageHintForEnvironment = (environmentName) => {
   if (environmentName === "development") {
-    return chalk9.gray("dotenc dev <command> [args...]");
+    return chalk10.gray("dotenc dev <command> [args...]");
   }
-  return `${chalk9.gray(`dotenc run -e ${environmentName} <command> [args...]`)} or ${chalk9.gray(`DOTENC_ENV=${environmentName} dotenc run <command> [args...]`)}`;
+  return `${chalk10.gray(`dotenc run -e ${environmentName} <command> [args...]`)} or ${chalk10.gray(`DOTENC_ENV=${environmentName} dotenc run <command> [args...]`)}`;
 }, _normalizePublicKeyNamesForCreate = (selection) => {
   if (Array.isArray(selection)) {
     return selection;
@@ -1362,25 +1428,29 @@ var _getRunUsageHintForEnvironment = (environmentName) => {
     environmentName = await createEnvironmentPrompt("What should the environment be named?", getEnvironmentNameSuggestion());
   }
   if (!environmentName) {
-    console.error(`${chalk9.red("Error:")} no environment name provided`);
+    console.error(`${chalk10.red("Error:")} no environment name provided`);
     process.exit(1);
   }
   const validation = validateEnvironmentName(environmentName);
   if (!validation.valid) {
-    console.error(`${chalk9.red("Error:")} ${validation.reason}`);
+    console.error(`${chalk10.red("Error:")} ${validation.reason}`);
     process.exit(1);
   }
   if (environmentExists(environmentName)) {
-    console.error(`${chalk9.red("Error:")} environment ${environmentName} already exists. To edit it, use ${chalk9.gray(`dotenc env edit ${environmentName}`)}`);
+    console.error(`${chalk10.red("Error:")} environment ${environmentName} already exists. To edit it, use ${chalk10.gray(`dotenc env edit ${environmentName}`)}`);
     process.exit(1);
   }
   const availablePublicKeys = await getPublicKeys();
   if (!availablePublicKeys.length) {
-    console.error(`${chalk9.red("Error:")} no public keys found. Please add a public key using ${chalk9.gray("dotenc key add")}.`);
+    console.error(`${chalk10.red("Error:")} no public keys found. Please add a public key using ${chalk10.gray("dotenc key add")}.`);
     process.exit(1);
   }
   const publicKeySelection = publicKeyNameArg ? publicKeyNameArg : await choosePublicKeyPrompt("Which public key(s) do you want to grant access for this environment?", true);
   const publicKeys = _normalizePublicKeyNamesForCreate(publicKeySelection);
+  if (publicKeys.length === 0) {
+    console.error(`${chalk10.red("Error:")} select at least one public key before creating an environment.`);
+    process.exit(1);
+  }
   const dataKey = createDataKey();
   const content = initialContent ?? `# ${environmentName} environment
 `;
@@ -1392,7 +1462,7 @@ var _getRunUsageHintForEnvironment = (environmentName) => {
   for (const publicKeyName of publicKeys) {
     const publicKey = availablePublicKeys.find((key) => key.name === publicKeyName);
     if (!publicKey) {
-      console.error(`Public key ${chalk9.cyan(publicKeyName)} not found or invalid.`);
+      console.error(`Public key ${chalk10.cyan(publicKeyName)} not found or invalid.`);
       continue;
     }
     const encrypted = encryptDataKey(publicKey, dataKey);
@@ -1403,11 +1473,15 @@ var _getRunUsageHintForEnvironment = (environmentName) => {
       algorithm: publicKey.algorithm
     });
   }
+  if (environmentJson.keys.length === 0) {
+    console.error(`${chalk10.red("Error:")} no valid public keys were selected. Environment creation aborted.`);
+    process.exit(1);
+  }
   await fs8.writeFile(path8.join(process.cwd(), `.env.${environmentName}.enc`), JSON.stringify(environmentJson, null, 2), "utf-8");
-  console.log(`${chalk9.green("✔")} Environment ${chalk9.cyan(environmentName)} created!`);
+  console.log(`${chalk10.green("✔")} Environment ${chalk10.cyan(environmentName)} created!`);
   console.log(`
 Some useful tips:`);
-  const editCommand = chalk9.gray(`dotenc env edit ${environmentName}`);
+  const editCommand = chalk10.gray(`dotenc env edit ${environmentName}`);
   console.log(`
 - To securely edit your environment:	${editCommand}`);
   console.log(`- To run your application:		${_getRunUsageHintForEnvironment(environmentName)}`);
@@ -1542,18 +1616,87 @@ var init_getDefaultEditor = __esm(() => {
   };
 });
 
+// src/helpers/splitCommand.ts
+var splitCommand = (input) => {
+  const trimmed = input.trim();
+  if (!trimmed) {
+    return [];
+  }
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  let escaped = false;
+  for (const char of trimmed) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      if (quote === null) {
+        escaped = true;
+      } else {
+        current += char;
+      }
+      continue;
+    }
+    if (quote === "single") {
+      if (char === "'") {
+        quote = null;
+      } else {
+        current += char;
+      }
+      continue;
+    }
+    if (quote === "double") {
+      if (char === '"') {
+        quote = null;
+      } else {
+        current += char;
+      }
+      continue;
+    }
+    if (char === "'") {
+      quote = "single";
+      continue;
+    }
+    if (char === '"') {
+      quote = "double";
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (current.length > 0) {
+        tokens.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += char;
+  }
+  if (escaped) {
+    current += "\\";
+  }
+  if (quote) {
+    throw new Error("Unterminated quote in command.");
+  }
+  if (current.length > 0) {
+    tokens.push(current);
+  }
+  return tokens;
+};
+
 // src/commands/env/edit.ts
 import { spawnSync } from "node:child_process";
 import { existsSync as existsSync5 } from "node:fs";
 import fs9 from "node:fs/promises";
 import os3 from "node:os";
 import path9 from "node:path";
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 var editCommand = async (environmentNameArg) => {
   const environmentName = environmentNameArg || await chooseEnvironmentPrompt("What environment do you want to edit?");
   const nameValidation = validateEnvironmentName(environmentName);
   if (!nameValidation.valid) {
-    console.error(`${chalk10.red("Error:")} ${nameValidation.reason}`);
+    console.error(`${chalk11.red("Error:")} ${nameValidation.reason}`);
     process.exit(1);
   }
   const environmentFile = `.env.${environmentName}.enc`;
@@ -1594,9 +1737,15 @@ ${separator}${content}`;
   };
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
-  const editor = await getDefaultEditor();
+  const editorCommand = await getDefaultEditor();
   try {
-    const result = spawnSync(editor, [tempFilePath], { stdio: "inherit" });
+    const [editorExecutable, ...editorArgs] = splitCommand(editorCommand);
+    if (!editorExecutable) {
+      throw new Error("No editor command configured.");
+    }
+    const result = spawnSync(editorExecutable, [...editorArgs, tempFilePath], {
+      stdio: "inherit"
+    });
     if (result.error) {
       throw result.error;
     }
@@ -1609,7 +1758,7 @@ Editor exited with code ${result.status}`);
     const finalHash = createHash(newContent);
     if (initialHash === finalHash) {
       console.log(`
-No changes were made to the ${chalk10.cyan(environmentName)} environment.`);
+No changes were made to the ${chalk11.cyan(environmentName)} environment.`);
     } else {
       const separatorIndex = newContent.indexOf(separator);
       if (separatorIndex !== -1) {
@@ -1618,11 +1767,11 @@ No changes were made to the ${chalk10.cyan(environmentName)} environment.`);
       }
       await encryptEnvironment(environmentName, newContent);
       console.log(`
-Encrypted ${chalk10.cyan(environmentName)} environment and saved it to ${chalk10.gray(environmentFile)}.`);
+Encrypted ${chalk11.cyan(environmentName)} environment and saved it to ${chalk11.gray(environmentFile)}.`);
     }
   } catch (error) {
     console.error(`
-Failed to open editor: ${editor}`);
+Failed to open editor: ${editorCommand}`);
     console.error(error instanceof Error ? error.message : error);
   } finally {
     process.removeListener("SIGINT", onSignal);
@@ -1766,12 +1915,12 @@ var init_list2 = __esm(() => {
 });
 
 // src/commands/env/rotate.ts
-import chalk11 from "chalk";
+import chalk12 from "chalk";
 var rotateCommand = async (environmentNameArg) => {
   const environmentName = environmentNameArg || await chooseEnvironmentPrompt("What environment do you want to rotate the data key for?");
   const validation = validateEnvironmentName(environmentName);
   if (!validation.valid) {
-    console.error(`${chalk11.red("Error:")} ${validation.reason}`);
+    console.error(`${chalk12.red("Error:")} ${validation.reason}`);
     process.exit(1);
   }
   let currentContent;
@@ -1866,9 +2015,81 @@ var init_createEd25519SshKey = __esm(() => {
   };
 });
 
+// src/helpers/validatePublicKey.ts
+function getRsaModulusLength(key) {
+  const der = key.export({ type: "spki", format: "der" });
+  let i = 0;
+  i += 1;
+  i += der[i] & 128 ? (der[i] & 127) + 1 : 1;
+  i += 1;
+  let algLen = 0;
+  if (der[i] & 128) {
+    const n = der[i] & 127;
+    for (let j = 1;j <= n; j++)
+      algLen = algLen << 8 | der[i + j];
+    i += n + 1;
+  } else {
+    algLen = der[i];
+    i += 1;
+  }
+  i += algLen;
+  i += 1;
+  i += der[i] & 128 ? (der[i] & 127) + 1 : 1;
+  i += 1;
+  i += 1;
+  i += der[i] & 128 ? (der[i] & 127) + 1 : 1;
+  i += 1;
+  let modLen = 0;
+  if (der[i] & 128) {
+    const n = der[i] & 127;
+    for (let j = 1;j <= n; j++)
+      modLen = modLen << 8 | der[i + j];
+    i += n + 1;
+  } else {
+    modLen = der[i];
+    i += 1;
+  }
+  if (der[i] === 0)
+    modLen -= 1;
+  return modLen * 8;
+}
+function validatePublicKey(key) {
+  const keyType = key.asymmetricKeyType;
+  switch (keyType) {
+    case "rsa": {
+      const modulusLength = getRsaModulusLength(key);
+      if (modulusLength < 2048) {
+        return {
+          valid: false,
+          reason: `RSA key is ${modulusLength} bits, minimum is 2048 bits.`
+        };
+      }
+      return { valid: true };
+    }
+    case "ed25519":
+      return { valid: true };
+    case "dsa":
+      return {
+        valid: false,
+        reason: "DSA keys are not supported. Use Ed25519 or RSA (2048+ bits)."
+      };
+    case "ec":
+      return {
+        valid: false,
+        reason: "ECDSA keys are not supported. Use Ed25519 or RSA (2048+ bits)."
+      };
+    default:
+      return {
+        valid: false,
+        reason: `Unsupported key type: ${keyType}. Use Ed25519 or RSA (2048+ bits).`
+      };
+  }
+}
+
 // src/prompts/choosePrivateKey.ts
+import crypto10 from "node:crypto";
 import path12 from "node:path";
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 import inquirer5 from "inquirer";
 function toSupportedChoice(key) {
   return {
@@ -1878,23 +2099,48 @@ function toSupportedChoice(key) {
 }
 function toUnsupportedChoice(key, index) {
   return {
-    name: `${chalk12.gray(key.name)} (${chalk12.yellow(key.reason)})`,
+    name: `${chalk13.gray(key.name)} (${chalk13.yellow(key.reason)})`,
     value: `__unsupported_${index}__`,
     disabled: true
   };
 }
+function classifySupportedKeys(keys) {
+  const supportedKeys = [];
+  const policyUnsupportedKeys = [];
+  for (const key of keys) {
+    try {
+      const publicKey = crypto10.createPublicKey(key.privateKey);
+      const validation = validatePublicKey(publicKey);
+      if (!validation.valid) {
+        policyUnsupportedKeys.push({
+          name: key.name,
+          reason: validation.reason
+        });
+        continue;
+      }
+    } catch {
+      policyUnsupportedKeys.push({
+        name: key.name,
+        reason: "invalid private key format"
+      });
+      continue;
+    }
+    supportedKeys.push(key);
+  }
+  return { supportedKeys, policyUnsupportedKeys };
+}
 var CREATE_NEW_PRIVATE_KEY_CHOICE = "__dotenc_create_new_private_key__", defaultChoosePrivateKeyPromptDeps, buildPromptChoices = (keys, unsupportedKeys) => {
   const choices = keys.map(toSupportedChoice);
   if (unsupportedKeys.length > 0) {
     if (choices.length > 0) {
       choices.push({
-        name: chalk12.gray("────────"),
+        name: chalk13.gray("────────"),
         value: "__separator_supported_unsupported__",
         disabled: true
       });
     }
     choices.push({
-      name: chalk12.gray("Unsupported keys (ignored)"),
+      name: chalk13.gray("Unsupported keys (ignored)"),
       value: "__unsupported_header__",
       disabled: true
     });
@@ -1902,7 +2148,7 @@ var CREATE_NEW_PRIVATE_KEY_CHOICE = "__dotenc_create_new_private_key__", default
   }
   if (choices.length > 0) {
     choices.push({
-      name: chalk12.gray("────────"),
+      name: chalk13.gray("────────"),
       value: "__separator_create__",
       disabled: true
     });
@@ -1919,16 +2165,18 @@ var CREATE_NEW_PRIVATE_KEY_CHOICE = "__dotenc_create_new_private_key__", default
       passphraseProtectedKeys,
       unsupportedKeys = []
     } = await deps.getPrivateKeys();
-    const privateKeyMap = new Map(keys.map((key) => [key.name, key]));
+    const { supportedKeys, policyUnsupportedKeys } = classifySupportedKeys(keys);
+    const allUnsupportedKeys = [...unsupportedKeys, ...policyUnsupportedKeys];
+    const privateKeyMap = new Map(supportedKeys.map((key) => [key.name, key]));
     if (!deps.isInteractive()) {
-      if (keys.length > 0) {
-        return keys[0];
+      if (supportedKeys.length > 0) {
+        return supportedKeys[0];
       }
       if (passphraseProtectedKeys.length > 0) {
         throw new Error(passphraseProtectedKeyError(passphraseProtectedKeys));
       }
-      if (unsupportedKeys.length > 0) {
-        const unsupportedList = unsupportedKeys.map((key) => `  - ${key.name}: ${key.reason}`).join(`
+      if (allUnsupportedKeys.length > 0) {
+        const unsupportedList = allUnsupportedKeys.map((key) => `  - ${key.name}: ${key.reason}`).join(`
 `);
         throw new Error(`No supported SSH keys found.
 
@@ -1945,16 +2193,16 @@ Generate a new key with:
         type: "list",
         name: "key",
         message,
-        choices: buildPromptChoices(keys, unsupportedKeys)
+        choices: buildPromptChoices(supportedKeys, allUnsupportedKeys)
       }
     ]);
     const selected = String(result.key || "");
     if (selected === CREATE_NEW_PRIVATE_KEY_CHOICE) {
       try {
         const createdPath = await deps.createEd25519SshKey();
-        deps.logInfo(`${chalk12.green("✔")} Created ${chalk12.cyan(path12.basename(createdPath))} at ${chalk12.gray(createdPath)}.`);
+        deps.logInfo(`${chalk13.green("✔")} Created ${chalk13.cyan(path12.basename(createdPath))} at ${chalk13.gray(createdPath)}.`);
       } catch (error) {
-        deps.logWarn(`${chalk12.yellow("Warning:")} failed to create a new SSH key. ${error instanceof Error ? error.message : String(error)}`);
+        deps.logWarn(`${chalk13.yellow("Warning:")} failed to create a new SSH key. ${error instanceof Error ? error.message : String(error)}`);
       }
       continue;
     }
@@ -1994,77 +2242,6 @@ var inputNamePrompt = async (message, defaultValue) => {
 };
 var init_inputName = () => {};
 
-// src/helpers/validatePublicKey.ts
-function getRsaModulusLength(key) {
-  const der = key.export({ type: "spki", format: "der" });
-  let i = 0;
-  i += 1;
-  i += der[i] & 128 ? (der[i] & 127) + 1 : 1;
-  i += 1;
-  let algLen = 0;
-  if (der[i] & 128) {
-    const n = der[i] & 127;
-    for (let j = 1;j <= n; j++)
-      algLen = algLen << 8 | der[i + j];
-    i += n + 1;
-  } else {
-    algLen = der[i];
-    i += 1;
-  }
-  i += algLen;
-  i += 1;
-  i += der[i] & 128 ? (der[i] & 127) + 1 : 1;
-  i += 1;
-  i += 1;
-  i += der[i] & 128 ? (der[i] & 127) + 1 : 1;
-  i += 1;
-  let modLen = 0;
-  if (der[i] & 128) {
-    const n = der[i] & 127;
-    for (let j = 1;j <= n; j++)
-      modLen = modLen << 8 | der[i + j];
-    i += n + 1;
-  } else {
-    modLen = der[i];
-    i += 1;
-  }
-  if (der[i] === 0)
-    modLen -= 1;
-  return modLen * 8;
-}
-function validatePublicKey(key) {
-  const keyType = key.asymmetricKeyType;
-  switch (keyType) {
-    case "rsa": {
-      const modulusLength = getRsaModulusLength(key);
-      if (modulusLength < 2048) {
-        return {
-          valid: false,
-          reason: `RSA key is ${modulusLength} bits, minimum is 2048 bits.`
-        };
-      }
-      return { valid: true };
-    }
-    case "ed25519":
-      return { valid: true };
-    case "dsa":
-      return {
-        valid: false,
-        reason: "DSA keys are not supported. Use Ed25519 or RSA (2048+ bits)."
-      };
-    case "ec":
-      return {
-        valid: false,
-        reason: "ECDSA keys are not supported. Use Ed25519 or RSA (2048+ bits)."
-      };
-    default:
-      return {
-        valid: false,
-        reason: `Unsupported key type: ${keyType}. Use Ed25519 or RSA (2048+ bits).`
-      };
-  }
-}
-
 // src/prompts/inputKey.ts
 import inquirer7 from "inquirer";
 var inputKeyPrompt = async (message, defaultValue) => {
@@ -2082,95 +2259,99 @@ var inputKeyPrompt = async (message, defaultValue) => {
 var init_inputKey = () => {};
 
 // src/commands/key/add.ts
-import crypto10 from "node:crypto";
+import crypto11 from "node:crypto";
 import { existsSync as existsSync7 } from "node:fs";
 import fs12 from "node:fs/promises";
 import os5 from "node:os";
 import path13 from "node:path";
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import inquirer8 from "inquirer";
-var keyAddCommand = async (nameArg, options) => {
+var defaultDeps4, _runKeyAddCommand = async (nameArg, options, depsOverrides = {}) => {
+  const deps = {
+    ...defaultDeps4,
+    ...depsOverrides
+  };
   let publicKey;
   if (options?.fromSsh) {
-    const sshPath = options.fromSsh.startsWith("~") ? path13.join(os5.homedir(), options.fromSsh.slice(1)) : options.fromSsh;
-    if (!existsSync7(sshPath)) {
-      console.error(`File ${chalk13.cyan(sshPath)} does not exist. Please provide a valid SSH key path.`);
-      process.exit(1);
+    const sshPath = options.fromSsh.startsWith("~") ? path13.join(deps.homedir(), options.fromSsh.slice(1)) : options.fromSsh;
+    if (!deps.existsSync(sshPath)) {
+      deps.logError(`File ${chalk14.cyan(sshPath)} does not exist. Please provide a valid SSH key path.`);
+      deps.exit(1);
     }
-    const keyContent = await fs12.readFile(sshPath, "utf-8");
-    if (isPassphraseProtected(keyContent)) {
-      console.error(`${chalk13.red("Error:")} the provided key is passphrase-protected, which is not currently supported by dotenc.`);
-      process.exit(1);
+    const keyContent = await deps.readFile(sshPath, "utf-8");
+    if (deps.isPassphraseProtected(keyContent)) {
+      deps.logError(`${chalk14.red("Error:")} the provided key is passphrase-protected, which is not currently supported by dotenc.`);
+      deps.exit(1);
     }
     try {
-      const privateKey = crypto10.createPrivateKey(keyContent);
-      publicKey = crypto10.createPublicKey(privateKey);
+      const privateKey = deps.createPrivateKey(keyContent);
+      publicKey = deps.createPublicKey(privateKey);
     } catch {
-      const parsed = parseOpenSSHPrivateKey(keyContent);
+      const parsed = deps.parseOpenSSHPrivateKey(keyContent);
       if (parsed) {
-        publicKey = crypto10.createPublicKey(parsed);
+        publicKey = deps.createPublicKey(parsed);
       } else {
         try {
-          publicKey = crypto10.createPublicKey(keyContent);
+          publicKey = deps.createPublicKey(keyContent);
         } catch (error) {
-          console.error("Invalid SSH key format. Please provide a valid SSH key file.");
-          console.error(`Details: ${error instanceof Error ? error.message : error}`);
-          process.exit(1);
+          deps.logError("Invalid SSH key format. Please provide a valid SSH key file.");
+          deps.logError(`Details: ${error instanceof Error ? error.message : error}`);
+          deps.exit(1);
         }
       }
     }
   }
   if (options?.fromFile) {
-    if (!existsSync7(options.fromFile)) {
-      console.error(`File ${chalk13.cyan(options.fromFile)} does not exist. Please provide a valid file path.`);
-      process.exit(1);
+    if (!deps.existsSync(options.fromFile)) {
+      deps.logError(`File ${chalk14.cyan(options.fromFile)} does not exist. Please provide a valid file path.`);
+      deps.exit(1);
     }
-    const keyContent = await fs12.readFile(options.fromFile, "utf-8");
-    if (isPassphraseProtected(keyContent)) {
-      console.error(`${chalk13.red("Error:")} the provided key is passphrase-protected, which is not currently supported by dotenc.`);
-      process.exit(1);
+    const keyContent = await deps.readFile(options.fromFile, "utf-8");
+    if (deps.isPassphraseProtected(keyContent)) {
+      deps.logError(`${chalk14.red("Error:")} the provided key is passphrase-protected, which is not currently supported by dotenc.`);
+      deps.exit(1);
     }
     try {
-      publicKey = crypto10.createPublicKey(keyContent);
+      publicKey = deps.createPublicKey(keyContent);
     } catch {
       try {
-        const privateKey = crypto10.createPrivateKey(keyContent);
-        publicKey = crypto10.createPublicKey(privateKey);
+        const privateKey = deps.createPrivateKey(keyContent);
+        publicKey = deps.createPublicKey(privateKey);
       } catch {
-        const parsed = parseOpenSSHPrivateKey(keyContent);
+        const parsed = deps.parseOpenSSHPrivateKey(keyContent);
         if (parsed) {
-          publicKey = crypto10.createPublicKey(parsed);
+          publicKey = deps.createPublicKey(parsed);
         } else {
-          console.error("Invalid key format. Please provide a valid PEM formatted public or private key.");
-          process.exit(1);
+          deps.logError("Invalid key format. Please provide a valid PEM formatted public or private key.");
+          deps.exit(1);
         }
       }
     }
   }
   if (options?.fromString) {
-    if (isPassphraseProtected(options.fromString)) {
-      console.error(`${chalk13.red("Error:")} the provided key is passphrase-protected, which is not currently supported by dotenc.`);
-      process.exit(1);
+    if (deps.isPassphraseProtected(options.fromString)) {
+      deps.logError(`${chalk14.red("Error:")} the provided key is passphrase-protected, which is not currently supported by dotenc.`);
+      deps.exit(1);
     }
     try {
-      publicKey = crypto10.createPublicKey(options.fromString);
+      publicKey = deps.createPublicKey(options.fromString);
     } catch {
       try {
-        const privateKey = crypto10.createPrivateKey(options.fromString);
-        publicKey = crypto10.createPublicKey(privateKey);
+        const privateKey = deps.createPrivateKey(options.fromString);
+        publicKey = deps.createPublicKey(privateKey);
       } catch {
-        const parsed = parseOpenSSHPrivateKey(options.fromString);
+        const parsed = deps.parseOpenSSHPrivateKey(options.fromString);
         if (parsed) {
-          publicKey = crypto10.createPublicKey(parsed);
+          publicKey = deps.createPublicKey(parsed);
         } else {
-          console.error("Invalid key format. Please provide a valid PEM formatted public or private key.");
-          process.exit(1);
+          deps.logError("Invalid key format. Please provide a valid PEM formatted public or private key.");
+          deps.exit(1);
         }
       }
     }
   }
   if (!publicKey) {
-    const modePrompt = await inquirer8.prompt({
+    const modePrompt = await deps.prompt({
       type: "list",
       name: "mode",
       message: "Would you like to add one of your SSH keys or paste a public key?",
@@ -2180,74 +2361,103 @@ var keyAddCommand = async (nameArg, options) => {
       ]
     });
     if (modePrompt.mode === "paste") {
-      const publicKeyInput = await inputKeyPrompt("Please paste your public key (PEM format):");
+      const publicKeyInput = await deps.inputKeyPrompt("Please paste your public key (PEM format):");
       if (!publicKeyInput) {
-        console.error("No public key provided. Add operation cancelled.");
-        process.exit(1);
+        deps.logError("No public key provided. Add operation cancelled.");
+        deps.exit(1);
       }
       try {
-        publicKey = crypto10.createPublicKey(publicKeyInput);
+        publicKey = deps.createPublicKey(publicKeyInput);
       } catch (error) {
-        console.error("Invalid public key format. Please provide a valid PEM formatted public key.");
-        console.error(`Details: ${error instanceof Error ? error.message : error}`);
-        process.exit(1);
+        deps.logError("Invalid public key format. Please provide a valid PEM formatted public key.");
+        deps.logError(`Details: ${error instanceof Error ? error.message : error}`);
+        deps.exit(1);
       }
     } else {
       let selectedKey;
       try {
-        selectedKey = await choosePrivateKeyPrompt("Which SSH key do you want to add?");
+        selectedKey = await deps.choosePrivateKeyPrompt("Which SSH key do you want to add?");
       } catch (error) {
-        console.error(error instanceof Error ? error.message : String(error));
-        process.exit(1);
+        deps.logError(error instanceof Error ? error.message : String(error));
+        deps.exit(1);
       }
-      publicKey = crypto10.createPublicKey(selectedKey.privateKey);
+      publicKey = deps.createPublicKey(selectedKey.privateKey);
       if (!nameArg) {
         nameArg = selectedKey.name;
       }
     }
   }
   if (!publicKey) {
-    console.error("An unexpected error occurred. No public key was inferred from the provided input.");
-    process.exit(1);
+    deps.logError("An unexpected error occurred. No public key was inferred from the provided input.");
+    deps.exit(1);
   }
-  const validation = validatePublicKey(publicKey);
+  const validation = deps.validatePublicKey(publicKey);
   if (!validation.valid) {
-    console.error(validation.reason);
-    process.exit(1);
+    deps.logError(validation.reason);
+    deps.exit(1);
   }
   const publicKeyOutput = publicKey.export({
     type: "spki",
     format: "pem"
   });
-  if (!existsSync7(path13.join(process.cwd(), ".dotenc"))) {
-    await fs12.mkdir(path13.join(process.cwd(), ".dotenc"));
+  if (!deps.existsSync(path13.join(deps.cwd(), ".dotenc"))) {
+    await deps.mkdir(path13.join(deps.cwd(), ".dotenc"));
   }
   let name = nameArg;
   if (!name) {
-    name = await inputNamePrompt("What name do you want to give to the new public key?");
-    if (existsSync7(path13.join(process.cwd(), ".dotenc", `${name}.pub`))) {
-      console.error(`A public key with name ${chalk13.cyan(name)} already exists. Please choose a different name.`);
-      process.exit(1);
-    }
+    name = await deps.inputNamePrompt("What name do you want to give to the new public key?");
   }
-  await fs12.writeFile(path13.join(process.cwd(), ".dotenc", `${name}.pub`), publicKeyOutput, "utf-8");
-  console.log(`
-Public key ${chalk13.cyan(name)} added successfully!`);
+  const keyNameValidation = deps.validateKeyName(name);
+  if (!keyNameValidation.valid) {
+    deps.logError(`${chalk14.red("Error:")} ${keyNameValidation.reason}`);
+    deps.exit(1);
+  }
+  const keyOutputPath = path13.join(deps.cwd(), ".dotenc", `${name}.pub`);
+  if (deps.existsSync(keyOutputPath)) {
+    deps.logError(`A public key with name ${chalk14.cyan(name)} already exists. Please choose a different name.`);
+    deps.exit(1);
+  }
+  await deps.writeFile(keyOutputPath, publicKeyOutput, "utf-8");
+  deps.logInfo(`
+Public key ${chalk14.cyan(name)} added successfully!`);
+}, keyAddCommand = async (nameArg, options) => {
+  return _runKeyAddCommand(nameArg, options);
 };
 var init_add = __esm(() => {
   init_parseOpenSSHKey();
   init_choosePrivateKey();
   init_inputKey();
   init_inputName();
+  defaultDeps4 = {
+    createPrivateKey: crypto11.createPrivateKey,
+    createPublicKey: crypto11.createPublicKey,
+    existsSync: existsSync7,
+    readFile: fs12.readFile,
+    mkdir: fs12.mkdir,
+    writeFile: fs12.writeFile,
+    homedir: os5.homedir,
+    cwd: process.cwd,
+    prompt: inquirer8.prompt,
+    isPassphraseProtected,
+    parseOpenSSHPrivateKey,
+    validatePublicKey,
+    validateKeyName,
+    choosePrivateKeyPrompt,
+    inputKeyPrompt,
+    inputNamePrompt,
+    logError: (message) => console.error(message),
+    logInfo: (message) => console.log(message),
+    exit: (code) => process.exit(code)
+  };
 });
 
 // src/commands/init.ts
-import crypto11 from "node:crypto";
+import crypto12 from "node:crypto";
 import { existsSync as existsSync8 } from "node:fs";
 import fs13 from "node:fs/promises";
 import os6 from "node:os";
 import path14 from "node:path";
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 var _resolveDocsUrl = () => {
   if (typeof package_default.homepage === "string" && package_default.homepage.trim().length > 0) {
     return package_default.homepage;
@@ -2257,64 +2467,70 @@ var _resolveDocsUrl = () => {
     return;
   }
   return repositoryUrl.replace(/^git\+/, "").replace(/\.git$/, "");
-}, initCommand = async (options) => {
-  const username = options.name || await inputNamePrompt("What's your name?", os6.userInfo().username);
+}, defaultDeps5, _runInitCommand = async (options, depsOverrides = {}) => {
+  const deps = {
+    ...defaultDeps5,
+    ...depsOverrides
+  };
+  const username = options.name || await deps.inputNamePrompt("What's your name?", deps.userInfo().username);
   if (!username) {
-    console.error(`${chalk14.red("Error:")} no name provided.`);
-    process.exit(1);
+    deps.logError(`${chalk15.red("Error:")} no name provided.`);
+    deps.exit(1);
   }
   let keyEntry;
   try {
-    keyEntry = await choosePrivateKeyPrompt("Which SSH key would you like to use?");
+    keyEntry = await deps.choosePrivateKeyPrompt("Which SSH key would you like to use?");
   } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    deps.logError(error instanceof Error ? error.message : String(error));
+    deps.exit(1);
   }
-  console.log(`Adding key: ${chalk14.cyan(username)} (${keyEntry.algorithm})`);
-  const publicKey = crypto11.createPublicKey(keyEntry.privateKey);
+  deps.logInfo(`Adding key: ${chalk15.cyan(username)} (${keyEntry.algorithm})`);
+  const publicKey = deps.createPublicKey(keyEntry.privateKey);
   const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
-  await keyAddCommand(username, {
+  await deps.keyAddCommand(username, {
     fromString: publicKeyPem
   });
   try {
-    setupGitDiff();
+    deps.setupGitDiff();
   } catch (_error) {
-    console.warn(`${chalk14.yellow("Warning:")} could not set up git diff driver. You can run ${chalk14.gray("dotenc init")} again inside a git repository.`);
+    deps.logWarn(`${chalk15.yellow("Warning:")} could not set up git diff driver. You can run ${chalk15.gray("dotenc init")} again inside a git repository.`);
   }
   let initialContent;
-  const envPath = path14.join(process.cwd(), ".env");
-  if (existsSync8(envPath)) {
-    initialContent = await fs13.readFile(envPath, "utf-8");
-    await fs13.unlink(envPath);
-    console.log(`Migrated ${chalk14.gray(".env")} contents to ${chalk14.cyan("development")} environment.`);
+  const envPath = path14.join(deps.cwd(), ".env");
+  if (deps.existsSync(envPath)) {
+    initialContent = await deps.readFile(envPath, "utf-8");
+    await deps.unlink(envPath);
+    deps.logInfo(`Migrated ${chalk15.gray(".env")} contents to ${chalk15.cyan("development")} environment.`);
   }
-  await createCommand("development", username, initialContent);
+  await deps.createCommand("development", username, initialContent);
   if (username !== "development") {
-    await createCommand(username, username);
+    await deps.createCommand(username, username);
   }
-  console.log(`
-${chalk14.green("✔")} Initialization complete!`);
-  console.log(`
+  deps.logInfo(`
+${chalk15.green("✔")} Initialization complete!`);
+  deps.logInfo(`
 Some useful tips:`);
-  const developmentEditCmd = chalk14.gray("dotenc env edit development");
-  const personalEditCmd = chalk14.gray(`dotenc env edit ${username}`);
-  console.log(`- Edit the development environment:	${developmentEditCmd}`);
+  const developmentEditCmd = chalk15.gray("dotenc env edit development");
+  const personalEditCmd = chalk15.gray(`dotenc env edit ${username}`);
+  deps.logInfo(`- Edit the development environment:	${developmentEditCmd}`);
   if (username !== "development") {
-    console.log(`- Edit your personal environment:	${personalEditCmd}`);
+    deps.logInfo(`- Edit your personal environment:	${personalEditCmd}`);
   }
   const devEnvironmentChain = username === "development" ? "development" : `development,${username}`;
-  const devCmd = chalk14.gray("dotenc dev <command>");
-  console.log(`- Run in development mode:		${devCmd} ${chalk14.gray(`(loads ${devEnvironmentChain})`)}`);
-  const docsUrl = _resolveDocsUrl();
+  const devCmd = chalk15.gray("dotenc dev <command>");
+  deps.logInfo(`- Run in development mode:		${devCmd} ${chalk15.gray(`(loads ${devEnvironmentChain})`)}`);
+  const docsUrl = deps.resolveDocsUrl();
   if (docsUrl) {
-    console.log(`- Full docs:			${chalk14.gray(docsUrl)}`);
+    deps.logInfo(`- Full docs:			${chalk15.gray(docsUrl)}`);
   }
-  if (existsSync8(".claude") || existsSync8("CLAUDE.md")) {
-    console.log(`- Install the agent skill:		${chalk14.gray("dotenc tools install-agent-skill")}`);
+  if (deps.existsSync(".claude") || deps.existsSync("CLAUDE.md")) {
+    deps.logInfo(`- Install the agent skill:		${chalk15.gray("dotenc tools install-agent-skill")}`);
   }
-  if (existsSync8(".vscode") || existsSync8(".cursor") || existsSync8(".windsurf")) {
-    console.log(`- Add the editor extension:		${chalk14.gray("dotenc tools install-vscode-extension")}`);
+  if (deps.existsSync(".vscode") || deps.existsSync(".cursor") || deps.existsSync(".windsurf")) {
+    deps.logInfo(`- Add the editor extension:		${chalk15.gray("dotenc tools install-vscode-extension")}`);
   }
+}, initCommand = async (options) => {
+  return _runInitCommand(options);
 };
 var init_init = __esm(() => {
   init_package();
@@ -2323,6 +2539,24 @@ var init_init = __esm(() => {
   init_inputName();
   init_create();
   init_add();
+  defaultDeps5 = {
+    inputNamePrompt,
+    userInfo: os6.userInfo,
+    choosePrivateKeyPrompt,
+    createPublicKey: crypto12.createPublicKey,
+    keyAddCommand,
+    setupGitDiff,
+    existsSync: existsSync8,
+    readFile: fs13.readFile,
+    unlink: fs13.unlink,
+    cwd: process.cwd,
+    createCommand,
+    logInfo: (message) => console.log(message),
+    logWarn: (message) => console.warn(message),
+    logError: (message) => console.error(message),
+    resolveDocsUrl: _resolveDocsUrl,
+    exit: (code) => process.exit(code)
+  };
 });
 
 // src/commands/key/list.ts
@@ -2358,15 +2592,20 @@ var init_confirm = () => {};
 import { existsSync as existsSync9 } from "node:fs";
 import fs14 from "node:fs/promises";
 import path15 from "node:path";
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 var keyRemoveCommand = async (nameArg) => {
   let name = nameArg;
   if (!name) {
     name = await choosePublicKeyPrompt("Which public key do you want to remove?");
   }
+  const keyNameValidation = validateKeyName(name);
+  if (!keyNameValidation.valid) {
+    console.error(`${chalk16.red("Error:")} ${keyNameValidation.reason}`);
+    process.exit(1);
+  }
   const filePath = path15.join(process.cwd(), ".dotenc", `${name}.pub`);
   if (!existsSync9(filePath)) {
-    console.error(`Public key ${chalk15.cyan(name)} not found.`);
+    console.error(`Public key ${chalk16.cyan(name)} not found.`);
     process.exit(1);
   }
   const allEnvironments = await getEnvironments();
@@ -2380,7 +2619,7 @@ var keyRemoveCommand = async (nameArg) => {
     } catch {}
   }
   if (affectedEnvironments.length > 0) {
-    console.log(`Key ${chalk15.cyan(name)} has access to the following environments:`);
+    console.log(`Key ${chalk16.cyan(name)} has access to the following environments:`);
     for (const env of affectedEnvironments) {
       console.log(`  - ${env}`);
     }
@@ -2393,7 +2632,7 @@ Access will be revoked from these environments automatically.`);
     return;
   }
   await fs14.unlink(filePath);
-  console.log(`Public key ${chalk15.cyan(name)} removed successfully.`);
+  console.log(`Public key ${chalk16.cyan(name)} removed successfully.`);
   for (const envName of affectedEnvironments) {
     try {
       const envJson = await getEnvironmentByName(envName);
@@ -2401,9 +2640,9 @@ Access will be revoked from these environments automatically.`);
       await encryptEnvironment(envName, content, {
         revokePublicKeys: [name]
       });
-      console.log(`Revoked access from ${chalk15.cyan(envName)} environment.`);
+      console.log(`Revoked access from ${chalk16.cyan(envName)} environment.`);
     } catch {
-      console.warn(`${chalk15.yellow("Warning:")} could not revoke access from ${chalk15.cyan(envName)}. You may need to run ${chalk15.gray(`dotenc auth revoke ${envName} ${name}`)} manually or rotate the environment.`);
+      console.warn(`${chalk16.yellow("Warning:")} could not revoke access from ${chalk16.cyan(envName)}. You may need to run ${chalk16.gray(`dotenc auth revoke ${envName} ${name}`)} manually or rotate the environment.`);
     }
   }
 };
@@ -2437,7 +2676,7 @@ var init_textconv = __esm(() => {
 
 // src/commands/tools/install-agent-skill.ts
 import { spawn as spawn2 } from "node:child_process";
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import inquirer10 from "inquirer";
 var SKILL_SOURCE = "ivanfilhoz/dotenc", SKILL_NAME = "dotenc", runNpx = (args, spawnImpl = spawn2) => new Promise((resolve, reject) => {
   const child = spawnImpl("npx", args, {
@@ -2446,9 +2685,9 @@ var SKILL_SOURCE = "ivanfilhoz/dotenc", SKILL_NAME = "dotenc", runNpx = (args, s
   });
   child.on("error", reject);
   child.on("exit", (code) => resolve(code ?? 1));
-}), defaultDeps2, _runInstallAgentSkillCommand = async (options, depsOverrides = {}) => {
+}), defaultDeps6, _runInstallAgentSkillCommand = async (options, depsOverrides = {}) => {
   const deps = {
-    ...defaultDeps2,
+    ...defaultDeps6,
     ...depsOverrides
   };
   const { scope } = await deps.prompt([
@@ -2474,21 +2713,21 @@ var SKILL_SOURCE = "ivanfilhoz/dotenc", SKILL_NAME = "dotenc", runNpx = (args, s
   try {
     exitCode = await deps.runNpx(args);
   } catch (error) {
-    deps.logError(`${chalk16.red("Error:")} failed to run ${chalk16.gray(npxCommand)}.`);
-    deps.logError(`${chalk16.red("Details:")} ${error instanceof Error ? error.message : String(error)}`);
+    deps.logError(`${chalk17.red("Error:")} failed to run ${chalk17.gray(npxCommand)}.`);
+    deps.logError(`${chalk17.red("Details:")} ${error instanceof Error ? error.message : String(error)}`);
     deps.exit(1);
   }
   if (exitCode !== 0) {
-    deps.logError(`${chalk16.red("Error:")} skill installation command exited with code ${exitCode}.`);
+    deps.logError(`${chalk17.red("Error:")} skill installation command exited with code ${exitCode}.`);
     deps.exit(exitCode);
   }
-  deps.log(`${chalk16.green("✓")} Agent skill installation completed via ${chalk16.gray(npxCommand)}.`);
-  deps.log(`Run ${chalk16.gray("/dotenc")} in your agent to use it.`);
+  deps.log(`${chalk17.green("✓")} Agent skill installation completed via ${chalk17.gray(npxCommand)}.`);
+  deps.log(`Run ${chalk17.gray("/dotenc")} in your agent to use it.`);
 }, installAgentSkillCommand = async (options) => {
   await _runInstallAgentSkillCommand(options);
 };
 var init_install_agent_skill = __esm(() => {
-  defaultDeps2 = {
+  defaultDeps6 = {
     prompt: inquirer10.prompt,
     runNpx,
     log: console.log,
@@ -2503,7 +2742,7 @@ import { existsSync as existsSync10 } from "node:fs";
 import fs16 from "node:fs/promises";
 import path17 from "node:path";
 import { promisify } from "node:util";
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 import inquirer11 from "inquirer";
 async function addToExtensionsJson() {
   const extensionsJsonPath = path17.join(process.cwd(), ".vscode", "extensions.json");
@@ -2524,9 +2763,9 @@ async function addToExtensionsJson() {
   if (!json.recommendations.includes(EXTENSION_ID)) {
     json.recommendations.push(EXTENSION_ID);
     await fs16.writeFile(extensionsJsonPath, JSON.stringify(json, null, 2), "utf-8");
-    console.log(`${chalk17.green("✓")} Added dotenc to ${chalk17.gray(".vscode/extensions.json")}`);
+    console.log(`${chalk18.green("✓")} Added dotenc to ${chalk18.gray(".vscode/extensions.json")}`);
   } else {
-    console.log(`${chalk17.green("✓")} dotenc already in ${chalk17.gray(".vscode/extensions.json")}`);
+    console.log(`${chalk18.green("✓")} dotenc already in ${chalk18.gray(".vscode/extensions.json")}`);
   }
 }
 async function which(bin) {
@@ -2590,7 +2829,7 @@ async function _runInstallVscodeExtension(getEditors = detectEditors, _openUrl =
   await addToExtensionsJson();
   if (editors.length === 0) {
     console.log(`
-Install the extension in VS Code: ${chalk17.cyan(EDITOR_PROTOCOL_URLS.vscode)}`);
+Install the extension in VS Code: ${chalk18.cyan(EDITOR_PROTOCOL_URLS.vscode)}`);
     return;
   }
   if (editors.length === 1) {
@@ -2609,10 +2848,10 @@ Install the extension in VS Code: ${chalk17.cyan(EDITOR_PROTOCOL_URLS.vscode)}`)
       try {
         await _openUrl(url);
       } catch {
-        console.log(`Open manually: ${chalk17.cyan(url)}`);
+        console.log(`Open manually: ${chalk18.cyan(url)}`);
       }
     } else {
-      console.log(`Install manually: ${chalk17.cyan(url)}`);
+      console.log(`Install manually: ${chalk18.cyan(url)}`);
     }
     return;
   }
@@ -2621,7 +2860,7 @@ Install the extension in your editor:`);
   for (const editor of editors) {
     const name = EDITOR_NAMES[editor] ?? editor;
     const url = EDITOR_PROTOCOL_URLS[editor];
-    console.log(`  ${name}: ${chalk17.cyan(url)}`);
+    console.log(`  ${name}: ${chalk18.cyan(url)}`);
   }
 }
 var execFileAsync, execAsync, EXTENSION_ID = "dotenc.dotenc", EDITOR_PROTOCOL_URLS, EDITOR_NAMES, installVscodeExtensionCommand = async () => {
@@ -2728,7 +2967,7 @@ var init_update = () => {};
 
 // src/commands/update.ts
 import { spawn as spawn3 } from "node:child_process";
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 var runPackageManagerCommand = (command, args, spawnImpl = spawn3) => new Promise((resolve, reject) => {
   const child = spawnImpl(command, args, {
     stdio: "inherit",
@@ -2736,37 +2975,52 @@ var runPackageManagerCommand = (command, args, spawnImpl = spawn3) => new Promis
   });
   child.on("error", reject);
   child.on("exit", (code) => resolve(code ?? 1));
-}), defaultDeps3, updateCommands, _runUpdateCommand = async (depsOverrides = {}) => {
+}), defaultDeps7, updateCommands, _runUpdateCommand = async (depsOverrides = {}) => {
   const deps = {
-    ...defaultDeps3,
+    ...defaultDeps7,
     ...depsOverrides
   };
   const method = deps.detectInstallMethod();
   if (method === "binary") {
-    deps.log(`Standalone binary detected. Download the latest release at ${chalk18.cyan(GITHUB_RELEASES_URL)}.`);
+    deps.log(`Standalone binary detected. Download the latest release at ${chalk19.cyan(GITHUB_RELEASES_URL)}.`);
     return;
   }
   if (method === "unknown") {
     deps.log("Could not determine installation method automatically.");
     deps.log(`Try one of these commands:`);
-    deps.log(`  ${chalk18.gray("brew upgrade dotenc")}`);
-    deps.log(`  ${chalk18.gray("scoop update dotenc")}`);
-    deps.log(`  ${chalk18.gray("npm install -g @dotenc/cli")}`);
-    deps.log(`Or download from ${chalk18.cyan(GITHUB_RELEASES_URL)}.`);
+    deps.log(`  ${chalk19.gray("brew update && brew upgrade dotenc")}`);
+    deps.log(`  ${chalk19.gray("scoop update dotenc")}`);
+    deps.log(`  ${chalk19.gray("npm install -g @dotenc/cli")}`);
+    deps.log(`Or download from ${chalk19.cyan(GITHUB_RELEASES_URL)}.`);
     return;
   }
   const updater = updateCommands[method];
   deps.log(`Updating dotenc via ${updater.label}...`);
+  if (method === "homebrew") {
+    try {
+      const brewUpdateCode = await deps.runPackageManagerCommand("brew", [
+        "update"
+      ]);
+      if (brewUpdateCode !== 0) {
+        deps.logError(`${chalk19.red("Error:")} update command exited with code ${brewUpdateCode}.`);
+        deps.exit(brewUpdateCode);
+      }
+    } catch (error) {
+      deps.logError(`${chalk19.red("Error:")} failed to run ${chalk19.gray("brew update")}.`);
+      deps.logError(`${chalk19.red("Details:")} ${error instanceof Error ? error.message : String(error)}`);
+      deps.exit(1);
+    }
+  }
   let exitCode = 0;
   try {
     exitCode = await deps.runPackageManagerCommand(updater.command, updater.args);
   } catch (error) {
-    deps.logError(`${chalk18.red("Error:")} failed to run ${chalk18.gray([updater.command, ...updater.args].join(" "))}.`);
-    deps.logError(`${chalk18.red("Details:")} ${error instanceof Error ? error.message : String(error)}`);
+    deps.logError(`${chalk19.red("Error:")} failed to run ${chalk19.gray([updater.command, ...updater.args].join(" "))}.`);
+    deps.logError(`${chalk19.red("Details:")} ${error instanceof Error ? error.message : String(error)}`);
     deps.exit(1);
   }
   if (exitCode !== 0) {
-    deps.logError(`${chalk18.red("Error:")} update command exited with code ${exitCode}.`);
+    deps.logError(`${chalk19.red("Error:")} update command exited with code ${exitCode}.`);
     deps.exit(exitCode);
   }
 }, updateCommand = async () => {
@@ -2774,7 +3028,7 @@ var runPackageManagerCommand = (command, args, spawnImpl = spawn3) => new Promis
 };
 var init_update2 = __esm(() => {
   init_update();
-  defaultDeps3 = {
+  defaultDeps7 = {
     detectInstallMethod,
     runPackageManagerCommand,
     log: console.log,
@@ -2853,8 +3107,8 @@ var init_whoami = __esm(() => {
 });
 
 // src/helpers/updateNotifier.ts
-import chalk19 from "chalk";
-var CHECK_INTERVAL_MS, defaultDeps4, shouldSkipCheck = (args, env) => {
+import chalk20 from "chalk";
+var CHECK_INTERVAL_MS, defaultDeps8, shouldSkipCheck = (args, env) => {
   if (env.DOTENC_SKIP_UPDATE_CHECK === "1") {
     return true;
   }
@@ -2876,7 +3130,7 @@ var CHECK_INTERVAL_MS, defaultDeps4, shouldSkipCheck = (args, env) => {
   } catch {}
 }, maybeNotifyAboutUpdate = async (depsOverrides = {}) => {
   const deps = {
-    ...defaultDeps4,
+    ...defaultDeps8,
     ...depsOverrides
   };
   if (shouldSkipCheck(deps.args, deps.env)) {
@@ -2909,7 +3163,7 @@ var CHECK_INTERVAL_MS, defaultDeps4, shouldSkipCheck = (args, env) => {
   if (updateState.notifiedVersion === latestVersion) {
     return;
   }
-  deps.log(`${chalk19.yellow("Update available:")} ${chalk19.gray(`dotenc ${deps.currentVersion}`)} -> ${chalk19.cyan(`dotenc ${latestVersion}`)}. Run ${chalk19.gray("dotenc update")}.`);
+  deps.log(`${chalk20.yellow("Update available:")} ${chalk20.gray(`dotenc ${deps.currentVersion}`)} -> ${chalk20.cyan(`dotenc ${latestVersion}`)}. Run ${chalk20.gray("dotenc update")}.`);
   updateState = {
     ...updateState,
     notifiedVersion: latestVersion
@@ -2921,7 +3175,7 @@ var init_updateNotifier = __esm(() => {
   init_homeConfig();
   init_update();
   CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;
-  defaultDeps4 = {
+  defaultDeps8 = {
     getHomeConfig,
     setHomeConfig,
     fetchLatestVersion,
@@ -2975,7 +3229,7 @@ var init_program = __esm(async () => {
   auth.command("grant").argument("[environment]", "the environment to grant access to").argument("[publicKey]", "the name of the public key to grant access to the environment").description("grant access to an environment").action(grantCommand);
   auth.command("revoke").argument("[environment]", "the environment to revoke access from").argument("[publicKey]", "the name of the public key to revoke access from the environment").description("revoke access from an environment").action(revokeCommand);
   auth.command("list").argument("[environment]", "the environment to list access for").description("list keys with access to an environment").action(authListCommand);
-  program.command("run").argument("<command>", "the command to run").argument("[args...]", "the arguments to pass to the command").addOption(new Option("-e, --env <env1>[,env2[,...]]", "the environments to run the command in")).description("run a command in an environment").action(runCommand);
+  program.command("run").argument("<command>", "the command to run").argument("[args...]", "the arguments to pass to the command").addOption(new Option("-e, --env <env1>[,env2[,...]]", "the environments to run the command in")).addOption(new Option("--strict", "fail if any selected environment fails to load")).description("run a command in an environment").action(runCommand);
   program.command("dev").argument("<command>", "the command to run").argument("[args...]", "the arguments to pass to the command").description("shortcut for 'run -e development,<yourname> <command>'").action((command, args) => devCommand(command, args));
   key = program.command("key").description("manage keys");
   key.command("add").argument("[name]", "the name of the public key in the project").addOption(new Option("--from-ssh <path>", "add a public key derived from an SSH key file")).addOption(new Option("-f, --from-file <file>", "add the key from a PEM file")).addOption(new Option("-s, --from-string <string>", "add a public key from a string")).description("add a public key to the project").action(keyAddCommand);