@kaynooo/env-tools 0.0.0-stage → 0.5.0

package/dist/ev.js

@@ -0,0 +1,1542 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/ev.ts
+import process8 from "process";
+
+// ../kit/src/args.ts
+import process4 from "process";
+import { parseArgs } from "util";
+
+// ../kit/src/format.ts
+import process3 from "process";
+
+// ../kit/src/style.ts
+import process2 from "process";
+
+// ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-mtetydvc.js
+function x(s) {
+  let r = s.startsWith("#") ? s.slice(1).toLowerCase() : s.toLowerCase();
+  if (!/^[a-f0-9]+$/.test(r))
+    return [0, 0, 0];
+  let t = r.length, n = (c) => Number.parseInt(c, 16);
+  if (t === 3 || t === 4) {
+    let c = n(r[0] + r[0]), u = n(r[1] + r[1]), h = n(r[2] + r[2]), g = t === 4 ? n(r[3] + r[3]) : undefined;
+    return g !== undefined ? [c, u, h, g] : [c, u, h];
+  }
+  if (t !== 6 && t !== 8)
+    throw Error(`Invalid hex color length: ${t}`);
+  let a = n(r.slice(0, 2)), b = n(r.slice(2, 4)), o = n(r.slice(4, 6)), y = t === 8 ? n(r.slice(6, 8)) : undefined;
+  if ([a, b, o].some(Number.isNaN) || y !== undefined && Number.isNaN(y))
+    throw Error(`Invalid hex color value: ${s}`);
+  return y !== undefined ? [a, b, o, y] : [a, b, o];
+}
+function A(s) {
+  let [r, t, n, a] = s;
+  if (a)
+    return `#${(r << 24 | t << 16 | n << 8 | Math.round((a ?? 1) * 255)).toString(16).padStart(8, "0").toUpperCase()}`;
+  return `#${(r << 16 | t << 8 | n).toString(16).padStart(6, "0").toUpperCase()}`;
+}
+function R(s, r, t) {
+  s = (s % 360 + 360) % 360, t /= 100;
+  let n = r * Math.min(t, 1 - t) / 100, a = (b) => {
+    let o = (b + s / 30) % 12, y = t - n * Math.max(Math.min(o - 3, 9 - o, 1), -1);
+    return Math.round(255 * y);
+  };
+  return [a(0), a(8), a(4)];
+}
+function k(s) {
+  let [r, t, n] = s;
+  r /= 255, t /= 255, n /= 255;
+  let a = Math.max(r, t, n), b = Math.min(r, t, n), o = 0, y = 0, c = (a + b) / 2;
+  if (a !== b) {
+    let u = a - b;
+    if (y = c > 0 && c < 1 ? u / (1 - Math.abs(2 * c - 1)) : 0, a === r)
+      o = (t - n) / u + (t < n ? 6 : 0);
+    else if (a === t)
+      o = (n - r) / u + 2;
+    else
+      o = (r - t) / u + 4;
+    o /= 6;
+  }
+  return [Math.round(o * 360), Math.round(y * 100), Math.round(c * 100)];
+}
+function H(s, r, t) {
+  s = (s % 360 + 360) % 360, r /= 100, t /= 100;
+  let n = (a) => {
+    let b = (a + s / 60) % 6, o = t - t * r * Math.max(Math.min(b, 4 - b, 1), 0);
+    return Math.round(255 * o);
+  };
+  return [n(5), n(3), n(1)];
+}
+function f(s) {
+  let [r, t, n] = s;
+  r /= 255, t /= 255, n /= 255;
+  let a = Math.max(r, t, n), b = Math.min(r, t, n), o = a - b, y = 0, c = a === 0 ? 0 : o / a, u = a;
+  if (o !== 0) {
+    if (a === r)
+      y = (t - n) / o + (t < n ? 6 : 0);
+    else if (a === t)
+      y = (n - r) / o + 2;
+    else
+      y = (r - t) / o + 4;
+    y /= 6;
+  }
+  return [Math.round(y * 360), Math.round(c * 100), Math.round(u * 100)];
+}
+function O(s) {
+  let r = s[0] / 255, t = s[1] / 255, n = s[2] / 255, a = 1 - Math.max(r, t, n);
+  if (a === 1)
+    return [0, 0, 0, 100];
+  let b = (1 - r - a) / (1 - a), o = (1 - t - a) / (1 - a), y = (1 - n - a) / (1 - a);
+  return [Math.round(b * 100), Math.round(o * 100), Math.round(y * 100), Math.round(a * 100)];
+}
+function v(s, r, t, n) {
+  return s /= 100, r /= 100, t /= 100, n /= 100, [Math.round(255 * (1 - s) * (1 - n)), Math.round(255 * (1 - r) * (1 - n)), Math.round(255 * (1 - t) * (1 - n))];
+}
+var m = (s) => s <= 0.04045 ? s / 12.92 : ((s + 0.055) / 1.055) ** 2.4;
+var p = (s) => s <= 0.0031308 ? 12.92 * s : 1.055 * s ** 0.4166666666666667 - 0.055;
+var i = (s, r) => Math.round(s * 10 ** r) / 10 ** r;
+function T(s) {
+  let r = m(s[0] / 255), t = m(s[1] / 255), n = m(s[2] / 255), a = Math.cbrt(0.4122214708 * r + 0.5363325363 * t + 0.0514459929 * n), b = Math.cbrt(0.2119034982 * r + 0.6806995451 * t + 0.1073969566 * n), o = Math.cbrt(0.0883024619 * r + 0.2817188376 * t + 0.6299787005 * n);
+  return [i(0.2104542553 * a + 0.793617785 * b - 0.0040720468 * o, 4), i(1.9779984951 * a - 2.428592205 * b + 0.4505937099 * o, 4), i(0.0259040371 * a + 0.7827717662 * b - 0.808675766 * o, 4)];
+}
+function M(s, r, t) {
+  let n = (s + 0.3963377774 * r + 0.2158037573 * t) ** 3, a = (s - 0.1055613458 * r - 0.0638541728 * t) ** 3, b = (s - 0.0894841775 * r - 1.291485548 * t) ** 3, o = p(4.0767416621 * n - 3.3077115913 * a + 0.2309699292 * b), y = p(-1.2684380046 * n + 2.6097574011 * a - 0.3413193965 * b), c = p(-0.0041960863 * n - 0.7034186147 * a + 1.707614701 * b), u = (h) => Math.min(255, Math.max(0, Math.round(h * 255)));
+  return [u(o), u(y), u(c)];
+}
+function d(s) {
+  let [r, t, n] = T(s), a = Math.sqrt(t * t + n * n), b = (Math.atan2(n, t) * 180 / Math.PI + 360) % 360;
+  return [i(r, 4), i(a, 4), i(b, 2)];
+}
+function C(s, r, t) {
+  let n = t * Math.PI / 180;
+  return M(s, r * Math.cos(n), r * Math.sin(n));
+}
+function l(s) {
+  let r = s / 255;
+  return r <= 0.03928 ? r / 12.92 : ((r + 0.055) / 1.055) ** 2.4;
+}
+
+class e {
+  r;
+  g;
+  b;
+  a;
+  constructor(s, r, t, n = 1) {
+    this.r = s, this.g = r, this.b = t, this.a = n;
+  }
+  static from(s, r) {
+    if (s === "hex") {
+      let [t, n, a, b] = x(r);
+      return new e(t, n, a, b);
+    }
+    if (s === "rgb") {
+      if (Array.isArray(r)) {
+        let [o, y, c, u] = r;
+        return new e(o, y, c, u);
+      }
+      let { r: t, g: n, b: a, a: b } = r;
+      return new e(t, n, a, b);
+    }
+    if (s === "hsl") {
+      let t, n, a, b;
+      if (Array.isArray(r))
+        [t, n, a, b] = r;
+      else
+        ({ h: t, s: n, l: a, a: b } = r);
+      let [o, y, c] = R(t, n, a);
+      return new e(o, y, c, b);
+    }
+    if (s === "hsv") {
+      let t, n, a, b;
+      if (Array.isArray(r))
+        [t, n, a, b] = r;
+      else
+        ({ h: t, s: n, v: a, a: b } = r);
+      let [o, y, c] = H(t, n, a);
+      return new e(o, y, c, b);
+    }
+    if (s === "cmyk") {
+      let t, n, a, b, o;
+      if (Array.isArray(r))
+        [t, n, a, b, o] = r;
+      else
+        ({ c: t, m: n, y: a, k: b, a: o } = r);
+      let [y, c, u] = v(t, n, a, b);
+      return new e(y, c, u, o);
+    }
+    if (s === "oklch") {
+      let t, n, a, b;
+      if (Array.isArray(r))
+        [t, n, a, b] = r;
+      else
+        ({ l: t, c: n, h: a, a: b } = r);
+      let [o, y, c] = C(t, n, a);
+      return new e(o, y, c, b);
+    }
+    if (s === "oklab") {
+      let t, n, a, b;
+      if (Array.isArray(r))
+        [t, n, a, b] = r;
+      else
+        ({ l: t, a: n, b: a, alpha: b } = r);
+      let [o, y, c] = M(t, n, a);
+      return new e(o, y, c, b);
+    }
+    throw Error("Invalid input");
+  }
+  to(s) {
+    switch (s) {
+      case "rgb":
+        return [this.r, this.g, this.b];
+      case "rgba":
+        return [this.r, this.g, this.b, this.a];
+      case "hex":
+        return A([this.r, this.g, this.b]);
+      case "hexa":
+        return A([this.r, this.g, this.b, this.a]);
+      case "hsl":
+        return k([this.r, this.g, this.b]);
+      case "hsla":
+        return [...k([this.r, this.g, this.b]), this.a];
+      case "hsv":
+        return f([this.r, this.g, this.b]);
+      case "hsva":
+        return [...f([this.r, this.g, this.b]), this.a];
+      case "cmyk":
+        return O([this.r, this.g, this.b]);
+      case "cmyka":
+        return [...O([this.r, this.g, this.b]), this.a];
+      case "oklch":
+        return d([this.r, this.g, this.b]);
+      case "oklcha":
+        return [...d([this.r, this.g, this.b]), this.a];
+      case "oklab":
+        return T([this.r, this.g, this.b]);
+      case "oklaba":
+        return [...T([this.r, this.g, this.b]), this.a];
+      default:
+        return [this.r, this.g, this.b];
+    }
+  }
+  getLuminance() {
+    let s = l(this.r), r = l(this.g), t = l(this.b);
+    return 0.2126 * s + 0.7152 * r + 0.0722 * t;
+  }
+  contrastRatio(s) {
+    let r = this.getLuminance(), t = s.getLuminance(), [n, a] = r >= t ? [r, t] : [t, r];
+    return (n + 0.05) / (a + 0.05);
+  }
+  bestContrastForeground() {
+    let s = new e(255, 255, 255, 1), r = new e(0, 0, 0, 1), t = this.contrastRatio(s), n = this.contrastRatio(r);
+    return t >= n ? s : r;
+  }
+}
+
+// ../../node_modules/.bun/@kaynooo+utils@2.31.0+d0769e28dc4dad16/node_modules/@kaynooo/utils/dist/chunk-y1msbssb.js
+var r = 39;
+var o = 49;
+var f2 = "\x1B[";
+var C2 = { reset: [0, 0], bold: [1, 22], dim: [2, 22], italic: [3, 23], underline: [4, 24], inverse: [7, 27], hidden: [8, 28], strikethrough: [9, 29], black: [30, r], red: [31, r], green: [32, r], yellow: [33, r], blue: [34, r], magenta: [35, r], cyan: [36, r], white: [37, r], gray: [90, r], grey: [90, r], blackBright: [90, r], redBright: [91, r], greenBright: [92, r], yellowBright: [93, r], blueBright: [94, r], magentaBright: [95, r], cyanBright: [96, r], whiteBright: [97, r], bgBlack: [40, o], bgRed: [41, o], bgGreen: [42, o], bgYellow: [43, o], bgBlue: [44, o], bgMagenta: [45, o], bgCyan: [46, o], bgWhite: [47, o], bgBlackBright: [100, o], bgRedBright: [101, o], bgGreenBright: [102, o], bgYellowBright: [103, o], bgBlueBright: [104, o], bgMagentaBright: [105, o], bgCyanBright: [106, o], bgWhiteBright: [107, o], rgb: (i, n, a, l = "fg") => [`${l === "fg" ? 38 : 48};2;${i};${n};${a}`, l === "fg" ? r : o], hex: (i, n = "fg") => {
+  let [a, l, s] = e.from("hex", i).to("rgb");
+  return [`${n === "fg" ? 38 : 48};2;${a};${l};${s}`, n === "fg" ? r : o];
+}, ansi256: (i, n = "fg") => [`${n === "fg" ? 38 : 48};5;${i}`, n === "fg" ? r : o] };
+var b = new Set(["", "1", "2", "3", "true"]);
+function h(i, n = globalThis.process?.env ?? {}) {
+  if (n.FORCE_COLOR !== undefined)
+    return b.has(n.FORCE_COLOR);
+  if (n.NO_COLOR !== undefined || n.NODE_DISABLE_COLORS !== undefined || n.TERM === "dumb")
+    return false;
+  return i?.isTTY === true;
+}
+function d2(i, n, a) {
+  if (!h(a.stream ?? globalThis.process?.stdout, a.env))
+    return n;
+  let l = "", s = "";
+  for (let g = 0, y = i.length;g < y; g++) {
+    let [c, p] = i[g];
+    l += `${f2}${c}m`, s = `${f2}${p}m${s}`;
+  }
+  return l + n + s;
+}
+function u(i, n = []) {
+  return new Proxy((l) => d2(n, l, i), { get(l, s) {
+    let g = C2[s];
+    if (Array.isArray(g))
+      return u(i, [...n, g]);
+    if (typeof g === "function")
+      return (...y) => u(i, [...n, g(...y)]);
+    throw Error(`Unknown style: ${String(s)}`);
+  } });
+}
+function le(i = {}) {
+  return u(i);
+}
+var t = le();
+
+// ../kit/src/style.ts
+function takesControlCodes(stream, env = process2.env) {
+  return stream.isTTY === true && env.NO_COLOR === undefined && env.NODE_DISABLE_COLORS === undefined && env.TERM !== "dumb";
+}
+function paint(stream, env = process2.env) {
+  return le({ stream: { isTTY: takesControlCodes(stream, env) }, env });
+}
+var STATUSES = {
+  passed: { symbol: "\u2713", words: ["passed", "success", "succeeded", "ok"], paint: (colors) => colors.green },
+  failed: { symbol: "\u2717", words: ["failed", "failure", "error", "errored"], paint: (colors) => colors.red },
+  running: { symbol: "\u25CF", words: ["running", "in_progress", "started"], paint: (colors) => colors.cyan },
+  queued: { symbol: "\u25CB", words: ["queued", "waiting", "pending", "created", "blocked", "scheduled"], paint: (colors) => colors.yellow },
+  skipped: { symbol: "-", words: ["skipped", "cancelled", "canceled", "manual"], paint: (colors) => colors.dim }
+};
+var STATUS_OF = new Map(Object.entries(STATUSES).flatMap(([status, { words }]) => words.map((word) => [word, status])));
+
+// ../kit/src/format.ts
+function upTo(text, separator) {
+  const end = text.indexOf(separator);
+  return end === -1 ? text : text.slice(0, end);
+}
+function truncate(text, width) {
+  return text.length <= width ? text : `${text.slice(0, Math.max(0, width - 1))}\u2026`;
+}
+var LINE_BREAKS = /\s*\n\s*/g;
+var ESCAPE = String.fromCharCode(27);
+function textWidth(text) {
+  return Bun.stringWidth(text);
+}
+function table(rows, { cellWidth, header = false, align = [], fit } = {}) {
+  const cells = cellWidth === undefined ? rows : rows.map((row) => row.map((cell) => truncate(cell.replaceAll(LINE_BREAKS, " "), cellWidth)));
+  const widths = [];
+  for (const row of cells) {
+    for (const [index, cell] of row.entries())
+      widths[index] = Math.max(widths[index] ?? 0, textWidth(cell));
+  }
+  const shown = fit === undefined ? cells : narrow(cells, widths, fit);
+  const colors = paint(process3.stdout);
+  const lines = shown.map((row) => row.map((cell, index) => {
+    const width = widths[index] ?? 0;
+    const gap = " ".repeat(Math.max(0, width - textWidth(cell)));
+    if (align[index] === "right")
+      return `${gap}${cell}`;
+    return index === row.length - 1 ? cell : `${cell}${gap}`;
+  }).join("  ").trimEnd());
+  return lines.map((line, index) => header && index === 0 ? colors.bold(line) : line).join(`
+`);
+}
+function narrow(rows, widths, limit) {
+  const used = () => widths.reduce((sum, width) => sum + width, 0) + 2 * Math.max(0, widths.length - 1);
+  const cuttable = (index) => rows.every((row) => !(row[index] ?? "").includes(ESCAPE));
+  const floor = 8;
+  while (used() > limit) {
+    let widest = -1;
+    for (const [index, width] of widths.entries()) {
+      if (cuttable(index) && width > floor && width > (widths[widest] ?? 0))
+        widest = index;
+    }
+    if (widest === -1)
+      break;
+    widths[widest] = Math.max(floor, (widths[widest] ?? 0) - (used() - limit));
+  }
+  return rows.map((row) => row.map((cell, index) => textWidth(cell) > (widths[index] ?? 0) ? truncate(cell, widths[index] ?? 0) : cell));
+}
+function printJson(value) {
+  console.log(JSON.stringify(value, undefined, 2));
+}
+
+// ../kit/src/args.ts
+function jsonOption(holds) {
+  return { type: "boolean", description: holds === undefined ? "print JSON" : `print JSON: ${holds}` };
+}
+
+class Exit extends Error {
+  code;
+  hint;
+  constructor(message, code, hint) {
+    super(message);
+    this.code = code;
+    this.hint = hint;
+  }
+}
+function fail(message, code = 2, hint) {
+  throw new Exit(message, code, hint);
+}
+
+class UsageError extends Exit {
+  constructor(message) {
+    super(message, 2);
+  }
+}
+function badUsage(message) {
+  throw new UsageError(message);
+}
+
+class HelpShown extends Exit {
+  constructor() {
+    super("help shown", 0);
+  }
+}
+
+class Completing {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+}
+var completion = { active: false };
+var OPTIONAL = /\[[^\]]+\]/g;
+var USAGE_PREFIX = /^usage:\s*/i;
+var FULL_STOP = /\.$/;
+function usageLine(usage, colors = paint(process4.stdout)) {
+  return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
+}
+function helpText(usage, options, colors = paint(process4.stdout), { examples = [], replaces } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+`);
+}
+function replacesRows(replaces, colors = paint(process4.stdout)) {
+  return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
+}
+function wantsHelpJson(env = process4.env) {
+  return env.KIT_HELP === "json";
+}
+function description(usage, { examples = [], replaces } = {}) {
+  const lines = usage.replace(USAGE_PREFIX, "").split(`
+`);
+  const first = lines[0];
+  const colon = first.indexOf(": ");
+  const prose = lines[lines.indexOf("") + 1] ?? "";
+  const fallback = lines.includes("") ? `${prose.charAt(0).toLowerCase()}${prose.slice(1)}`.replace(FULL_STOP, "") : "";
+  return {
+    synopsis: colon === -1 ? first : first.slice(0, colon),
+    summary: colon === -1 ? fallback : first.slice(colon + 2),
+    ...replaces === undefined ? {} : { replaces },
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
+  };
+}
+function exampleRows(examples, colors = paint(process4.stdout)) {
+  if (examples.length === 0)
+    return [];
+  return ["", colors.bold("Examples:"), ...examples.map((example) => typeof example === "string" ? `  ${example}` : `  ${example[0]}  ${colors.dim(`# ${example[1]}`)}`)];
+}
+function optionRows(options, colors = paint(process4.stdout)) {
+  const rows = Object.entries(options).map(([name, option]) => {
+    const short = option.short === undefined ? "    " : `${colors.cyan(`-${option.short}`)}, `;
+    const value = option.type === "string" ? ` ${colors.dim("<value>")}` : "";
+    return { flag: `${short}${colors.cyan(`--${name}`)}${value}`, width: `-x, --${name}`.length + (option.type === "string" ? " <value>".length : 0), description: option.description };
+  });
+  const width = Math.max(0, ...rows.map((row) => row.width));
+  return rows.map((row) => `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
+}
+var OUTPUT_OPTIONS = {
+  color: { type: "string", description: "auto (on a terminal alone), always or never" },
+  plain: { type: "boolean", description: "plain text, no colour or spinner: --color never" }
+};
+function applyOutput(color, plain, env = process4.env) {
+  const when = plain === true ? "never" : color ?? "auto";
+  if (when === "auto")
+    return;
+  if (when !== "always" && when !== "never")
+    badUsage(`--color takes auto, always or never, not ${when}`);
+  if (when === "always") {
+    env.FORCE_COLOR = "1";
+    delete env.NO_COLOR;
+  } else {
+    env.NO_COLOR = "1";
+    delete env.FORCE_COLOR;
+  }
+}
+function parse(args, usage, options, settings = {}) {
+  const output = Object.fromEntries(Object.entries(OUTPUT_OPTIONS).filter(([name]) => !(name in options)));
+  const all = { ...options, ...output, help: { type: "boolean", short: "h", description: "show this help" } };
+  if (completion.active)
+    throw new Completing(all);
+  const separator = settings.rest === true ? args.indexOf("--") : -1;
+  const own = separator === -1 ? args : args.slice(0, separator);
+  const rest = separator === -1 ? undefined : args.slice(separator + 1);
+  let parsed;
+  try {
+    parsed = parseArgs({ args: joinDashValues(own, all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+  } catch (error) {
+    badUsage(parseError(error));
+  }
+  const values = parsed.values;
+  applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
+  if (values.help === true) {
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, all, undefined, settings));
+    throw new HelpShown;
+  }
+  if (settings.positionals !== undefined)
+    checkPositionals(parsed.positionals, settings.positionals);
+  return { ...parsed, positionals: parsed.positionals, rest };
+}
+function checkPositionals(given, names) {
+  const variadic = names.at(-1)?.replace("]", "").endsWith("...") === true;
+  const required = names.filter((name) => !name.startsWith("[")).length;
+  if (given.length < required)
+    badUsage(`missing ${names[given.length]}`);
+  if (!variadic && given.length > names.length)
+    badUsage(`unexpected argument ${given[names.length]}`);
+}
+function joinDashValues(args, options) {
+  const longOf = new Map(Object.entries(options).flatMap(([name, option]) => option.short === undefined ? [[`--${name}`, name]] : [[`--${name}`, name], [`-${option.short}`, name]]));
+  const isOption = (arg) => arg === "--" || longOf.has(arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg);
+  const joined = [];
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i] ?? "";
+    if (arg === "--")
+      return [...joined, ...args.slice(i)];
+    const name = longOf.get(arg);
+    const next = args[i + 1];
+    if (name !== undefined && options[name]?.type === "string" && next !== undefined && next.startsWith("-") && next !== "-" && !isOption(next)) {
+      joined.push(`--${name}=${next}`);
+      i++;
+    } else {
+      joined.push(arg);
+    }
+  }
+  return joined;
+}
+function parseError(error) {
+  const message = upTo(error instanceof Error ? error.message : String(error), ". ");
+  return `${message.charAt(0).toLowerCase()}${message.slice(1)}`;
+}
+async function readInput(path, { noStdin = "nothing is piped on stdin" } = {}) {
+  if (path === "-") {
+    if (process4.stdin.isTTY)
+      fail(noStdin);
+    return Bun.stdin.text();
+  }
+  const file = Bun.file(path);
+  if (!await file.exists())
+    fail(`no file ${path}`);
+  return file.text();
+}
+// ../kit/src/cli.ts
+import process5 from "process";
+
+// ../kit/src/text.ts
+var ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
+function distance(a, b) {
+  let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (const [i, left] of [...a].entries()) {
+    const current = [i + 1];
+    for (const [j, right] of [...b].entries())
+      current.push(Math.min((previous[j + 1] ?? 0) + 1, (current[j] ?? 0) + 1, (previous[j] ?? 0) + (left === right ? 0 : 1)));
+    previous = current;
+  }
+  return previous[b.length] ?? 0;
+}
+
+// ../kit/src/cli.ts
+var LEVEL_OPTIONS = {
+  ...OUTPUT_OPTIONS,
+  help: { type: "boolean", short: "h", description: "show this help" }
+};
+var TOP_OPTIONS = { ...LEVEL_OPTIONS, version: { type: "boolean", short: "v", description: "print the version" } };
+function commandRows(commands, colors) {
+  const width = Math.max(...Object.keys(commands).map((name) => name.length));
+  const groups = new Map([["Commands:", []]]);
+  for (const [name, { summary, group }] of Object.entries(commands)) {
+    const heading = group === undefined ? "Commands:" : `${group}:`;
+    const rows = groups.get(heading) ?? [];
+    rows.push(`  ${colors.cyan(name.padEnd(width))}  ${colors.dim(summary)}`);
+    groups.set(heading, rows);
+  }
+  return [...groups].filter(([, rows]) => rows.length > 0).flatMap(([heading, rows], index) => [...index === 0 ? [] : [""], colors.bold(heading), ...rows]);
+}
+function takeOutputFlags(argv) {
+  let index = 0;
+  for (;index < argv.length; index++) {
+    const word = argv[index];
+    if (word === "--plain")
+      applyOutput(undefined, true);
+    else if (word.startsWith("--color="))
+      applyOutput(word.slice("--color=".length), undefined);
+    else if (word === "--color" && argv[index + 1] !== undefined)
+      applyOutput(argv[++index], undefined);
+    else
+      break;
+  }
+  return argv.slice(index);
+}
+function closest(name, names) {
+  const started = names.find((known) => known.startsWith(name));
+  if (started !== undefined)
+    return started;
+  const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
+  return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
+}
+async function help({ path, header, summary, commands, defaultCommand, examples, replaces }, stream) {
+  const colors = paint(stream);
+  const prefix = path.join(" ");
+  if (wantsHelpJson())
+    return JSON.stringify(description(`${prefix} <command> [options]: ${summary}`, { examples, replaces }));
+  const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
+  const options = fallback !== undefined && "run" in fallback ? await optionsOf(fallback.run) : undefined;
+  const own = Object.entries(options ?? {}).filter(([name]) => !(name in TOP_OPTIONS));
+  return [
+    header(colors),
+    "",
+    usageLine(`${prefix} ${defaultCommand === undefined ? colors.cyan("<command>") : `[${colors.cyan("<command>")}]`} [options]`, colors),
+    ...replacesRows(replaces, colors),
+    "",
+    ...commandRows(commands, colors),
+    ...own.length === 0 ? [] : ["", `${colors.bold(`Options of ${defaultCommand}:`)} ${colors.dim("the command run when none is named")}`, ...optionRows(Object.fromEntries(own), colors)],
+    "",
+    colors.bold("Options:"),
+    ...optionRows(path.length === 1 ? TOP_OPTIONS : LEVEL_OPTIONS, colors),
+    ...exampleRows(examples ?? [], colors),
+    "",
+    `${colors.dim("Run")} ${prefix} ${colors.cyan("<command>")} --help ${colors.dim("for its options.")}`
+  ].join(`
+`);
+}
+function printError(prefix, message, hint, cause) {
+  const colors = paint(process5.stderr);
+  const styled = takesControlCodes(process5.stderr);
+  const head = styled ? `${colors.red.bold("error")} ${colors.dim(`${prefix}:`)}` : `error: ${prefix}:`;
+  const under = (label, text, tint) => text === undefined ? "" : `
+  ${styled ? tint(label) : `${label}:`} ${text}`;
+  console.error(`${head} ${message}${under("cause", cause, colors.dim)}${under("hint", hint, colors.yellow)}`);
+}
+function printJsonError(message, hint, cause) {
+  console.error(JSON.stringify({ error: message, ...hint === undefined ? {} : { hint }, ...cause === undefined ? {} : { cause } }));
+}
+function wantsJson(argv) {
+  const end = argv.indexOf("--");
+  return (end === -1 ? argv : argv.slice(0, end)).includes("--json");
+}
+function reportThrown(prefix, error, redact = (text) => text, json = false) {
+  if (error instanceof HelpShown)
+    return 0;
+  const help = error instanceof UsageError ? `run ${prefix} --help for its options` : undefined;
+  const named = error instanceof Error && !(error instanceof Exit) && error.name !== "Error" ? `${error.name}: ${error.message}` : undefined;
+  const cause = error instanceof Error && error.cause instanceof Error ? redact(error.cause.message) : undefined;
+  const report = json ? printJsonError : (message, hint, causeText) => printError(prefix, message, hint, causeText);
+  report(redact(named ?? (error instanceof Error ? error.message : String(error))), error instanceof Exit ? error.hint ?? help : undefined, cause);
+  return error instanceof Exit ? error.code : 1;
+}
+async function dispatch(level, typed, { version, redact }) {
+  const prefix = level.path.join(" ");
+  let argv;
+  try {
+    argv = takeOutputFlags(typed);
+  } catch (error) {
+    return reportThrown(prefix, error);
+  }
+  const [name, ...args] = argv;
+  if (name === undefined && level.path.length > 1) {
+    console.error(await help(level, process5.stderr));
+    return 2;
+  }
+  if (name === undefined || name === "help" || name === "--help" || name === "-h") {
+    console.log(await help(level, process5.stdout));
+    return 0;
+  }
+  if (level.path.length === 1 && (name === "--version" || name === "-v")) {
+    console.log(version);
+    return 0;
+  }
+  let command = level.commands[level.aliases?.[name] ?? name];
+  let rest = args;
+  if (command === undefined && level.defaultCommand !== undefined) {
+    command = level.commands[level.defaultCommand];
+    rest = argv;
+  }
+  if (command === undefined) {
+    const meant = closest(name, Object.keys(level.commands));
+    printError(prefix, `no command ${name}`, meant === undefined ? `run ${prefix} --help for its commands` : `did you mean ${meant}?`);
+    return 2;
+  }
+  if ("commands" in command) {
+    const { summary } = command;
+    return dispatch({ path: [...level.path, name], header: (colors) => `${colors.bold(`${prefix} ${name}`)}  ${summary}`, summary, commands: command.commands, aliases: command.aliases, defaultCommand: undefined, examples: command.examples, replaces: undefined }, rest, { version, redact });
+  }
+  try {
+    return await command.run(rest);
+  } catch (error) {
+    return reportThrown(`${prefix} ${name}`, error, redact, wantsJson(rest));
+  }
+}
+var COMPLETE = "__complete";
+var FILES = "__files__";
+async function optionsOf(run) {
+  completion.active = true;
+  try {
+    await run([]);
+  } catch (error) {
+    if (error instanceof Completing)
+      return error.options;
+  } finally {
+    completion.active = false;
+  }
+  return {};
+}
+async function leafCandidates(run, words) {
+  if (!(words.at(-1) ?? "").startsWith("-"))
+    return [FILES];
+  return Object.entries(await optionsOf(run)).map(([name, option]) => `--${name}	${option.description}`);
+}
+async function candidates(commands, aliases, defaultCommand, words) {
+  const [word = "", ...rest] = words;
+  const command = commands[aliases?.[word] ?? word];
+  if (rest.length === 0 && !word.startsWith("-"))
+    return Object.entries(commands).map(([name, { summary }]) => `${name}	${summary}`);
+  if (command === undefined) {
+    const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
+    return fallback !== undefined && "run" in fallback ? leafCandidates(fallback.run, words) : [];
+  }
+  return "commands" in command ? candidates(command.commands, command.aliases, undefined, rest) : leafCandidates(command.run, rest);
+}
+async function printCandidates(found) {
+  for (const line of await found)
+    console.log(line);
+  return 0;
+}
+async function runCli(cli, argv = process5.argv.slice(2)) {
+  if (argv[0] === COMPLETE)
+    return printCandidates(candidates(cli.commands, cli.aliases, cli.defaultCommand, argv.slice(1)));
+  return dispatch({ path: [cli.name], header: (colors) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${cli.about}`, summary: cli.about, commands: cli.commands, aliases: cli.aliases, defaultCommand: cli.defaultCommand, examples: cli.examples, replaces: cli.replaces }, argv, { version: cli.version, redact: cli.redact });
+}
+async function runMain({ name, version, run, redact }, argv = process5.argv.slice(2)) {
+  if (argv[0] === COMPLETE)
+    return printCandidates(leafCandidates(run, argv.slice(1)));
+  if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
+    console.log(version);
+    return 0;
+  }
+  try {
+    return await run(argv);
+  } catch (error) {
+    return reportThrown(name, error, redact, wantsJson(argv));
+  }
+}
+// package.json
+var version = "0.5.0";
+
+// src/commands/audit.ts
+import { stat as stat3 } from "fs/promises";
+import { relative, resolve } from "path";
+import process7 from "process";
+
+// src/audit.ts
+import { readdir as readdir2, stat } from "fs/promises";
+import { dirname, join } from "path";
+var {$ } = globalThis.Bun;
+
+// src/files.ts
+import { readdir } from "fs/promises";
+
+// src/dotenv.ts
+var ASSIGNMENT = /^\s*(?:export\s+)?([A-Z_][\w.-]*)\s*=(.*)$/i;
+var EXPORTED = /^\s*export\s/;
+var INLINE_COMMENT = /\s+#.*$/;
+var CARRIAGE_RETURN = /\r$/;
+var ESCAPES = { n: `
+`, r: "\r", t: "\t", '"': '"', "\\": "\\" };
+var NEEDS_QUOTES = /[\s#"'\\$`]/;
+function closingQuote(text, quote) {
+  for (let index = 0;index < text.length; index++) {
+    if (quote === '"' && text[index] === "\\")
+      index++;
+    else if (text[index] === quote)
+      return index;
+  }
+  return -1;
+}
+function unescapeDouble(text) {
+  let out = "";
+  for (let index = 0;index < text.length; index++) {
+    const next = text[index + 1];
+    if (text[index] === "\\" && next !== undefined && next in ESCAPES) {
+      out += ESCAPES[next];
+      index++;
+    } else {
+      out += text[index];
+    }
+  }
+  return out;
+}
+function parseDotenv(text) {
+  const physical = text.split(`
+`);
+  const lines = [];
+  for (let index = 0;index < physical.length; index++) {
+    const line = physical[index] ?? "";
+    const match = ASSIGNMENT.exec(line.replace(CARRIAGE_RETURN, ""));
+    if (match === null) {
+      lines.push({ raw: line });
+      continue;
+    }
+    const [, key = "", rest = ""] = match;
+    const start = rest.trimStart();
+    const quote = start[0];
+    if (quote !== '"' && quote !== "'" && quote !== "`") {
+      lines.push({ raw: line, key, value: start.replace(INLINE_COMMENT, "").trim() });
+      continue;
+    }
+    let body = start.slice(1);
+    let raw = line;
+    let end = closingQuote(body, quote);
+    while (end === -1 && index + 1 < physical.length) {
+      index++;
+      body += `
+${(physical[index] ?? "").replace(CARRIAGE_RETURN, "")}`;
+      raw += `
+${physical[index] ?? ""}`;
+      end = closingQuote(body, quote);
+    }
+    const inner = end === -1 ? body : body.slice(0, end);
+    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : inner });
+  }
+  return { lines };
+}
+function serializeDotenv(file) {
+  return file.lines.map((line) => line.raw).join(`
+`);
+}
+function entries(file) {
+  const map = new Map;
+  for (const line of file.lines) {
+    if (line.key !== undefined)
+      map.set(line.key, line.value ?? "");
+  }
+  return map;
+}
+function formatAssignment(key, value) {
+  if (value === "" || !NEEDS_QUOTES.test(value))
+    return `${key}=${value}`;
+  const escaped = value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("\r", "\\r").replaceAll(`
+`, "\\n");
+  return `${key}="${escaped}"`;
+}
+function setLine(file, key, value, raw) {
+  const index = file.lines.findLastIndex((line) => line.key === key);
+  const existing = file.lines[index];
+  if (existing !== undefined) {
+    const exported = EXPORTED.test(existing.raw) ? "export " : "";
+    file.lines[index] = { raw: raw ?? `${exported}${formatAssignment(key, value)}`, key, value };
+    return;
+  }
+  const line = { raw: raw ?? formatAssignment(key, value), key, value };
+  const last = file.lines.at(-1);
+  if (last === undefined)
+    file.lines.push(line, { raw: "" });
+  else if (last.raw === "")
+    file.lines.splice(-1, 0, line);
+  else
+    file.lines.push(line, { raw: "" });
+}
+function removeKey(file, key) {
+  const before = file.lines.length;
+  file.lines = file.lines.filter((line) => line.key !== key);
+  return before - file.lines.length;
+}
+function lastLine(file, key) {
+  return file.lines.findLast((line) => line.key === key);
+}
+
+// src/mask.ts
+var MIN_KNOWN_LENGTH = 6;
+var SECRET_KEY = /TOKEN|SECRET|PASSWORD|KEY|PRIVATE|DSN/i;
+var URL_PASSWORD = /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]*:([^\s@/]+)@/dgi;
+var ESCAPE2 = /[.*+?^${}()|[\]\\]/g;
+var TOKEN_FORMATS = [
+  ["GitHub token", /\b(?:gh[pousr]_|github_pat_)\w{20,}/g],
+  ["GitLab token", /\bglpat-[\w-]{20,}/g],
+  ["API key", /\bsk-[\w-]{20,}/g],
+  ["Slack token", /\bxox[abprs]-[\w-]{10,}/g],
+  ["JWT", /\beyJ[\w-]+\.[\w-]+\.[\w-]+/g]
+];
+var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+var PEM_END = /-----END [A-Z ]*PRIVATE KEY-----/;
+function isSecretKey(key) {
+  return SECRET_KEY.test(key);
+}
+function hint(value) {
+  const shown = Math.min(3, Math.floor(value.length / 4));
+  return `${value.slice(0, shown)}***(${value.length})`;
+}
+function knownSecrets(pairs) {
+  const keys = new Map;
+  for (const [key, value] of pairs) {
+    if (value.length >= MIN_KNOWN_LENGTH && !keys.has(value))
+      keys.set(value, key);
+  }
+  if (keys.size === 0)
+    return { pattern: undefined, keys };
+  const alternatives = [...keys.keys()].sort((a, b) => b.length - a.length).map((value) => value.replace(ESCAPE2, "\\$&"));
+  return { pattern: new RegExp(`(?<!\\w)(?:${alternatives.join("|")})(?!\\w)`, "g"), keys };
+}
+function urlPasswords(text) {
+  return [...text.matchAll(URL_PASSWORD)].flatMap((url) => url[1] ?? []);
+}
+function findSecrets(line, known) {
+  const found = [];
+  for (const url of line.matchAll(URL_PASSWORD)) {
+    const [start, end] = url.indices?.[1] ?? [];
+    if (start !== undefined && end !== undefined)
+      found.push({ start, end, kind: "URL password", mask: "***" });
+  }
+  for (const [kind, pattern] of TOKEN_FORMATS) {
+    for (const token of line.matchAll(pattern))
+      found.push({ start: token.index, end: token.index + token[0].length, kind, mask: hint(token[0]) });
+  }
+  if (known?.pattern !== undefined) {
+    for (const value of line.matchAll(known.pattern))
+      found.push({ start: value.index, end: value.index + value[0].length, kind: `value of ${known.keys.get(value[0])}`, mask: hint(value[0]) });
+  }
+  found.sort((a, b) => a.start - b.start || b.end - a.end);
+  const kept = [];
+  for (const match of found) {
+    if (match.start >= (kept.at(-1)?.end ?? 0))
+      kept.push(match);
+  }
+  return kept;
+}
+function maskLine(line, known) {
+  let out = "";
+  let at = 0;
+  for (const match of findSecrets(line, known)) {
+    out += line.slice(at, match.start) + match.mask;
+    at = match.end;
+  }
+  return out + line.slice(at);
+}
+function maskValue(key, value) {
+  if (value === "")
+    return value;
+  return isSecretKey(key) || PEM_BEGIN.test(value) ? hint(value) : maskLine(value);
+}
+
+// src/files.ts
+var ENV_FILE = /^\.env(?:\..+)?$/;
+var TEMPLATE = /\.(?:example|sample|template|dist|defaults)$/;
+async function envFiles(folder = process.cwd()) {
+  const found = await readdir(folder, { withFileTypes: true });
+  return found.filter((entry) => entry.isFile() && ENV_FILE.test(entry.name)).map((entry) => entry.name).sort();
+}
+async function readEnv(path) {
+  const file = Bun.file(path);
+  if (!await file.exists())
+    fail(`${path} does not exist`);
+  return parseDotenv(await file.text());
+}
+async function writeEnv(path, file) {
+  await Bun.write(path, serializeDotenv(file));
+}
+async function loadKnown(folder = process.cwd()) {
+  const pairs = [];
+  for (const name of await envFiles(folder)) {
+    for (const [key, value] of entries(parseDotenv(await Bun.file(`${folder}/${name}`).text()))) {
+      if (isSecretKey(key))
+        pairs.push([key, value]);
+      else
+        pairs.push(...urlPasswords(value).map((password) => [key, password]));
+    }
+  }
+  return knownSecrets(pairs);
+}
+
+// src/audit.ts
+var MAX_DEPTH = 5;
+var SKIPPED = new Set(["node_modules", ".git", "vendor"]);
+var COMPOSE_FILE = /^(?:docker-)?compose[\w.-]*\.ya?ml$/;
+var ENTRY = /^\s*(?:-\s*)?["']?([A-Z0-9_]+)["']?\s*[:=]\s*["']?([^"'\s#]+)/;
+var SECRET_NAME = /(?:PASSWORD|PASSWD|SECRET|TOKEN|KEY)$/;
+var FLAG = /^(?:[01]|yes|no|true|false)$/i;
+function isInlineSecret(name, value) {
+  if (value === "" || value.startsWith("$") || value.startsWith("/run/secrets/") || FLAG.test(value))
+    return false;
+  return SECRET_NAME.test(name) || urlPasswords(value).some((password) => !password.startsWith("$"));
+}
+function inlineSecrets(compose) {
+  const names = compose.split(`
+`).flatMap((line) => {
+    const [, name = "", value = ""] = ENTRY.exec(line) ?? [];
+    return isInlineSecret(name, value) ? [name] : [];
+  });
+  return [...new Set(names)];
+}
+async function openToOthers(path) {
+  if (((await stat(path)).mode & 4) === 0)
+    return false;
+  for (let dir = dirname(path);dir !== "/"; dir = dirname(dir)) {
+    if (((await stat(dir)).mode & 1) === 0)
+      return false;
+  }
+  return true;
+}
+async function tracked(path) {
+  return (await $`git ls-files --error-unmatch -- ${path}`.cwd(dirname(path)).quiet().nothrow()).exitCode === 0;
+}
+async function* candidates2(root, unread, depth = 0) {
+  let found;
+  try {
+    found = await readdir2(root, { withFileTypes: true });
+  } catch {
+    unread.push(root);
+    return;
+  }
+  for (const entry of found) {
+    const path = join(root, entry.name);
+    if (entry.isDirectory() && depth < MAX_DEPTH && !SKIPPED.has(entry.name))
+      yield* candidates2(path, unread, depth + 1);
+    else if (entry.isFile() && !TEMPLATE.test(entry.name) && (ENV_FILE.test(entry.name) || COMPOSE_FILE.test(entry.name)))
+      yield path;
+  }
+}
+async function audit(roots) {
+  const exposed = [];
+  const unread = [];
+  for (const root of roots) {
+    for await (const path of candidates2(root, unread)) {
+      const readable = await openToOthers(path);
+      const name = path.slice(path.lastIndexOf("/") + 1);
+      if (ENV_FILE.test(name)) {
+        const isTracked = await tracked(path);
+        if (readable || isTracked)
+          exposed.push({ path, readable, tracked: isTracked });
+        continue;
+      }
+      const secrets = readable ? inlineSecrets(await Bun.file(path).text()) : [];
+      if (secrets.length > 0)
+        exposed.push({ path, readable, tracked: false, secrets });
+    }
+  }
+  return { exposed: exposed.sort((a, b) => a.path.localeCompare(b.path)), unread };
+}
+
+// src/fix.ts
+import { chmod, chown, rm, stat as stat2, writeFile } from "fs/promises";
+import { dirname as dirname2, join as join2 } from "path";
+var MAP_ENTRY = /^(\s*)(["']?)([A-Z0-9_]+)\2(\s*:)(.*)$/;
+var LIST_ENTRY = /^(\s*-[ \t]*)(["']?)([A-Z0-9_]+)=(.*)$/;
+var TRAILING = /^\s*(?:#.*)?$/;
+var PLAIN_COMMENT = /\s+#.*$/;
+var NOT_PLAIN = /^[|>&*![{]/;
+var ENV_PLAIN = /^[^\s#"'\\$`]*$/;
+function quoted(text, quote) {
+  let value = "";
+  for (let index = 0;index < text.length; index++) {
+    const char = text[index] ?? "";
+    const next = text[index + 1];
+    if (quote === "'" && char === "'" && next === "'") {
+      value += "'";
+      index++;
+    } else if (quote === '"' && char === "\\") {
+      if (next !== "\\" && next !== '"')
+        return;
+      value += next;
+      index++;
+    } else if (char === quote) {
+      return { value, after: text.slice(index + 1) };
+    } else {
+      value += char;
+    }
+  }
+  return;
+}
+function plain(text) {
+  const value = text.replace(PLAIN_COMMENT, "").trimEnd();
+  return { value, after: text.slice(value.length) };
+}
+function composeEntry(line) {
+  const map = MAP_ENTRY.exec(line);
+  if (map !== null) {
+    const [, indent = "", keyQuote = "", key = "", colon = "", spaced = ""] = map;
+    const rest = spaced.trimStart();
+    const separator = colon + spaced.slice(0, spaced.length - rest.length);
+    const quote = rest[0] === '"' || rest[0] === "'" ? rest[0] : "";
+    const scalar = quote === "" ? plain(rest) : quoted(rest.slice(1), quote);
+    if (scalar === undefined || !TRAILING.test(scalar.after))
+      return { key, value: rest, unmovable: "its value is written in a form ev does not rewrite" };
+    if (quote === "" && NOT_PLAIN.test(scalar.value))
+      return { key, value: scalar.value, unmovable: "its value is a block, anchor, alias, tag or collection" };
+    return { key, value: scalar.value, swap: (ref) => `${indent}${keyQuote}${key}${keyQuote}${separator}${quote}${ref}${quote}${scalar.after}` };
+  }
+  const list = LIST_ENTRY.exec(line);
+  if (list === null)
+    return;
+  const [, dash = "", quote = "", key = "", rest = ""] = list;
+  const scalar = quote === "" ? plain(rest) : quoted(rest, quote);
+  if (scalar === undefined || !TRAILING.test(scalar.after))
+    return { key, value: rest, unmovable: "its value is written in a form ev does not rewrite" };
+  return { key, value: scalar.value, swap: (ref) => `${dash}${quote}${key}=${ref}${quote}${scalar.after}` };
+}
+function envLine(key, value) {
+  if (ENV_PLAIN.test(value))
+    return `${key}=${value}`;
+  return value.includes("'") || value.includes(`
+`) ? undefined : `${key}='${value}'`;
+}
+async function resolved(path) {
+  const run = Bun.spawn(["docker", "compose", "-f", path, "config", "--format", "json"], { cwd: dirname2(path), stdout: "pipe", stderr: "ignore", stdin: "ignore" });
+  const [out, code] = await Promise.all([new Response(run.stdout).text(), run.exited]);
+  return code === 0 ? out : undefined;
+}
+function gainedBy(before, after, key) {
+  const services = (config) => Object.entries(JSON.parse(config).services ?? {});
+  const had = new Set(services(before).filter(([, service]) => service.environment?.[key] !== undefined).map(([name]) => name));
+  return services(after).filter(([name, service]) => service.environment?.[key] !== undefined && !had.has(name)).map(([name]) => name);
+}
+async function shutOthersOut(path) {
+  try {
+    await chmod(path, (await stat2(path)).mode & 504);
+    return true;
+  } catch (error) {
+    if (error.code === "EPERM")
+      return false;
+    throw error;
+  }
+}
+async function fixCompose(path) {
+  const env = join2(dirname2(path), ".env");
+  const compose = await Bun.file(path).text();
+  const envBefore = await Bun.file(env).exists() ? await Bun.file(env).text() : undefined;
+  const dotenv = parseDotenv(envBefore ?? "");
+  const known = entries(dotenv);
+  const fix = { path, env, moved: [], left: [], open: [] };
+  const lines = compose.split(`
+`).map((line) => {
+    const entry = composeEntry(line);
+    if (entry === undefined || !isInlineSecret(entry.key, entry.value))
+      return line;
+    const { key } = entry;
+    if ("unmovable" in entry) {
+      fix.left.push({ key, why: entry.unmovable });
+      return line;
+    }
+    if (entry.value.replaceAll("$$", "").includes("$")) {
+      fix.left.push({ key, why: "its value reads another variable" });
+      return line;
+    }
+    const value = entry.value.replaceAll("$$", "$");
+    const existing = known.get(key);
+    if (existing === undefined) {
+      const raw = envLine(key, value);
+      if (raw === undefined) {
+        fix.left.push({ key, why: "its value holds a quote or line break a .env cannot keep literal" });
+        return line;
+      }
+      setLine(dotenv, key, value, raw);
+      known.set(key, value);
+    } else if (existing !== value) {
+      fix.left.push({ key, why: `${env.slice(env.lastIndexOf("/") + 1)} already sets it to another value` });
+      return line;
+    }
+    if (!fix.moved.includes(key))
+      fix.moved.push(key);
+    return entry.swap(`\${${key}}`);
+  });
+  if (fix.moved.length > 0)
+    await move(fix, compose, lines.join(`
+`), envBefore, serializeDotenv(dotenv));
+  for (const file of [path, env]) {
+    if (await Bun.file(file).exists() && !await shutOthersOut(file))
+      fix.open.push(file);
+  }
+  return fix;
+}
+async function move(fix, compose, composeAfter, envBefore, envAfter) {
+  const { path, env } = fix;
+  const docker = Bun.which("docker") !== null;
+  const before = docker ? await resolved(path) : undefined;
+  if (envBefore === undefined) {
+    await writeFile(env, envAfter, { mode: 384 });
+    const { uid, gid } = await stat2(path);
+    try {
+      await chown(env, uid, gid);
+    } catch {}
+  } else {
+    await writeFile(env, envAfter);
+  }
+  await writeFile(path, composeAfter);
+  if (!docker) {
+    fix.check = "no docker";
+    return;
+  }
+  if (before === undefined) {
+    fix.check = "fails before";
+    return;
+  }
+  const after = await resolved(path);
+  if (after === before) {
+    fix.check = "same";
+    return;
+  }
+  await writeFile(path, compose);
+  if (envBefore === undefined)
+    await rm(env);
+  else
+    await writeFile(env, envBefore);
+  fix.check = "rolled back";
+  fix.left.push(...fix.moved.map((key) => {
+    const gained = after === undefined ? [] : gainedBy(before, after, key);
+    return { key, why: gained.length > 0 ? `${gained.join(", ")} ${gained.length > 1 ? "load" : "loads"} the .env through env_file and would gain it, so it was put back` : "docker compose config resolved differently once moved, so it was put back" };
+  }));
+  fix.moved = [];
+}
+
+// src/commands/audit.ts
+var usage = `ev audit [dir...] [--fix]
+
+Lists the .env files any account on the machine can read or git tracks, and the compose files any account can read that write a secret out (a secret-named value or a URL password) instead of reading it from a .env, never printing a value.
+Looks under each folder (the current one by default) down to 5 levels, skipping node_modules, vendor and .git, and leaves .example, .sample, .template and .dist files out. A folder it cannot read is named on stderr.
+With --fix, moves each secret a listed compose file writes out into the .env beside it as \${KEY}, puts it back when \`docker compose config\` resolves differently after, and shuts other accounts out of both files and of every listed .env; a key the .env already sets to another value stays put.
+Exits 0 when it finds none (with --fix, when none is left), 1 when it finds one, 2 on a usage error.`;
+var options = {
+  json: jsonOption("the findings and the folders it could not read"),
+  fix: { type: "boolean", description: "move inline compose secrets into a .env and shut other accounts out" }
+};
+var SHELL_SAFE = /^[\w./-]+$/;
+var MAX_UNREAD_LISTED = 3;
+var CHECKS = {
+  same: "docker compose config resolves the same",
+  "rolled back": "docker compose config resolved differently, so everything was put back",
+  "no docker": "not checked against docker compose config: docker is not installed",
+  "fails before": "not checked against docker compose config: it already failed on the file"
+};
+async function isFolder(path) {
+  try {
+    return (await stat3(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function quoted2(path) {
+  return SHELL_SAFE.test(path) ? path : `'${path.replaceAll("'", "'\\''")}'`;
+}
+function shown(path) {
+  return path.startsWith(`${process7.cwd()}/`) ? relative(process7.cwd(), path) : path;
+}
+async function fixAll(exposed, json) {
+  const fixed = [];
+  let left = false;
+  for (const { path, readable, tracked, secrets } of exposed) {
+    const fix = secrets === undefined ? undefined : await fixCompose(path);
+    const open = fix?.open ?? (readable && !await shutOthersOut(path) ? [path] : []);
+    if (fix !== undefined)
+      fixed.push(fix);
+    left ||= tracked || open.length > 0 || (fix?.left.length ?? 0) > 0;
+    if (json)
+      continue;
+    const lines = [
+      ...fix === undefined || fix.moved.length === 0 ? [] : [`moved ${fix.moved.join(", ")} into ${shown(fix.env)}`],
+      ...fix?.left.map(({ key, why }) => `left ${key} in place: ${why}`) ?? [],
+      ...fix?.check === undefined ? [] : [CHECKS[fix.check]],
+      ...open.map((file) => `another account owns ${file === path ? "it" : shown(file)}, so it stays readable: sudo chmod o-rwx ${quoted2(shown(file))}`),
+      ...readable && !open.includes(path) ? ["now unreadable by other accounts"] : [],
+      ...tracked ? [`tracked by git: git rm --cached ${quoted2(shown(path))}, then ignore it`] : []
+    ];
+    console.log(`${shown(path)}
+  ${lines.join(`
+  `)}`);
+  }
+  return { fixed, left };
+}
+async function audit2(args) {
+  const parsed = parse(args, usage, options);
+  const roots = (parsed.positionals.length > 0 ? parsed.positionals : ["."]).map((dir) => resolve(dir));
+  for (const dir of roots) {
+    if (!await isFolder(dir))
+      fail(`${dir} is not a folder`);
+  }
+  const { exposed, unread } = await audit(roots);
+  const json = parsed.values.json === true;
+  if (!json && unread.length > MAX_UNREAD_LISTED) {
+    console.error(`could not read ${unread.length} folders, so they were not audited (--json lists them)`);
+  } else if (!json) {
+    for (const dir of unread)
+      console.error(`could not read ${dir}, so it was not audited`);
+  }
+  if (parsed.values.fix === true && (json || exposed.length > 0)) {
+    const { fixed, left } = await fixAll(exposed, json);
+    if (json)
+      printJson({ fixed, exposed: (await audit(roots)).exposed, unread });
+    return left ? 1 : 0;
+  }
+  if (json) {
+    printJson({ exposed, unread });
+    return exposed.length > 0 ? 1 : 0;
+  }
+  if (exposed.length === 0) {
+    console.log("no exposed .env file nor compose file writing a secret out");
+    return 0;
+  }
+  const uid = process7.getuid?.();
+  for (const { path, readable, tracked, secrets } of exposed) {
+    const sudo = uid !== undefined && uid !== 0 && (await stat3(path)).uid !== uid ? "sudo " : "";
+    const problems = [
+      ...secrets === undefined ? [] : [`writes out ${secrets.join(", ")}: ev audit --fix moves the values into a .env beside it`],
+      ...readable ? [`readable by any account: ${sudo}chmod o-rwx ${quoted2(shown(path))}`] : [],
+      ...tracked ? [`tracked by git: git rm --cached ${quoted2(shown(path))}, then ignore it`] : []
+    ];
+    console.log(`${shown(path)}
+  ${problems.join(`
+  `)}`);
+  }
+  return 1;
+}
+
+// src/commands/compare.ts
+var diffUsage = `ev diff <a> <b>
+
+Names the keys set in one file and not the other, never their values.
+
+Exits 0 when both set the same keys, 1 when they differ, 2 on a usage error.`;
+var missingUsage = `ev missing [file]
+
+Names the keys the reference file sets that the file (.env by default) does not.
+
+Exits 0 when none is missing, 1 when some are, 2 on a usage error.`;
+async function keys(path) {
+  return new Set(entries(await readEnv(path)).keys());
+}
+async function diff(args) {
+  const parsed = parse(args, diffUsage, {});
+  const [a, b] = parsed.positionals;
+  if (a === undefined || b === undefined)
+    fail(`needs two files
+
+${diffUsage}`);
+  const left = await keys(a);
+  const right = await keys(b);
+  const lines = [
+    ...[...left].filter((key) => !right.has(key)).map((key) => `only in ${a}: ${key}`),
+    ...[...right].filter((key) => !left.has(key)).map((key) => `only in ${b}: ${key}`)
+  ];
+  if (lines.length === 0)
+    return 0;
+  console.log(lines.join(`
+`));
+  return 1;
+}
+async function missing(args) {
+  const parsed = parse(args, missingUsage, { against: { type: "string", description: "the reference file (.env.example by default)" } });
+  const [file = ".env"] = parsed.positionals;
+  const against = parsed.values.against ?? ".env.example";
+  const have = await keys(file);
+  const absent = [...await keys(against)].filter((key) => !have.has(key));
+  if (absent.length === 0)
+    return 0;
+  console.log(absent.map((key) => `${key} (set in ${against}, not in ${file})`).join(`
+`));
+  return 1;
+}
+
+// src/commands/edit.ts
+var DEFAULT_FILE = ".env";
+var TRAILING_NEWLINE = /\r?\n$/;
+var setUsage = `ev set KEY [file]
+
+Sets KEY in the file (.env by default, created when missing), replacing its line in place or appending one. The value is read from stdin, or from -F <file>, so it never appears in a command line; --empty sets it to an empty value.
+
+Exits 0 when it wrote the key, 1 when it could not, 2 on a usage error.`;
+var unsetUsage = `ev unset KEY [file]
+
+Removes every line setting KEY from the file (.env by default), leaving comments and other lines as they are.
+
+Exits 0 when it removed the key, 1 when the file does not set it, 2 on a usage error.`;
+var mvUsage = `ev mv KEY --from <file> --to <file>
+
+Moves KEY's line from one file to another, as written. Refuses to replace a key the target already sets unless --force.
+
+Exits 0 when it moved the key, 1 when the source lacks it or the target already sets it, 2 on a usage error.`;
+async function readValue(from) {
+  const input = await readInput(from ?? "-", { noStdin: "pipe the value on stdin or give -F <file>, it is never taken from the command line" });
+  if (input === "")
+    fail("the value is empty, nothing was written: --empty sets an empty value");
+  return input.replace(TRAILING_NEWLINE, "");
+}
+async function readOrEmpty(path) {
+  return await Bun.file(path).exists() ? readEnv(path) : { lines: [] };
+}
+async function set(args) {
+  const parsed = parse(args, setUsage, {
+    file: { type: "string", short: "F", description: "read the value from this file instead of stdin" },
+    empty: { type: "boolean", description: "set an empty value, reading nothing" }
+  });
+  const [key, target = DEFAULT_FILE] = parsed.positionals;
+  if (key === undefined)
+    fail(`missing KEY
+
+${setUsage}`);
+  if (parsed.values.empty === true && parsed.values.file !== undefined)
+    fail("--empty and -F exclude each other");
+  const value = parsed.values.empty === true ? "" : await readValue(parsed.values.file);
+  const file = await readOrEmpty(target);
+  setLine(file, key, value);
+  await writeEnv(target, file);
+  console.log(`${target}: ${key}=${maskValue(key, value).replaceAll(`
+`, "\\n")}`);
+  return 0;
+}
+async function unset(args) {
+  const parsed = parse(args, unsetUsage, {});
+  const [key, target = DEFAULT_FILE] = parsed.positionals;
+  if (key === undefined)
+    fail(`missing KEY
+
+${unsetUsage}`);
+  const file = await readEnv(target);
+  if (removeKey(file, key) === 0)
+    fail(`${key} is not set in ${target}`, 1);
+  await writeEnv(target, file);
+  console.log(`${target}: removed ${key}`);
+  return 0;
+}
+async function mv(args) {
+  const parsed = parse(args, mvUsage, {
+    from: { type: "string", description: "the file to take KEY from" },
+    to: { type: "string", description: "the file to put KEY in, created when missing" },
+    force: { type: "boolean", description: "replace KEY when the target already sets it" }
+  });
+  const [key] = parsed.positionals;
+  const { from, to, force } = parsed.values;
+  if (key === undefined || from === undefined || to === undefined)
+    fail(`needs KEY, --from and --to
+
+${mvUsage}`);
+  if (from === to)
+    fail("--from and --to are the same file");
+  const source = await readEnv(from);
+  const line = lastLine(source, key);
+  if (line === undefined)
+    fail(`${key} is not set in ${from}`, 1);
+  const target = await readOrEmpty(to);
+  if (entries(target).has(key) && force !== true)
+    fail(`${to} already sets ${key}, --force replaces it`, 1);
+  setLine(target, key, line.value ?? "", line.raw);
+  await writeEnv(to, target);
+  removeKey(source, key);
+  await writeEnv(from, source);
+  console.log(`${key}: ${from} -> ${to}`);
+  return 0;
+}
+
+// src/commands/read.ts
+var {$: $2 } = globalThis.Bun;
+var listUsage = `ev list [file]
+
+Prints every key of the folder's .env* files, or of one file, with secret values masked: a few leading characters and the length under a key named like TOKEN, SECRET, PASSWORD, KEY, PRIVATE or DSN, and the password of any URL.
+
+Exits 0 when it printed them, 1 when there is no .env* file, 2 on a usage error.`;
+var getUsage = `ev get KEY [file]
+
+Prints the masked value of one key, from every .env* file that sets it or from one file.
+
+Exits 0 when the key is set, 1 when it is not set anywhere, 2 on a usage error.`;
+function display(key, value) {
+  return maskValue(key, value).replaceAll(`
+`, "\\n").replaceAll("\r", "\\r");
+}
+async function list(args) {
+  const parsed = parse(args, listUsage, {});
+  const [file] = parsed.positionals;
+  const names = file === undefined ? await envFiles() : [file];
+  if (names.length === 0)
+    fail("no .env* file in this folder", 1);
+  const rows = [];
+  for (const name of names) {
+    for (const [key, value] of entries(await readEnv(name)))
+      rows.push([name, key, display(key, value)]);
+  }
+  if (rows.length > 0)
+    console.log(table(rows));
+  return 0;
+}
+async function get(args) {
+  const parsed = parse(args, getUsage, {});
+  const [key, file] = parsed.positionals;
+  if (key === undefined)
+    fail(`missing KEY
+
+${getUsage}`);
+  const names = file === undefined ? await envFiles() : [file];
+  const rows = [];
+  for (const name of names) {
+    const value = entries(await readEnv(name)).get(key);
+    if (value !== undefined)
+      rows.push([name, display(key, value)]);
+  }
+  if (rows.length === 0)
+    fail(`${key} is not set in ${file ?? "any .env* file"}`, 1);
+  console.log(file === undefined ? table(rows) : rows[0]?.[1]);
+  return 0;
+}
+var grepUsage = `ev grep [-i] <regex> [file...]
+
+Prints the keys matching the regular expression, from the folder's .env* files or the files given, with their values masked as ev list does. The regex is matched against the key only, never the value: \`ev grep '^DATABASE_'\` instead of \`grep ^DATABASE_ .env\`.
+
+Exits 0 when a key matches, 1 when none does, 2 on a usage error.`;
+var showUsage = `ev show <rev>:<file>
+
+Prints every key of an env file as a git revision holds it, values masked as ev list does: \`ev show HEAD~1:api/.env\` instead of \`git show HEAD~1:api/.env\`.
+
+Exits 0 when it printed them, 1 when git cannot show the file, 2 on a usage error.`;
+var REVISION = /^([^:]+):(.+)$/;
+async function grep(args) {
+  const parsed = parse(args, grepUsage, { "ignore-case": { type: "boolean", short: "i", description: "match the key whatever its case" } });
+  const [source, ...files] = parsed.positionals;
+  if (source === undefined)
+    fail(`missing the regex
+
+${grepUsage}`);
+  let pattern;
+  try {
+    pattern = new RegExp(source, parsed.values["ignore-case"] === true ? "i" : "");
+  } catch (error) {
+    fail(`${source} is no valid regular expression: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const names = files.length === 0 ? await envFiles() : files;
+  const rows = [];
+  for (const name of names) {
+    for (const [key, value] of entries(await readEnv(name))) {
+      if (pattern.test(key))
+        rows.push([name, key, display(key, value)]);
+    }
+  }
+  if (rows.length === 0)
+    fail(`no key matches ${source} in ${names.join(", ") || "any .env* file"}`, 1);
+  console.log(table(rows));
+  return 0;
+}
+async function show(args) {
+  const parsed = parse(args, showUsage, {});
+  const [target] = parsed.positionals;
+  const [, revision, path] = REVISION.exec(target ?? "") ?? [];
+  if (revision === undefined || path === undefined)
+    fail(`give <rev>:<file>
+
+${showUsage}`);
+  const shown = await $2`git show ${`${revision}:${path}`}`.quiet().nothrow();
+  if (shown.exitCode !== 0)
+    fail(`git show ${revision}:${path} failed: ${shown.stderr.toString().trim()}`, 1);
+  const rows = [...entries(parseDotenv(shown.stdout.toString()))].map(([key, value]) => [key, display(key, value)]);
+  if (rows.length > 0)
+    console.log(table(rows));
+  return 0;
+}
+
+// src/ev.ts
+process8.exitCode = await runCli({
+  name: "ev",
+  version,
+  about: ".env files listed and edited with secrets masked",
+  replaces: "cat .env, grep on env files and editing them by hand",
+  examples: ["ev list", ["ev get DATABASE_URL", "one key, its value masked"]],
+  commands: {
+    list: { run: list, summary: "every key of the .env* files, secrets masked" },
+    get: { run: get, summary: "one key's masked value" },
+    grep: { run: grep, summary: "the keys matching a regex, values masked" },
+    show: { run: show, summary: "an env file at a git revision, values masked" },
+    set: { run: set, summary: "set a key, the value read from stdin or -F" },
+    unset: { run: unset, summary: "remove a key from a file" },
+    mv: { run: mv, summary: "move a key from one file to another" },
+    diff: { run: diff, summary: "keys set in one file and not the other" },
+    missing: { run: missing, summary: "keys of .env.example that .env lacks" },
+    audit: { run: audit2, summary: ".env files others can read or git tracks, compose files writing secrets out" }
+  },
+  aliases: { ls: "list" }
+});