@modootoday/envs 0.1.0

package/dist/chunk-47XO3SDE.js

@@ -0,0 +1,4591 @@
+import {
+  SCHEMA_VERSION,
+  addWrap,
+  config,
+  createKeyring,
+  createSchema,
+  globalDir,
+  hashKeyName,
+  itemContext,
+  locateCatalogs,
+  migrate,
+  open,
+  openDatabaseSync,
+  parseEnv,
+  readEntries,
+  readMeta,
+  readWraps,
+  seal,
+  sha256Hex,
+  toRecord,
+  unlockDek
+} from "./chunk-STHFIZRP.js";
+
+// src/catalog/export.ts
+import { existsSync } from "fs";
+function csvField(value) {
+  return `"${value.replace(/"/g, '""')}"`;
+}
+var FORMULA_START = /* @__PURE__ */ new Set(["=", "+", "-", "@"]);
+function toCsv(entries) {
+  const rows = [
+    ["key", "value", "source", "path", "layer"].map(csvField).join(",")
+  ];
+  for (const entry of entries) {
+    rows.push(
+      [entry.key, entry.value, entry.alias, entry.path, entry.layer].map(csvField).join(",")
+    );
+  }
+  return `${rows.join("\r\n")}\r
+`;
+}
+function toShell(entries) {
+  return entries.map((entry) => `export ${entry.key}=${JSON.stringify(entry.value)}`).join("\n").concat("\n");
+}
+function toEnvFile(entries) {
+  return entries.map((entry) => `${entry.key}=${JSON.stringify(entry.value)}`).join("\n").concat("\n");
+}
+function readCatalog(path, options, layer) {
+  if (!existsSync(path)) return [];
+  const db = openDatabaseSync(path, { readOnly: true });
+  try {
+    return readEntries(db, {
+      unlock: options.unlock,
+      ...options.aliases ? { aliases: options.aliases } : {},
+      ...options.revisionId ? { revisionId: options.revisionId } : {}
+    }).map((entry) => ({ ...entry, layer }));
+  } finally {
+    db.close();
+  }
+}
+function exportValues(options) {
+  const located = locateCatalogs(options);
+  const catalogs = [];
+  const entries = [];
+  catalogs.push(located.project);
+  entries.push(...readCatalog(located.project, options, "project"));
+  if (options.includeGlobal === true && located.global !== void 0) {
+    catalogs.push(located.global);
+    entries.push(...readCatalog(located.global, options, "global"));
+  }
+  const format = options.format ?? "csv";
+  const text = format === "csv" ? toCsv(entries) : format === "env" ? toEnvFile(entries) : format === "shell" ? toShell(entries) : `${JSON.stringify(
+    Object.fromEntries(entries.map((e) => [e.key, e.value])),
+    null,
+    2
+  )}
+`;
+  return {
+    text,
+    count: entries.length,
+    // Not rewritten: altering a value to make a spreadsheet safe would hand back
+    // something that is not what is stored. The hazard is reported instead.
+    formulaKeys: entries.filter((e) => e.value.length > 0 && FORMULA_START.has(e.value[0])).map((e) => e.key),
+    catalogs
+  };
+}
+
+// src/cli/ui.ts
+var ESC = String.fromCharCode(27);
+var CODES = {
+  reset: `${ESC}[0m`,
+  bold: `${ESC}[1m`,
+  dim: `${ESC}[2m`,
+  red: `${ESC}[31m`,
+  green: `${ESC}[32m`,
+  yellow: `${ESC}[33m`,
+  cyan: `${ESC}[36m`
+};
+var SYMBOL = {
+  success: "+",
+  error: "x",
+  warn: "!",
+  info: "-",
+  prompt: ">"
+};
+var KIND_COLOUR = {
+  success: "green",
+  error: "red",
+  warn: "yellow",
+  info: "cyan",
+  prompt: "cyan"
+};
+var Ui = class {
+  out;
+  err;
+  colour;
+  constructor(options = {}) {
+    this.out = options.stdout ?? process.stdout;
+    this.err = options.stderr ?? process.stderr;
+    const env = options.env ?? process.env;
+    this.colour = options.color ?? (this.err.isTTY === true && (env["NO_COLOR"] ?? "") === "" && env["TERM"] !== "dumb");
+  }
+  paint(text, ...colours) {
+    if (!this.colour || colours.length === 0) return text;
+    return `${colours.map((c) => CODES[c]).join("")}${text}${CODES.reset}`;
+  }
+  /** Data goes to stdout so it can be piped; everything else to stderr. */
+  data(text) {
+    this.out.write(text);
+  }
+  line(text = "") {
+    this.err.write(`${text}
+`);
+  }
+  message(kind, text, detail) {
+    const mark = this.paint(SYMBOL[kind], KIND_COLOUR[kind], "bold");
+    const tail = detail === void 0 ? "" : ` ${this.paint(detail, "dim")}`;
+    this.line(`${mark} ${text}${tail}`);
+  }
+  success(text, detail) {
+    this.message("success", text, detail);
+  }
+  error(text, detail) {
+    this.message("error", text, detail);
+  }
+  warn(text, detail) {
+    this.message("warn", text, detail);
+  }
+  info(text, detail) {
+    this.message("info", text, detail);
+  }
+  /** Two aligned columns, as a help screen or a summary. */
+  table(rows, indent = "  ") {
+    const width = rows.reduce((n, [left]) => Math.max(n, left.length), 0);
+    for (const [left, right] of rows) {
+      this.line(
+        `${indent}${this.paint(left.padEnd(width), "cyan")}  ${this.paint(right, "dim")}`
+      );
+    }
+  }
+  heading(text) {
+    this.line(this.paint(text, "bold"));
+  }
+};
+
+// src/cli/command.ts
+var GROUPS = [
+  "start here",
+  "values",
+  "check",
+  "history",
+  "backup",
+  "hosted account",
+  "publish"
+];
+var ArgumentError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ArgumentError";
+  }
+};
+function parseArgs(argv, specs = []) {
+  const byName = new Map(specs.map((spec) => [spec.name, spec]));
+  const positional = [];
+  const options = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--") {
+      positional.push(...argv.slice(i + 1));
+      break;
+    }
+    if (!arg.startsWith("--")) {
+      positional.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const name = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
+    const spec = byName.get(name);
+    if (spec === void 0) {
+      throw new ArgumentError(`unknown option --${name}`);
+    }
+    if (spec.boolean === true) {
+      if (eq !== -1) {
+        throw new ArgumentError(`--${name} does not take a value`);
+      }
+      flags.add(name);
+      continue;
+    }
+    const value = eq === -1 ? argv[++i] : arg.slice(eq + 1);
+    if (value === void 0) {
+      throw new ArgumentError(`--${name} needs a value`);
+    }
+    const existing = options.get(name);
+    if (existing !== void 0 && spec.repeat !== true) {
+      throw new ArgumentError(`--${name} was given more than once`);
+    }
+    options.set(name, [...existing ?? [], value]);
+  }
+  return { positional, options, flags };
+}
+function one(args, name) {
+  return args.options.get(name)?.[0];
+}
+function many(args, name) {
+  return args.options.get(name) ?? [];
+}
+function printCommandHelp(ui, command) {
+  ui.heading(`envs ${command.name}`);
+  ui.line(`  ${command.describe}`);
+  ui.line();
+  ui.line(`  ${ui.paint(command.usage, "dim")}`);
+  if (command.options && command.options.length > 0) {
+    ui.line();
+    ui.table(
+      command.options.map((option) => [
+        `--${option.name}${option.placeholder ? ` ${option.placeholder}` : ""}`,
+        option.describe
+      ])
+    );
+  }
+  ui.line();
+}
+function printHelp(ui, commands, notImplemented) {
+  ui.heading("envs \u2014 environment values in a catalog");
+  ui.line();
+  const ungrouped = commands.filter(
+    (command) => command.group === void 0 || !GROUPS.includes(command.group)
+  );
+  for (const group of GROUPS) {
+    const members = commands.filter((command) => command.group === group);
+    const rows = group === GROUPS[GROUPS.length - 1] ? [...members, ...ungrouped] : members;
+    if (rows.length === 0) continue;
+    ui.line(`  ${ui.paint(group, "dim")}`);
+    ui.table(rows.map((command) => [command.name, command.describe]));
+    ui.line();
+  }
+  if (notImplemented.length > 0) {
+    ui.line(
+      `  ${ui.paint(`not implemented yet: ${notImplemented.join(", ")}`, "dim")}`
+    );
+    ui.line();
+  }
+}
+
+// src/commands/add.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+
+// src/template/schema.ts
+var TemplateError = class extends Error {
+  constructor(message, at) {
+    super(at === void 0 ? message : `${at}: ${message}`);
+    this.at = at;
+    this.name = "TemplateError";
+  }
+  at;
+};
+var TEMPLATE_FIELDS = /* @__PURE__ */ new Set(["name", "version", "title", "keys"]);
+var KEY_FIELDS = /* @__PURE__ */ new Set([
+  "required",
+  "sensitivity",
+  "pattern",
+  "obtain",
+  "rotateDays",
+  "description"
+]);
+var NAME = /^[a-z0-9][a-z0-9-]{0,38}[a-z0-9]\/[a-z0-9][a-z0-9-]{0,38}$/;
+var KEY_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
+var PATTERN_MAX = 200;
+var NESTED_QUANTIFIER = /\([^()]*[+*}][^()]*\)(?:[+*]|\{\d+,\})/;
+function ownFields(value, at) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TemplateError("must be an object", at);
+  }
+  return value;
+}
+function rejectUnknown(fields, allowed, at) {
+  for (const name of Object.keys(fields)) {
+    if (!allowed.has(name)) {
+      throw new TemplateError(`unknown field "${name}"`, at);
+    }
+  }
+}
+function compilePattern(pattern, at) {
+  if (pattern.length > PATTERN_MAX) {
+    throw new TemplateError(
+      `pattern is longer than ${String(PATTERN_MAX)} characters`,
+      at
+    );
+  }
+  if (NESTED_QUANTIFIER.test(pattern)) {
+    throw new TemplateError("pattern nests quantifiers and may not halt", at);
+  }
+  if (!pattern.startsWith("^") || !pattern.endsWith("$")) {
+    throw new TemplateError("pattern must be anchored with ^ and $", at);
+  }
+  try {
+    return new RegExp(pattern, "u");
+  } catch {
+    throw new TemplateError("pattern is not a valid regular expression", at);
+  }
+}
+function parseKey(raw, at, allowObtain) {
+  const fields = ownFields(raw, at);
+  rejectUnknown(fields, KEY_FIELDS, at);
+  const required = fields["required"];
+  if (typeof required !== "boolean") {
+    throw new TemplateError("required must be true or false", at);
+  }
+  const sensitivity = fields["sensitivity"];
+  if (sensitivity !== "secret" && sensitivity !== "config") {
+    throw new TemplateError('sensitivity must be "secret" or "config"', at);
+  }
+  const key = { required, sensitivity };
+  const pattern = fields["pattern"];
+  if (pattern !== void 0) {
+    if (typeof pattern !== "string") {
+      throw new TemplateError("pattern must be a string", at);
+    }
+    compilePattern(pattern, at);
+    key.pattern = pattern;
+  }
+  const obtain = fields["obtain"];
+  if (obtain !== void 0) {
+    if (typeof obtain !== "string") {
+      throw new TemplateError("obtain must be a string", at);
+    }
+    allowObtain(obtain, at);
+    key.obtain = obtain;
+  }
+  const rotateDays = fields["rotateDays"];
+  if (rotateDays !== void 0) {
+    if (typeof rotateDays !== "number" || !Number.isInteger(rotateDays) || rotateDays <= 0 || rotateDays > 3650) {
+      throw new TemplateError("rotateDays must be a whole number of days", at);
+    }
+    key.rotateDays = rotateDays;
+  }
+  const description = fields["description"];
+  if (description !== void 0) {
+    if (typeof description !== "string" || description.length > 300) {
+      throw new TemplateError("description must be a short string", at);
+    }
+    key.description = description;
+  }
+  return key;
+}
+function parseTemplate(text, options = {}) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw new TemplateError("is not valid JSON");
+  }
+  assertNoDuplicateKeys(text);
+  const fields = ownFields(raw, "template");
+  rejectUnknown(fields, TEMPLATE_FIELDS, "template");
+  const name = fields["name"];
+  if (typeof name !== "string" || !NAME.test(name)) {
+    throw new TemplateError(
+      'name must be "publisher/template" in lowercase',
+      "template"
+    );
+  }
+  const version = fields["version"];
+  if (typeof version !== "number" || !Number.isInteger(version) || version < 1) {
+    throw new TemplateError("version must be a whole number from 1", "template");
+  }
+  const title = fields["title"];
+  if (typeof title !== "string" || title === "" || title.length > 120) {
+    throw new TemplateError("title must be a short non-empty string", "template");
+  }
+  const keys = ownFields(fields["keys"], "keys");
+  const names = Object.keys(keys);
+  if (names.length === 0) {
+    throw new TemplateError("must declare at least one key", "keys");
+  }
+  if (names.length > 100) {
+    throw new TemplateError("declares more than 100 keys", "keys");
+  }
+  const allowObtain = options.allowObtain ?? (() => void 0);
+  const parsed = {};
+  for (const keyName of names) {
+    if (!KEY_NAME.test(keyName)) {
+      throw new TemplateError(
+        "key names are upper snake case",
+        `keys.${keyName}`
+      );
+    }
+    parsed[keyName] = parseKey(keys[keyName], `keys.${keyName}`, allowObtain);
+  }
+  return { name, version, title, keys: parsed };
+}
+function assertNoDuplicateKeys(text) {
+  const seen = [];
+  let depth = -1;
+  let index = 0;
+  let inString = false;
+  let escaped = false;
+  let current = "";
+  let captured = null;
+  while (index < text.length) {
+    const ch = text[index];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === '"') {
+        inString = false;
+        captured = current;
+      } else current += ch;
+      index += 1;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      current = "";
+      captured = null;
+    } else if (ch === "{") {
+      depth += 1;
+      seen[depth] = /* @__PURE__ */ new Set();
+    } else if (ch === "}") {
+      if (depth >= 0) depth -= 1;
+    } else if (ch === ":" && captured !== null && depth >= 0) {
+      const scope = seen[depth];
+      if (scope.has(captured)) {
+        throw new TemplateError(`duplicate field "${captured}"`);
+      }
+      scope.add(captured);
+      captured = null;
+    } else if (ch === "," || ch === "[") {
+      captured = null;
+    }
+    index += 1;
+  }
+}
+async function templateDigest(text) {
+  return sha256Hex(new TextEncoder().encode(text));
+}
+
+// src/template/fetch.ts
+var DEFAULT_REGISTRY = "https://envs.build/v1/templates";
+var NAME2 = /^[a-z0-9][a-z0-9-]{0,38}[a-z0-9]\/[a-z0-9][a-z0-9-]{0,38}$/;
+var MAX_BYTES = 64 * 1024;
+var looksLikeName = (value) => NAME2.test(value);
+function templateUrl(name, registry2) {
+  if (!NAME2.test(name)) {
+    throw new TemplateError(
+      `"${name}" is not a template name; use publisher/template`
+    );
+  }
+  const base = new URL(`${registry2.replace(/\/+$/, "")}/`);
+  if (base.protocol !== "https:" && base.hostname !== "localhost") {
+    throw new TemplateError("the registry must be served over https");
+  }
+  return new URL(`${name}.json`, base).toString();
+}
+async function fetchTemplate(name, registry2 = DEFAULT_REGISTRY, fetcher2 = fetch) {
+  const url = templateUrl(name, registry2);
+  let response;
+  try {
+    response = await fetcher2(url, {
+      redirect: "error",
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (error) {
+    throw new TemplateError(
+      `could not reach the registry: ${error instanceof Error ? error.message : "failed"}`
+    );
+  }
+  if (response.status === 404) {
+    throw new TemplateError(`no template named "${name}" in the registry`);
+  }
+  if (!response.ok) {
+    throw new TemplateError(
+      `the registry refused: ${String(response.status)}`
+    );
+  }
+  const declared = Number(response.headers.get("content-length") ?? "0");
+  if (declared > MAX_BYTES) {
+    throw new TemplateError("that template is larger than a template can be");
+  }
+  const text = await response.text();
+  if (text.length > MAX_BYTES) {
+    throw new TemplateError("that template is larger than a template can be");
+  }
+  return text;
+}
+
+// src/template/registry.ts
+var RESERVED_NAMESPACES = [
+  "anthropic",
+  "aws",
+  "azure",
+  "cloudflare",
+  "datadog",
+  "discord",
+  "envs",
+  "gcp",
+  "github",
+  "gitlab",
+  "google",
+  "openai",
+  "postgres",
+  "redis",
+  "sentry",
+  "slack",
+  "stripe",
+  "supabase",
+  "twilio",
+  "vercel"
+];
+var OBTAIN_DOMAINS = {
+  anthropic: ["console.anthropic.com"],
+  aws: ["console.aws.amazon.com", "docs.aws.amazon.com"],
+  azure: ["portal.azure.com", "learn.microsoft.com"],
+  cloudflare: ["dash.cloudflare.com", "developers.cloudflare.com"],
+  datadog: ["app.datadoghq.com", "docs.datadoghq.com"],
+  discord: ["discord.com"],
+  envs: ["envs.build"],
+  gcp: ["console.cloud.google.com"],
+  github: ["github.com", "docs.github.com"],
+  gitlab: ["gitlab.com", "docs.gitlab.com"],
+  google: ["console.cloud.google.com", "developers.google.com"],
+  openai: ["platform.openai.com"],
+  postgres: ["www.postgresql.org"],
+  redis: ["redis.io"],
+  sentry: ["sentry.io", "docs.sentry.io"],
+  slack: ["api.slack.com"],
+  stripe: ["dashboard.stripe.com", "docs.stripe.com"],
+  supabase: ["supabase.com"],
+  twilio: ["console.twilio.com"],
+  vercel: ["vercel.com"]
+};
+var namespaceOf = (name) => name.slice(0, name.indexOf("/"));
+function checkObtain(name, url, at) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new TemplateError("obtain must be an absolute URL", at);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new TemplateError("obtain must be https", at);
+  }
+  if (parsed.username !== "" || parsed.password !== "") {
+    throw new TemplateError("obtain must not carry credentials", at);
+  }
+  const allowed = OBTAIN_DOMAINS[namespaceOf(name)];
+  if (allowed === void 0) {
+    throw new TemplateError(
+      `namespace "${namespaceOf(name)}" has no obtain allowlist; templates under it may not link out`,
+      at
+    );
+  }
+  if (!allowed.includes(parsed.hostname)) {
+    throw new TemplateError(
+      `obtain host "${parsed.hostname}" is not one of ${allowed.join(", ")}`,
+      at
+    );
+  }
+}
+function checkNamespace(name, publisher) {
+  const namespace = namespaceOf(name);
+  if (!RESERVED_NAMESPACES.includes(namespace)) return;
+  if (publisher !== "modootoday") {
+    throw new TemplateError(
+      `"${namespace}" is a reserved namespace`,
+      "template"
+    );
+  }
+}
+
+// src/template/store.ts
+function recordTemplate(db, input) {
+  db.prepare(
+    `INSERT INTO template_ref (name, version, digest, payload, applied_at)
+       VALUES ($name, $version, $digest, $payload, $appliedAt)
+       ON CONFLICT (name) DO UPDATE SET
+         version = $version, digest = $digest,
+         payload = $payload, applied_at = $appliedAt`
+  ).run(input);
+}
+function appliedTemplates(db) {
+  let rows;
+  try {
+    rows = db.prepare(
+      "SELECT name, version, digest, payload, applied_at FROM template_ref ORDER BY name"
+    ).all();
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const row of rows) {
+    try {
+      out.push({
+        name: row.name,
+        version: Number(row.version),
+        digest: row.digest,
+        appliedAt: row.applied_at,
+        template: parseTemplate(row.payload)
+      });
+    } catch {
+      continue;
+    }
+  }
+  return out;
+}
+
+// src/commands/unlock.ts
+import { readFileSync } from "fs";
+function readStdin() {
+  try {
+    return readFileSync(0, "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+function resolveUnlock(code, env) {
+  const fromArg = code === "-" ? readStdin() : code;
+  const recovery = fromArg ?? env["ENVS_RECOVERY_CODE"] ?? "";
+  if (recovery !== "") return { recoveryCode: recovery };
+  const kek = env["ENVS_KEK"] ?? "";
+  if (kek === "") {
+    return "no key given: pass --recovery-code -, or set ENVS_RECOVERY_CODE or ENVS_KEK";
+  }
+  const bytes = new Uint8Array(Buffer.from(kek, "base64"));
+  if (bytes.length !== 32) return "ENVS_KEK must be 32 bytes, base64 encoded";
+  return { kek: bytes };
+}
+
+// src/commands/add.ts
+var CATALOG_LEVEL = {
+  secret: "high",
+  config: "low"
+};
+async function loadTemplate(source, env = {}) {
+  let payload;
+  let from;
+  if (existsSync2(source)) {
+    payload = readFileSync2(source, "utf8");
+    from = source;
+  } else if (looksLikeName(source)) {
+    const registry2 = env["ENVS_REGISTRY"] ?? DEFAULT_REGISTRY;
+    payload = await fetchTemplate(source, registry2);
+    from = templateUrl(source, registry2);
+  } else {
+    throw new Error(
+      `no template at ${source}; pass a file or a publisher/template name`
+    );
+  }
+  const template = parseTemplate(payload, {
+    allowObtain: (url, at) => {
+      const name = JSON.parse(payload).name;
+      checkObtain(typeof name === "string" ? name : "", url, at);
+    }
+  });
+  return { template, payload, from };
+}
+var addCommand = {
+  name: "add",
+  describe: "declare the keys a template names, without setting any value",
+  usage: "envs add <publisher/template | template.json>",
+  group: "start here",
+  options: [
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  async run({ ui, args, env, cwd }) {
+    const source = args.positional[0];
+    if (source === void 0) {
+      ui.error(
+        "say which template",
+        "envs add <publisher/template | template.json>"
+      );
+      return 2;
+    }
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync2(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    let loaded;
+    try {
+      loaded = await loadTemplate(source, env);
+    } catch (error) {
+      ui.error("template refused", error.message);
+      return 1;
+    }
+    const { template, payload } = loaded;
+    const digest = await templateDigest(payload);
+    const db = openDatabaseSync(located.project);
+    try {
+      const dek = unlockDek(readWraps(db), unlock);
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const declared = [];
+      const already = [];
+      db.transaction(() => {
+        for (const [name, key] of Object.entries(template.keys)) {
+          const hash = hashKeyName(dek, name);
+          const existing = db.prepare(
+            "SELECT key_hash FROM keys WHERE key_hash = $hash"
+          ).get({ hash });
+          if (existing) {
+            already.push(name);
+            continue;
+          }
+          db.prepare(
+            `INSERT INTO keys (key_hash, first_seen_at, sensitivity)
+               VALUES ($hash, $at, $level)`
+          ).run({
+            hash,
+            at: now,
+            level: CATALOG_LEVEL[key.sensitivity]
+          });
+          declared.push(name);
+        }
+        recordTemplate(db, {
+          name: template.name,
+          version: template.version,
+          digest,
+          payload,
+          appliedAt: now
+        });
+      });
+      ui.success(
+        `${template.name} v${String(template.version)}`,
+        template.title
+      );
+      if (declared.length > 0) {
+        ui.info(`declared ${String(declared.length)}`, declared.join(" "));
+      }
+      if (already.length > 0) {
+        ui.info(`already present ${String(already.length)}`, already.join(" "));
+      }
+      ui.info("no values were set", "envs doctor says which are still missing");
+      return 0;
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/export.ts
+import { existsSync as existsSync3 } from "fs";
+var FORMATS = /* @__PURE__ */ new Set(["csv", "env", "json", "shell"]);
+var exportCommand = {
+  name: "export",
+  describe: "decrypt the catalog and print its values",
+  usage: "envs export --yes [--format csv|env|json|shell] [--recovery-code -]",
+  group: "values",
+  options: [
+    { name: "yes", boolean: true, describe: "required: this prints secrets" },
+    {
+      name: "format",
+      placeholder: "<fmt>",
+      describe: "csv (default), env, json or shell"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    },
+    {
+      name: "alias",
+      placeholder: "<name>",
+      repeat: true,
+      describe: "restrict to one source; repeatable"
+    },
+    {
+      name: "revision",
+      placeholder: "<id>",
+      describe: "a release other than the current"
+    },
+    { name: "include-global", boolean: true, describe: "also read ~/.envs" }
+  ],
+  run({ ui, args, env, cwd }) {
+    if (!args.flags.has("yes")) {
+      ui.error(
+        "export prints decrypted values to stdout",
+        "re-run with --yes if that is what you want"
+      );
+      return 2;
+    }
+    const format = one(args, "format") ?? "csv";
+    if (!FORMATS.has(format)) {
+      ui.error(`unknown format "${format}"`, "use csv, env, json or shell");
+      return 2;
+    }
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync3(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const code = one(args, "recovery-code");
+    if (code !== void 0 && code !== "-") {
+      ui.warn(
+        "a recovery code on the command line is visible to other processes",
+        "prefer --recovery-code - and pipe it in"
+      );
+    }
+    const unlock = resolveUnlock(code, env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    const aliases = many(args, "alias");
+    const revision = one(args, "revision");
+    try {
+      const result = exportValues({
+        unlock,
+        cwd,
+        env,
+        format,
+        ...aliases.length > 0 ? { aliases } : {},
+        ...revision ? { revisionId: revision } : {},
+        includeGlobal: args.flags.has("include-global")
+      });
+      ui.data(result.text);
+      ui.success(`exported ${result.count} values`, result.catalogs.join(", "));
+      if (result.formulaKeys.length > 0) {
+        ui.warn(
+          "a spreadsheet will evaluate these rather than display them",
+          `value starts with = + - or @: ${result.formulaKeys.join(", ")}`
+        );
+      }
+      return 0;
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    }
+  }
+};
+
+// src/commands/del.ts
+import { existsSync as existsSync4 } from "fs";
+
+// src/catalog/write.ts
+import { randomUUID } from "crypto";
+
+// src/catalog/alias.ts
+import { basename, dirname, sep } from "path";
+var AliasError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AliasError";
+  }
+};
+function normaliseAlias(raw) {
+  const cleaned = raw.toLowerCase().replace(/^\.+/, "").replace(/\./g, "-").replace(/[^a-z0-9-]+/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+  if (cleaned === "") {
+    throw new AliasError(`"${raw}" normalises to nothing; give an alias`);
+  }
+  return cleaned;
+}
+var OFFSET = "_";
+function deriveAlias(path, options) {
+  const { taken } = options;
+  const maxSegments = options.maxSegments ?? 4;
+  const base = normaliseAlias(basename(path));
+  if (!taken.has(base)) return base;
+  const parents = dirname(path).split(sep).filter((segment) => segment !== "" && segment !== ".");
+  for (let depth = 1; depth <= Math.min(maxSegments, parents.length); depth += 1) {
+    const prefix = parents.slice(parents.length - depth).map((segment) => normaliseAlias(segment)).join("-");
+    const candidate = `${prefix}-${base}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+  for (let n = 1; ; n += 1) {
+    const candidate = `${base}${OFFSET}${n}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+}
+function checkAlias(alias, taken) {
+  if (!/^[a-z0-9][a-z0-9-]*(_[0-9]+)?$/.test(alias)) {
+    throw new AliasError(
+      `"${alias}" is not a usable alias: lower case letters, digits and dashes`
+    );
+  }
+  if (taken.has(alias)) {
+    throw new AliasError(`alias "${alias}" is already in use or retired`);
+  }
+}
+
+// src/catalog/write.ts
+var encoder = new TextEncoder();
+var systemClock = {
+  now: () => (/* @__PURE__ */ new Date()).toISOString(),
+  newId: () => randomUUID()
+};
+function writeWraps(db, wraps, clock = systemClock) {
+  const insert = db.prepare(
+    `INSERT INTO dek_wraps (wrap_id, method, salt, scrypt_n, scrypt_r, scrypt_p, envelope, created_at)
+     VALUES ($id, $method, $salt, $n, $r, $p, $envelope, $at)`
+  );
+  const at = clock.now();
+  for (const wrap of wraps) {
+    insert.run({
+      id: wrap.wrapId,
+      method: wrap.method,
+      salt: wrap.salt,
+      n: wrap.n,
+      r: wrap.r,
+      p: wrap.p,
+      envelope: wrap.envelope,
+      at
+    });
+  }
+}
+function audit(db, action, subject, detail, clock = systemClock) {
+  db.prepare(
+    "INSERT INTO audit (at, action, subject, detail) VALUES ($at, $action, $subject, $detail)"
+  ).run({
+    at: clock.now(),
+    action,
+    subject: subject ?? null,
+    detail: detail ?? null
+  });
+}
+function takenAliases(db) {
+  const live = db.prepare("SELECT alias FROM sources").all().map((row) => row.alias);
+  const retired = db.prepare("SELECT alias FROM alias_retired").all().map((row) => row.alias);
+  return /* @__PURE__ */ new Set([...live, ...retired]);
+}
+function ensureSource(db, path, options = {}) {
+  const clock = options.clock ?? systemClock;
+  const existing = db.prepare(
+    "SELECT source_id, alias FROM sources WHERE path = $path"
+  ).get({ path });
+  if (existing !== void 0) {
+    db.prepare(
+      "UPDATE sources SET last_seen_at = $at, digest = $digest, retired_at = NULL WHERE path = $path"
+    ).run({ at: clock.now(), digest: options.digest ?? null, path });
+    return { sourceId: existing.source_id, alias: existing.alias, path };
+  }
+  const taken = takenAliases(db);
+  const alias = options.alias ?? deriveAlias(path, { taken });
+  checkAlias(alias, taken);
+  const sourceId = clock.newId();
+  db.prepare(
+    `INSERT INTO sources (source_id, path, alias, kind, digest, added_at, last_seen_at)
+     VALUES ($id, $path, $alias, 'file', $digest, $at, $at)`
+  ).run({
+    id: sourceId,
+    path,
+    alias,
+    digest: options.digest ?? null,
+    at: clock.now()
+  });
+  audit(db, "source.add", alias, path, clock);
+  return { sourceId, alias, path };
+}
+function currentRevisionId(db) {
+  return db.prepare(
+    "SELECT revision_id FROM pointer WHERE id = 1"
+  ).get()?.revision_id;
+}
+function writeRelease(db, dek, items, options = {}) {
+  const clock = options.clock ?? systemClock;
+  const revisionId = clock.newId();
+  const at = clock.now();
+  db.transaction(() => {
+    db.prepare(
+      "INSERT INTO releases (revision_id, created_at, note) VALUES ($rev, $at, $note)"
+    ).run({ rev: revisionId, at, note: options.note ?? null });
+    const insertKey = db.prepare(
+      "INSERT OR IGNORE INTO keys (key_hash, first_seen_at) VALUES ($hash, $at)"
+    );
+    const insertItem = db.prepare(
+      `INSERT INTO items (source_id, key_hash, revision_id, envelope, kek_version, created_at)
+       VALUES ($source, $hash, $rev, $envelope, 1, $at)`
+    );
+    for (const item of items) {
+      const keyHash = hashKeyName(dek, item.key);
+      insertKey.run({ hash: keyHash, at });
+      insertItem.run({
+        source: item.sourceId,
+        hash: keyHash,
+        rev: revisionId,
+        // The name travels inside the envelope: the column holds only its HMAC.
+        envelope: seal({
+          kek: dek,
+          kekVersion: 1,
+          plaintext: encoder.encode(`${item.key}=${item.value}`),
+          context: itemContext(item.sourceId, keyHash, revisionId)
+        }),
+        at
+      });
+    }
+    if (options.movePointer !== false) {
+      db.prepare(
+        `INSERT INTO pointer (id, revision_id, updated_at) VALUES (1, $rev, $at)
+         ON CONFLICT (id) DO UPDATE SET revision_id = $rev, updated_at = $at`
+      ).run({ rev: revisionId, at });
+    }
+    audit(db, "release.write", revisionId, `${items.length} items`, clock);
+  });
+  return { revisionId, count: items.length };
+}
+function movePointer(db, revisionId, clock = systemClock) {
+  const known = db.prepare(
+    "SELECT count(*) AS n FROM releases WHERE revision_id = $rev"
+  ).get({ rev: revisionId });
+  if ((known?.n ?? 0) === 0) {
+    throw new Error(`no release ${revisionId} in this catalog`);
+  }
+  const at = clock.now();
+  db.transaction(() => {
+    db.prepare(
+      `INSERT INTO pointer (id, revision_id, updated_at) VALUES (1, $rev, $at)
+       ON CONFLICT (id) DO UPDATE SET revision_id = $rev, updated_at = $at`
+    ).run({ rev: revisionId, at });
+    audit(db, "pointer.move", revisionId, void 0, clock);
+  });
+}
+
+// src/commands/del.ts
+var delCommand = {
+  name: "del",
+  describe: "remove one key, as a new release",
+  usage: "envs del <KEY> [--source <alias>]",
+  group: "values",
+  options: [
+    {
+      name: "source",
+      placeholder: "<alias>",
+      describe: "remove it from this source only"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    if (args.positional.length !== 1) {
+      ui.error("give exactly one key", "envs del <KEY>");
+      return 2;
+    }
+    const key = args.positional[0];
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync4(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    const wantedSource = one(args, "source");
+    const db = openDatabaseSync(located.project);
+    try {
+      const dek = unlockDek(readWraps(db), unlock);
+      const items = [];
+      const removedFrom = [];
+      for (const entry of readEntries(db, { unlock })) {
+        const matches = entry.key === key && (wantedSource === void 0 || entry.alias === wantedSource);
+        if (matches) {
+          removedFrom.push(entry.alias);
+          continue;
+        }
+        items.push({
+          sourceId: entry.sourceId,
+          key: entry.key,
+          value: entry.value
+        });
+      }
+      if (removedFrom.length === 0) {
+        ui.error(
+          `no value for ${key}`,
+          wantedSource === void 0 ? "nothing removed" : `not in ${wantedSource}`
+        );
+        return 1;
+      }
+      const release = writeRelease(db, dek, items, {
+        note: `del ${key} from ${removedFrom.join(", ")}`
+      });
+      ui.success(`removed ${key}`, `from ${removedFrom.join(", ")}`);
+      ui.success(
+        `release ${release.revisionId.slice(0, 8)} is current`,
+        `${release.count} values \u2014 envs rollback brings it back`
+      );
+      return 0;
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/migrate.ts
+import { existsSync as existsSync5 } from "fs";
+var migrateCommand = {
+  name: "migrate",
+  describe: "bring an older catalog up to this build's schema",
+  usage: "envs migrate",
+  group: "history",
+  run({ ui, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync5(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const db = openDatabaseSync(located.project);
+    try {
+      const meta = readMeta(db);
+      if (meta === void 0) {
+        ui.error("this file is not a catalog", located.project);
+        return 1;
+      }
+      if (meta.version === SCHEMA_VERSION) {
+        ui.info(
+          `already at schema ${String(SCHEMA_VERSION)}`,
+          "nothing to upgrade"
+        );
+        return 0;
+      }
+      const from = meta.version;
+      const after = migrate(db);
+      ui.success(
+        `schema ${String(from)} to ${String(after.version)}`,
+        located.project
+      );
+      return 0;
+    } catch (error) {
+      ui.error("could not upgrade", error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/template.ts
+import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
+var isReserved = (name) => RESERVED_NAMESPACES.includes(namespaceOf(name));
+var templateCommand = {
+  name: "template",
+  describe: "check a template before publishing it",
+  usage: "envs template lint <file.json>",
+  group: "publish",
+  options: [
+    {
+      name: "publisher",
+      placeholder: "<name>",
+      describe: "who is publishing, for the reserved namespace check"
+    }
+  ],
+  async run({ ui, args }) {
+    const [verb, file] = args.positional;
+    if (verb !== "lint") {
+      ui.error("say what to do", "envs template lint <file.json>");
+      return 2;
+    }
+    if (file === void 0) {
+      ui.error("say which file", "envs template lint <file.json>");
+      return 2;
+    }
+    if (!existsSync6(file)) {
+      ui.error("no such file", file);
+      return 1;
+    }
+    const payload = readFileSync3(file, "utf8");
+    try {
+      const declared = JSON.parse(payload).name;
+      const name = typeof declared === "string" ? declared : "";
+      const template = parseTemplate(payload, {
+        allowObtain: (url, at) => {
+          checkObtain(name, url, at);
+        }
+      });
+      const publisher = one(args, "publisher");
+      if (publisher !== void 0) {
+        checkNamespace(template.name, publisher);
+      } else if (isReserved(template.name)) {
+        ui.warn(
+          `"${namespaceOf(template.name)}" is a reserved namespace`,
+          "publishing under it is refused unless we are the publisher"
+        );
+      }
+      const keys = Object.entries(template.keys);
+      ui.success(`${template.name} v${String(template.version)}`, template.title);
+      ui.info("digest", await templateDigest(payload));
+      ui.info(
+        `${String(keys.length)} keys`,
+        keys.map(([keyName, key]) => `${keyName}${key.required ? "" : "?"}`).join(" ")
+      );
+      const unpatterned = keys.filter(([, key]) => key.pattern === void 0);
+      if (unpatterned.length > 0) {
+        ui.warn(
+          `${String(unpatterned.length)} without a pattern`,
+          unpatterned.map(([keyName]) => keyName).join(" ")
+        );
+      }
+      return 0;
+    } catch (error) {
+      ui.error("template refused", error.message);
+      return 1;
+    }
+  }
+};
+
+// src/commands/backup.ts
+import {
+  copyFileSync,
+  existsSync as existsSync8,
+  readFileSync as readFileSync6,
+  renameSync as renameSync2,
+  rmSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { dirname as dirname3 } from "path";
+
+// src/backup/provider.ts
+var BackupError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BackupError";
+  }
+};
+var registry = /* @__PURE__ */ new Map();
+function register(provider) {
+  registry.set(provider.name, provider);
+}
+function providers() {
+  return [...registry.values()];
+}
+function resolveProvider(env, pinned) {
+  const name = pinned ?? env["ENVS_BACKUP_PROVIDER"];
+  if (name !== void 0 && name !== "") {
+    const chosen = registry.get(name);
+    if (chosen === void 0) {
+      throw new BackupError(
+        `"${name}" is not one of ${[...registry.keys()].join(", ")}`
+      );
+    }
+    if (!chosen.eligible(env)) {
+      throw new BackupError(
+        `${name} is not configured: ${chosen.describe(env)}`
+      );
+    }
+    return chosen;
+  }
+  for (const provider of registry.values()) {
+    if (provider.eligible(env)) return provider;
+  }
+  throw new BackupError("no backup destination is configured");
+}
+
+// src/backup/providers.ts
+import {
+  mkdirSync,
+  readFileSync as readFileSync4,
+  readdirSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { isAbsolute, join, resolve } from "path";
+
+// src/backup/sigv4.ts
+import { createHash, createHmac } from "crypto";
+var ALGORITHM = "AWS4-HMAC-SHA256";
+var sha256Hex2 = (data) => createHash("sha256").update(data).digest("hex");
+var hmac = (key, data) => new Uint8Array(createHmac("sha256", key).update(data, "utf8").digest());
+function amzDate(now) {
+  return `${now.toISOString().replace(/[:-]|\.\d{3}/g, "")}`;
+}
+function encodePath(path) {
+  return path.split("/").map(
+    (segment) => encodeURIComponent(segment).replace(
+      /[!'()*]/g,
+      (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`
+    )
+  ).join("/");
+}
+function canonicalQuery(query) {
+  return Object.keys(query).sort().map(
+    (key) => `${encodeURIComponent(key)}=${encodeURIComponent(query[key] ?? "")}`
+  ).join("&");
+}
+function signRequest(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const stamp = amzDate(now);
+  const day = stamp.slice(0, 8);
+  const payloadHash = sha256Hex2(input.body);
+  const headers = {
+    ...input.headers,
+    "x-amz-date": stamp,
+    "x-amz-content-sha256": payloadHash
+  };
+  if (input.sessionToken !== void 0 && input.sessionToken !== "") {
+    headers["x-amz-security-token"] = input.sessionToken;
+  }
+  const names = Object.keys(headers).map((name) => name.toLowerCase()).sort();
+  const lookup = new Map(
+    Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value])
+  );
+  const canonicalHeaders = names.map((name) => `${name}:${(lookup.get(name) ?? "").trim()}
+`).join("");
+  const signedHeaders = names.join(";");
+  const canonicalRequest = [
+    input.method.toUpperCase(),
+    input.path,
+    canonicalQuery(input.query ?? {}),
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash
+  ].join("\n");
+  const scope = `${day}/${input.region}/${input.service}/aws4_request`;
+  const stringToSign = [
+    ALGORITHM,
+    stamp,
+    scope,
+    sha256Hex2(canonicalRequest)
+  ].join("\n");
+  const kDate = hmac(`AWS4${input.secretAccessKey}`, day);
+  const kRegion = hmac(kDate, input.region);
+  const kService = hmac(kRegion, input.service);
+  const kSigning = hmac(kService, "aws4_request");
+  const signature = Buffer.from(hmac(kSigning, stringToSign)).toString("hex");
+  return {
+    headers: {
+      ...headers,
+      authorization: `${ALGORITHM} Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+    },
+    canonicalRequest,
+    stringToSign,
+    signature
+  };
+}
+
+// src/backup/providers.ts
+var fileProvider = {
+  name: "file",
+  describe: (env) => {
+    const given = env["ENVS_BACKUP_DIR"];
+    return given === void 0 || given === "" ? "needs ENVS_BACKUP_DIR or --to <dir>" : `writes to ${resolve(given)}`;
+  },
+  eligible: (env) => (env["ENVS_BACKUP_DIR"] ?? "") !== "",
+  async put(env, name, bytes) {
+    const dir = directoryOf(env);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, name), bytes, { mode: 384 });
+  },
+  async get(env, name) {
+    return new Uint8Array(readFileSync4(join(directoryOf(env), name)));
+  },
+  async list(env) {
+    const dir = directoryOf(env);
+    let names;
+    try {
+      names = readdirSync(dir);
+    } catch {
+      return [];
+    }
+    return names.filter((name) => name.endsWith(".envsnap")).map((name) => {
+      const info = statSync(join(dir, name));
+      return {
+        name,
+        size: info.size,
+        modifiedAt: info.mtime.toISOString()
+      };
+    }).sort((a, b) => a.name.localeCompare(b.name));
+  }
+};
+function directoryOf(env) {
+  const given = env["ENVS_BACKUP_DIR"];
+  if (given === void 0 || given === "") {
+    throw new BackupError(
+      "set ENVS_BACKUP_DIR to a directory, or pass --to <dir>"
+    );
+  }
+  return isAbsolute(given) ? given : resolve(given);
+}
+function s3Config(env) {
+  const bucket = env["ENVS_BACKUP_BUCKET"] ?? "";
+  const accessKeyId = env["ENVS_BACKUP_ACCESS_KEY_ID"] ?? env["AWS_ACCESS_KEY_ID"] ?? "";
+  const secretAccessKey = env["ENVS_BACKUP_SECRET_ACCESS_KEY"] ?? env["AWS_SECRET_ACCESS_KEY"] ?? "";
+  if (bucket === "" || accessKeyId === "" || secretAccessKey === "") {
+    return void 0;
+  }
+  const region = env["ENVS_BACKUP_REGION"] ?? env["AWS_REGION"] ?? "us-east-1";
+  const endpoint = env["ENVS_BACKUP_ENDPOINT"] ?? `https://s3.${region}.amazonaws.com`;
+  const token = env["ENVS_BACKUP_SESSION_TOKEN"] ?? env["AWS_SESSION_TOKEN"];
+  return {
+    endpoint: endpoint.replace(/\/+$/, ""),
+    bucket,
+    region,
+    accessKeyId,
+    secretAccessKey,
+    ...token !== void 0 && token !== "" ? { sessionToken: token } : {},
+    prefix: (env["ENVS_BACKUP_PREFIX"] ?? "").replace(/^\/+|\/+$/g, "")
+  };
+}
+async function s3Send(config2, method, key, body, query = {}) {
+  const url = new URL(`${config2.endpoint}/${config2.bucket}${key}`);
+  for (const [name, value] of Object.entries(query)) {
+    url.searchParams.set(name, value);
+  }
+  const signed = signRequest({
+    method,
+    path: encodePath(url.pathname),
+    query,
+    headers: { host: url.host },
+    body,
+    region: config2.region,
+    service: "s3",
+    accessKeyId: config2.accessKeyId,
+    secretAccessKey: config2.secretAccessKey,
+    ...config2.sessionToken ? { sessionToken: config2.sessionToken } : {}
+  });
+  const response = await fetch(url, {
+    method,
+    headers: signed.headers,
+    ...method === "PUT" ? { body } : {}
+  });
+  if (!response.ok) {
+    throw new BackupError(
+      `${method} ${url.pathname} failed: ${response.status} ${(await response.text()).slice(0, 200)}`
+    );
+  }
+  return response;
+}
+var s3Provider = {
+  name: "s3",
+  describe: (env) => s3Config(env) === void 0 ? "needs ENVS_BACKUP_BUCKET and credentials" : `writes to ${s3Config(env).endpoint}/${s3Config(env).bucket}`,
+  eligible: (env) => s3Config(env) !== void 0,
+  async put(env, name, bytes) {
+    const config2 = s3Config(env);
+    await s3Send(config2, "PUT", keyFor(config2, name), bytes);
+  },
+  async get(env, name) {
+    const config2 = s3Config(env);
+    const response = await s3Send(
+      config2,
+      "GET",
+      keyFor(config2, name),
+      new Uint8Array(0)
+    );
+    return new Uint8Array(await response.arrayBuffer());
+  },
+  async list(env) {
+    const config2 = s3Config(env);
+    const response = await s3Send(config2, "GET", "", new Uint8Array(0), {
+      "list-type": "2",
+      ...config2.prefix === "" ? {} : { prefix: `${config2.prefix}/` }
+    });
+    const xml = await response.text();
+    const out = [];
+    for (const block of xml.split("<Contents>").slice(1)) {
+      const key = /<Key>([^<]*)<\/Key>/.exec(block)?.[1];
+      if (key === void 0 || !key.endsWith(".envsnap")) continue;
+      out.push({
+        name: key.slice(key.lastIndexOf("/") + 1),
+        size: Number(/<Size>(\d+)<\/Size>/.exec(block)?.[1] ?? 0),
+        .../<LastModified>([^<]*)<\/LastModified>/.exec(block)?.[1] ? {
+          modifiedAt: /<LastModified>([^<]*)<\/LastModified>/.exec(
+            block
+          )[1]
+        } : {}
+      });
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+  }
+};
+function keyFor(config2, name) {
+  return config2.prefix === "" ? `/${name}` : `/${config2.prefix}/${name}`;
+}
+register(s3Provider);
+register(fileProvider);
+
+// src/remote/session.ts
+import {
+  constants,
+  closeSync,
+  fchmodSync,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync as readFileSync5,
+  renameSync,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var form = (fields) => new URLSearchParams(fields).toString();
+var FORM_HEADERS = { "content-type": "application/x-www-form-urlencoded" };
+function validateIssuerUrl(value, issuer) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.origin !== new URL(issuer).origin || url.username || url.password || url.hash)
+    throw new Error("OAuth endpoint must stay on the issuer origin");
+}
+async function discover(issuer, fetcher2) {
+  const base = issuer.replace(/\/+$/, "");
+  const source = new URL(base);
+  if (source.protocol !== "https:" || source.username || source.password || source.search || source.hash || source.pathname !== "/")
+    throw new Error("issuer must be an HTTPS origin");
+  const res = await fetcher2(`${base}/.well-known/oauth-authorization-server`);
+  if (!res.ok)
+    throw new Error(`issuer did not answer discovery (${res.status})`);
+  const body = await res.json();
+  if (!body.token_endpoint || !body.device_authorization_endpoint) {
+    throw new Error("issuer advertises no device grant");
+  }
+  if (!body.issuer || new URL(body.issuer).toString() !== source.toString()) {
+    throw new Error("discovery issuer mismatch");
+  }
+  for (const endpoint of [
+    body.token_endpoint,
+    body.device_authorization_endpoint,
+    body.revocation_endpoint
+  ]) {
+    if (endpoint !== void 0) validateIssuerUrl(endpoint, base);
+  }
+  const grants = body.grant_types_supported ?? [];
+  if (grants.length > 0 && !grants.includes(DEVICE_GRANT)) {
+    throw new Error("issuer does not support the device grant");
+  }
+  return body;
+}
+async function startDevice(metadata, request, fetcher2, now = Date.now) {
+  const res = await fetcher2(metadata.device_authorization_endpoint, {
+    method: "POST",
+    headers: FORM_HEADERS,
+    body: form({
+      client_id: request.clientId,
+      resource: request.resource,
+      scope: request.scope
+    })
+  });
+  const body = await res.json();
+  if (!res.ok) {
+    throw new Error(
+      String(body["error"] ?? `device request failed (${res.status})`)
+    );
+  }
+  const deviceCode = body["device_code"];
+  const userCode = body["user_code"];
+  const verificationUri = body["verification_uri"];
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string") {
+    throw new Error("device response is missing a field");
+  }
+  const interval = Number(body["interval"] ?? 5);
+  const expires = Number(body["expires_in"] ?? 600);
+  const complete = body["verification_uri_complete"];
+  validateIssuerUrl(verificationUri, metadata.device_authorization_endpoint);
+  if (typeof complete === "string")
+    validateIssuerUrl(complete, metadata.device_authorization_endpoint);
+  if (!Number.isFinite(interval) || interval < 1 || interval > 300 || !Number.isFinite(expires) || expires < 1 || expires > 3600)
+    throw new Error("invalid device timing");
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...typeof complete === "string" ? { verificationUriComplete: complete } : {},
+    intervalMs: (Number.isFinite(interval) ? interval : 5) * 1e3,
+    expiresAt: now() + (Number.isFinite(expires) ? expires : 600) * 1e3
+  };
+}
+async function pollOnce(metadata, request, fetcher2, now = Date.now) {
+  const res = await fetcher2(metadata.token_endpoint, {
+    method: "POST",
+    headers: FORM_HEADERS,
+    body: form({
+      grant_type: DEVICE_GRANT,
+      device_code: request.deviceCode,
+      client_id: request.clientId
+    })
+  });
+  const body = await res.json();
+  if (res.ok) {
+    const token = body["access_token"];
+    if (typeof token !== "string")
+      throw new Error("token response has no token");
+    const expiresIn = Number(body["expires_in"]);
+    const refresh2 = body["refresh_token"];
+    const scope = body["scope"];
+    return {
+      kind: "granted",
+      session: {
+        issuer: request.issuer,
+        clientId: request.clientId,
+        accessToken: token,
+        ...typeof refresh2 === "string" ? { refreshToken: refresh2 } : {},
+        ...Number.isFinite(expiresIn) ? { expiresAt: now() + expiresIn * 1e3 } : {},
+        ...typeof scope === "string" ? { scope } : {}
+      }
+    };
+  }
+  switch (body["error"]) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    default:
+      return { kind: "denied" };
+  }
+}
+async function refresh(metadata, session, clientId, fetcher2, now = Date.now) {
+  if (typeof session.refreshToken !== "string") return null;
+  validateIssuerUrl(metadata.token_endpoint, session.issuer);
+  let res;
+  try {
+    res = await fetcher2(metadata.token_endpoint, {
+      method: "POST",
+      headers: FORM_HEADERS,
+      body: form({
+        grant_type: "refresh_token",
+        refresh_token: session.refreshToken,
+        client_id: clientId
+      })
+    });
+  } catch {
+    return null;
+  }
+  if (!res.ok) return null;
+  const body = await res.json();
+  const token = body["access_token"];
+  if (typeof token !== "string" || token === "") return null;
+  const expiresIn = Number(body["expires_in"]);
+  const rotated = body["refresh_token"];
+  const scope = body["scope"];
+  return {
+    issuer: session.issuer,
+    clientId,
+    accessToken: token,
+    // A server that rotates the refresh token invalidates the old one, so
+    // keeping the previous value would sign the machine out on next use.
+    refreshToken: typeof rotated === "string" && rotated !== "" ? rotated : session.refreshToken,
+    ...Number.isFinite(expiresIn) ? { expiresAt: now() + expiresIn * 1e3 } : {},
+    ...typeof scope === "string" ? { scope } : session.scope !== void 0 ? { scope: session.scope } : {}
+  };
+}
+var sessionPath = (home) => join2(globalDir(home), "session.json");
+function absent(error) {
+  return error.code === "ENOENT";
+}
+function secureDirectory(home, create = false) {
+  const dir = resolve2(globalDir(home));
+  for (let path = dirname2(dir); ; path = dirname2(path)) {
+    const stat2 = lstatSync(path);
+    if (!stat2.isDirectory() || stat2.isSymbolicLink())
+      throw new Error(`unsafe session parent ${path}: not a plain directory`);
+    if ((stat2.mode & 18) !== 0 && (stat2.mode & 512) === 0)
+      throw new Error(
+        `unsafe session parent ${path}: writable by others, so ${dir} is not private`
+      );
+    if (path === dirname2(path)) break;
+  }
+  if (create) mkdirSync2(dir, { mode: 448 });
+  const stat = lstatSync(dir);
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    throw new Error(`unsafe session directory ${dir}: not a plain directory`);
+  if (stat.uid !== process.getuid?.())
+    throw new Error(`unsafe session directory ${dir}: owned by another user`);
+  if ((stat.mode & 18) !== 0)
+    throw new Error(
+      `unsafe session directory ${dir}: not private; run chmod 700 ${dir}`
+    );
+}
+function parseSession(value) {
+  const session = value;
+  if (!session || typeof session.issuer !== "string" || typeof session.accessToken !== "string" || !session.accessToken || session.refreshToken !== void 0 && typeof session.refreshToken !== "string" || session.expiresAt !== void 0 && !Number.isFinite(session.expiresAt))
+    throw new Error("invalid stored session");
+  const issuer = new URL(session.issuer);
+  if (issuer.protocol !== "https:" || issuer.username || issuer.password || issuer.search || issuer.hash || issuer.pathname !== "/")
+    throw new Error("invalid stored issuer");
+  return session;
+}
+function readSession(home) {
+  let fd;
+  try {
+    secureDirectory(home);
+    fd = openSync(sessionPath(home), constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > 65536)
+      throw new Error("unsafe session file");
+    return parseSession(JSON.parse(readFileSync5(fd, "utf8")));
+  } catch (error) {
+    if (absent(error)) return null;
+    throw error;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+function writeSession(session, home) {
+  parseSession(session);
+  try {
+    secureDirectory(home);
+  } catch (error) {
+    if (!absent(error)) throw error;
+    secureDirectory(home, true);
+  }
+  const path = sessionPath(home);
+  try {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.uid !== process.getuid?.())
+      throw new Error("unsafe session destination");
+  } catch (error) {
+    if (!absent(error)) throw error;
+  }
+  const temporary = join2(globalDir(home), `.session-${randomUUID2()}`);
+  const fd = openSync(
+    temporary,
+    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+    384
+  );
+  try {
+    fchmodSync(fd, 384);
+    writeFileSync2(fd, `${JSON.stringify(session)}
+`);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  try {
+    renameSync(temporary, path);
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+  }
+}
+function clearSession(home) {
+  try {
+    secureDirectory(home);
+    unlinkSync(sessionPath(home));
+  } catch (error) {
+    if (!absent(error)) throw error;
+  }
+}
+async function revoke(metadata, session, clientId, fetcher2) {
+  if (!metadata.revocation_endpoint) return false;
+  validateIssuerUrl(metadata.revocation_endpoint, session.issuer);
+  let ok = true;
+  const tokens = [session.refreshToken, session.accessToken].filter(
+    (token) => typeof token === "string"
+  );
+  for (const token of tokens) {
+    try {
+      const res = await fetcher2(metadata.revocation_endpoint, {
+        method: "POST",
+        headers: FORM_HEADERS,
+        body: form({ token, client_id: clientId })
+      });
+      if (!res.ok) ok = false;
+    } catch {
+      ok = false;
+    }
+  }
+  return ok;
+}
+
+// src/remote/client.ts
+var DEFAULT_ISSUER = "https://auth.envs.build";
+var DEFAULT_CLIENT = "https://auth.envs.build/oauth-client.json";
+var DEFAULT_RESOURCE = "https://api.envs.build";
+var DEFAULT_SCOPE = "envs:catalog:read envs:catalog:write envs:team:manage";
+var setting = (env, name, fallback) => env[name] ?? fallback;
+var fetcher = (url, init) => fetch(url, {
+  ...init,
+  redirect: "error",
+  signal: AbortSignal.timeout(15e3)
+});
+var RemoteError = class extends Error {
+  constructor(message, detail, status) {
+    super(message);
+    this.detail = detail;
+    this.status = status;
+    this.name = "RemoteError";
+  }
+  detail;
+  status;
+};
+var RENEW_BEFORE_MS = 6e4;
+function sessionState(env) {
+  try {
+    return { session: readSession(env["HOME"]) };
+  } catch (error) {
+    return { session: null, unreadable: error.message };
+  }
+}
+async function access(env) {
+  const state = sessionState(env);
+  if (state.unreadable !== void 0) {
+    throw new RemoteError("cannot read the sign-in here", state.unreadable);
+  }
+  const session = state.session;
+  if (!session) {
+    throw new RemoteError("not signed in", "run envs login");
+  }
+  const resource = setting(env, "ENVS_RESOURCE", DEFAULT_RESOURCE).replace(
+    /\/+$/,
+    ""
+  );
+  const stale = session.expiresAt !== void 0 && session.expiresAt - Date.now() < RENEW_BEFORE_MS;
+  if (!stale) return { token: session.accessToken, resource };
+  const clientId = session.clientId ?? setting(env, "ENVS_OAUTH_CLIENT_ID", DEFAULT_CLIENT);
+  try {
+    const metadata = await discover(session.issuer, fetcher);
+    const renewed = await refresh(metadata, session, clientId, fetcher);
+    if (renewed) {
+      writeSession(renewed, env["HOME"]);
+      return { token: renewed.accessToken, resource };
+    }
+  } catch {
+  }
+  return { token: session.accessToken, resource };
+}
+async function refusal(response) {
+  const text = await response.text();
+  try {
+    const body = JSON.parse(text);
+    const message = typeof body.error?.message === "string" ? body.error.message : "";
+    const code = typeof body.error?.code === "string" ? body.error.code : "";
+    const id = typeof body.requestId === "string" ? body.requestId : "";
+    const said = message || code;
+    if (!said) return text;
+    return id ? `${said} (request ${id})` : said;
+  } catch {
+    return text;
+  }
+}
+function explain(status, path, body) {
+  const detail = body.slice(0, 200);
+  const said = (message, why) => new RemoteError(message, why, status);
+  switch (status) {
+    case 401:
+      return said("sign-in expired", "run envs login again");
+    case 402:
+      return said(
+        "this destination needs a subscription",
+        "your catalog is untouched and stays readable; see envs.build"
+      );
+    case 403:
+      return said("this sign-in may not do that", detail);
+    case 404:
+      return said("not found on the remote", path);
+    case 409:
+      return said("the remote read different bytes", detail);
+    case 412:
+      return said(
+        "the remote moved since you last read it",
+        "someone else wrote it; read it again before writing"
+      );
+    case 413:
+      return said("snapshot is too large for the remote", detail);
+    case 428:
+      return said("refusing to overwrite blindly", detail);
+    default:
+      return said(`remote refused: ${String(status)}`, detail);
+  }
+}
+async function hub(grant, request) {
+  const url = `${grant.resource}${request.path}`;
+  let response;
+  try {
+    response = await fetch(url, {
+      method: request.method,
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4),
+      headers: {
+        authorization: `Bearer ${grant.token}`,
+        accept: request.accept ?? "application/json",
+        ...request.headers ?? {}
+      },
+      ...request.body ? {
+        body: request.body.slice().buffer,
+        duplex: "half"
+      } : {}
+    });
+  } catch (error) {
+    throw new RemoteError(
+      "could not reach the remote",
+      error instanceof Error ? error.message : void 0
+    );
+  }
+  if (!response.ok) {
+    throw explain(response.status, request.path, await refusal(response));
+  }
+  return response;
+}
+async function account(grant) {
+  const body = await (await hub(grant, { method: "GET", path: "/v1/me" })).json();
+  const subscription = body["subscription"];
+  return {
+    userId: String(body["userId"] ?? ""),
+    subscription: subscription === "active" || subscription === "inactive" ? subscription : "unavailable",
+    catalogs: Array.isArray(body["catalogs"]) ? body["catalogs"] : [],
+    members: Array.isArray(body["members"]) ? body["members"] : [],
+    teams: Array.isArray(body["teams"]) ? body["teams"] : [],
+    teamManagement: body["capabilities"]?.teamManagement === true
+  };
+}
+
+// src/backup/remote.ts
+var REMOTE_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+var scopeOf = (env) => {
+  const raw = env["ENVS_REMOTE_SCOPE"] ?? "";
+  return raw === "" ? "" : `${raw.replace(/[^A-Za-z0-9._-]/g, "-")}-`;
+};
+function remoteId(env, name) {
+  const id = `${scopeOf(env)}${name}`.toLowerCase();
+  if (!REMOTE_ID.test(id)) {
+    throw new BackupError(
+      `"${name}" cannot be named on the remote; it must be letters, digits, dot, dash or underscore`
+    );
+  }
+  return id;
+}
+async function currentVersion(grant, owner, id) {
+  try {
+    const response = await hub(grant, {
+      method: "GET",
+      path: `/v1/catalogs/${owner}/${id}/head`
+    });
+    const body = await response.json();
+    return typeof body.version === "string" ? body.version : null;
+  } catch (error) {
+    if (error instanceof RemoteError && error.status === 404) return null;
+    throw error;
+  }
+}
+async function grantFor(env) {
+  const grant = await access(env);
+  const who = await account(grant);
+  if (who.userId === "") {
+    throw new BackupError("the remote did not say who this sign-in belongs to");
+  }
+  return { grant, who };
+}
+var remoteProvider = {
+  name: "envs",
+  describe: (env) => {
+    const state = sessionState(env);
+    if (state.unreadable !== void 0) return state.unreadable;
+    return state.session ? `writes to ${env["ENVS_RESOURCE"] ?? "the hosted catalog"}` : "needs envs login";
+  },
+  // Declared, not discovered by failing: without a sign-in there is nothing to
+  // try, and the file provider stays the default.
+  eligible: (env) => sessionState(env).session !== null,
+  async put(env, name, bytes) {
+    const { grant, who } = await grantFor(env);
+    const id = remoteId(env, name);
+    const version = await currentVersion(grant, who.userId, id);
+    await hub(grant, {
+      method: "PUT",
+      path: `/v1/catalogs/${who.userId}/${id}`,
+      body: bytes,
+      headers: {
+        "content-type": "application/octet-stream",
+        "x-envs-digest": await sha256Hex(bytes),
+        // Says which of the two writes this is, so a concurrent write is
+        // refused rather than silently overwriting someone else's snapshot.
+        ...version === null ? { "if-none-match": "*" } : { "if-match": `"${version}"` }
+      }
+    });
+  },
+  async get(env, name) {
+    const { grant, who } = await grantFor(env);
+    const response = await hub(grant, {
+      method: "GET",
+      path: `/v1/catalogs/${who.userId}/${remoteId(env, name)}`,
+      accept: "application/octet-stream"
+    });
+    return new Uint8Array(await response.arrayBuffer());
+  },
+  async list(env) {
+    const { who } = await grantFor(env);
+    const prefix = scopeOf(env);
+    return who.catalogs.filter(
+      (entry) => entry.id.startsWith(prefix) && entry.id.endsWith(".envsnap")
+    ).map(
+      (entry) => ({
+        name: entry.id,
+        size: entry.bytes,
+        ...entry.updatedAt ? { modifiedAt: entry.updatedAt } : {}
+      })
+    ).sort((a, b) => a.name.localeCompare(b.name));
+  }
+};
+register(remoteProvider);
+
+// src/backup/snapshot.ts
+import { createHash as createHash2 } from "crypto";
+var SNAPSHOT_MAGIC = "ENVSNAP1";
+var encoder2 = new TextEncoder();
+var decoder = new TextDecoder();
+var b64 = (bytes) => Buffer.from(bytes).toString("base64");
+var unb64 = (text) => new Uint8Array(Buffer.from(text, "base64"));
+function snapshotContext(catalogId, createdAt) {
+  return encoder2.encode(`envs:snapshot:v1:${catalogId}:${createdAt}`);
+}
+function pack(input) {
+  const header = {
+    magic: SNAPSHOT_MAGIC,
+    catalogId: input.catalogId,
+    schemaVersion: input.schemaVersion,
+    createdAt: input.createdAt,
+    // Of the plaintext, so a restore can say the bytes are the ones sealed.
+    sha256: createHash2("sha256").update(input.catalogBytes).digest("hex"),
+    wraps: input.wraps.map((wrap) => ({
+      wrapId: wrap.wrapId,
+      method: wrap.method,
+      salt: b64(wrap.salt),
+      n: wrap.n,
+      r: wrap.r,
+      p: wrap.p,
+      envelope: b64(wrap.envelope)
+    }))
+  };
+  const headerBytes = encoder2.encode(`${JSON.stringify(header)}
+`);
+  const body = seal({
+    kek: input.dek,
+    kekVersion: 1,
+    plaintext: input.catalogBytes,
+    context: snapshotContext(input.catalogId, input.createdAt)
+  });
+  const out = new Uint8Array(headerBytes.length + body.length);
+  out.set(headerBytes, 0);
+  out.set(body, headerBytes.length);
+  return out;
+}
+function readHeader(blob) {
+  const newline = blob.indexOf(10);
+  if (newline === -1) throw new BackupError("not a snapshot: no header");
+  let header;
+  try {
+    header = JSON.parse(decoder.decode(blob.subarray(0, newline)));
+  } catch {
+    throw new BackupError("not a snapshot: the header is not JSON");
+  }
+  if (header.magic !== SNAPSHOT_MAGIC) {
+    throw new BackupError(`not a snapshot: magic is ${String(header.magic)}`);
+  }
+  return { header, body: blob.subarray(newline + 1) };
+}
+function unpack(blob, unlock) {
+  const { header, body } = readHeader(blob);
+  const wraps = header.wraps.map((wrap) => ({
+    wrapId: wrap.wrapId,
+    method: wrap.method === "kek" ? "kek" : "recovery",
+    salt: unb64(wrap.salt),
+    n: wrap.n,
+    r: wrap.r,
+    p: wrap.p,
+    envelope: unb64(wrap.envelope)
+  }));
+  const dek = unlockDek(wraps, unlock);
+  const catalogBytes = open({
+    kek: dek,
+    blob: body,
+    context: snapshotContext(header.catalogId, header.createdAt)
+  });
+  const digest = createHash2("sha256").update(catalogBytes).digest("hex");
+  if (digest !== header.sha256) {
+    throw new BackupError("snapshot contents do not match the header digest");
+  }
+  return { header, catalogBytes };
+}
+function snapshotName(catalogId, createdAt) {
+  const stamp = createdAt.replace(/[:.]/g, "-");
+  return `${catalogId.slice(0, 8)}-${stamp}.envsnap`;
+}
+
+// src/catalog/dir.ts
+import { chmodSync, existsSync as existsSync7, mkdirSync as mkdirSync3, statSync as statSync2 } from "fs";
+function ensureCatalogDir(dir) {
+  const existed = existsSync7(dir);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  try {
+    if ((statSync2(dir).mode & 63) === 0) return existed ? "ok" : "created";
+    chmodSync(dir, 448);
+    return existed ? "narrowed" : "created";
+  } catch {
+    return "unsupported";
+  }
+}
+
+// src/commands/backup.ts
+function reportFailure(ui, error) {
+  const detail = error instanceof RemoteError ? error.detail : void 0;
+  const message = error instanceof Error ? error.message : String(error);
+  if (detail) ui.error(message, detail);
+  else ui.error(message);
+}
+function destinationEnv(env, to) {
+  if (to === void 0) return env;
+  const remote = /^envs:\/\/(.*)$/.exec(to);
+  if (remote) {
+    const scope = remote[1].replace(/^\/+|\/+$/g, "");
+    return {
+      ...env,
+      ENVS_BACKUP_PROVIDER: "envs",
+      ...scope === "" ? {} : { ENVS_REMOTE_SCOPE: scope }
+    };
+  }
+  const s3 = /^s3:\/\/([^/]+)(?:\/(.*))?$/.exec(to);
+  if (s3) {
+    const prefix = (s3[2] ?? "").replace(/^\/+|\/+$/g, "");
+    return {
+      ...env,
+      ENVS_BACKUP_PROVIDER: "s3",
+      ENVS_BACKUP_BUCKET: s3[1],
+      ...prefix === "" ? {} : { ENVS_BACKUP_PREFIX: prefix }
+    };
+  }
+  return { ...env, ENVS_BACKUP_DIR: to, ENVS_BACKUP_PROVIDER: "file" };
+}
+var DESTINATION_OPTIONS = [
+  {
+    name: "to",
+    placeholder: "<dest>",
+    describe: "a directory, s3://bucket/prefix, or envs:// for your account"
+  },
+  {
+    name: "provider",
+    placeholder: "<name>",
+    describe: "file, s3 or envs; otherwise the first that is configured"
+  },
+  {
+    name: "recovery-code",
+    placeholder: "<code|->",
+    describe: "unlock with a recovery code; - reads it from stdin"
+  }
+];
+var backupCommand = {
+  name: "backup",
+  describe: "write an encrypted snapshot of the catalog",
+  usage: "envs backup [--to <dest>] [--provider file|s3|envs]",
+  group: "backup",
+  options: [...DESTINATION_OPTIONS],
+  async run({ ui, args, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync8(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    try {
+      const destination = destinationEnv(env, one(args, "to"));
+      const provider = resolveProvider(destination, one(args, "provider"));
+      const db = openDatabaseSync(located.project);
+      let blob;
+      let name;
+      try {
+        db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+        const meta = readMeta(db);
+        if (meta === void 0) throw new BackupError("catalog has no schema");
+        const wraps = readWraps(db);
+        const dek = unlockDek(wraps, unlock);
+        const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+        blob = pack({
+          catalogBytes: new Uint8Array(readFileSync6(located.project)),
+          catalogId: meta.catalogId,
+          schemaVersion: meta.version,
+          wraps,
+          dek,
+          createdAt
+        });
+        name = snapshotName(meta.catalogId, createdAt);
+        audit(db, "backup.write", name, provider.name);
+      } finally {
+        db.close();
+      }
+      await provider.put(destination, name, blob);
+      ui.success(`wrote ${name}`, `${blob.length} bytes`);
+      ui.info(provider.describe(destination));
+      return 0;
+    } catch (error) {
+      reportFailure(ui, error);
+      return 1;
+    }
+  }
+};
+var restoreCommand = {
+  name: "restore",
+  describe: "put a snapshot back, keeping the catalog it replaces",
+  usage: "envs restore <name> [--to <dest>] [--force]  |  envs restore --list",
+  group: "backup",
+  options: [
+    ...DESTINATION_OPTIONS,
+    {
+      name: "list",
+      boolean: true,
+      describe: "list what the destination holds"
+    },
+    {
+      name: "force",
+      boolean: true,
+      describe: "replace an existing catalog (the old one is kept beside it)"
+    }
+  ],
+  async run({ ui, args, env, cwd }) {
+    const destination = destinationEnv(env, one(args, "to"));
+    let provider;
+    try {
+      provider = resolveProvider(destination, one(args, "provider"));
+    } catch (error) {
+      reportFailure(ui, error);
+      ui.table(
+        providers().map((candidate) => [
+          candidate.name,
+          candidate.eligible(destination) ? candidate.describe(destination) : `not configured \u2014 ${candidate.describe(destination)}`
+        ])
+      );
+      return 2;
+    }
+    if (args.flags.has("list")) {
+      try {
+        const found = await provider.list(destination);
+        if (found.length === 0) {
+          ui.info("nothing there", provider.describe(destination));
+          return 0;
+        }
+        ui.heading(provider.describe(destination));
+        ui.table(
+          found.map((snapshot) => [
+            snapshot.name,
+            `${snapshot.size} bytes  ${snapshot.modifiedAt ?? ""}`.trimEnd()
+          ])
+        );
+        return 0;
+      } catch (error) {
+        reportFailure(ui, error);
+        return 1;
+      }
+    }
+    const name = args.positional[0];
+    if (name === void 0 || args.positional.length > 1) {
+      ui.error("give one snapshot name", "envs restore --list shows them");
+      return 2;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock, "a recovery code is enough here");
+      return 2;
+    }
+    const located = locateCatalogs({ cwd, env });
+    if (existsSync8(located.project) && !args.flags.has("force")) {
+      ui.error("a catalog is already here", located.project);
+      ui.info("pass --force", "the one it replaces is kept beside it");
+      return 1;
+    }
+    try {
+      const blob = await provider.get(destination, name);
+      const { header, catalogBytes } = unpack(blob, unlock);
+      if (ensureCatalogDir(dirname3(located.project)) === "narrowed") {
+        ui.warn(
+          "narrowed the catalog directory to 700",
+          "it was writable by others, who could have replaced the catalog"
+        );
+      }
+      if (existsSync8(located.project)) {
+        const kept = `${located.project}.replaced-${Date.now()}`;
+        copyFileSync(located.project, kept);
+        ui.info("kept the catalog it replaced", kept);
+      }
+      const incoming = `${located.project}.incoming`;
+      writeFileSync3(incoming, catalogBytes, { mode: 384 });
+      renameSync2(incoming, located.project);
+      for (const suffix of ["-wal", "-shm"]) {
+        rmSync(`${located.project}${suffix}`, { force: true });
+      }
+      ui.success(`restored ${name}`, `catalog ${header.catalogId.slice(0, 8)}`);
+      ui.info("taken at", header.createdAt);
+      ui.info("schema", String(header.schemaVersion));
+      return 0;
+    } catch (error) {
+      reportFailure(ui, error);
+      return 1;
+    }
+  }
+};
+
+// src/commands/build.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, resolve as resolve3 } from "path";
+var DEFAULT_SENSITIVITY = "medium";
+var LEVELS = /* @__PURE__ */ new Set([
+  "low",
+  "medium",
+  "high",
+  "critical"
+]);
+function isSensitivity(value) {
+  return LEVELS.has(value);
+}
+function readSensitivity(db, dek, key) {
+  const row = db.prepare(
+    "SELECT sensitivity FROM keys WHERE key_hash = $hash"
+  ).get({ hash: hashKeyName(dek, key) });
+  const value = row?.sensitivity ?? null;
+  return value !== null && isSensitivity(value) ? value : DEFAULT_SENSITIVITY;
+}
+var PUBLIC_PREFIXES = ["PUBLIC_", "VITE_", "NEXT_PUBLIC_"];
+function isPublicByName(key) {
+  return PUBLIC_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+function asIdentifier(key) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
+}
+function renderModule(chosen, generatedAt) {
+  const lines = [
+    "// Generated by envs. Do not edit.",
+    `// ${generatedAt}`,
+    "//",
+    "// Every value here is baked into whatever imports this file. Only keys",
+    "// classified low reach it; see envs build.",
+    ""
+  ];
+  for (const entry of chosen) {
+    lines.push(`/** from ${entry.alias} (${entry.path}) */`);
+    lines.push(
+      `export const ${asIdentifier(entry.key)} = ${JSON.stringify(entry.value)};`
+    );
+  }
+  lines.push("");
+  lines.push("export const ENV = {");
+  for (const entry of chosen) {
+    lines.push(`  ${asIdentifier(entry.key)},`);
+  }
+  lines.push("} as const;");
+  lines.push("");
+  lines.push("export type EnvKey = keyof typeof ENV;");
+  lines.push("");
+  return lines.join("\n");
+}
+var buildCommand = {
+  name: "build",
+  describe: "write chosen values into a module, for targets that cannot read files",
+  usage: "envs build --out <path> [--expose K1,K2]",
+  group: "publish",
+  options: [
+    {
+      name: "out",
+      placeholder: "<path>",
+      describe: "where to write the module"
+    },
+    {
+      name: "expose",
+      placeholder: "<K1,K2>",
+      describe: "keys to include; repeatable",
+      repeat: true
+    },
+    {
+      name: "public",
+      boolean: true,
+      describe: `also include keys named ${PUBLIC_PREFIXES.join(", ")}`
+    },
+    {
+      name: "allow-sensitive",
+      boolean: true,
+      describe: "bake a key that is not classified low (it cannot be recalled)"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const out = one(args, "out");
+    if (out === void 0) {
+      ui.error("no output path", "envs build --out src/generated/env.ts");
+      return 2;
+    }
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync9(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    const asked = new Set(
+      many(args, "expose").flatMap((value) => value.split(",")).map((key) => key.trim()).filter((key) => key !== "")
+    );
+    const wantPublic = args.flags.has("public");
+    if (asked.size === 0 && !wantPublic) {
+      ui.error(
+        "nothing selected, so nothing was written",
+        "--expose K1,K2 or --public"
+      );
+      return 2;
+    }
+    const db = openDatabaseSync(located.project, { readOnly: true });
+    try {
+      const dek = unlockDek(readWraps(db), unlock);
+      const entries = readEntries(db, { unlock });
+      const seen = /* @__PURE__ */ new Map();
+      for (const entry of entries) {
+        if (!seen.has(entry.key)) seen.set(entry.key, entry);
+      }
+      const wanted = [...seen.values()].filter(
+        (entry) => asked.has(entry.key) || wantPublic && isPublicByName(entry.key)
+      );
+      const missing = [...asked].filter((key) => !seen.has(key));
+      if (missing.length > 0) {
+        ui.error(`no value for ${missing.join(", ")}`, "nothing was written");
+        return 1;
+      }
+      const refused = [];
+      const chosen = [];
+      for (const entry of wanted) {
+        const level = readSensitivity(db, dek, entry.key);
+        if (level === "low" || args.flags.has("allow-sensitive")) {
+          chosen.push(entry);
+          continue;
+        }
+        refused.push(`${entry.key} (${level})`);
+      }
+      if (refused.length > 0) {
+        ui.error("these are not classified low", refused.join(", "));
+        ui.info(
+          "envs set <KEY> <value> --sensitivity low",
+          "or --allow-sensitive to bake them anyway"
+        );
+        return 1;
+      }
+      if (chosen.length === 0) {
+        ui.error("nothing to write", "no selected key survived the check");
+        return 1;
+      }
+      const path = resolve3(cwd, out);
+      mkdirSync5(dirname4(path), { recursive: true });
+      writeFileSync4(path, renderModule(chosen, (/* @__PURE__ */ new Date()).toISOString()));
+      ui.success(`wrote ${out}`, `${chosen.length} values`);
+      ui.warn(
+        "these are now in whatever imports that file",
+        chosen.map((entry) => entry.key).join(", ")
+      );
+      return 0;
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/doctor.ts
+import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
+import { join as join3, relative } from "path";
+function read(path, layer, unlock) {
+  if (!existsSync10(path)) return [];
+  const db = openDatabaseSync(path, { readOnly: true });
+  try {
+    return readEntries(db, { unlock }).map((entry) => ({ ...entry, layer }));
+  } catch {
+    return [];
+  } finally {
+    db.close();
+  }
+}
+function conflicts(entries) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    byKey.set(entry.key, [...byKey.get(entry.key) ?? [], entry]);
+  }
+  const findings = [];
+  for (const [key, group] of byKey) {
+    if (group.length < 2) continue;
+    const same = group.every((entry) => entry.value === group[0].value);
+    const where = group.map((e) => `${e.layer}:${e.alias}`).join(" and ");
+    findings.push({
+      level: same ? "warn" : "error",
+      what: key,
+      detail: same ? `declared twice, same value \u2014 ${where}` : `values differ \u2014 ${where}`
+    });
+  }
+  return findings;
+}
+function globalOnly(entries) {
+  const inProject = new Set(
+    entries.filter((e) => e.layer === "project").map((e) => e.key)
+  );
+  return entries.filter((entry) => entry.layer === "global" && !inProject.has(entry.key)).map((entry) => ({
+    level: "warn",
+    what: entry.key,
+    detail: `only in the machine-wide layer \u2014 a teammate will not have it`
+  }));
+}
+function ghosts(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const findings = [];
+  for (const entry of entries) {
+    if (seen.has(entry.path) || entry.path.startsWith("envs:")) continue;
+    seen.add(entry.path);
+    if (!existsSync10(entry.path)) {
+      findings.push({
+        level: "warn",
+        what: entry.alias,
+        detail: `the file it was loaded from is gone \u2014 ${entry.path}`
+      });
+    }
+  }
+  return findings;
+}
+function catalogIgnored(catalogPath, root) {
+  if (root === void 0) return [];
+  const rel = relative(root, catalogPath);
+  if (rel.startsWith("..")) return [];
+  const ignoreFile = join3(root, ".gitignore");
+  const lines = existsSync10(ignoreFile) ? readFileSync7(ignoreFile, "utf8").split(/\r?\n/).map((line) => line.trim()) : [];
+  if (lines.includes(".envs/") || lines.includes(".envs")) return [];
+  return [
+    {
+      level: "error",
+      what: "the catalog is not ignored by git",
+      detail: `add .envs/ to .gitignore \u2014 ${rel}`
+    }
+  ];
+}
+function readTemplates(path, unlock) {
+  const setAt = /* @__PURE__ */ new Map();
+  if (!existsSync10(path)) return { refs: [], setAt };
+  const db = openDatabaseSync(path, { readOnly: true });
+  try {
+    const refs = appliedTemplates(db);
+    if (refs.length === 0) return { refs, setAt };
+    const dek = unlockDek(readWraps(db), unlock);
+    const current = db.prepare(
+      "SELECT revision_id FROM pointer WHERE id = 1"
+    ).get({});
+    if (current) {
+      const at = db.prepare(
+        "SELECT created_at FROM items WHERE key_hash = $hash AND revision_id = $revision"
+      );
+      for (const ref of refs) {
+        for (const key of Object.keys(ref.template.keys)) {
+          const row = at.get({
+            hash: hashKeyName(dek, key),
+            revision: current.revision_id
+          });
+          if (row) setAt.set(key, row.created_at);
+        }
+      }
+    }
+    return { refs, setAt };
+  } catch {
+    return { refs: [], setAt };
+  } finally {
+    db.close();
+  }
+}
+function templateFindings(refs, entries, setAt, now) {
+  if (refs.length === 0) return [];
+  const findings = [];
+  const value = new Map(entries.map((entry) => [entry.key, entry.value]));
+  const declared = /* @__PURE__ */ new Set();
+  for (const ref of refs) {
+    for (const [key, spec] of Object.entries(ref.template.keys)) {
+      declared.add(key);
+      const held = value.get(key);
+      if (held === void 0) {
+        if (spec.required) {
+          findings.push({
+            level: "error",
+            what: key,
+            detail: `required by ${ref.name} and not set`
+          });
+        }
+        continue;
+      }
+      if (spec.pattern !== void 0) {
+        if (!new RegExp(spec.pattern, "u").test(held)) {
+          findings.push({
+            level: "error",
+            what: key,
+            // The value is not printed, here or anywhere else.
+            detail: `does not match the shape ${ref.name} declares`
+          });
+        }
+      }
+      if (spec.rotateDays !== void 0) {
+        const at = setAt(key);
+        const age = at === void 0 ? void 0 : now - Date.parse(at);
+        if (age !== void 0 && age > spec.rotateDays * 864e5) {
+          findings.push({
+            level: "warn",
+            what: key,
+            detail: `set ${String(Math.floor(age / 864e5))} days ago; ${ref.name} asks for rotation every ${String(spec.rotateDays)}`
+          });
+        }
+      }
+    }
+  }
+  for (const entry of entries) {
+    if (declared.has(entry.key)) continue;
+    findings.push({
+      level: "warn",
+      what: entry.key,
+      detail: "set here but named by no applied template"
+    });
+  }
+  return findings;
+}
+function report(ui, findings) {
+  for (const finding of findings) {
+    if (finding.level === "error") ui.error(finding.what, finding.detail);
+    else ui.warn(finding.what, finding.detail);
+  }
+}
+var doctorCommand = {
+  name: "doctor",
+  describe: "say where each value comes from, and what disagrees",
+  usage: "envs doctor [--key <KEY>]",
+  group: "check",
+  options: [
+    {
+      name: "key",
+      placeholder: "<KEY>",
+      describe: "one key's sources and which one wins"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync10(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    ui.heading("catalogs");
+    ui.table([
+      ["project", located.project],
+      ["global", located.global ?? "(none \u2014 this is the machine-wide catalog)"]
+    ]);
+    ui.line();
+    const entries = [
+      ...read(located.project, "project", unlock),
+      ...located.global ? read(located.global, "global", unlock) : []
+    ];
+    const wanted = one(args, "key");
+    if (wanted !== void 0) {
+      const group = entries.filter((entry) => entry.key === wanted);
+      if (group.length === 0) {
+        ui.warn(`no source declares ${wanted}`);
+        return 1;
+      }
+      ui.heading(wanted);
+      ui.table(
+        group.map((entry, index) => [
+          `${index === 0 ? "*" : " "} ${entry.layer}:${entry.alias}`,
+          entry.path
+        ])
+      );
+      ui.info("* wins", "project beats global; earlier source beats later");
+      return 0;
+    }
+    const applied = readTemplates(located.project, unlock);
+    const findings = [
+      ...catalogIgnored(located.project, located.projectRoot),
+      ...conflicts(entries),
+      ...globalOnly(entries),
+      ...ghosts(entries),
+      ...templateFindings(
+        applied.refs,
+        entries,
+        (key) => applied.setAt.get(key),
+        Date.now()
+      )
+    ];
+    ui.heading("values");
+    ui.table([
+      ["keys", String(new Set(entries.map((entry) => entry.key)).size)],
+      ["sources", String(new Set(entries.map((entry) => entry.alias)).size)]
+    ]);
+    ui.line();
+    if (findings.length === 0) {
+      ui.success("nothing to report");
+      return 0;
+    }
+    ui.heading("findings");
+    report(ui, findings);
+    return findings.some((finding) => finding.level === "error") ? 1 : 0;
+  }
+};
+
+// src/commands/get.ts
+import { existsSync as existsSync11 } from "fs";
+var FORMATS2 = /* @__PURE__ */ new Set([
+  "plain",
+  "shell",
+  "eval",
+  "json"
+]);
+function render(format, key, value) {
+  if (format === "json")
+    return `${JSON.stringify({ [key]: value }, null, 2)}
+`;
+  if (format === "shell") return `${key}=${JSON.stringify(value)}
+`;
+  if (format === "eval") return `export ${key}=${JSON.stringify(value)}
+`;
+  return `${value}
+`;
+}
+var getCommand = {
+  name: "get",
+  describe: "print one value",
+  usage: "envs get <KEY> [--format shell|eval|json]",
+  group: "values",
+  options: [
+    {
+      name: "source",
+      placeholder: "<alias>",
+      describe: "read the key from this source rather than the winner"
+    },
+    {
+      name: "format",
+      placeholder: "<fmt>",
+      describe: "plain (default), shell, eval or json"
+    },
+    {
+      name: "include-global",
+      boolean: true,
+      describe: "also look in the machine-wide layer"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    if (args.positional.length !== 1) {
+      ui.error(
+        "give exactly one key",
+        "envs ls --keys lists them; envs export prints values"
+      );
+      return 2;
+    }
+    const key = args.positional[0];
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync11(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    const paths = [located.project];
+    if (args.flags.has("include-global") && located.global !== void 0) {
+      paths.push(located.global);
+    }
+    const format = one(args, "format") ?? "plain";
+    if (!FORMATS2.has(format)) {
+      ui.error(`unknown format "${format}"`, "use plain, shell, eval or json");
+      return 2;
+    }
+    const wantedSource = one(args, "source");
+    for (const path of paths) {
+      if (!existsSync11(path)) continue;
+      const db = openDatabaseSync(path, { readOnly: true });
+      try {
+        for (const entry of readEntries(db, { unlock })) {
+          if (entry.key !== key) continue;
+          if (wantedSource !== void 0 && entry.alias !== wantedSource)
+            continue;
+          ui.data(render(format, key, entry.value));
+          return 0;
+        }
+      } catch (error) {
+        ui.error(error.message);
+        return 1;
+      } finally {
+        db.close();
+      }
+    }
+    ui.error(
+      `no value for ${key}`,
+      wantedSource === void 0 ? "envs doctor --key lists what declares it" : `not in source ${wantedSource}`
+    );
+    return 1;
+  }
+};
+
+// src/commands/hygiene.ts
+import { execFileSync } from "child_process";
+import {
+  appendFileSync,
+  existsSync as existsSync12,
+  readFileSync as readFileSync8,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { join as join4, relative as relative2 } from "path";
+var IGNORE_LINE = ".envs/";
+function ensureIgnored(root, ui) {
+  const path = join4(root, ".gitignore");
+  if (!existsSync12(path)) {
+    writeFileSync5(path, `${IGNORE_LINE}
+`);
+    ui.success("created .gitignore", IGNORE_LINE);
+    return true;
+  }
+  const text = readFileSync8(path, "utf8");
+  if (text.split(/\r?\n/).some((line) => line.trim() === IGNORE_LINE)) {
+    ui.info(".gitignore already ignores .envs/", "left alone");
+    return false;
+  }
+  appendFileSync(
+    path,
+    text.endsWith("\n") ? `${IGNORE_LINE}
+` : `
+${IGNORE_LINE}
+`
+  );
+  ui.success("added to .gitignore", IGNORE_LINE);
+  return true;
+}
+var gitignoreCommand = {
+  name: "gitignore",
+  describe: "make sure git ignores the catalog",
+  usage: "envs gitignore",
+  group: "check",
+  run({ ui, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    if (located.projectRoot === void 0) {
+      ui.error("no project root here", "nothing to ignore");
+      return 1;
+    }
+    ensureIgnored(located.projectRoot, ui);
+    return 0;
+  }
+};
+function trackedFiles(root) {
+  try {
+    const out = execFileSync("git", ["ls-files", "-z"], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return new Set(out.split("\0").filter((line) => line !== ""));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+var precommitCommand = {
+  name: "precommit",
+  describe: "refuse the commit if a secret is about to go into it",
+  usage: "envs precommit",
+  group: "check",
+  options: [
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    const root = located.projectRoot;
+    if (root === void 0) {
+      ui.error("no project root here", "nothing to check");
+      return 1;
+    }
+    const tracked = trackedFiles(root);
+    if (tracked.size === 0) {
+      ui.warn("git tracks nothing here", "not a repository, or an empty one");
+      return 0;
+    }
+    const problems = [];
+    const catalogRel = relative2(root, located.project);
+    if (!catalogRel.startsWith("..") && tracked.has(catalogRel)) {
+      problems.push(
+        `${catalogRel} is tracked \u2014 the catalog must not be committed`
+      );
+    }
+    if (existsSync12(located.project)) {
+      const unlock = resolveUnlock(one(args, "recovery-code"), env);
+      if (typeof unlock !== "string") {
+        const db = openDatabaseSync(located.project, { readOnly: true });
+        try {
+          const seen = /* @__PURE__ */ new Set();
+          for (const entry of readEntries(db, { unlock })) {
+            if (seen.has(entry.path) || entry.path.startsWith("envs:"))
+              continue;
+            seen.add(entry.path);
+            const rel = relative2(root, entry.path);
+            if (!rel.startsWith("..") && tracked.has(rel)) {
+              problems.push(`${rel} is tracked and holds plaintext values`);
+            }
+          }
+        } catch {
+        } finally {
+          db.close();
+        }
+      } else {
+        ui.info(
+          "no key available",
+          "checked tracked files only, not their contents"
+        );
+      }
+    }
+    if (problems.length === 0) {
+      ui.success("nothing tracked that should not be");
+      return 0;
+    }
+    for (const problem of problems) ui.error(problem);
+    ui.info(
+      "git rm --cached <path>",
+      "removes it from the commit, keeps the file"
+    );
+    return 1;
+  }
+};
+var genexampleCommand = {
+  name: "genexample",
+  describe: "write an example file with the key names and no values",
+  usage: "envs genexample [--out <path>] [--requires]",
+  group: "check",
+  options: [
+    {
+      name: "out",
+      placeholder: "<path>",
+      describe: "where to write (default .env.example)"
+    },
+    {
+      name: "requires",
+      boolean: true,
+      describe: "write envs.requires instead \u2014 names only, for config() to enforce"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync12(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock, "key names are sealed with the values");
+      return 2;
+    }
+    const db = openDatabaseSync(located.project, { readOnly: true });
+    let keys;
+    try {
+      keys = [
+        ...new Set(readEntries(db, { unlock }).map((entry) => entry.key))
+      ].sort();
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+    if (keys.length === 0) {
+      ui.error("no values to describe", "envs load <path> first");
+      return 1;
+    }
+    const wantRequires = args.flags.has("requires");
+    const target = one(args, "out") ?? (wantRequires ? "envs.requires" : ".env.example");
+    const path = join4(located.projectRoot ?? cwd, target);
+    const body = wantRequires ? `${keys.join("\n")}
+` : `${keys.map((key) => `${key}=`).join("\n")}
+`;
+    writeFileSync5(path, body);
+    ui.success(`wrote ${target}`, `${keys.length} keys, no values`);
+    if (wantRequires) {
+      ui.info("commit it", "config() then fails loudly when one is missing");
+    }
+    return 0;
+  }
+};
+
+// src/commands/history.ts
+import { existsSync as existsSync13 } from "fs";
+function releases(db, limit) {
+  return db.prepare(
+    `SELECT r.revision_id, r.created_at, r.note,
+              (SELECT count(*) FROM items i WHERE i.revision_id = r.revision_id) AS items
+         FROM releases r
+        ORDER BY r.created_at DESC, r.rowid DESC
+        LIMIT $limit`
+  ).all({ limit });
+}
+function openHere(cwd, env) {
+  const located = locateCatalogs({ cwd, env });
+  if (!existsSync13(located.project)) return located.project;
+  return { db: openDatabaseSync(located.project), path: located.project };
+}
+var historyCommand = {
+  name: "history",
+  describe: "list releases and say which one is current",
+  usage: "envs history [--limit <n>]",
+  group: "history",
+  options: [
+    {
+      name: "limit",
+      placeholder: "<n>",
+      describe: "how many to show (default 20)"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const opened = openHere(cwd, env);
+    if (typeof opened === "string") {
+      ui.error("no catalog here", opened);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const { db, path } = opened;
+    try {
+      const limit = Number(one(args, "limit") ?? 20);
+      if (!Number.isInteger(limit) || limit < 1) {
+        ui.error("--limit must be a whole number of at least 1");
+        return 2;
+      }
+      const current = currentRevisionId(db);
+      const rows = releases(db, limit);
+      if (rows.length === 0) {
+        ui.info("no releases yet", "envs load <path> makes the first");
+        return 0;
+      }
+      ui.heading(path);
+      ui.table(
+        rows.map((row) => [
+          `${row.revision_id === current ? "*" : " "} ${row.revision_id.slice(0, 8)}`,
+          `${row.created_at}  ${row.items} values  ${row.note ?? ""}`.trimEnd()
+        ])
+      );
+      ui.info("* is current", "envs rollback <id> moves the pointer");
+      return 0;
+    } finally {
+      db.close();
+    }
+  }
+};
+var rollbackCommand = {
+  name: "rollback",
+  describe: "point at an earlier release",
+  usage: "envs rollback <revision-id>",
+  group: "history",
+  run({ ui, args, env, cwd }) {
+    if (args.positional.length !== 1) {
+      ui.error("give one revision id", "envs history shows them");
+      return 2;
+    }
+    const opened = openHere(cwd, env);
+    if (typeof opened === "string") {
+      ui.error("no catalog here", opened);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const { db } = opened;
+    try {
+      const prefix = args.positional[0];
+      const matches = db.prepare(
+        "SELECT revision_id FROM releases WHERE revision_id LIKE $like ORDER BY created_at DESC"
+      ).all({ like: `${prefix}%` });
+      if (matches.length === 0) {
+        ui.error(`no release starting with "${prefix}"`);
+        return 1;
+      }
+      if (matches.length > 1) {
+        ui.error(
+          `"${prefix}" matches ${matches.length} releases`,
+          matches.map((m) => m.revision_id.slice(0, 12)).join(", ")
+        );
+        return 1;
+      }
+      const target = matches[0].revision_id;
+      const current = currentRevisionId(db);
+      if (target === current) {
+        ui.info("already current", target.slice(0, 8));
+        return 0;
+      }
+      movePointer(db, target);
+      ui.success(
+        `now at ${target.slice(0, 8)}`,
+        `was ${current?.slice(0, 8) ?? "none"}`
+      );
+      return 0;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/ls.ts
+import { existsSync as existsSync14 } from "fs";
+var lsCommand = {
+  name: "ls",
+  describe: "list the sources in the catalog, and their keys",
+  usage: "envs ls [--keys]",
+  group: "values",
+  options: [
+    {
+      name: "keys",
+      boolean: true,
+      describe: "also list key names (needs a key)"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync14(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const db = openDatabaseSync(located.project, { readOnly: true });
+    try {
+      const sources = db.prepare(
+        "SELECT alias, path, added_at, retired_at FROM sources ORDER BY added_at"
+      ).all();
+      ui.heading(located.project);
+      if (sources.length === 0) {
+        ui.info("no sources yet", "envs load <path> adds one");
+        return 0;
+      }
+      ui.table(
+        sources.map((source) => [
+          source.retired_at === null ? source.alias : `${source.alias} (retired)`,
+          source.path
+        ])
+      );
+      const revision = currentRevisionId(db);
+      ui.line();
+      ui.info(
+        revision === void 0 ? "no release yet" : `release ${revision.slice(0, 8)} is current`,
+        "envs history lists them"
+      );
+      if (!args.flags.has("keys")) return 0;
+      const unlock = resolveUnlock(one(args, "recovery-code"), env);
+      if (typeof unlock === "string") {
+        ui.error(unlock, "key names are sealed with the values");
+        return 2;
+      }
+      const byAlias = /* @__PURE__ */ new Map();
+      for (const entry of readEntries(db, { unlock })) {
+        byAlias.set(entry.alias, [
+          ...byAlias.get(entry.alias) ?? [],
+          entry.key
+        ]);
+      }
+      ui.line();
+      ui.heading("keys");
+      for (const [alias, keys] of byAlias) {
+        ui.table([[alias, keys.sort().join(" ")]]);
+      }
+      return 0;
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/init.ts
+import { randomBytes } from "crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync15 } from "fs";
+import { dirname as dirname5 } from "path";
+var DEFAULT_CODES = 5;
+var initCommand = {
+  name: "init",
+  describe: "create a catalog and print its recovery codes once",
+  usage: "envs init [--recovery-codes <n>] [--no-gitignore]",
+  group: "start here",
+  options: [
+    {
+      name: "recovery-codes",
+      placeholder: "<n>",
+      describe: `how many to mint (default ${DEFAULT_CODES}, 0 for none)`
+    },
+    {
+      name: "no-gitignore",
+      boolean: true,
+      describe: "do not touch .gitignore"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    const path = located.project;
+    if (existsSync15(path)) {
+      ui.error("a catalog already exists here", path);
+      ui.info("nothing was changed", "delete it deliberately to start over");
+      return 1;
+    }
+    const requested = one(args, "recovery-codes");
+    const count = requested === void 0 ? DEFAULT_CODES : Number(requested);
+    if (!Number.isInteger(count) || count < 0 || count > 20) {
+      ui.error(`--recovery-codes must be a whole number from 0 to 20`);
+      return 2;
+    }
+    const givenKek = env["ENVS_KEK"] ?? "";
+    let kek;
+    let mintedKek = false;
+    if (givenKek !== "") {
+      kek = new Uint8Array(Buffer.from(givenKek, "base64"));
+      if (kek.length !== 32) {
+        ui.error("ENVS_KEK must be 32 bytes, base64 encoded");
+        return 2;
+      }
+    } else {
+      kek = new Uint8Array(randomBytes(32));
+      mintedKek = true;
+    }
+    const keyring = createKeyring({ kek, recoveryCodes: count });
+    const dir = ensureCatalogDir(dirname5(path));
+    const db = openDatabaseSync(path);
+    try {
+      createSchema(db);
+      writeWraps(db, keyring.wraps);
+    } finally {
+      db.close();
+    }
+    try {
+      chmodSync2(path, 384);
+    } catch {
+    }
+    ui.success("catalog created", path);
+    if (dir === "narrowed") {
+      ui.warn(
+        "narrowed the catalog directory to 700",
+        "it was writable by others, who could have replaced the catalog"
+      );
+    }
+    if (located.source === "global") {
+      ui.warn(
+        "no project root here, so this is the machine-wide catalog",
+        located.project
+      );
+    }
+    if (args.flags.has("no-gitignore")) {
+      ui.info("left .gitignore alone", "as asked");
+    } else if (located.projectRoot !== void 0) {
+      ensureIgnored(located.projectRoot, ui);
+    }
+    ui.line();
+    if (mintedKek) {
+      ui.heading("Your key \u2014 save it now, it is not stored");
+      ui.line(`  ENVS_KEK=${Buffer.from(kek).toString("base64")}`);
+      ui.line();
+    } else {
+      ui.info("used the ENVS_KEK already in your environment", "not reprinted");
+    }
+    if (keyring.recoveryCodes.length > 0) {
+      ui.heading(
+        `Recovery codes \u2014 ${keyring.recoveryCodes.length}, shown once, not stored`
+      );
+      for (const code of keyring.recoveryCodes) ui.line(`  ${code}`);
+      ui.line();
+      ui.info(
+        "any one of them opens this catalog without the key",
+        "keep them somewhere the key is not"
+      );
+    } else {
+      ui.warn(
+        "no recovery codes were minted",
+        "losing ENVS_KEK will lose this catalog"
+      );
+    }
+    ui.line();
+    ui.info("next", "envs load <path> to put values in");
+    return 0;
+  }
+};
+
+// src/commands/load.ts
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync16, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve4 } from "path";
+var loadCommand = {
+  name: "load",
+  describe: "put the values of one or more env files into a new release",
+  usage: "envs load <path>... [--alias <name>] [--replace]",
+  group: "start here",
+  options: [
+    {
+      name: "alias",
+      placeholder: "<name>",
+      describe: "name this source explicitly; only with a single path"
+    },
+    {
+      name: "replace",
+      boolean: true,
+      describe: "drop sources not named here instead of carrying them forward"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    if (args.positional.length === 0) {
+      ui.error("no paths given", "envs load <path>...");
+      return 2;
+    }
+    const explicitAlias = one(args, "alias");
+    if (explicitAlias !== void 0 && args.positional.length > 1) {
+      ui.error("--alias names one source", "give a single path with it");
+      return 2;
+    }
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync16(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const parsed = [];
+    for (const given of args.positional) {
+      const path = resolve4(cwd, given);
+      if (!existsSync16(path)) {
+        ui.error(path, "no such file");
+        return 1;
+      }
+      const text = readFileSync9(path, "utf8");
+      const result = parseEnv(text);
+      const record = toRecord(result);
+      if (record === null) {
+        ui.error(path, `${result.findings.length} problems, nothing loaded`);
+        ui.table(
+          result.findings.map((f) => [`line ${f.line}`, f.code]),
+          "    "
+        );
+        return 1;
+      }
+      parsed.push({
+        path,
+        values: record,
+        digest: createHash3("sha256").update(text).digest("hex")
+      });
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    const db = openDatabaseSync(located.project);
+    try {
+      const dek = unlockDek(readWraps(db), unlock);
+      const named = /* @__PURE__ */ new Set();
+      const items = [];
+      for (const file of parsed) {
+        const source = ensureSource(db, file.path, {
+          ...explicitAlias ? { alias: explicitAlias } : {},
+          digest: file.digest
+        });
+        named.add(source.sourceId);
+        for (const [key, value] of Object.entries(file.values)) {
+          items.push({ sourceId: source.sourceId, key, value });
+        }
+      }
+      let carried = 0;
+      if (!args.flags.has("replace")) {
+        try {
+          for (const entry of readEntries(db, { unlock })) {
+            if (named.has(entry.sourceId)) continue;
+            items.push({
+              sourceId: entry.sourceId,
+              key: entry.key,
+              value: entry.value
+            });
+            carried += 1;
+          }
+        } catch {
+        }
+      }
+      const release = writeRelease(db, dek, items, {
+        note: `load ${parsed.map((f) => f.path).join(", ")}`
+      });
+      for (const file of parsed) {
+        ui.success(file.path, `${Object.keys(file.values).length} keys`);
+      }
+      if (carried > 0) {
+        ui.info(
+          `carried ${carried} values from other sources`,
+          "use --replace to drop them"
+        );
+      }
+      ui.success(
+        `release ${release.revisionId.slice(0, 8)} is current`,
+        `${release.count} values`
+      );
+      return 0;
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/rotate.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { existsSync as existsSync17 } from "fs";
+var rotateCommand = {
+  name: "rotate",
+  describe: "replace the key, the recovery codes, or both",
+  usage: "envs rotate [--key] [--recovery-codes <n>]",
+  group: "history",
+  options: [
+    {
+      name: "key",
+      boolean: true,
+      describe: "mint a new ENVS_KEK and retire the old wrap"
+    },
+    {
+      name: "recovery-codes",
+      placeholder: "<n>",
+      describe: "mint this many new codes and retire the old ones"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const wantKey = args.flags.has("key");
+    const codesRaw = one(args, "recovery-codes");
+    const wantCodes = codesRaw !== void 0;
+    if (!wantKey && !wantCodes) {
+      ui.error("nothing to rotate", "--key, --recovery-codes <n>, or both");
+      return 2;
+    }
+    const codeCount = wantCodes ? Number(codesRaw) : 0;
+    if (wantCodes && (!Number.isInteger(codeCount) || codeCount < 1 || codeCount > 20)) {
+      ui.error("--recovery-codes must be a whole number from 1 to 20");
+      return 2;
+    }
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync17(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    const db = openDatabaseSync(located.project);
+    try {
+      const before = readWraps(db);
+      const dek = unlockDek(before, unlock);
+      const added = [];
+      let newKek;
+      let newCodes = [];
+      if (wantKey) {
+        newKek = new Uint8Array(randomBytes2(32));
+        const wrap = addWrap(dek, { kek: newKek }, crypto.randomUUID());
+        writeWraps(db, [wrap]);
+        added.push(wrap.wrapId);
+      }
+      if (wantCodes) {
+        const minted = createKeyring({ kek: dek, recoveryCodes: codeCount });
+        newCodes = minted.recoveryCodes;
+        const wraps = minted.recoveryCodes.map(
+          (code) => addWrap(dek, { recoveryCode: code }, crypto.randomUUID())
+        );
+        writeWraps(db, wraps);
+        added.push(...wraps.map((wrap) => wrap.wrapId));
+      }
+      db.transaction(() => {
+        const retire = db.prepare(
+          "UPDATE dek_wraps SET retired_at = $at WHERE wrap_id = $id"
+        );
+        const at = (/* @__PURE__ */ new Date()).toISOString();
+        for (const wrap of before) {
+          const stale = wantKey && wrap.method === "kek" || wantCodes && wrap.method === "recovery";
+          if (stale) retire.run({ at, id: wrap.wrapId });
+        }
+        audit(
+          db,
+          "keyring.rotate",
+          added.join(" "),
+          `retired ${before.length}`
+        );
+      });
+      ui.success(
+        "rotated",
+        `${added.length} new wraps, ${before.length} retired`
+      );
+      ui.line();
+      if (newKek !== void 0) {
+        ui.heading("Your new key \u2014 save it now, it is not stored");
+        ui.line(`  ENVS_KEK=${Buffer.from(newKek).toString("base64")}`);
+        ui.line();
+        ui.warn("the old ENVS_KEK no longer opens this catalog");
+      }
+      if (newCodes.length > 0) {
+        ui.heading(`New recovery codes \u2014 ${newCodes.length}, shown once`);
+        for (const code of newCodes) ui.line(`  ${code}`);
+        ui.line();
+        ui.warn("the old codes no longer open this catalog");
+      }
+      return 0;
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/run.ts
+import { spawnSync } from "child_process";
+var runCommand = {
+  name: "run",
+  describe: "run a command with the values in its environment",
+  usage: "envs run -- <command> [args...]",
+  group: "values",
+  options: [
+    {
+      name: "alias",
+      placeholder: "<name>",
+      repeat: true,
+      describe: "restrict to these sources, in precedence order"
+    },
+    {
+      name: "no-global",
+      boolean: true,
+      describe: "leave the machine-wide layer out; CI should"
+    },
+    {
+      name: "override",
+      boolean: true,
+      describe: "let the store win over values already in the environment"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const [command, ...rest] = args.positional;
+    if (command === void 0) {
+      ui.error("no command given", "envs run -- node server.js");
+      return 2;
+    }
+    const aliases = many(args, "alias");
+    const target = { ...env };
+    const result = config({
+      cwd,
+      env,
+      processEnv: target,
+      override: args.flags.has("override"),
+      global: !args.flags.has("no-global"),
+      ...aliases.length > 0 ? { aliases } : {}
+    });
+    if (result.error) {
+      ui.error(result.error.message);
+      return 1;
+    }
+    const count = Object.keys(result.parsed ?? {}).length;
+    if (count === 0) {
+      ui.error("no values resolved", "envs load <path> first, or envs doctor");
+      return 1;
+    }
+    ui.info(`running with ${count} values`, command);
+    const child = spawnSync(command, rest, {
+      cwd,
+      env: target,
+      stdio: "inherit",
+      // The child shares this process group, so a terminal's SIGINT reaches it
+      // directly. A signal sent only to this process cannot be forwarded from a
+      // synchronous spawn, and config() being synchronous is the harder rule.
+      shell: false
+    });
+    if (child.error !== void 0) {
+      ui.error(`could not run ${command}`, child.error.message);
+      return 127;
+    }
+    if (child.signal !== null && child.signal !== void 0) {
+      ui.warn(`${command} was killed`, child.signal);
+      return 128 + (SIGNAL_NUMBER[child.signal] ?? 0);
+    }
+    return child.status ?? 0;
+  }
+};
+var SIGNAL_NUMBER = {
+  SIGHUP: 1,
+  SIGINT: 2,
+  SIGQUIT: 3,
+  SIGKILL: 9,
+  SIGTERM: 15
+};
+
+// src/commands/serve.ts
+import {
+  createServer
+} from "http";
+import { timingSafeEqual } from "crypto";
+import { existsSync as existsSync18, readFileSync as readFileSync10 } from "fs";
+function constantTimeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function authorised(header, token) {
+  if (header === void 0) return false;
+  const prefix = "Bearer ";
+  if (!header.startsWith(prefix)) return false;
+  return constantTimeEqual(header.slice(prefix.length), token);
+}
+function snapshotBytes(catalogPath) {
+  const db = openDatabaseSync(catalogPath);
+  try {
+    db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+  } finally {
+    db.close();
+  }
+  return new Uint8Array(readFileSync10(catalogPath));
+}
+function handle(request, response, options) {
+  const url = request.url ?? "/";
+  if (url === "/healthz") {
+    response.writeHead(200, { "content-type": "application/json" });
+    response.end(JSON.stringify({ ok: true }));
+    return false;
+  }
+  if (!authorised(request.headers.authorization, options.token)) {
+    response.writeHead(401, { "content-type": "application/json" });
+    response.end(JSON.stringify({ error: "unauthorised" }));
+    return false;
+  }
+  if (url === "/v1/meta") {
+    const db = openDatabaseSync(options.catalogPath, { readOnly: true });
+    try {
+      const meta = readMeta(db);
+      response.writeHead(200, { "content-type": "application/json" });
+      response.end(JSON.stringify(meta ?? { error: "no schema" }));
+    } finally {
+      db.close();
+    }
+    return false;
+  }
+  if (url === "/v1/catalog" && request.method === "GET") {
+    const bytes = snapshotBytes(options.catalogPath);
+    response.writeHead(200, {
+      "content-type": "application/octet-stream",
+      "content-length": String(bytes.length)
+    });
+    response.end(Buffer.from(bytes));
+    options.ui.info("served the catalog", `${bytes.length} bytes`);
+    return true;
+  }
+  response.writeHead(404, { "content-type": "application/json" });
+  response.end(JSON.stringify({ error: "not found" }));
+  return false;
+}
+var serveCommand = {
+  name: "serve",
+  describe: "hand the sealed catalog to teammates over HTTP",
+  usage: "envs serve [--port <n>] [--host <addr>]",
+  group: "publish",
+  options: [
+    { name: "port", placeholder: "<n>", describe: "default 7373" },
+    {
+      name: "host",
+      placeholder: "<addr>",
+      describe: "default 127.0.0.1; anything else exposes it"
+    },
+    {
+      name: "once",
+      boolean: true,
+      describe: "stop after handing the catalog over once, for a scripted pull"
+    }
+  ],
+  async run({ ui, args, env, cwd }) {
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync18(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const token = env["ENVS_SERVE_TOKEN"] ?? "";
+    if (token.length < 16) {
+      ui.error(
+        "set ENVS_SERVE_TOKEN to at least 16 characters",
+        "clients send it as Authorization: Bearer <token>"
+      );
+      return 2;
+    }
+    const port = Number(one(args, "port") ?? 7373);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      ui.error("--port must be a port number");
+      return 2;
+    }
+    const host = one(args, "host") ?? "127.0.0.1";
+    const options = {
+      catalogPath: located.project,
+      token,
+      port,
+      host,
+      ui
+    };
+    return new Promise((resolveRun) => {
+      const server = createServer((request, response) => {
+        let served = false;
+        try {
+          served = handle(request, response, options);
+        } catch (error) {
+          ui.error(error.message);
+          response.writeHead(500, { "content-type": "application/json" });
+          response.end(JSON.stringify({ error: "failed" }));
+        }
+        if (served && args.flags.has("once")) {
+          server.close(() => resolveRun(0));
+        }
+      });
+      server.on("error", (error) => {
+        ui.error(error.message);
+        resolveRun(1);
+      });
+      server.listen(port, host, () => {
+        ui.success(`listening on http://${host}:${port}`, located.project);
+        ui.info("it serves the sealed catalog", "clients still need a key");
+        if (host !== "127.0.0.1" && host !== "localhost") {
+          ui.warn(
+            "this is reachable from the network",
+            "put TLS in front of it: the token crosses the wire"
+          );
+        }
+        ui.info("stop with ctrl-c");
+      });
+      const stop = () => {
+        server.close(() => resolveRun(0));
+      };
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+    });
+  }
+};
+
+// src/commands/session.ts
+var wait = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var loginCommand = {
+  name: "login",
+  describe: "sign in on this machine, for a remote catalog",
+  usage: "envs login [--issuer <url>]",
+  group: "hosted account",
+  options: [
+    {
+      name: "issuer",
+      describe: "override the auth issuer",
+      placeholder: "<url>"
+    }
+  ],
+  async run({ ui, args, env }) {
+    const issuer = args.options.get("issuer")?.[0] ?? setting(env, "ENVS_AUTH_ISSUER", DEFAULT_ISSUER);
+    const clientId = setting(env, "ENVS_OAUTH_CLIENT_ID", DEFAULT_CLIENT);
+    const resource = setting(env, "ENVS_OAUTH_RESOURCE", DEFAULT_RESOURCE);
+    const scope = setting(env, "ENVS_OAUTH_SCOPE", DEFAULT_SCOPE);
+    let metadata;
+    try {
+      metadata = await discover(issuer, fetcher);
+    } catch (error) {
+      ui.error("cannot sign in", error.message);
+      return 1;
+    }
+    let start;
+    try {
+      start = await startDevice(
+        metadata,
+        { clientId, resource, scope },
+        fetcher
+      );
+    } catch (error) {
+      ui.error("cannot start sign-in", error.message);
+      return 1;
+    }
+    ui.info("open", start.verificationUriComplete ?? start.verificationUri);
+    ui.info("code", start.userCode);
+    ui.line();
+    ui.info("waiting", "approve it and this finishes on its own");
+    let interval = start.intervalMs;
+    for (; ; ) {
+      if (Date.now() >= start.expiresAt) {
+        ui.error("expired", "the code timed out; run envs login again");
+        return 1;
+      }
+      await wait(interval);
+      const outcome = await pollOnce(
+        metadata,
+        { clientId, deviceCode: start.deviceCode, issuer },
+        fetcher
+      );
+      if (outcome.kind === "granted" && outcome.session) {
+        writeSession(outcome.session, env["HOME"]);
+        ui.success("signed in", issuer);
+        return 0;
+      }
+      if (outcome.kind === "slow_down") interval += 5e3;
+      if (outcome.kind === "denied") {
+        ui.error("declined", "the request was not approved");
+        return 1;
+      }
+      if (outcome.kind === "expired") {
+        ui.error("expired", "the code timed out; run envs login again");
+        return 1;
+      }
+    }
+  }
+};
+var logoutCommand = {
+  name: "logout",
+  describe: "forget the sign-in on this machine",
+  usage: "envs logout",
+  group: "hosted account",
+  async run({ ui, env }) {
+    const state = sessionState(env);
+    if (state.unreadable !== void 0) {
+      ui.error("cannot read the sign-in here", state.unreadable);
+      return 1;
+    }
+    const session = state.session;
+    if (!session) {
+      ui.info("not signed in", "nothing to forget");
+      return 0;
+    }
+    const clientId = session.clientId ?? setting(env, "ENVS_OAUTH_CLIENT_ID", DEFAULT_CLIENT);
+    clearSession(env["HOME"]);
+    try {
+      const metadata = await discover(session.issuer, fetcher);
+      const revoked = await revoke(metadata, session, clientId, fetcher);
+      ui.success(
+        "signed out",
+        revoked ? "access and refresh credentials revoked" : "local copy removed; remote revocation was not confirmed"
+      );
+    } catch {
+      ui.success(
+        "signed out",
+        "local copy removed; remote revocation was not confirmed"
+      );
+    }
+    return 0;
+  }
+};
+async function describeAccount(env) {
+  try {
+    const who = await account(await access(env));
+    return {
+      account: who.userId,
+      subscription: who.subscription,
+      snapshots: who.catalogs.filter((c) => c.id.endsWith(".envsnap")).length,
+      teams: who.teams,
+      members: who.members
+    };
+  } catch {
+    return null;
+  }
+}
+var whoamiCommand = {
+  name: "whoami",
+  describe: "whether this machine is signed in, and to what",
+  usage: "envs whoami [--json]",
+  group: "hosted account",
+  options: [
+    { name: "json", boolean: true, describe: "answer as one JSON object" }
+  ],
+  async run({ ui, args, env }) {
+    const asJson = args.flags.has("json");
+    const answer = (value) => {
+      ui.data(`${JSON.stringify(value)}
+`);
+    };
+    const state = sessionState(env);
+    if (state.unreadable !== void 0) {
+      if (asJson) answer({ signedIn: false, unreadable: state.unreadable });
+      else ui.data("cannot tell\n");
+      ui.error("cannot read the sign-in here", state.unreadable);
+      return 1;
+    }
+    const session = state.session;
+    if (!session) {
+      if (asJson) answer({ signedIn: false });
+      else ui.data("not signed in\n");
+      ui.info("not signed in", "run envs login");
+      return 1;
+    }
+    if (asJson) {
+      const account2 = await describeAccount(env);
+      answer({
+        signedIn: true,
+        issuer: session.issuer,
+        ...session.scope ? { scope: session.scope } : {},
+        ...account2 ?? {}
+      });
+      return 0;
+    }
+    ui.data(`signed in to ${session.issuer}
+`);
+    ui.info("issuer", session.issuer);
+    if (session.scope) ui.info("scope", session.scope);
+    if (session.expiresAt !== void 0) {
+      const left = session.expiresAt - Date.now();
+      ui.info(
+        "token",
+        left > 0 ? `valid for ${String(Math.floor(left / 6e4))} min` : "expired, will renew on next use"
+      );
+    }
+    try {
+      const who = await account(await access(env));
+      ui.info("account", who.userId);
+      ui.info(
+        "subscription",
+        who.subscription === "active" ? "active" : who.subscription === "inactive" ? "none; envs:// destinations will be refused" : "could not be read; try again shortly"
+      );
+      const snapshots = who.catalogs.filter(
+        (entry) => entry.id.endsWith(".envsnap")
+      );
+      ui.info("snapshots", String(snapshots.length));
+      if (who.teams.length > 0) ui.info("member of", who.teams.join(" "));
+      if (who.members.length > 0) ui.info("shared with", who.members.join(" "));
+    } catch (error) {
+      ui.info(
+        "account",
+        error instanceof RemoteError ? `${error.message}${error.detail ? ` \u2014 ${error.detail}` : ""}` : "could not be reached"
+      );
+    }
+    return 0;
+  }
+};
+
+// src/commands/set.ts
+import { existsSync as existsSync19 } from "fs";
+function parseAssignment(text) {
+  const result = parseEnv(text);
+  const assignments = result.entries.filter((e) => e.kind === "assignment");
+  if (!result.ok || assignments.length !== 1) {
+    return `"${text.split("=")[0] ?? text}" is not a single KEY=VALUE assignment`;
+  }
+  const [entry] = assignments;
+  return { key: entry.key, value: entry.value };
+}
+var setCommand = {
+  name: "set",
+  describe: "change one value, as a new release",
+  usage: "envs set KEY VALUE  |  envs set KEY=VALUE",
+  group: "values",
+  options: [
+    {
+      name: "source",
+      placeholder: "<alias>",
+      describe: "which source owns the key; required when there is more than one"
+    },
+    {
+      name: "sensitivity",
+      placeholder: "<level>",
+      describe: "low, medium, high or critical; only low may be baked by build"
+    },
+    {
+      name: "recovery-code",
+      placeholder: "<code|->",
+      describe: "unlock with a recovery code; - reads it from stdin"
+    }
+  ],
+  run({ ui, args, env, cwd }) {
+    const [first, second] = args.positional;
+    if (first === void 0 || args.positional.length > 2) {
+      ui.error("give one KEY=VALUE or KEY VALUE", "envs set KEY VALUE");
+      return 2;
+    }
+    if (second !== void 0 && first.includes("=")) {
+      ui.error(
+        "that mixes both spellings",
+        'either "set KEY VALUE" or "set KEY=VALUE", not both'
+      );
+      return 2;
+    }
+    const joined = second === void 0 ? first : `${first}=${second}`;
+    const assignment = parseAssignment(joined);
+    if (typeof assignment === "string") {
+      ui.error(assignment);
+      return 2;
+    }
+    const located = locateCatalogs({ cwd, env });
+    if (!existsSync19(located.project)) {
+      ui.error("no catalog here", located.project);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const unlock = resolveUnlock(one(args, "recovery-code"), env);
+    if (typeof unlock === "string") {
+      ui.error(unlock);
+      return 2;
+    }
+    const db = openDatabaseSync(located.project);
+    try {
+      const dek = unlockDek(readWraps(db), unlock);
+      const sources = db.prepare(
+        "SELECT source_id, alias, path FROM sources WHERE retired_at IS NULL ORDER BY added_at"
+      ).all();
+      const wanted = one(args, "source");
+      let target;
+      if (wanted !== void 0) {
+        target = sources.find((source) => source.alias === wanted);
+        if (target === void 0) {
+          ui.error(
+            `no source "${wanted}"`,
+            sources.map((s) => s.alias).join(", ")
+          );
+          return 1;
+        }
+      } else if (sources.length === 1) {
+        target = sources[0];
+      } else if (sources.length === 0) {
+        const created = ensureSource(db, "envs:set", { alias: "set" });
+        target = {
+          source_id: created.sourceId,
+          alias: created.alias,
+          path: created.path
+        };
+        ui.info(
+          `created source "${created.alias}"`,
+          "values set by hand live here"
+        );
+      } else {
+        ui.error(
+          "more than one source; say which with --source",
+          sources.map((s) => s.alias).join(", ")
+        );
+        return 2;
+      }
+      const items = [];
+      let replaced = false;
+      try {
+        for (const entry of readEntries(db, { unlock })) {
+          if (entry.sourceId === target.source_id && entry.key === assignment.key) {
+            replaced = true;
+            continue;
+          }
+          items.push({
+            sourceId: entry.sourceId,
+            key: entry.key,
+            value: entry.value
+          });
+        }
+      } catch {
+      }
+      items.push({
+        sourceId: target.source_id,
+        key: assignment.key,
+        value: assignment.value
+      });
+      const release = writeRelease(db, dek, items, {
+        note: `set ${assignment.key} in ${target.alias}`
+      });
+      const level = one(args, "sensitivity");
+      if (level !== void 0) {
+        if (!isSensitivity(level)) {
+          ui.error(
+            `"${level}" is not a level`,
+            "low, medium, high or critical"
+          );
+          return 2;
+        }
+        db.prepare(
+          "UPDATE keys SET sensitivity = $level WHERE key_hash = $hash"
+        ).run({ level, hash: hashKeyName(dek, assignment.key) });
+        ui.info(`classified ${assignment.key}`, level);
+      }
+      ui.success(
+        `${replaced ? "replaced" : "added"} ${assignment.key}`,
+        `source ${target.alias}`
+      );
+      ui.success(
+        `release ${release.revisionId.slice(0, 8)} is current`,
+        `${release.count} values`
+      );
+      return 0;
+    } catch (error) {
+      ui.error(error.message);
+      return 1;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/team.ts
+var USAGE = "envs team <ls|invite|join <code>|remove <member>>";
+var report2 = (ui, error) => {
+  if (error instanceof RemoteError) {
+    ui.error(error.message, error.detail);
+    return 1;
+  }
+  throw error;
+};
+async function list({ ui, env }) {
+  const who = await account(await access(env));
+  ui.heading(who.userId);
+  if (!who.teamManagement) {
+    ui.warn(
+      "team sharing is not on this plan",
+      "invites will be refused; see envs.build for the plan that carries it"
+    );
+  }
+  if (who.members.length === 0) ui.info("shared with", "nobody yet");
+  else ui.table(who.members.map((member) => [member, "member"]));
+  if (who.teams.length > 0) {
+    ui.table(who.teams.map((owner) => [owner, "you are a member"]));
+  }
+  return 0;
+}
+async function invite({ ui, env }) {
+  const response = await hub(await access(env), {
+    method: "POST",
+    path: "/v1/invites"
+  });
+  const body = await response.json();
+  if (typeof body.invite !== "string") {
+    ui.error("the remote answered without an invite");
+    return 1;
+  }
+  ui.data(`${body.invite}
+`);
+  ui.success("invite created", "one use only, and it is not stored anywhere");
+  if (typeof body.expiresAt === "string") ui.info("expires", body.expiresAt);
+  ui.info(
+    "they also need the key",
+    "send ENVS_KEK or a recovery code separately; the invite alone opens nothing"
+  );
+  return 0;
+}
+async function join5(ctx, code) {
+  const { ui, env } = ctx;
+  const response = await hub(await access(env), {
+    method: "POST",
+    path: "/v1/invites/accept",
+    body: new TextEncoder().encode(JSON.stringify({ invite: code })),
+    headers: { "content-type": "application/json" }
+  });
+  const body = await response.json();
+  ui.success(
+    "joined",
+    typeof body.owner === "string" ? `shared by ${body.owner}` : void 0
+  );
+  ui.info(
+    "next",
+    "ask the owner for the key, then envs restore --provider envs"
+  );
+  return 0;
+}
+async function remove(ctx, member) {
+  const { ui, env } = ctx;
+  await hub(await access(env), {
+    method: "DELETE",
+    path: `/v1/members/${encodeURIComponent(member)}`
+  });
+  ui.success("removed", member);
+  ui.warn(
+    "rotate the key if they had it",
+    "envs rotate --key, then back up again"
+  );
+  return 0;
+}
+var teamCommand = {
+  name: "team",
+  describe: "share a hosted catalog, and see who has it",
+  usage: USAGE,
+  group: "hosted account",
+  async run(ctx) {
+    const [verb, argument] = ctx.args.positional;
+    try {
+      switch (verb) {
+        case void 0:
+        case "ls":
+          return await list(ctx);
+        case "invite":
+          return await invite(ctx);
+        case "join":
+          if (argument === void 0) {
+            ctx.ui.error("say which code", "envs team join <code>");
+            return 2;
+          }
+          return await join5(ctx, argument);
+        case "remove":
+          if (argument === void 0) {
+            ctx.ui.error("say which member", "envs team remove <member>");
+            return 2;
+          }
+          return await remove(ctx, argument);
+        default:
+          ctx.ui.error(`unknown "${verb}"`, USAGE);
+          return 2;
+      }
+    } catch (error) {
+      return report2(ctx.ui, error);
+    }
+  }
+};
+
+// src/commands/validate.ts
+import { readFileSync as readFileSync11 } from "fs";
+var validateCommand = {
+  name: "validate",
+  describe: "check that files are env format",
+  usage: "envs validate <path>...",
+  group: "check",
+  run({ ui, args }) {
+    if (args.positional.length === 0) {
+      ui.error("no paths given", "envs validate <path>...");
+      return 2;
+    }
+    let failed = 0;
+    for (const path of args.positional) {
+      let text;
+      try {
+        text = readFileSync11(path, "utf8");
+      } catch (error) {
+        ui.error(path, error.message);
+        failed += 1;
+        continue;
+      }
+      const result = parseEnv(text);
+      if (result.ok) {
+        const keys = result.entries.filter(
+          (e) => e.kind === "assignment"
+        ).length;
+        ui.success(path, `${keys} keys`);
+        continue;
+      }
+      failed += 1;
+      ui.error(path, `${result.findings.length} problems`);
+      ui.table(
+        result.findings.map((finding) => [
+          `line ${finding.line}`,
+          finding.code
+        ]),
+        "    "
+      );
+    }
+    return failed === 0 ? 0 : 1;
+  }
+};
+
+// src/commands/watch.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { existsSync as existsSync20, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { join as join6, relative as relative3, resolve as resolve5, sep as sep2 } from "path";
+
+// src/catalog/glob.ts
+function globToRegExp(pattern) {
+  let source = "^";
+  for (let i = 0; i < pattern.length; i += 1) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      if (pattern[i + 1] === "*") {
+        const slash = pattern[i + 2] === "/";
+        source += slash ? "(?:.*/)?" : ".*";
+        i += slash ? 2 : 1;
+        continue;
+      }
+      source += "[^/]*";
+      continue;
+    }
+    if (ch === "?") {
+      source += "[^/]";
+      continue;
+    }
+    source += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`${source}$`);
+}
+function matchesGlob(pattern, path) {
+  return globToRegExp(pattern).test(path);
+}
+function selected(path, includes, excludes) {
+  if (excludes.some((pattern) => matchesGlob(pattern, path))) return false;
+  return includes.some((pattern) => matchesGlob(pattern, path));
+}
+var DEFAULT_INCLUDES = [".env", ".env.*", "*.env"];
+var DEFAULT_EXCLUDES = [
+  "**/.env.example",
+  "**/.env.sample",
+  "**/.env.template",
+  "**/node_modules/**",
+  "**/.envs/**"
+];
+
+// src/commands/watch.ts
+function readTargets(db) {
+  return db.prepare(
+    "SELECT pattern, mode FROM watch_targets ORDER BY added_at, pattern"
+  ).all().map((row) => ({
+    pattern: row.pattern,
+    mode: row.mode === "exclude" ? "exclude" : "include"
+  }));
+}
+function scan(root, targets) {
+  const includes = [
+    ...DEFAULT_INCLUDES,
+    ...targets.filter((t) => t.mode === "include").map((t) => t.pattern)
+  ];
+  const excludes = [
+    ...DEFAULT_EXCLUDES,
+    ...targets.filter((t) => t.mode === "exclude").map((t) => t.pattern)
+  ];
+  const found = [];
+  const walk = (dir, depth) => {
+    if (depth > 8) return;
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = join6(dir, entry.name);
+      const rel = relative3(root, full).split(sep2).join("/");
+      if (entry.isDirectory()) {
+        if (selected(`${rel}/`, ["**"], excludes)) walk(full, depth + 1);
+        continue;
+      }
+      if (selected(rel, includes, excludes)) found.push(full);
+    }
+  };
+  walk(root, 0);
+  return found.sort();
+}
+function open2(cwd, env) {
+  const located = locateCatalogs({ cwd, env });
+  if (!existsSync20(located.project)) return located.project;
+  return { db: openDatabaseSync(located.project), located };
+}
+var SUB = /* @__PURE__ */ new Set(["add", "exclude", "list", "remove", "scan"]);
+var watchCommand = {
+  name: "watch",
+  describe: "choose which env files this project looks at",
+  usage: "envs watch add|exclude|remove <pattern>  |  envs watch list|scan",
+  group: "backup",
+  run({ ui, args, env, cwd }) {
+    const [sub, ...rest] = args.positional;
+    if (sub === void 0 || !SUB.has(sub)) {
+      ui.error(
+        sub === void 0 ? "no subcommand" : `unknown subcommand "${sub}"`,
+        [...SUB].join(", ")
+      );
+      return 2;
+    }
+    const opened = open2(cwd, env);
+    if (typeof opened === "string") {
+      ui.error("no catalog here", opened);
+      ui.info("run envs init first");
+      return 1;
+    }
+    const { db, located } = opened;
+    const root = located.projectRoot ?? cwd;
+    try {
+      if (sub === "list") {
+        const targets = readTargets(db);
+        ui.heading("always looked at");
+        ui.table(DEFAULT_INCLUDES.map((pattern2) => [pattern2, "default"]));
+        ui.heading("never looked at");
+        ui.table(DEFAULT_EXCLUDES.map((pattern2) => [pattern2, "default"]));
+        if (targets.length > 0) {
+          ui.line();
+          ui.heading("added here");
+          ui.table(targets.map((target) => [target.pattern, target.mode]));
+        }
+        return 0;
+      }
+      if (sub === "scan") {
+        const paths = scan(root, readTargets(db));
+        if (paths.length === 0) {
+          ui.info("nothing matched", "envs watch add <pattern> widens it");
+          return 0;
+        }
+        ui.heading(`${paths.length} files`);
+        ui.table(paths.map((path) => [relative3(root, path), ""]));
+        ui.info("envs load <path>...", "puts them in a release");
+        return 0;
+      }
+      const pattern = rest[0];
+      if (pattern === void 0 || rest.length > 1) {
+        ui.error("give exactly one pattern", `envs watch ${sub} <pattern>`);
+        return 2;
+      }
+      if (sub === "remove") {
+        const gone = db.prepare("DELETE FROM watch_targets WHERE pattern = $pattern").run({ pattern });
+        if (Number(gone.changes) === 0) {
+          ui.error(`no target "${pattern}"`, "envs watch list shows them");
+          return 1;
+        }
+        audit(db, "watch.remove", pattern);
+        ui.success("removed", pattern);
+        return 0;
+      }
+      const stored = pattern.startsWith("/") ? relative3(root, resolve5(pattern)).split(sep2).join("/") : pattern;
+      const mode = sub === "exclude" ? "exclude" : "include";
+      try {
+        db.prepare(
+          "INSERT INTO watch_targets (target_id, pattern, mode, added_at) VALUES ($id, $pattern, $mode, $at)"
+        ).run({
+          id: randomUUID3(),
+          pattern: stored,
+          mode,
+          at: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      } catch {
+        ui.error(
+          `"${stored}" is already a target`,
+          "envs watch list shows them"
+        );
+        return 1;
+      }
+      audit(db, `watch.${mode}`, stored);
+      ui.success(`${mode} ${stored}`);
+      if (mode === "include") {
+        const absolute = resolve5(root, stored);
+        if (existsSync20(absolute) && statSync3(absolute).isDirectory()) {
+          ui.warn(
+            "that is a directory, so it matches no file by itself",
+            `did you mean ${stored}/**`
+          );
+        }
+      }
+      const matched = scan(root, readTargets(db)).length;
+      ui.info(`${matched} files match now`, "envs watch scan lists them");
+      return 0;
+    } finally {
+      db.close();
+    }
+  }
+};
+
+// src/commands/index.ts
+var COMMANDS = [
+  initCommand,
+  addCommand,
+  loadCommand,
+  setCommand,
+  getCommand,
+  delCommand,
+  lsCommand,
+  runCommand,
+  validateCommand,
+  doctorCommand,
+  historyCommand,
+  rollbackCommand,
+  exportCommand,
+  rotateCommand,
+  genexampleCommand,
+  gitignoreCommand,
+  precommitCommand,
+  watchCommand,
+  backupCommand,
+  restoreCommand,
+  buildCommand,
+  serveCommand,
+  templateCommand,
+  migrateCommand,
+  loginCommand,
+  logoutCommand,
+  whoamiCommand,
+  teamCommand
+];
+var PLANNED = [];
+function dispatch(argv, options = {}) {
+  const ui = options.ui ?? new Ui();
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const [verb, ...rest] = argv;
+  if (verb === void 0) {
+    printHelp(ui, COMMANDS, PLANNED);
+    return 2;
+  }
+  if (verb === "--help" || verb === "-h" || verb === "help") {
+    const named = COMMANDS.find((command2) => command2.name === rest[0]);
+    if (named) printCommandHelp(ui, named);
+    else printHelp(ui, COMMANDS, PLANNED);
+    return 0;
+  }
+  const command = COMMANDS.find((candidate) => candidate.name === verb);
+  if (command === void 0) {
+    if (PLANNED.includes(verb)) {
+      ui.error(`"${verb}" is designed but not implemented yet`);
+    } else {
+      ui.error(`unknown command "${verb}"`);
+    }
+    printHelp(ui, COMMANDS, PLANNED);
+    return 2;
+  }
+  if (rest.includes("--help") || rest.includes("-h")) {
+    printCommandHelp(ui, command);
+    return 0;
+  }
+  const refuse = (error) => {
+    if (error instanceof ArgumentError) {
+      ui.error(error.message);
+      printCommandHelp(ui, command);
+      return 2;
+    }
+    ui.error(
+      `envs ${command.name} could not finish`,
+      error instanceof Error ? error.message : String(error)
+    );
+    return 1;
+  };
+  try {
+    const outcome = command.run({
+      ui,
+      args: parseArgs(rest, command.options),
+      env,
+      cwd
+    });
+    return outcome instanceof Promise ? outcome.catch(refuse) : outcome;
+  } catch (error) {
+    return refuse(error);
+  }
+}
+
+export {
+  csvField,
+  exportValues,
+  Ui,
+  COMMANDS,
+  PLANNED,
+  dispatch
+};