@penvhq/cli 0.1.0 → 0.3.0

package/dist/index.cjs

@@ -26,28 +26,34 @@ __export(index_exports, {
   insertEnvAlias: () => insertEnvAlias,
   main: () => main,
   renderDoctor: () => renderDoctor,
+  renderFill: () => renderFill,
   renderMove: () => renderMove,
+  renderPull: () => renderPull,
   renderPush: () => renderPush,
+  renderRotate: () => renderRotate,
   renderWatch: () => renderWatch,
   runDecrypt: () => runDecrypt,
   runDoctor: () => runDoctor,
   runEncrypt: () => runEncrypt,
   runExplain: () => runExplain,
+  runFill: () => runFill,
   runGenerate: () => runGenerate,
   runGet: () => runGet,
   runInit: () => runInit,
   runList: () => runList,
   runMain: () => runMain,
   runMove: () => runMove,
+  runPull: () => runPull,
   runPush: () => runPush,
   runRemove: () => runRemove,
+  runRotate: () => runRotate,
   runSet: () => runSet,
   runValidate: () => runValidate,
   runWatch: () => runWatch
 });
 module.exports = __toCommonJS(index_exports);
-var import_core20 = require("@penvhq/core");
-var import_citty15 = require("citty");
+var import_core22 = require("@penvhq/core");
+var import_citty18 = require("citty");
 
 // src/commands/doctor.ts
 var import_core7 = require("@penvhq/core");
@@ -55,17 +61,42 @@ var import_sink_github2 = require("@penvhq/sink-github");
 var import_citty3 = require("citty");
 
 // src/project.ts
-var import_node_path = require("path");
+var import_node_path2 = require("path");
 var import_core2 = require("@penvhq/core");
 var import_provider_filesystem2 = require("@penvhq/provider-filesystem");
 
 // src/registry.ts
+var import_node_module = require("module");
+var import_node_path = require("path");
+var import_node_url = require("url");
 var import_core = require("@penvhq/core");
 var import_provider_filesystem = require("@penvhq/provider-filesystem");
+var import_provider_kubernetes = require("@penvhq/provider-kubernetes");
+var import_provider_mock = require("@penvhq/provider-mock");
+var import_provider_ssm = require("@penvhq/provider-ssm");
+var import_provider_vault = require("@penvhq/provider-vault");
+var PLUGIN_FACTORY_EXPORT = "penvProviderFactory";
 var LOCAL_TREE_TYPE = "filesystem";
 var REGISTRY = /* @__PURE__ */ new Map([
-  [LOCAL_TREE_TYPE, ({ root, config }) => (0, import_provider_filesystem.createFilesystemProvider)({ root, config })]
+  [LOCAL_TREE_TYPE, ({ root, config }) => (0, import_provider_filesystem.createFilesystemProvider)({ root, config })],
+  ["vault", ({ providerConfig }) => (0, import_provider_vault.createVaultProvider)({ path: providerConfig?.path ?? "penv" })],
+  ["ssm", ({ providerConfig }) => (0, import_provider_ssm.createSsmProvider)({ path: providerConfig?.path ?? "penv" })],
+  [
+    "kubernetes",
+    ({ providerConfig }) => (0, import_provider_kubernetes.createKubernetesProvider)(kubernetesOptions(providerConfig))
+  ],
+  ["mock", ({ root }) => (0, import_provider_mock.createMockProvider)({ storePath: (0, import_node_path.resolve)(root, ".penv-mock.json") })]
 ]);
+var CONTRACT_METHODS = [
+  "read",
+  "write",
+  "list",
+  "remove",
+  "readMeta",
+  "writeMeta",
+  "removeMeta"
+];
+var pluginModuleCache = /* @__PURE__ */ new Map();
 function isProviderRegistered(type) {
   return REGISTRY.has(type);
 }
@@ -76,20 +107,102 @@ function createProvider(type, context) {
   }
   return factory(context);
 }
-function assertProvidersRegistered(config) {
+async function createSourceProvider(type, context) {
+  if (REGISTRY.has(type)) {
+    return createProvider(type, context);
+  }
+  return loadPluginProvider(type, context);
+}
+async function loadPluginProvider(type, context) {
+  const fromDir = resolutionBase(context);
+  const specifier = pluginSpecifier(context.providerConfig, type);
+  const resolved = resolvePlugin(specifier, fromDir);
+  if (resolved === void 0) {
+    throw unknownProvider(type, context.environment, specifier);
+  }
+  let mod;
+  try {
+    mod = await importPlugin(resolved);
+  } catch {
+    throw new import_core.PenvError(
+      "PROVIDER_PLUGIN_LOAD",
+      `The provider package \`${specifier}\` for type \`${type}\` failed to load`,
+      "It resolved but threw while importing. Check it builds and its dependencies are installed."
+    );
+  }
+  const factory = mod[PLUGIN_FACTORY_EXPORT];
+  if (typeof factory !== "function") {
+    throw new import_core.PenvError(
+      "PROVIDER_PLUGIN_INVALID",
+      `\`${specifier}\` does not export \`${PLUGIN_FACTORY_EXPORT}\``,
+      `A penv provider package must export \`${PLUGIN_FACTORY_EXPORT}(context) => Provider\`.`
+    );
+  }
+  const provider = await factory(context);
+  assertSatisfiesContract(provider, specifier);
+  return provider;
+}
+function assertProvidersRegistered(config, projectRoot) {
   for (const [environment, provider] of Object.entries(config.providers)) {
-    if (!isProviderRegistered(provider.type)) {
-      throw unknownProvider(provider.type, environment);
+    if (isProviderRegistered(provider.type)) {
+      continue;
+    }
+    const specifier = pluginSpecifier(provider, provider.type);
+    if (resolvePlugin(specifier, projectRoot) === void 0) {
+      throw unknownProvider(provider.type, environment, specifier);
+    }
+  }
+}
+function pluginSpecifier(providerConfig, type) {
+  return providerConfig?.module ?? `@penvhq/provider-${type}`;
+}
+function resolutionBase(context) {
+  return (0, import_node_path.dirname)(context.root);
+}
+function resolvePlugin(specifier, fromDir) {
+  try {
+    const require2 = (0, import_node_module.createRequire)((0, import_node_path.resolve)(fromDir, "noop.js"));
+    return require2.resolve(specifier);
+  } catch {
+    return void 0;
+  }
+}
+function importPlugin(resolvedPath) {
+  const cached2 = pluginModuleCache.get(resolvedPath);
+  if (cached2 !== void 0) {
+    return cached2;
+  }
+  const loading = import((0, import_node_url.pathToFileURL)(resolvedPath).href);
+  pluginModuleCache.set(resolvedPath, loading);
+  return loading;
+}
+function assertSatisfiesContract(provider, specifier) {
+  for (const method of CONTRACT_METHODS) {
+    if (typeof provider[method] !== "function") {
+      throw new import_core.PenvError(
+        "PROVIDER_PLUGIN_INVALID",
+        `The provider from \`${specifier}\` is missing \`${method}()\``,
+        "It must satisfy the @penvhq/core Provider contract that the filesystem provider defines."
+      );
     }
   }
 }
-function unknownProvider(type, environment) {
+function kubernetesOptions(providerConfig) {
+  const path = providerConfig?.path ?? "penv";
+  const slash = path.indexOf("/");
+  if (slash === -1) return { secretName: path };
+  const namespace = path.slice(0, slash);
+  const secretName = path.slice(slash + 1) || "penv";
+  return namespace === "" ? { secretName } : { namespace, secretName };
+}
+function unknownProvider(type, environment, specifier) {
   const known = [...REGISTRY.keys()].map((name) => `\`${name}\``).join(", ");
   const where = environment === void 0 ? "" : ` for environment ${environment}`;
+  const remedy = specifier === void 0 ? `This build registers ${known}. Name a registered provider, or install the build that carries \`${type}\`.` : `Install its package with \`npm i ${specifier}\`, or name a built-in provider: ${known}.`;
   return new import_core.PenvError(
     "UNKNOWN_PROVIDER",
     `The provider type \`${type}\`${where} in penv.config.ts is not one this penv build carries`,
-    `This build registers ${known}. Name a registered provider, or install the build that carries \`${type}\`.`
+    remedy
   );
 }
 
@@ -97,9 +210,9 @@ function unknownProvider(type, environment) {
 var PENV_DIR = ".penv";
 function openProject(cwd) {
   const { config, file } = (0, import_core2.loadConfig)(cwd);
-  const root = (0, import_node_path.dirname)(file);
-  const penvDir = (0, import_node_path.resolve)(root, PENV_DIR);
-  assertProvidersRegistered(config);
+  const root = (0, import_node_path2.dirname)(file);
+  const penvDir = (0, import_node_path2.resolve)(root, PENV_DIR);
+  assertProvidersRegistered(config, root);
   return {
     root,
     configFile: file,
@@ -118,6 +231,18 @@ function localTree(project) {
   }
   return project.provider;
 }
+async function sourceProviderFor(project, environment) {
+  const providerConfig = project.config.providers[environment];
+  if (providerConfig === void 0) {
+    return createProvider(LOCAL_TREE_TYPE, { root: project.penvDir, config: project.config });
+  }
+  return createSourceProvider(providerConfig.type, {
+    root: project.penvDir,
+    config: project.config,
+    providerConfig,
+    environment
+  });
+}
 function targetEnvironment(project, explicit) {
   return (0, import_core2.resolveEnvironment)(project.config, explicit);
 }
@@ -138,6 +263,26 @@ function refFromKey(key, config) {
   }
   return { namespace: segments.slice(0, -1), name };
 }
+function assertWritableKey(key) {
+  const segments = key.split(KEY_SEPARATOR).filter((s) => s.length > 0);
+  if (segments.length === 0 || segments.every((s) => (0, import_core2.isCanonicalSegment)(s))) {
+    return;
+  }
+  const ref = (0, import_core2.refFromAccessPath)(segments);
+  if (ref !== void 0) {
+    const suggestion = [...ref.namespace, ref.name].join("/");
+    throw new import_core2.PenvError(
+      "PARAMETER_KEY_CASING",
+      `\`${key}\` is not a canonical parameter name`,
+      `Parameter files are lower-case and hyphenated. Did you mean \`${suggestion}\`? That is the file that backs the \`${key}\` key in your schema.`
+    );
+  }
+  throw new import_core2.PenvError(
+    "PARAMETER_KEY_UNREACHABLE",
+    `No value file can be named that reaches \`${key}\``,
+    "Parameter files are lower-case and hyphenated, and this key maps to no such file \u2014 a run of capitals like `apiURL` cannot be reached (use `api-url`, which the schema reads as `apiUrl`). Run `penv validate` or `penv fill` to see the names penv expects."
+  );
+}
 function keySourceFor(project, environment) {
   return (0, import_core2.resolveKeySource)(project.config, environment);
 }
@@ -493,36 +638,36 @@ async function runPush(options) {
     decrypted: outbound.filter((item) => item.encrypted).length
   };
 }
-function renderPush(result) {
-  if (result.pushed === 0) {
+function renderPush(result2) {
+  if (result2.pushed === 0) {
     return formatRows([
       {
         glyph: CHECK,
         label: "Nothing to push",
-        subject: `no values resolve for environment ${result.environment}`
+        subject: `no values resolve for environment ${result2.environment}`
       }
     ]);
   }
-  const target = `GitHub Actions for environment ${result.environment}${result.repo === void 0 ? "" : ` (${result.repo})`}`;
+  const target = `GitHub Actions for environment ${result2.environment}${result2.repo === void 0 ? "" : ` (${result2.repo})`}`;
   const rows = [
     {
       glyph: CHECK,
       label: "Pushed",
-      subject: `${result.pushed} ${result.pushed === 1 ? "secret" : "secrets"}`,
+      subject: `${result2.pushed} ${result2.pushed === 1 ? "secret" : "secrets"}`,
       detail: `to ${target}`
     },
     {
       glyph: CHECK,
       label: "Scopes",
-      subject: `${result.environmentSecrets} environment, ${result.repositorySecrets} repository`,
+      subject: `${result2.environmentSecrets} environment, ${result2.repositorySecrets} repository`,
       detail: "environment secrets override repository secrets, as penv's env scope overrides the default"
     }
   ];
-  if (result.decrypted > 0) {
+  if (result2.decrypted > 0) {
     rows.push({
       glyph: WARN,
       label: "Decrypted",
-      subject: `${result.decrypted} ${result.decrypted === 1 ? "secret" : "secrets"}`,
+      subject: `${result2.decrypted} ${result2.decrypted === 1 ? "secret" : "secrets"}`,
       detail: "sent as plaintext for GitHub to re-seal under its own key"
     });
   }
@@ -542,19 +687,19 @@ var pushCommand = (0, import_citty.defineCommand)({
   },
   run({ args }) {
     return guard(async () => {
-      const result = await runPush({
+      const result2 = await runPush({
         cwd: process.cwd(),
         ...args.env === void 0 ? {} : { environment: args.env },
         ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] }
       });
-      write(renderPush(result));
+      write(renderPush(result2));
     });
   }
 });
 
 // src/commands/validate.ts
-var import_node_path2 = require("path");
-var import_node_url = require("url");
+var import_node_path3 = require("path");
+var import_node_url2 = require("url");
 var import_core6 = require("@penvhq/core");
 var import_citty2 = require("citty");
 var import_jiti = require("jiti");
@@ -623,16 +768,16 @@ function validationIssuesOf(cause, schemaPath) {
 }
 var schemaLoads = Promise.resolve();
 function exclusively(work) {
-  const result = schemaLoads.then(work, work);
-  schemaLoads = result.then(
+  const result2 = schemaLoads.then(work, work);
+  schemaLoads = result2.then(
     () => void 0,
     () => void 0
   );
-  return result;
+  return result2;
 }
 function loadSchema(project, environment) {
   const schemaPath = (0, import_core6.schemaFileOf)(project.config);
-  const file = (0, import_node_url.pathToFileURL)((0, import_node_path2.resolve)(project.root, schemaPath)).href;
+  const file = (0, import_node_url2.pathToFileURL)((0, import_node_path3.resolve)(project.root, schemaPath)).href;
   return exclusively(() => loadSchemaExclusively(file, schemaPath, environment));
 }
 async function loadSchemaExclusively(file, schemaPath, environment) {
@@ -734,9 +879,9 @@ async function runValidate(options) {
       }
     }
     drift = computeDrift({ schema, resolutions, config: project.config, environment });
-    const result = schema.safeParse(object);
-    if (!result.success) {
-      for (const problem of result.error.issues) {
+    const result2 = schema.safeParse(object);
+    if (!result2.success) {
+      for (const problem of result2.error.issues) {
         const path = problem.path.join(".");
         if (undecryptable.has(path)) {
           continue;
@@ -752,24 +897,24 @@ async function runValidate(options) {
   }
   return { ok: issues.length === 0, environment, parameters: refs.length, issues, drift };
 }
-function renderValidate(result) {
-  if (result.ok) {
+function renderValidate(result2) {
+  if (result2.ok) {
     return formatRows([
       {
         glyph: CHECK,
         label: "Schema valid",
-        subject: `${result.parameters} parameters for environment ${result.environment}`
+        subject: `${result2.parameters} parameters for environment ${result2.environment}`
       }
     ]);
   }
-  const rows = result.issues.map((issue) => ({
+  const rows = result2.issues.map((issue) => ({
     glyph: WARN,
     label: LABELS[issue.kind],
     subject: issue.subject,
     detail: issue.message
   }));
   const lines = formatRows(rows);
-  const remedies = [...new Set(result.issues.map((issue) => issue.remedy))];
+  const remedies = [...new Set(result2.issues.map((issue) => issue.remedy))];
   for (const remedy of remedies) {
     if (remedy !== void 0) {
       lines.push(`  ${remedy}`);
@@ -787,12 +932,12 @@ var validateCommand = (0, import_citty2.defineCommand)({
   },
   run({ args }) {
     return guard(async () => {
-      const result = await runValidate({
+      const result2 = await runValidate({
         cwd: process.cwd(),
         ...args.env === void 0 ? {} : { environment: args.env }
       });
-      write(renderValidate(result));
-      if (!result.ok) {
+      write(renderValidate(result2));
+      if (!result2.ok) {
         process.exitCode = 1;
       }
     });
@@ -800,6 +945,7 @@ var validateCommand = (0, import_citty2.defineCommand)({
 });
 
 // src/commands/doctor.ts
+var STUCK_THRESHOLD_MS = 864e5;
 function skipped(check, label) {
   return {
     check,
@@ -813,6 +959,8 @@ async function runDoctor(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
   const findings = [];
+  const now = new Date(options.now ?? (/* @__PURE__ */ new Date()).toISOString());
+  const stuckThresholdMs = options.stuckThresholdMs ?? STUCK_THRESHOLD_MS;
   const { schema, issues } = await loadSchema(project, environment);
   if (schema !== void 0) {
     findings.push({ check: "schema", severity: "pass", label: "Schema valid" });
@@ -861,6 +1009,14 @@ async function runDoctor(options) {
   findings.push(...plaintextSecretFindings(subjects, environment));
   findings.push(...publicSecretFindings(subjects, environment, project.config));
   findings.push(...encryptionFindings(subjects, environment));
+  const rotation = await rotationSubjects(project, environment, subjects, options.source);
+  if (rotation.kind === "unreachable") {
+    findings.push(rotation.finding);
+  } else {
+    findings.push(...overdueFindings(rotation.subjects, environment, now));
+    findings.push(...stuckFindings(rotation.subjects, environment, now, stuckThresholdMs));
+  }
+  findings.push(...await providerDriftFindings(project, environment, options.source));
   findings.push(...await sinkFindings(project, environment, options.sink));
   findings.push({
     check: "provider",
@@ -1278,6 +1434,246 @@ async function sinkFindings(project, environment, override) {
   });
   return findings;
 }
+function humanizeMs(ms) {
+  const abs = Math.max(0, ms);
+  const day = 864e5;
+  const hour = 36e5;
+  const minute = 6e4;
+  const round = (value, unit) => {
+    const n = Math.round(value);
+    return `${n} ${unit}${n === 1 ? "" : "s"}`;
+  };
+  if (abs >= day) return round(abs / day, "day");
+  if (abs >= hour) return round(abs / hour, "hour");
+  if (abs >= minute) return round(abs / minute, "minute");
+  return round(abs / 1e3, "second");
+}
+function refPathOf(ref) {
+  return [...ref.namespace, ref.name].join("/");
+}
+async function rotationSubjects(project, environment, local, override) {
+  const providerConfig = project.config.providers[environment];
+  if (override === void 0 && (providerConfig === void 0 || providerConfig.type === LOCAL_TREE_TYPE)) {
+    return { kind: "read", subjects: local };
+  }
+  const source = override ?? await sourceProviderFor(project, environment);
+  try {
+    const subjects = await Promise.all(
+      local.map(async ({ resolution }) => ({
+        resolution,
+        meta: await source.readMeta(resolution.ref)
+      }))
+    );
+    return { kind: "read", subjects };
+  } catch (error) {
+    return {
+      kind: "unreachable",
+      finding: {
+        check: "rotation-overdue",
+        severity: "unknown",
+        label: "Rotation",
+        subject: `could not reach the ${providerConfig?.type ?? source.type} source of truth for ${environment}`,
+        detail: errorDetail(error)
+      }
+    };
+  }
+}
+function overdueFindings(subjects, environment, now) {
+  const findings = [];
+  for (const { resolution, meta } of subjects) {
+    const { policy, lastRotated } = (0, import_core7.rotationOf)(meta, environment);
+    if (policy === void 0 || lastRotated === null) {
+      continue;
+    }
+    const interval = (0, import_core7.tryParseDuration)(policy);
+    if (interval === void 0) {
+      findings.push({
+        check: "rotation-overdue",
+        severity: "warning",
+        label: "Rotation policy invalid",
+        subject: resolution.parameter,
+        detail: `rotationPolicy \`${policy}\` is not a duration penv can parse (e.g. \`90d\`, \`24h\`)`
+      });
+      continue;
+    }
+    const last = Date.parse(lastRotated);
+    if (Number.isNaN(last)) {
+      continue;
+    }
+    const overdueBy = now.getTime() - last - interval;
+    if (overdueBy <= 0) {
+      continue;
+    }
+    findings.push({
+      check: "rotation-overdue",
+      severity: "warning",
+      label: "Rotation overdue",
+      subject: resolution.parameter,
+      detail: `overdue by ~${humanizeMs(overdueBy)}, policy ${policy}`,
+      remedy: `penv rotate ${refPathOf(resolution.ref)} --env ${environment}`
+    });
+  }
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "rotation-overdue",
+      severity: "pass",
+      label: "Rotation freshness",
+      subject: `no parameter is past its rotation policy for ${environment}`
+    }
+  ];
+}
+function stuckFindings(subjects, environment, now, stuckThresholdMs) {
+  const findings = [];
+  for (const { resolution, meta } of subjects) {
+    if (!(0, import_core7.isStuck)(meta, environment, now, stuckThresholdMs)) {
+      continue;
+    }
+    const { rotatingSince } = (0, import_core7.rotationOf)(meta, environment);
+    if (rotatingSince === null) {
+      continue;
+    }
+    const openFor = now.getTime() - Date.parse(rotatingSince);
+    findings.push({
+      check: "rotation-stuck",
+      severity: "warning",
+      label: "Rotation stuck",
+      subject: resolution.parameter,
+      detail: `dual-valid window open ~${humanizeMs(openFor)}, past the ${humanizeMs(stuckThresholdMs)} grace window`,
+      remedy: `penv rotate ${refPathOf(resolution.ref)} --complete --env ${environment}`
+    });
+  }
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "rotation-stuck",
+      severity: "pass",
+      label: "Rotation progress",
+      subject: `no dual-valid rotation has stayed open past its grace window for ${environment}`
+    }
+  ];
+}
+function driftKey(file) {
+  return [file.namespace.join("/"), file.name, scopeKey(file.scope)].join(" ");
+}
+function scopeKey(scope) {
+  switch (scope.kind) {
+    case "unscoped":
+      return "unscoped";
+    case "environment":
+      return `environment:${scope.environment}`;
+    case "local":
+      return "local";
+    case "environment-local":
+      return `environment-local:${scope.environment}`;
+    default:
+      return (0, import_core7.assertNever)(scope, "scope");
+  }
+}
+function relevantToEnvironment(file, environment) {
+  const scope = file.scope;
+  if (scope.kind === "unscoped") return true;
+  if (scope.kind === "environment") return scope.environment === environment;
+  return false;
+}
+async function readRelevant(provider, environment) {
+  const files = (await provider.list()).filter((file) => relevantToEnvironment(file, environment));
+  const stored = await Promise.all(files.map((file) => provider.read(file)));
+  const entries = /* @__PURE__ */ new Map();
+  for (const [index, file] of files.entries()) {
+    const value = stored[index];
+    if (value !== void 0) {
+      entries.set(driftKey(file), { file, stored: value });
+    }
+  }
+  return entries;
+}
+async function providerDriftFindings(project, environment, override) {
+  const providerConfig = project.config.providers[environment];
+  if (providerConfig === void 0 || providerConfig.type === LOCAL_TREE_TYPE) {
+    return [
+      {
+        check: "provider-value-drift",
+        severity: "pass",
+        label: "Provider values",
+        subject: `${environment} keeps its values in the local .penv tree, so there is no other source of truth to compare against`
+      }
+    ];
+  }
+  const source = override ?? await sourceProviderFor(project, environment);
+  let local;
+  let remote;
+  try {
+    local = await readRelevant(project.provider, environment);
+    remote = await readRelevant(source, environment);
+  } catch (error) {
+    return [
+      {
+        check: "provider-value-drift",
+        severity: "unknown",
+        label: "Provider values",
+        subject: `could not reach the ${providerConfig.type} provider for ${environment}`,
+        detail: errorDetail(error)
+      }
+    ];
+  }
+  const keys = keySourceFor(project, environment);
+  const findings = [];
+  const addresses = [.../* @__PURE__ */ new Set([...local.keys(), ...remote.keys()])].sort();
+  for (const address of addresses) {
+    const here = local.get(address);
+    const there = remote.get(address);
+    if (here !== void 0 && there !== void 0) {
+      const opened = (0, import_core7.openValue)(here.file, here.stored, keys);
+      if (opened.kind !== "plaintext") {
+        findings.push({
+          check: "provider-value-drift",
+          severity: "unknown",
+          label: "Provider value unreadable",
+          subject: (0, import_core7.formatValueFile)(here.file),
+          detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.type} source of truth`
+        });
+        continue;
+      }
+      if (opened.value !== there.stored) {
+        findings.push({
+          check: "provider-value-drift",
+          severity: "failure",
+          label: "Provider value drift",
+          subject: (0, import_core7.formatValueFile)(here.file),
+          detail: `the local tree and the ${providerConfig.type} source of truth hold different values`
+        });
+      }
+      continue;
+    }
+    const present = here ?? there;
+    if (present === void 0) {
+      continue;
+    }
+    findings.push({
+      check: "provider-value-drift",
+      severity: "warning",
+      label: here !== void 0 ? "Only in the local tree" : "Only in the source",
+      subject: (0, import_core7.formatValueFile)(present.file),
+      detail: here !== void 0 ? `present locally, absent from the ${providerConfig.type} source of truth` : `present in the ${providerConfig.type} source of truth, absent from the local tree`
+    });
+  }
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "provider-value-drift",
+      severity: "pass",
+      label: "Provider values",
+      subject: `every value matches the ${providerConfig.type} source of truth for ${environment}`
+    }
+  ];
+}
 function renderDoctor(report) {
   const rows = report.findings.map((finding) => ({
     glyph: finding.severity === "pass" ? CHECK : finding.severity === "unknown" ? UNKNOWN : WARN,
@@ -1364,32 +1760,45 @@ function sealFor(project, file, value, parameter, environment) {
   }
   return (0, import_core8.sealValue)(file, value, keySourceFor(project, environment), parameter, environment);
 }
-async function runSet(options) {
-  const project = openProject(options.cwd);
-  const ref = refFromKey(options.key, project.config);
-  const scope = targetScope(project, options, options.key);
-  const environment = policyEnvironment(project, options);
-  const secret = (0, import_core8.isSecret)(await project.provider.readMeta(ref), environment);
+async function sealAwareWrite(options) {
+  const { project, provider, ref, scope, value, environment } = options;
+  const secret = (0, import_core8.isSecret)(await provider.readMeta(ref), environment);
   const file = {
     namespace: ref.namespace,
     name: ref.name,
     scope,
     encrypted: secret
   };
-  const stored = secret ? sealFor(project, file, options.value, (0, import_core8.parameterId)(ref), environment) : options.value;
-  await project.provider.write(file, stored);
-  await project.provider.remove({ ...file, encrypted: !secret });
-  return { parameter: options.key, location: (0, import_core8.formatValueFile)(file), encrypted: secret };
+  const stored = secret ? sealFor(project, file, value, (0, import_core8.parameterId)(ref), environment) : value;
+  await provider.write(file, stored);
+  await provider.remove({ ...file, encrypted: !secret });
+  return { encrypted: secret, location: (0, import_core8.formatValueFile)(file) };
+}
+async function runSet(options) {
+  const project = openProject(options.cwd);
+  assertWritableKey(options.key);
+  const ref = refFromKey(options.key, project.config);
+  const scope = targetScope(project, options, options.key);
+  const environment = policyEnvironment(project, options);
+  const { encrypted, location } = await sealAwareWrite({
+    project,
+    provider: project.provider,
+    ref,
+    scope,
+    value: options.value,
+    environment
+  });
+  return { parameter: options.key, location, encrypted };
 }
-function renderSet(result) {
+function renderSet(result2) {
   return formatRows([
     {
       glyph: CHECK,
       label: "Wrote",
-      subject: `${PENV_DIR}/${result.location}`,
+      subject: `${PENV_DIR}/${result2.location}`,
       // The `.enc` suffix says this already, but only to a reader who knows the
       // grammar. Meta decided it, not the command line, so the command says so.
-      ...result.encrypted ? { detail: "encrypted, per the parameter's meta policy" } : {}
+      ...result2.encrypted ? { detail: "encrypted, per the parameter's meta policy" } : {}
     }
   ]);
 }
@@ -1525,13 +1934,13 @@ var UndecryptableAt = class extends import_core9.PenvError {
     );
   }
 };
-function renderReseal(result, verb) {
+function renderReseal(result2, verb) {
   return formatRows([
     {
       glyph: CHECK,
       label: verb,
-      subject: `${PENV_DIR}/${result.location}`,
-      detail: `${PENV_DIR}/${result.removed} removed`
+      subject: `${PENV_DIR}/${result2.location}`,
+      detail: `${PENV_DIR}/${result2.removed} removed`
     }
   ]);
 }
@@ -1554,8 +1963,8 @@ var encryptCommand = (0, import_citty5.defineCommand)({
   args: SCOPE_ARGS,
   run({ args }) {
     return guard(async () => {
-      const result = await runEncrypt({ cwd: process.cwd(), key: args.key, ...scopeOptions(args) });
-      write(renderReseal(result, "Encrypted"));
+      const result2 = await runEncrypt({ cwd: process.cwd(), key: args.key, ...scopeOptions(args) });
+      write(renderReseal(result2, "Encrypted"));
     });
   }
 });
@@ -1564,23 +1973,128 @@ var decryptCommand = (0, import_citty5.defineCommand)({
   args: SCOPE_ARGS,
   run({ args }) {
     return guard(async () => {
-      const result = await runDecrypt({ cwd: process.cwd(), key: args.key, ...scopeOptions(args) });
-      write(renderReseal(result, "Decrypted"));
+      const result2 = await runDecrypt({ cwd: process.cwd(), key: args.key, ...scopeOptions(args) });
+      write(renderReseal(result2, "Decrypted"));
     });
   }
 });
 
-// src/commands/generate.ts
-var import_node_fs = require("fs");
-var import_node_path3 = require("path");
+// src/commands/fill.ts
+var import_promises = require("readline/promises");
 var import_core10 = require("@penvhq/core");
 var import_citty6 = require("citty");
+var BLOCKING = /* @__PURE__ */ new Set(["config", "collision", "reserved"]);
+async function runFill(options) {
+  const validation = await runValidate({
+    cwd: options.cwd,
+    ...options.environment === void 0 ? {} : { environment: options.environment }
+  });
+  const environment = validation.environment;
+  const blockers = validation.issues.filter((issue) => BLOCKING.has(issue.kind));
+  if (blockers.length > 0) {
+    const detail = blockers.map(
+      (issue) => `  - ${issue.message}${issue.remedy === void 0 ? "" : ` (${issue.remedy})`}`
+    ).join("\n");
+    throw new import_core10.PenvError(
+      "FILL_BLOCKED",
+      `penv fill cannot run: environment ${environment} has ${blockers.length} unresolved configuration ${blockers.length === 1 ? "issue" : "issues"}:
+${detail}`,
+      `Fix these \u2014 \`penv validate\` reports them \u2014 then run \`penv fill\`. If you have not written a schema yet, declare the required parameters in ${PENV_DIR}/env.ts.`
+    );
+  }
+  const written = [];
+  const skipped2 = [];
+  const unreachable = [];
+  for (const drift of validation.drift.declared) {
+    if (drift.ref === void 0) {
+      unreachable.push({ subject: drift.subject, remedy: drift.remedy });
+      continue;
+    }
+    const ref = drift.ref;
+    const key = [...ref.namespace, ref.name].join("/");
+    const value = await options.ask({ parameter: key, environment, secret: false });
+    if (value === void 0 || value === "") {
+      skipped2.push(drift.subject);
+      continue;
+    }
+    const result2 = await runSet({ cwd: options.cwd, key, value, environment });
+    written.push({
+      parameter: drift.subject,
+      location: result2.location,
+      encrypted: result2.encrypted
+    });
+  }
+  return { environment, written, skipped: skipped2, unreachable };
+}
+function summaryLine(result2) {
+  const filled = result2.written.length;
+  if (filled === 0 && result2.skipped.length === 0 && result2.unreachable.length === 0) {
+    return `Nothing to fill for environment ${result2.environment}: every declared parameter has a value`;
+  }
+  const parts = [`${filled} written`];
+  if (result2.skipped.length > 0) {
+    parts.push(`${result2.skipped.length} skipped`);
+  }
+  if (result2.unreachable.length > 0) {
+    parts.push(`${result2.unreachable.length} unreachable`);
+  }
+  return `${parts.join(", ")} for environment ${result2.environment}`;
+}
+function renderFill(result2) {
+  const rows = result2.written.map((entry) => ({
+    glyph: CHECK,
+    label: "Wrote",
+    subject: `${PENV_DIR}/${entry.location}`,
+    // Meta decided the seal, not the answer, so the line says so — as `set` does.
+    ...entry.encrypted ? { detail: "encrypted, per the parameter's meta policy" } : {}
+  }));
+  for (const entry of result2.unreachable) {
+    rows.push({ glyph: WARN, label: "Unreachable", subject: entry.subject, detail: entry.remedy });
+  }
+  const lines = formatRows(rows);
+  lines.push(summaryLine(result2));
+  return lines;
+}
+var fillCommand = (0, import_citty6.defineCommand)({
+  meta: {
+    name: "fill",
+    description: "Prompt for each declared parameter the tree has no value for"
+  },
+  args: {
+    env: { type: "string", description: "The environment to fill" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const rl = (0, import_promises.createInterface)({ input: process.stdin, output: process.stdout });
+      const ask = (prompt) => rl.question(`${prompt.parameter} (${prompt.environment}): `);
+      try {
+        write(
+          renderFill(
+            await runFill({
+              cwd: process.cwd(),
+              ...args.env === void 0 ? {} : { environment: args.env },
+              ask
+            })
+          )
+        );
+      } finally {
+        rl.close();
+      }
+    });
+  }
+});
+
+// src/commands/generate.ts
+var import_node_fs = require("fs");
+var import_node_path4 = require("path");
+var import_core11 = require("@penvhq/core");
+var import_citty7 = require("citty");
 var DEFAULT_OUTPUT = ".env";
 function entriesFor(project, environment, allowDecrypt) {
   const keys = keySourceFor(project, environment);
   const tree = localTree(project);
   const resolutions = resolveAllSync(tree, environment, keys);
-  const collision = (0, import_core10.checkNameCollisions)(
+  const collision = (0, import_core11.checkNameCollisions)(
     refsFrom(resolutions.map((resolution) => resolution.ref)),
     project.config
   )[0];
@@ -1593,21 +2107,21 @@ function entriesFor(project, environment, allowDecrypt) {
     const winner = resolution.winner;
     if (winner?.file.encrypted === true) {
       if (!allowDecrypt) {
-        throw new import_core10.PenvError(
+        throw new import_core11.PenvError(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and \`penv generate\` writes plaintext`,
           `Re-run with \`--allow-decrypt\` to write the decrypted value into the artifact, or generate for an environment whose values are plaintext. The artifact is gitignored; a committed plaintext secret is a \`penv doctor\` failure.`
         );
       }
-      (0, import_core10.requireValue)(resolution, environment);
+      (0, import_core11.requireValue)(resolution, environment);
       decrypted += 1;
     }
     if (resolution.value === void 0) {
       continue;
     }
-    const description = (0, import_core10.effectiveMeta)(tree.readMetaSync(resolution.ref), environment).description;
+    const description = (0, import_core11.effectiveMeta)(tree.readMetaSync(resolution.ref), environment).description;
     entries.push({
-      key: (0, import_core10.variableName)(resolution.ref, project.config),
+      key: (0, import_core11.variableName)(resolution.ref, project.config),
       value: resolution.value,
       ...typeof description === "string" ? { description } : {}
     });
@@ -1618,40 +2132,40 @@ function entriesFor(project, environment, allowDecrypt) {
 function generateDotenv(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
-  return (0, import_core10.serializeDotenv)(entriesFor(project, environment, options.allowDecrypt === true).entries);
+  return (0, import_core11.serializeDotenv)(entriesFor(project, environment, options.allowDecrypt === true).entries);
 }
 function runGenerate(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
   const { entries, decrypted } = entriesFor(project, environment, options.allowDecrypt === true);
-  const file = options.out === void 0 ? (0, import_node_path3.resolve)(project.root, DEFAULT_OUTPUT) : (0, import_node_path3.isAbsolute)(options.out) ? options.out : (0, import_node_path3.resolve)(options.cwd, options.out);
-  (0, import_node_fs.writeFileSync)(file, (0, import_core10.serializeDotenv)(entries), "utf8");
+  const file = options.out === void 0 ? (0, import_node_path4.resolve)(project.root, DEFAULT_OUTPUT) : (0, import_node_path4.isAbsolute)(options.out) ? options.out : (0, import_node_path4.resolve)(options.cwd, options.out);
+  (0, import_node_fs.writeFileSync)(file, (0, import_core11.serializeDotenv)(entries), "utf8");
   return { file, environment, entries: entries.length, decrypted };
 }
 function displayPath(cwd, file) {
-  const rel = (0, import_node_path3.relative)(cwd, file);
+  const rel = (0, import_node_path4.relative)(cwd, file);
   return rel === "" || rel.startsWith("..") ? file : rel.split("\\").join("/");
 }
-function renderGenerate(result, cwd) {
+function renderGenerate(result2, cwd) {
   const rows = [
     {
       glyph: CHECK,
       label: "Generated",
-      subject: displayPath(cwd, result.file),
-      detail: `${result.entries} variables for environment ${result.environment}`
+      subject: displayPath(cwd, result2.file),
+      detail: `${result2.entries} variables for environment ${result2.environment}`
     }
   ];
-  if (result.decrypted > 0) {
+  if (result2.decrypted > 0) {
     rows.push({
       glyph: WARN,
       label: "Decrypted",
-      subject: `${result.decrypted} ${result.decrypted === 1 ? "secret" : "secrets"}`,
+      subject: `${result2.decrypted} ${result2.decrypted === 1 ? "secret" : "secrets"}`,
       detail: "written as plaintext into the artifact"
     });
   }
   return formatRows(rows);
 }
-var generateCommand = (0, import_citty6.defineCommand)({
+var generateCommand = (0, import_citty7.defineCommand)({
   meta: { name: "generate", description: "Write a standard .env artifact for deploy targets" },
   args: {
     env: { type: "string", description: "The environment to generate for" },
@@ -1664,29 +2178,29 @@ var generateCommand = (0, import_citty6.defineCommand)({
   run({ args }) {
     return guard(async () => {
       const cwd = process.cwd();
-      const result = runGenerate({
+      const result2 = runGenerate({
         cwd,
         ...args.env === void 0 ? {} : { environment: args.env },
         ...args.out === void 0 ? {} : { out: args.out },
         ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] }
       });
-      write(renderGenerate(result, cwd));
+      write(renderGenerate(result2, cwd));
     });
   }
 });
 
 // src/commands/get.ts
-var import_core11 = require("@penvhq/core");
-var import_citty7 = require("citty");
+var import_core12 = require("@penvhq/core");
+var import_citty8 = require("citty");
 async function runGet(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key);
   const keys = keySourceFor(project, environment);
-  const resolution = await (0, import_core11.resolveParameter)(ref, environment, project.provider, keys);
-  const value = (0, import_core11.requireValue)(resolution, environment);
+  const resolution = await (0, import_core12.resolveParameter)(ref, environment, project.provider, keys);
+  const value = (0, import_core12.requireValue)(resolution, environment);
   if (value === void 0) {
-    throw new import_core11.PenvError(
+    throw new import_core12.PenvError(
       "PARAMETER_ABSENT",
       `Parameter ${resolution.parameter} resolves to no value for environment ${environment}`,
       `Set it with \`penv set ${options.key} --env ${environment}\`, or run \`penv get ${options.key} --env ${environment} --explain\` to see every file penv looked at.`
@@ -1708,7 +2222,7 @@ async function runExplain(options) {
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key);
   const keys = keySourceFor(project, environment);
-  const resolution = await (0, import_core11.resolveParameter)(ref, environment, project.provider, keys);
+  const resolution = await (0, import_core12.resolveParameter)(ref, environment, project.provider, keys);
   const winner = resolution.winner;
   return {
     parameter: resolution.parameter,
@@ -1736,7 +2250,7 @@ function renderExplain(explanation) {
     ...columns(rows).map((line) => `  ${line}`)
   ];
 }
-var getCommand = (0, import_citty7.defineCommand)({
+var getCommand = (0, import_citty8.defineCommand)({
   meta: { name: "get", description: "Read a parameter" },
   args: {
     key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
@@ -1761,14 +2275,14 @@ var getCommand = (0, import_citty7.defineCommand)({
 
 // src/commands/import.ts
 var import_node_fs4 = require("fs");
-var import_node_path6 = require("path");
-var import_core14 = require("@penvhq/core");
-var import_citty9 = require("citty");
+var import_node_path7 = require("path");
+var import_core15 = require("@penvhq/core");
+var import_citty10 = require("citty");
 
 // src/detect.ts
 var import_node_fs2 = require("fs");
-var import_node_path4 = require("path");
-var import_core12 = require("@penvhq/core");
+var import_node_path5 = require("path");
+var import_core13 = require("@penvhq/core");
 var SIGNATURES = [
   { name: "Next.js", packages: ["next"], publicPrefixes: ["NEXT_PUBLIC_"] },
   {
@@ -1793,11 +2307,11 @@ function exportsSchema(file) {
   );
 }
 function occupied(cwd, relative3) {
-  const file = (0, import_node_path4.join)(cwd, ...relative3.split("/"));
+  const file = (0, import_node_path5.join)(cwd, ...relative3.split("/"));
   return (0, import_node_fs2.existsSync)(file) && !exportsSchema(file);
 }
 function schemaFileFor(cwd) {
-  const dir = (0, import_node_fs2.existsSync)((0, import_node_path4.join)(cwd, "src")) ? "src/" : "";
+  const dir = (0, import_node_fs2.existsSync)((0, import_node_path5.join)(cwd, "src")) ? "src/" : "";
   const preferred = `${dir}env.ts`;
   if (!occupied(cwd, preferred)) {
     return { file: preferred };
@@ -1806,7 +2320,7 @@ function schemaFileFor(cwd) {
   if (!occupied(cwd, beside)) {
     return { file: beside, displaced: preferred };
   }
-  return { file: import_core12.DEFAULT_SCHEMA_FILE, displaced: preferred };
+  return { file: import_core13.DEFAULT_SCHEMA_FILE, displaced: preferred };
 }
 function dependenciesOf(cwd) {
   const manifest = manifestOf(cwd);
@@ -1825,7 +2339,7 @@ function dependenciesOf(cwd) {
   return names;
 }
 function manifestOf(cwd) {
-  const file = (0, import_node_path4.join)(cwd, "package.json");
+  const file = (0, import_node_path5.join)(cwd, "package.json");
   if (!(0, import_node_fs2.existsSync)(file)) {
     return void 0;
   }
@@ -1868,10 +2382,10 @@ function hasImportsBlock(cwd) {
 
 // src/commands/init.ts
 var import_node_fs3 = require("fs");
-var import_node_path5 = require("path");
-var import_promises = require("readline/promises");
-var import_core13 = require("@penvhq/core");
-var import_citty8 = require("citty");
+var import_node_path6 = require("path");
+var import_promises2 = require("readline/promises");
+var import_core14 = require("@penvhq/core");
+var import_citty9 = require("citty");
 var CONFIG_FILE = "penv.config.ts";
 var TSCONFIG_FILE = "tsconfig.json";
 var GITIGNORE_FILE = ".gitignore";
@@ -1881,11 +2395,11 @@ var IMPORTS_PREFIX = "#";
 var PACKAGE_FILE = "package.json";
 var DEFAULT_DECISIONS = {
   environments: [],
-  schemaFile: import_core13.DEFAULT_SCHEMA_FILE,
+  schemaFile: import_core14.DEFAULT_SCHEMA_FILE,
   publicPrefixes: [],
   alias: DEFAULT_ALIAS
 };
-var NOT_ENVIRONMENTS = [...import_core13.RESERVED_TOKENS, "example", "sample", "template"];
+var NOT_ENVIRONMENTS = [...import_core14.RESERVED_TOKENS, "example", "sample", "template"];
 function suggestEnvironments(root) {
   let entries;
   try {
@@ -1901,7 +2415,7 @@ function suggestEnvironments(root) {
     const segments = entry.slice(".env.".length).split(".");
     const withoutLocal = segments.at(-1) === "local" ? segments.slice(0, -1) : segments;
     const name = withoutLocal.length === 1 ? withoutLocal[0] : void 0;
-    if (name === void 0 || !(0, import_core13.isLegalEnvironmentName)(name) || NOT_ENVIRONMENTS.includes(name)) {
+    if (name === void 0 || !(0, import_core14.isLegalEnvironmentName)(name) || NOT_ENVIRONMENTS.includes(name)) {
       continue;
     }
     found.add(name);
@@ -1909,10 +2423,10 @@ function suggestEnvironments(root) {
   return [...found].sort();
 }
 function emptyFlag(flag) {
-  return new import_core13.PenvError(
+  return new import_core14.PenvError(
     "INIT_FLAG_EMPTY",
     `\`--${flag}\` was given without a value`,
-    flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${import_core13.DEFAULT_SCHEMA_FILE}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
+    flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${import_core14.DEFAULT_SCHEMA_FILE}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
   );
 }
 function splitEnvironments(value) {
@@ -1933,11 +2447,11 @@ function configOf(decisions) {
   return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
 }
 function declaredIn(root) {
-  const file = (0, import_node_path5.join)(root, CONFIG_FILE);
+  const file = (0, import_node_path6.join)(root, CONFIG_FILE);
   if (!(0, import_node_fs3.existsSync)(file)) {
     return void 0;
   }
-  return (0, import_core13.loadConfigFrom)(file);
+  return (0, import_core14.loadConfigFrom)(file);
 }
 function planInit(root, flags = {}) {
   const declared = declaredIn(root);
@@ -1947,7 +2461,7 @@ function planInit(root, flags = {}) {
     notes.push(`${CONFIG_FILE} already exists \u2014 init keeps every decision it records.`);
   } else if (detected === void 0) {
     notes.push(
-      `No framework detected in package.json \u2014 the schema goes to ${import_core13.DEFAULT_SCHEMA_FILE}.`
+      `No framework detected in package.json \u2014 the schema goes to ${import_core14.DEFAULT_SCHEMA_FILE}.`
     );
   } else {
     notes.push(`Detected ${detected.name}.`);
@@ -1957,12 +2471,12 @@ function planInit(root, flags = {}) {
       );
     }
   }
-  const schemaFile = flags.schema === void 0 ? declared !== void 0 ? (0, import_core13.schemaFileOf)(declared) : detected?.schemaFile ?? import_core13.DEFAULT_SCHEMA_FILE : flags.schema.trim();
+  const schemaFile = flags.schema === void 0 ? declared !== void 0 ? (0, import_core14.schemaFileOf)(declared) : detected?.schemaFile ?? import_core14.DEFAULT_SCHEMA_FILE : flags.schema.trim();
   if (flags.schema !== void 0) {
     if (schemaFile.length === 0) {
       throw emptyFlag("schema");
     }
-    const error = (0, import_core13.validateSchemaFile)({ environments: [], providers: {}, schemaFile })[0];
+    const error = (0, import_core14.validateSchemaFile)({ environments: [], providers: {}, schemaFile })[0];
     if (error !== void 0) {
       throw error;
     }
@@ -1972,7 +2486,7 @@ function planInit(root, flags = {}) {
     throw emptyFlag("alias");
   }
   if (!ALIAS_NAME.test(alias)) {
-    throw new import_core13.PenvError(
+    throw new import_core14.PenvError(
       "INIT_ALIAS_INVALID",
       `\`${alias}\` is not an alias penv can write`,
       `An alias is \`@name\` \u2014 a tsconfig \`paths\` entry a bundler resolves \u2014 or \`#name\`, a package.json \`imports\` entry Node resolves itself. Those are the two things a module specifier can be that is not a package.`
@@ -2017,7 +2531,7 @@ function renderPlan(plan2) {
   rows.push([
     "  schemaFile",
     plan2.decisions.schemaFile,
-    plan2.decisions.schemaFile === import_core13.DEFAULT_SCHEMA_FILE ? "" : `(default: ${import_core13.DEFAULT_SCHEMA_FILE})`
+    plan2.decisions.schemaFile === import_core14.DEFAULT_SCHEMA_FILE ? "" : `(default: ${import_core14.DEFAULT_SCHEMA_FILE})`
   ]);
   for (const prefix of plan2.decisions.publicPrefixes) {
     rows.push(["  publicPrefix", prefix, ""]);
@@ -2091,7 +2605,7 @@ ${providers}  },
 }
 function renderConfigModule(decisions) {
   let body = renderEnvironments(decisions);
-  if (decisions.schemaFile !== import_core13.DEFAULT_SCHEMA_FILE) {
+  if (decisions.schemaFile !== import_core14.DEFAULT_SCHEMA_FILE) {
     body += `
   // The module that exports the schema. It is yours \u2014 penv scaffolds it once
   // and never regenerates it \u2014 so this says where you keep it.
@@ -2114,7 +2628,7 @@ ${body}});
 `;
 }
 function renderGitignore(decisions) {
-  const inside = (0, import_core13.schemaInsideTree)(configOf(decisions));
+  const inside = (0, import_core14.schemaInsideTree)(configOf(decisions));
   const listed = inside === void 0 ? "" : `${inside}, `;
   return `# Written by penv. Value files hold configuration values and are never
 # committed; only the structure, ${listed}meta, and config are.
@@ -2259,13 +2773,13 @@ ${objectIndent}${source.slice(close)}`;
 ${entryIndent}${member},${source.slice(open + 1)}`;
 }
 function shapeError(what, target, alias) {
-  return new import_core13.PenvError(
+  return new import_core14.PenvError(
     "TSCONFIG_SHAPE",
     `penv cannot add the \`${alias}\` path alias to tsconfig.json: ${what}`,
     `Add it by hand: \`{ "compilerOptions": { "paths": { "${alias}": ["${target}"] } } }\`.`
   );
 }
-function insertEnvAlias(source, target = import_core13.DEFAULT_SCHEMA_FILE, name = DEFAULT_ALIAS) {
+function insertEnvAlias(source, target = import_core14.DEFAULT_SCHEMA_FILE, name = DEFAULT_ALIAS) {
   const alias = `"${name}": ["${target}"]`;
   const root = skipTrivia(source, 0);
   if (source.charAt(root) !== "{") {
@@ -2329,7 +2843,7 @@ function renderTsconfig(target, alias) {
 `;
 }
 function ensurePenvDir(root) {
-  const dir = (0, import_node_path5.resolve)(root, PENV_DIR2);
+  const dir = (0, import_node_path6.resolve)(root, PENV_DIR2);
   if ((0, import_node_fs3.existsSync)(dir)) {
     return { target: "penv-dir", action: "kept", text: `Found ${PENV_DIR2}/` };
   }
@@ -2337,7 +2851,7 @@ function ensurePenvDir(root) {
   return { target: "penv-dir", action: "created", text: `Created ${PENV_DIR2}/` };
 }
 function writeSchemaFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
-  const file = (0, import_node_path5.join)(root, ...decisions.schemaFile.split("/"));
+  const file = (0, import_node_path6.join)(root, ...decisions.schemaFile.split("/"));
   if ((0, import_node_fs3.existsSync)(file)) {
     return {
       target: "schema",
@@ -2346,7 +2860,7 @@ function writeSchemaFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
       note: "(yours \u2014 penv never regenerates it)"
     };
   }
-  (0, import_node_fs3.mkdirSync)((0, import_node_path5.dirname)(file), { recursive: true });
+  (0, import_node_fs3.mkdirSync)((0, import_node_path6.dirname)(file), { recursive: true });
   (0, import_node_fs3.writeFileSync)(file, renderSchemaModule(fields, draft), "utf8");
   return {
     target: "schema",
@@ -2356,7 +2870,7 @@ function writeSchemaFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
   };
 }
 function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
-  const file = (0, import_node_path5.join)(root, CONFIG_FILE);
+  const file = (0, import_node_path6.join)(root, CONFIG_FILE);
   if ((0, import_node_fs3.existsSync)(file)) {
     return { target: "config", action: "kept", text: `Kept ${CONFIG_FILE}` };
   }
@@ -2366,7 +2880,7 @@ function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
 function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   const alias = decisions.alias;
   const imports = alias.startsWith(IMPORTS_PREFIX);
-  const file = (0, import_node_path5.join)(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
+  const file = (0, import_node_path6.join)(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
   const where = imports ? PACKAGE_FILE : TSCONFIG_FILE;
   if (!(0, import_node_fs3.existsSync)(file)) {
     if (imports) {
@@ -2409,14 +2923,14 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   };
 }
 function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
-  const file = (0, import_node_path5.join)(root, PENV_DIR2, GITIGNORE_FILE);
+  const file = (0, import_node_path6.join)(root, PENV_DIR2, GITIGNORE_FILE);
   const relative3 = `${PENV_DIR2}/${GITIGNORE_FILE}`;
   const wanted = renderGitignore(decisions);
   const existing = (0, import_node_fs3.existsSync)(file) ? (0, import_node_fs3.readFileSync)(file, "utf8") : void 0;
   if (existing === wanted) {
     return { target: "gitignore", action: "kept", text: `Kept ${relative3}` };
   }
-  (0, import_node_fs3.mkdirSync)((0, import_node_path5.join)(root, PENV_DIR2), { recursive: true });
+  (0, import_node_fs3.mkdirSync)((0, import_node_path6.join)(root, PENV_DIR2), { recursive: true });
   (0, import_node_fs3.writeFileSync)(file, wanted, "utf8");
   return {
     target: "gitignore",
@@ -2434,26 +2948,26 @@ function scaffold(root, fields, draft, decisions = DEFAULT_DECISIONS) {
   ];
 }
 function runInit(options) {
-  const root = (0, import_node_path5.resolve)(options.cwd);
+  const root = (0, import_node_path6.resolve)(options.cwd);
   const decisions = options.decisions ?? planInit(root).decisions;
   return { root, decisions, steps: scaffold(root, [], false, decisions) };
 }
-function renderInit(result) {
-  const steps = result.steps.map((step) => {
+function renderInit(result2) {
+  const steps = result2.steps.map((step) => {
     const glyph = step.action === "conflicted" ? WARN : CHECK;
     return step.note === void 0 ? { glyph, text: step.text } : { glyph, text: step.text, note: step.note };
   });
   return [
     ...formatSteps(steps),
     "",
-    `Done. Declare your parameters in ${result.decisions.schemaFile}, then \`penv set <key>\`.`,
-    ...result.decisions.environments.length === 0 ? [
+    `Done. Declare your parameters in ${result2.decisions.schemaFile}, then \`penv set <key>\`.`,
+    ...result2.decisions.environments.length === 0 ? [
       `Then declare your environments in ${CONFIG_FILE}: penv leaves the whitelist empty rather than inventing one, and every command needs it.`
     ] : []
   ];
 }
 async function askOnTty(plan2) {
-  const rl = (0, import_promises.createInterface)({ input: process.stdin, output: process.stdout });
+  const rl = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
   try {
     return await promptForDecisions(plan2, {
       ask: (question) => rl.question(question),
@@ -2464,7 +2978,7 @@ async function askOnTty(plan2) {
     rl.close();
   }
 }
-var initCommand = (0, import_citty8.defineCommand)({
+var initCommand = (0, import_citty9.defineCommand)({
   meta: { name: "init", description: "Initialize a project (.penv/, env.ts, config, @env alias)" },
   args: {
     yes: {
@@ -2473,7 +2987,7 @@ var initCommand = (0, import_citty8.defineCommand)({
     },
     schema: {
       type: "string",
-      description: `Where the schema module goes, e.g. src/env.ts (default: ${import_core13.DEFAULT_SCHEMA_FILE})`
+      description: `Where the schema module goes, e.g. src/env.ts (default: ${import_core14.DEFAULT_SCHEMA_FILE})`
     },
     alias: {
       type: "string",
@@ -2486,7 +3000,7 @@ var initCommand = (0, import_citty8.defineCommand)({
   },
   run({ args }) {
     return guard(async () => {
-      const root = (0, import_node_path5.resolve)(process.cwd());
+      const root = (0, import_node_path6.resolve)(process.cwd());
       const environments = environmentsFromFlag(args.env);
       const plan2 = planInit(root, {
         ...args.schema === void 0 ? {} : { schema: args.schema },
@@ -2527,7 +3041,7 @@ function inferType(value) {
 }
 function draftFields(entries) {
   return entries.map((entry) => {
-    const key = (0, import_core14.accessPath)((0, import_core14.refFromVariable)(entry.key)).join(".");
+    const key = (0, import_core15.accessPath)((0, import_core15.refFromVariable)(entry.key)).join(".");
     return {
       key: IDENTIFIER.test(key) ? key : JSON.stringify(key),
       type: inferType(entry.value)
@@ -2538,33 +3052,33 @@ function assertImportable(ref, variable) {
   if (!ref.name.includes(".")) {
     return;
   }
-  throw new import_core14.PenvError(
+  throw new import_core15.PenvError(
     "IMPORT_UNPARSEABLE_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, whose \`.\` would be read as a scope`,
     `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
   );
 }
 function assertNotReserved(ref, variable, where, config) {
-  if ((0, import_core14.isReservedToken)(ref.name, config)) {
-    throw new import_core14.ReservedTokenError("parameter", variable, where);
+  if ((0, import_core15.isReservedToken)(ref.name, config)) {
+    throw new import_core15.ReservedTokenError("parameter", variable, where);
   }
 }
 function assertRoundTrips(ref, variable, config) {
-  if ((0, import_core14.roundTripsCleanly)(variable)) {
+  if ((0, import_core15.roundTripsCleanly)(variable)) {
     return;
   }
-  if ((0, import_core14.variableName)(ref, config) === variable) {
+  if ((0, import_core15.variableName)(ref, config) === variable) {
     return;
   }
-  const generated = (0, import_core14.variableName)(ref, config);
-  throw new import_core14.PenvError(
+  const generated = (0, import_core15.variableName)(ref, config);
+  throw new import_core15.PenvError(
     "IMPORT_LOSSY_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, which regenerates as ${generated}`,
     `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`names\` block of penv.config.ts \u2014 \`names: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
   );
 }
 function collisionsIn(refs, config) {
-  const errors = (0, import_core14.checkNameCollisions)(refs, config);
+  const errors = (0, import_core15.checkNameCollisions)(refs, config);
   const first = errors[0];
   if (first !== void 0) {
     throw first;
@@ -2574,10 +3088,10 @@ function assertDeclared(segment, config) {
   if (config.environments.includes(segment)) {
     return segment;
   }
-  throw new import_core14.UnknownEnvironmentError(segment, config.environments);
+  throw new import_core15.UnknownEnvironmentError(segment, config.environments);
 }
 function scopeFromFilename(file, config) {
-  const name = (0, import_node_path6.basename)(file);
+  const name = (0, import_node_path7.basename)(file);
   const segments = name.split(".");
   const start = segments.indexOf(DOTENV_SEGMENT);
   if (start === -1) {
@@ -2599,13 +3113,13 @@ function scopeFromFilename(file, config) {
     return { kind: "environment-local", environment: assertDeclared(first, config) };
   }
   if (first === LOCAL && rest.length === 2) {
-    throw new import_core14.FilenameGrammarError(
+    throw new import_core15.FilenameGrammarError(
       name,
       "`local` precedes the environment segment",
       `The environment segment always precedes \`local\` \u2014 \`.env.${second}.${LOCAL}\` is the file Next.js and Vite read, and \`.env.${LOCAL}.${second}\` is not a synonym for it. Rename it to \`.env.${second}.${LOCAL}\`, then import it again. Nothing was imported.`
     );
   }
-  throw new import_core14.FilenameGrammarError(
+  throw new import_core15.FilenameGrammarError(
     name,
     `\`${rest.join("` and `")}\` are ${rest.length} scope segments`,
     "A dotenv file carries exactly one scope: `.env`, `.env.<environment>`, `.env.local`, or `.env.<environment>.local`. Point `penv import` at one of those. Nothing was imported."
@@ -2620,7 +3134,7 @@ function environmentOf(scope) {
     case "local":
       return void 0;
     default:
-      return (0, import_core14.assertNever)(scope, "scope");
+      return (0, import_core15.assertNever)(scope, "scope");
   }
 }
 function scopeWithEnvironment(scope, environment) {
@@ -2633,7 +3147,7 @@ function scopeWithEnvironment(scope, environment) {
     case "environment-local":
       return scope;
     default:
-      return (0, import_core14.assertNever)(scope, "scope");
+      return (0, import_core15.assertNever)(scope, "scope");
   }
 }
 function explicitEnvironment(options, source, config) {
@@ -2641,7 +3155,7 @@ function explicitEnvironment(options, source, config) {
   if (value.length > 0) {
     return value;
   }
-  throw new import_core14.PenvError(
+  throw new import_core15.PenvError(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
     `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
@@ -2651,7 +3165,7 @@ function assertEnvironmentAgrees(derived, explicit, source) {
   if (derived === void 0 || explicit === void 0 || derived === explicit) {
     return;
   }
-  throw new import_core14.PenvError(
+  throw new import_core15.PenvError(
     "IMPORT_ENV_CONFLICT",
     `The file ${source} is scoped to environment ${derived}, but \`--env ${explicit}\` names ${explicit}`,
     `Drop \`--env\` to import ${source} as ${derived}, pass \`--env ${derived}\` to say the same thing twice, or point \`penv import\` at the file that holds ${explicit}'s values. Nothing was imported.`
@@ -2661,7 +3175,7 @@ function environmentNamed(file, explicit) {
   if (explicit !== void 0 && explicit.trim().length > 0) {
     return explicit.trim();
   }
-  const segments = (0, import_node_path6.basename)(file).split(".");
+  const segments = (0, import_node_path7.basename)(file).split(".");
   const start = segments.indexOf(DOTENV_SEGMENT);
   if (start === -1) {
     return void 0;
@@ -2672,15 +3186,15 @@ function environmentNamed(file, explicit) {
 function decisionsOf(config, cwd) {
   return {
     environments: config.environments,
-    schemaFile: (0, import_core14.schemaFileOf)(config),
+    schemaFile: (0, import_core15.schemaFileOf)(config),
     publicPrefixes: config.publicPrefixes ?? [],
     alias: detectAlias(cwd)
   };
 }
 function configInEffect(cwd, environment) {
-  const existing = (0, import_core14.findConfigFile)(cwd);
+  const existing = (0, import_core15.findConfigFile)(cwd);
   if (existing !== void 0) {
-    const config = (0, import_core14.loadConfigFrom)(existing);
+    const config = (0, import_core15.loadConfigFrom)(existing);
     return { config, decisions: decisionsOf(config, cwd) };
   }
   const planned = planInit(cwd).decisions;
@@ -2692,16 +3206,16 @@ function configInEffect(cwd, environment) {
   return { config: openProject(cwd).config, decisions };
 }
 function importDotenv(options) {
-  const cwd = (0, import_node_path6.resolve)(options.cwd);
-  const file = (0, import_node_path6.isAbsolute)(options.file) ? options.file : (0, import_node_path6.resolve)(cwd, options.file);
+  const cwd = (0, import_node_path7.resolve)(options.cwd);
+  const file = (0, import_node_path7.isAbsolute)(options.file) ? options.file : (0, import_node_path7.resolve)(cwd, options.file);
   if (!(0, import_node_fs4.existsSync)(file)) {
-    throw new import_core14.PenvError(
+    throw new import_core15.PenvError(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = (0, import_core14.parseDotenv)((0, import_node_fs4.readFileSync)(file, "utf8"));
+  const parsed = (0, import_core15.parseDotenv)((0, import_node_fs4.readFileSync)(file, "utf8"));
   const { config, decisions } = configInEffect(cwd, environmentNamed(file, options.environment));
   const source = displayPath2(cwd, file);
   const named = scopeFromFilename(file, config);
@@ -2709,10 +3223,10 @@ function importDotenv(options) {
   const explicit = options.environment === void 0 ? void 0 : explicitEnvironment(options, source, config);
   assertEnvironmentAgrees(derived, explicit, source);
   const scope = explicit === void 0 ? named : scopeWithEnvironment(named, assertDeclared(explicit, config));
-  const environment = (0, import_core14.lookupEnvironment)(config, explicit ?? derived);
+  const environment = (0, import_core15.lookupEnvironment)(config, explicit ?? derived);
   const refs = [];
   for (const entry of parsed.entries) {
-    const ref = (0, import_core14.refFromVariable)(entry.key);
+    const ref = (0, import_core15.refFromVariable)(entry.key);
     assertImportable(ref, entry.key);
     assertNotReserved(ref, entry.key, source, config);
     assertRoundTrips(ref, entry.key, config);
@@ -2752,7 +3266,7 @@ function importDotenv(options) {
   };
 }
 function displayPath2(root, file) {
-  const rel = (0, import_node_path6.relative)(root, file);
+  const rel = (0, import_node_path7.relative)(root, file);
   return rel === "" || rel.startsWith("..") ? file : rel.split("\\").join("/");
 }
 function keptSchemaStep(step, variables) {
@@ -2776,19 +3290,19 @@ function skippedValidationStep(environments) {
     note: `(no environment set \u2014 run \`penv validate --env ${example}\`)`
   };
 }
-function renderImport(result, validation) {
-  const steps = [{ glyph: CHECK, text: `Found ${result.variables} variables` }];
-  if (result.orphanComments > 0) {
-    const plural = result.orphanComments === 1 ? "comment" : "comments";
+function renderImport(result2, validation) {
+  const steps = [{ glyph: CHECK, text: `Found ${result2.variables} variables` }];
+  if (result2.orphanComments > 0) {
+    const plural = result2.orphanComments === 1 ? "comment" : "comments";
     steps.push({
       glyph: WARN,
-      text: `Dropped ${result.orphanComments} orphan ${plural}`,
+      text: `Dropped ${result2.orphanComments} orphan ${plural}`,
       note: "attached to no variable, so nothing to describe"
     });
   }
-  for (const step of result.steps) {
+  for (const step of result2.steps) {
     if (step.target === "schema" && step.action === "kept") {
-      steps.push(keptSchemaStep(step, result.variables));
+      steps.push(keptSchemaStep(step, result2.variables));
       continue;
     }
     const glyph = step.action === "conflicted" ? WARN : CHECK;
@@ -2796,10 +3310,10 @@ function renderImport(result, validation) {
       step.note === void 0 ? { glyph, text: step.text } : { glyph, text: step.text, note: step.note }
     );
   }
-  steps.push({ glyph: CHECK, text: `Created ${displayPath2(result.root, result.backup)}` });
+  steps.push({ glyph: CHECK, text: `Created ${displayPath2(result2.root, result2.backup)}` });
   const lines = formatSteps(steps);
   if (validation === void 0) {
-    lines.push(...formatSteps([skippedValidationStep(result.environments)]));
+    lines.push(...formatSteps([skippedValidationStep(result2.environments)]));
   } else if (validation.ok) {
     lines.push(...formatSteps([{ glyph: CHECK, text: "Validated configuration" }]));
   } else {
@@ -2808,7 +3322,7 @@ function renderImport(result, validation) {
   lines.push("", "Done. .penv/ is now your source of truth.");
   return lines;
 }
-var importCommand = (0, import_citty9.defineCommand)({
+var importCommand = (0, import_citty10.defineCommand)({
   meta: {
     name: "import",
     description: "Import an existing dotenv file; it becomes the source of truth"
@@ -2840,16 +3354,16 @@ var importCommand = (0, import_citty9.defineCommand)({
 
 // src/commands/key.ts
 var import_node_crypto = require("crypto");
-var import_core15 = require("@penvhq/core");
-var import_citty10 = require("citty");
+var import_core16 = require("@penvhq/core");
+var import_citty11 = require("citty");
 
 // src/keychain.ts
-var import_node_module = require("module");
+var import_node_module2 = require("module");
 var import_meta = {};
 var cached;
 function entryConstructor() {
   if (cached === void 0) {
-    const require2 = (0, import_node_module.createRequire)(import_meta.url);
+    const require2 = (0, import_node_module2.createRequire)(import_meta.url);
     cached = require2("@napi-rs/keyring").Entry;
   }
   return cached;
@@ -2874,35 +3388,35 @@ function runKeyCreate(options) {
   const environment = targetEnvironment(project, options.environment);
   const declared = project.config.keys?.[environment];
   if (declared === void 0) {
-    throw new import_core15.PenvError(
+    throw new import_core16.PenvError(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
       `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
     );
   }
-  const key = (0, import_node_crypto.randomBytes)(import_core15.KEY_BYTES).toString("base64");
+  const key = (0, import_node_crypto.randomBytes)(import_core16.KEY_BYTES).toString("base64");
   if (declared.source === "keychain") {
     const keychain = options.keychain ?? defaultKeychain;
     if (options.force !== true) {
       let existing;
       try {
-        existing = keychain.getPassword(import_core15.KEYCHAIN_SERVICE, declared.id);
+        existing = keychain.getPassword(import_core16.KEYCHAIN_SERVICE, declared.id);
       } catch (cause) {
-        throw new import_core15.PenvError(
+        throw new import_core16.PenvError(
           "KEYCHAIN_UNAVAILABLE",
           `penv could not read your OS keychain to check for an existing key \`${declared.id}\``,
           `Unlock your keychain and run this again. Original error: ${cause instanceof Error ? cause.message : String(cause)}`
         );
       }
       if (existing !== null) {
-        throw new import_core15.PenvError(
+        throw new import_core16.PenvError(
           "KEY_EXISTS",
           `Environment ${environment} already has a key \`${declared.id}\` in your OS keychain`,
           "Replacing it would orphan every value already sealed under it \u2014 they could never be decrypted again. Re-run with `--force` only if you are certain nothing is sealed under the current key."
         );
       }
     }
-    keychain.setPassword(import_core15.KEYCHAIN_SERVICE, declared.id, key);
+    keychain.setPassword(import_core16.KEYCHAIN_SERVICE, declared.id, key);
     return { source: "keychain", environment, id: declared.id };
   }
   return {
@@ -2913,29 +3427,29 @@ function runKeyCreate(options) {
     key
   };
 }
-function renderKeyCreate(result) {
-  if (result.source === "keychain") {
+function renderKeyCreate(result2) {
+  if (result2.source === "keychain") {
     return [
-      `A new key for environment ${result.environment}, stored in your OS keychain as \`${result.id}\`.`,
+      `A new key for environment ${result2.environment}, stored in your OS keychain as \`${result2.id}\`.`,
       "",
       "penv kept no copy. Anything sealed under it is unreadable without your keychain, and running",
       "`penv key create` again would replace it \u2014 so it lives in exactly one place, on this machine."
     ];
   }
   return [
-    `A new key for environment ${result.environment}. penv did not store it.`,
+    `A new key for environment ${result2.environment}. penv did not store it.`,
     "",
-    `  ${result.variable}=${result.key}`,
+    `  ${result2.variable}=${result2.key}`,
     "",
     "Export it where penv runs, and put it wherever this environment's secrets already live \u2014",
     "a KMS, your CI's secret store, a password manager. Anything sealed under it is unreadable",
     "without it, and penv keeps no copy to fall back on."
   ];
 }
-var keyCommand = (0, import_citty10.defineCommand)({
+var keyCommand = (0, import_citty11.defineCommand)({
   meta: { name: "key", description: "Work with encryption keys" },
   subCommands: {
-    create: (0, import_citty10.defineCommand)({
+    create: (0, import_citty11.defineCommand)({
       meta: { name: "create", description: "Generate a key for an environment" },
       args: {
         env: { type: "string", description: "The environment the key is for" },
@@ -2962,8 +3476,8 @@ var keyCommand = (0, import_citty10.defineCommand)({
 });
 
 // src/commands/list.ts
-var import_core16 = require("@penvhq/core");
-var import_citty11 = require("citty");
+var import_core17 = require("@penvhq/core");
+var import_citty12 = require("citty");
 function scopeLabel2(scope) {
   switch (scope.kind) {
     case "environment":
@@ -2975,7 +3489,7 @@ function scopeLabel2(scope) {
     case "unscoped":
       return "default";
     default:
-      return (0, import_core16.assertNever)(scope, "scope");
+      return (0, import_core17.assertNever)(scope, "scope");
   }
 }
 async function runList(options) {
@@ -2983,12 +3497,12 @@ async function runList(options) {
   const environment = targetEnvironment(project, options.environment);
   const keys = keySourceFor(project, environment);
   const parameters = [];
-  for (const resolution of await (0, import_core16.resolveAll)(environment, project.provider, keys)) {
+  for (const resolution of await (0, import_core17.resolveAll)(environment, project.provider, keys)) {
     const winner = resolution.winner;
     const scope = winner?.file.scope;
     parameters.push({
       parameter: resolution.parameter,
-      variable: (0, import_core16.variableName)(resolution.ref, project.config),
+      variable: (0, import_core17.variableName)(resolution.ref, project.config),
       scope: scope === void 0 ? "absent" : scopeLabel2(scope),
       location: winner?.location,
       encrypted: winner?.file.encrypted === true,
@@ -2997,13 +3511,13 @@ async function runList(options) {
   }
   return { environment, parameters };
 }
-function renderList(result) {
-  if (result.parameters.length === 0) {
-    return [`No parameters in ${PENV_DIR}/ for environment ${result.environment}.`];
+function renderList(result2) {
+  if (result2.parameters.length === 0) {
+    return [`No parameters in ${PENV_DIR}/ for environment ${result2.environment}.`];
   }
-  return columns(result.parameters.map((entry) => [entry.parameter, entry.scope, entry.variable]));
+  return columns(result2.parameters.map((entry) => [entry.parameter, entry.scope, entry.variable]));
 }
-var listCommand = (0, import_citty11.defineCommand)({
+var listCommand = (0, import_citty12.defineCommand)({
   meta: { name: "list", description: "List parameters" },
   args: {
     env: { type: "string", description: "The environment to resolve against" },
@@ -3011,18 +3525,18 @@ var listCommand = (0, import_citty11.defineCommand)({
   },
   run({ args }) {
     return guard(async () => {
-      const result = await runList({
+      const result2 = await runList({
         cwd: process.cwd(),
         ...args.env === void 0 ? {} : { environment: args.env }
       });
-      write(args.json === true ? [JSON.stringify(result, null, 2)] : renderList(result));
+      write(args.json === true ? [JSON.stringify(result2, null, 2)] : renderList(result2));
     });
   }
 });
 
 // src/commands/mv.ts
-var import_core17 = require("@penvhq/core");
-var import_citty12 = require("citty");
+var import_core18 = require("@penvhq/core");
+var import_citty13 = require("citty");
 function environmentOf2(file) {
   const scope = file.scope;
   return scope.kind === "environment" || scope.kind === "environment-local" ? scope.environment : void 0;
@@ -3037,38 +3551,39 @@ async function planFile(project, source, target, parameter) {
   }
   const environment = environmentOf2(source);
   if (environment === void 0) {
-    throw new import_core17.PenvError(
+    throw new import_core18.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
-      `${PENV_DIR}/${(0, import_core17.formatValueFile)(source)} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
+      `${PENV_DIR}/${(0, import_core18.formatValueFile)(source)} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
       "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
     );
   }
   const keys = keySourceFor(project, environment);
-  const opened = (0, import_core17.openValue)(source, stored, keys);
+  const opened = (0, import_core18.openValue)(source, stored, keys);
   if (opened.kind === "failed") {
-    throw new import_core17.PenvError(
+    throw new import_core18.PenvError(
       "VALUE_UNDECRYPTABLE",
-      `${PENV_DIR}/${(0, import_core17.formatValueFile)(source)} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
+      `${PENV_DIR}/${(0, import_core18.formatValueFile)(source)} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
       "A sealed value is bound to the file it lives in, so moving it means opening it and sealing it again. Make the key available and run this again. Nothing has been moved."
     );
   }
   return {
     source,
     target,
-    contents: (0, import_core17.sealValue)(target, opened.value, keys, parameter, environment),
+    contents: (0, import_core18.sealValue)(target, opened.value, keys, parameter, environment),
     resealed: true
   };
 }
 function filesOf(all, ref) {
-  const id = (0, import_core17.parameterId)(ref);
-  return all.filter((file) => (0, import_core17.parameterId)(file) === id);
+  const id = (0, import_core18.parameterId)(ref);
+  return all.filter((file) => (0, import_core18.parameterId)(file) === id);
 }
 async function runMove(options) {
   const project = openProject(options.cwd);
   const from = refFromKey(options.from, project.config);
+  assertWritableKey(options.to);
   const to = refFromKey(options.to, project.config);
-  if ((0, import_core17.parameterId)(from) === (0, import_core17.parameterId)(to)) {
-    throw new import_core17.PenvError(
+  if ((0, import_core18.parameterId)(from) === (0, import_core18.parameterId)(to)) {
+    throw new import_core18.PenvError(
       "PARAMETER_UNCHANGED",
       `\`${options.from}\` and \`${options.to}\` are the same parameter`,
       "Name a different destination, e.g. `penv mv redis-password redis/password`."
@@ -3078,24 +3593,24 @@ async function runMove(options) {
   const sources = filesOf(all, from);
   const meta = await project.provider.readMeta(from);
   if (sources.length === 0 && meta === void 0) {
-    throw new import_core17.PenvError(
+    throw new import_core18.PenvError(
       "PARAMETER_ABSENT",
-      `Parameter ${(0, import_core17.parameterId)(from)} has no value files and no meta, so there is nothing to move`,
+      `Parameter ${(0, import_core18.parameterId)(from)} has no value files and no meta, so there is nothing to move`,
       `\`penv list\` shows every parameter penv holds.`
     );
   }
   const occupied2 = filesOf(all, to);
   if (occupied2.length > 0 || await project.provider.readMeta(to) !== void 0) {
-    throw new import_core17.PenvError(
+    throw new import_core18.PenvError(
       "PARAMETER_EXISTS",
-      `Parameter ${(0, import_core17.parameterId)(to)} already exists, and penv will not merge two parameters into one`,
-      `Remove or rename ${(0, import_core17.parameterId)(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
+      `Parameter ${(0, import_core18.parameterId)(to)} already exists, and penv will not merge two parameters into one`,
+      `Remove or rename ${(0, import_core18.parameterId)(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
     );
   }
   const planned = [];
   for (const source of sources) {
     const target = { ...source, namespace: to.namespace, name: to.name };
-    const one = await planFile(project, source, target, (0, import_core17.parameterId)(to));
+    const one = await planFile(project, source, target, (0, import_core18.parameterId)(to));
     if (one !== void 0) {
       planned.push(one);
     }
@@ -3113,39 +3628,39 @@ async function runMove(options) {
     await project.provider.removeMeta(from);
   }
   return {
-    from: (0, import_core17.parameterId)(from),
-    to: (0, import_core17.parameterId)(to),
+    from: (0, import_core18.parameterId)(from),
+    to: (0, import_core18.parameterId)(to),
     files: planned.map((file) => ({
-      from: (0, import_core17.formatValueFile)(file.source),
-      to: (0, import_core17.formatValueFile)(file.target),
+      from: (0, import_core18.formatValueFile)(file.source),
+      to: (0, import_core18.formatValueFile)(file.target),
       resealed: file.resealed
     })),
     // The meta's path, not the parameter's dotted id: `redis.password` is what
     // the schema calls it and `redis/password.json` is the file, and a report
     // that printed the first while moving the second names no file on disk.
-    meta: meta === void 0 ? void 0 : (0, import_core17.formatMetaFile)({ ...to, format: "json" }),
-    schema: { was: (0, import_core17.accessPath)(from).join("."), now: (0, import_core17.accessPath)(to).join(".") }
+    meta: meta === void 0 ? void 0 : (0, import_core18.formatMetaFile)({ ...to, format: "json" }),
+    schema: { was: (0, import_core18.accessPath)(from).join("."), now: (0, import_core18.accessPath)(to).join(".") }
   };
 }
-function renderMove(result) {
-  const rows = result.files.map((file) => ({
+function renderMove(result2) {
+  const rows = result2.files.map((file) => ({
     glyph: CHECK,
     label: "Moved",
     subject: `${PENV_DIR}/${file.to}`,
     ...file.resealed ? { detail: "re-sealed for its new address" } : {}
   }));
-  if (result.meta !== void 0) {
-    rows.push({ glyph: CHECK, label: "Moved", subject: `${PENV_DIR}/${result.meta}` });
+  if (result2.meta !== void 0) {
+    rows.push({ glyph: CHECK, label: "Moved", subject: `${PENV_DIR}/${result2.meta}` });
   }
   const lines = formatRows(rows);
   lines.push(
     "",
-    `  .penv/env.ts still declares \`${result.schema.was}\`. Rename it to \`${result.schema.now}\`,`,
+    `  .penv/env.ts still declares \`${result2.schema.was}\`. Rename it to \`${result2.schema.now}\`,`,
     "  or `penv validate` will report the value as unused and the declaration as unset."
   );
   return lines;
 }
-var mvCommand = (0, import_citty12.defineCommand)({
+var mvCommand = (0, import_citty13.defineCommand)({
   meta: { name: "mv", description: "Rename a parameter, every scope and its meta at once" },
   args: {
     from: {
@@ -3166,9 +3681,86 @@ var mvCommand = (0, import_citty12.defineCommand)({
   }
 });
 
+// src/commands/pull.ts
+var import_citty14 = require("citty");
+async function runPull(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const source = await sourceProviderFor(project, environment);
+  if (source.type === LOCAL_TREE_TYPE) {
+    return { environment, source: source.type, localSource: true, values: 0, meta: 0, refs: 0 };
+  }
+  const tree = localTree(project);
+  const files = await source.list();
+  let values = 0;
+  for (const file of files) {
+    const value = await source.read(file);
+    if (value === void 0) {
+      continue;
+    }
+    tree.writeSync(file, value);
+    values += 1;
+  }
+  const refs = refsFrom(files);
+  let meta = 0;
+  for (const ref of refs) {
+    const block = await source.readMeta(ref);
+    if (block === void 0) {
+      continue;
+    }
+    tree.writeMetaSync(ref, block);
+    meta += 1;
+  }
+  return { environment, source: source.type, localSource: false, values, meta, refs: refs.length };
+}
+function renderPull(result2) {
+  if (result2.localSource) {
+    return formatRows([
+      {
+        glyph: CHECK,
+        label: "Nothing to pull",
+        subject: `environment ${result2.environment} has no separate source of truth`,
+        detail: "its values live in the local .penv tree already"
+      }
+    ]);
+  }
+  return formatRows([
+    {
+      glyph: CHECK,
+      label: "Pulled",
+      subject: `${result2.values} ${result2.values === 1 ? "value" : "values"}`,
+      detail: `from the ${result2.source} provider for environment ${result2.environment}`
+    },
+    {
+      glyph: CHECK,
+      label: "Parameters",
+      subject: `${result2.refs} ${result2.refs === 1 ? "parameter" : "parameters"}, ${result2.meta} with meta`,
+      detail: "written into the local .penv tree"
+    }
+  ]);
+}
+var pullCommand = (0, import_citty14.defineCommand)({
+  meta: {
+    name: "pull",
+    description: "Materialise the local .penv tree from an environment's source-of-truth provider"
+  },
+  args: {
+    env: { type: "string", description: "The environment to pull" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const result2 = await runPull({
+        cwd: process.cwd(),
+        ...args.env === void 0 ? {} : { environment: args.env }
+      });
+      write(renderPull(result2));
+    });
+  }
+});
+
 // src/commands/remove.ts
-var import_core18 = require("@penvhq/core");
-var import_citty13 = require("citty");
+var import_core19 = require("@penvhq/core");
+var import_citty15 = require("citty");
 async function runRemove(options) {
   const project = openProject(options.cwd);
   const ref = refFromKey(options.key);
@@ -3185,17 +3777,17 @@ async function runRemove(options) {
       continue;
     }
     await project.provider.remove(file);
-    removed.push((0, import_core18.formatValueFile)(file));
+    removed.push((0, import_core19.formatValueFile)(file));
   }
   return {
     parameter: options.key,
     removed,
-    considered: files.map((file) => (0, import_core18.formatValueFile)(file))
+    considered: files.map((file) => (0, import_core19.formatValueFile)(file))
   };
 }
-function renderRemove(result) {
-  if (result.removed.length === 0) {
-    const first = result.considered[0] ?? result.parameter;
+function renderRemove(result2) {
+  if (result2.removed.length === 0) {
+    const first = result2.considered[0] ?? result2.parameter;
     return formatRows([
       {
         glyph: WARN,
@@ -3205,14 +3797,14 @@ function renderRemove(result) {
       }
     ]);
   }
-  const rows = result.removed.map((location) => ({
+  const rows = result2.removed.map((location) => ({
     glyph: CHECK,
     label: "Removed",
     subject: `${PENV_DIR}/${location}`
   }));
   return formatRows(rows);
 }
-var removeCommand = (0, import_citty13.defineCommand)({
+var removeCommand = (0, import_citty15.defineCommand)({
   meta: { name: "remove", description: "Delete a parameter" },
   args: {
     key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
@@ -3238,15 +3830,195 @@ var removeCommand = (0, import_citty13.defineCommand)({
   }
 });
 
+// src/commands/rotate.ts
+var import_core20 = require("@penvhq/core");
+var import_citty16 = require("citty");
+function rotatingFile(ref, environment) {
+  return {
+    namespace: ref.namespace,
+    name: ref.name,
+    scope: { kind: "environment", environment },
+    encrypted: false
+  };
+}
+async function writeRotatedValue(project, provider, ref, environment, value) {
+  if (provider.type === LOCAL_TREE_TYPE) {
+    await sealAwareWrite({
+      project,
+      provider,
+      ref,
+      scope: { kind: "environment", environment },
+      value,
+      environment
+    });
+    return;
+  }
+  await provider.write(rotatingFile(ref, environment), value);
+}
+function requireNewValue(value, phase, key) {
+  if (value === void 0) {
+    throw new import_core20.PenvError(
+      "ROTATION_NO_VALUE",
+      `A ${phase} rotation of ${key} writes a new value, and none was given`,
+      "Pass the new value as the argument \u2014 `penv rotate <key> <value>` \u2014 or pipe it in on stdin."
+    );
+  }
+  return value;
+}
+function requireRetaining(provider, environment) {
+  if (!(0, import_core20.retainsPrevious)(provider)) {
+    throw new import_core20.PenvError(
+      "ROTATION_NOT_RETAINING",
+      `A dual-valid rotation needs the previous value to stay readable during the grace window, and the \`${provider.type}\` provider for environment ${environment} does not retain it`,
+      "Point this environment at a provider that keeps prior versions (its `readPrevious` is what penv reads during the window), or, if a momentary overlap is not required, declare the parameter `atomic-cutover` in its meta and flip it in one step."
+    );
+  }
+  return provider;
+}
+async function runRotate(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const ref = refFromKey(options.key, project.config);
+  const provider = await sourceProviderFor(project, environment);
+  const nowIso = options.now ?? (/* @__PURE__ */ new Date()).toISOString();
+  const before = await provider.readMeta(ref);
+  const { mechanism } = (0, import_core20.rotationOf)(before, environment);
+  if (mechanism === void 0) {
+    throw new import_core20.PenvError(
+      "ROTATION_NO_MECHANISM",
+      `Parameter ${options.key} declares no rotation mechanism for environment ${environment}, so penv does not know how to rotate it`,
+      'Set `rotationMechanism` in the parameter\'s meta to `"dual-valid"` (a grace-window overlap) or `"atomic-cutover"` (a single flip), then run `penv rotate` again.'
+    );
+  }
+  const begin = options.begin === true;
+  const complete = options.complete === true;
+  if (mechanism === "atomic-cutover") {
+    if (begin || complete) {
+      throw new import_core20.PenvError(
+        "ROTATION_MECHANISM_MISMATCH",
+        `Parameter ${options.key} is atomic-cutover, which flips in one step, so \`--begin\`/\`--complete\` do not apply`,
+        "Run `penv rotate <key> <value>` with no phase flag to flip it. `--begin`/`--complete` bracket a dual-valid grace window, which atomic-cutover has none of."
+      );
+    }
+    const value = requireNewValue(options.value, "cutover", options.key);
+    await writeRotatedValue(project, provider, ref, environment, value);
+    const after2 = (0, import_core20.completeRotation)(before, environment, nowIso);
+    await provider.writeMeta(ref, after2);
+    return result(ref, environment, mechanism, "cutover", provider.type, true, after2);
+  }
+  const retaining = requireRetaining(provider, environment);
+  if (begin === complete) {
+    throw new import_core20.PenvError(
+      "ROTATION_PHASE_REQUIRED",
+      `A dual-valid rotation of ${options.key} needs exactly one of \`--begin\` or \`--complete\``,
+      "`--begin` writes the new value and opens the grace window; `--complete` closes it once every reader has moved to the new value. Run them in that order, one at a time."
+    );
+  }
+  if (begin) {
+    const value = requireNewValue(options.value, "begin", options.key);
+    await writeRotatedValue(project, retaining, ref, environment, value);
+    const after2 = (0, import_core20.beginRotation)(before, environment, nowIso);
+    await retaining.writeMeta(ref, after2);
+    return result(ref, environment, mechanism, "begin", retaining.type, true, after2);
+  }
+  const after = (0, import_core20.completeRotation)(before, environment, nowIso);
+  await retaining.writeMeta(ref, after);
+  return result(ref, environment, mechanism, "complete", retaining.type, false, after);
+}
+function result(ref, environment, mechanism, phase, source, wroteValue, after) {
+  const { state, rotatingSince, lastRotated } = (0, import_core20.rotationOf)(after, environment);
+  return {
+    parameter: [...ref.namespace, ref.name].join("/"),
+    environment,
+    mechanism,
+    phase,
+    source,
+    wroteValue,
+    state,
+    rotatingSince,
+    lastRotated
+  };
+}
+function renderRotate(result2) {
+  if (result2.phase === "begin") {
+    return formatRows([
+      {
+        glyph: CHECK,
+        label: "Rotating",
+        subject: result2.parameter,
+        detail: `dual-valid window open for environment ${result2.environment} (since ${result2.rotatingSince})`
+      },
+      {
+        glyph: CHECK,
+        label: "Previous",
+        subject: "still readable",
+        detail: `on the ${result2.source} provider until \`penv rotate ${result2.parameter} --complete\``
+      }
+    ]);
+  }
+  if (result2.phase === "complete") {
+    return formatRows([
+      {
+        glyph: CHECK,
+        label: "Rotated",
+        subject: result2.parameter,
+        detail: `dual-valid window closed for environment ${result2.environment} (completed ${result2.lastRotated})`
+      }
+    ]);
+  }
+  return formatRows([
+    {
+      glyph: CHECK,
+      label: "Rotated",
+      subject: result2.parameter,
+      detail: `atomic-cutover flip for environment ${result2.environment} (completed ${result2.lastRotated})`
+    }
+  ]);
+}
+var rotateCommand = (0, import_citty16.defineCommand)({
+  meta: {
+    name: "rotate",
+    description: "Rotate a parameter's value by the mechanism its meta declares"
+  },
+  args: {
+    key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
+    value: {
+      type: "positional",
+      required: false,
+      description: "The new value; read from stdin if omitted. Not needed with --complete"
+    },
+    env: { type: "string", description: "The environment to rotate in" },
+    begin: { type: "boolean", description: "Open a dual-valid grace window with the new value" },
+    complete: { type: "boolean", description: "Close a dual-valid grace window" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const value = args.complete === true ? void 0 : args.value ?? await readStdin();
+      write(
+        renderRotate(
+          await runRotate({
+            cwd: process.cwd(),
+            key: args.key,
+            ...value === void 0 ? {} : { value },
+            ...args.env === void 0 ? {} : { environment: args.env },
+            ...args.begin === void 0 ? {} : { begin: args.begin },
+            ...args.complete === void 0 ? {} : { complete: args.complete }
+          })
+        )
+      );
+    });
+  }
+});
+
 // src/commands/watch.ts
 var import_node_fs5 = require("fs");
-var import_node_path7 = require("path");
-var import_core19 = require("@penvhq/core");
-var import_citty14 = require("citty");
+var import_node_path8 = require("path");
+var import_core21 = require("@penvhq/core");
+var import_citty17 = require("citty");
 var DEBOUNCE_MS = 100;
 function runWatch(options) {
   const project = openProject(options.cwd);
-  const configFile = (0, import_node_path7.basename)(project.configFile);
+  const configFile = (0, import_node_path8.basename)(project.configFile);
   const debounceMs = options.debounceMs ?? DEBOUNCE_MS;
   const watchers = /* @__PURE__ */ new Set();
   let timer;
@@ -3263,12 +4035,12 @@ function runWatch(options) {
     }
     running = true;
     try {
-      const result = await runValidate({
+      const result2 = await runValidate({
         cwd: options.cwd,
         ...options.environment === void 0 ? {} : { environment: options.environment }
       });
       if (!closed) {
-        options.onResult?.(result);
+        options.onResult?.(result2);
       }
     } catch (error) {
       if (!closed) {
@@ -3299,8 +4071,8 @@ function runWatch(options) {
     watcher.close();
   }
   function armRecovery(target, recursive, only) {
-    const parent = (0, import_node_path7.dirname)(target);
-    const name = (0, import_node_path7.basename)(target);
+    const parent = (0, import_node_path8.dirname)(target);
+    const name = (0, import_node_path8.basename)(target);
     let recovery;
     try {
       recovery = (0, import_node_fs5.watch)(parent, { recursive: false }, (_event, filename) => {
@@ -3311,7 +4083,7 @@ function runWatch(options) {
           stop(recovery);
           return;
         }
-        if (filename !== null && (0, import_node_path7.basename)(filename) !== name) {
+        if (filename !== null && (0, import_node_path8.basename)(filename) !== name) {
           return;
         }
         if (!(0, import_node_fs5.existsSync)(target)) {
@@ -3346,7 +4118,7 @@ function runWatch(options) {
         schedule();
         return;
       }
-      if (only !== void 0 && (filename === null || (0, import_node_path7.basename)(filename) !== only)) {
+      if (only !== void 0 && (filename === null || (0, import_node_path8.basename)(filename) !== only)) {
         return;
       }
       schedule();
@@ -3373,10 +4145,10 @@ function runWatch(options) {
     watchers.add(watcher);
   }
   addWatcher(project.penvDir, true);
-  addWatcher((0, import_node_path7.dirname)(project.configFile), false, configFile);
-  if ((0, import_core19.schemaInsideTree)(project.config) === void 0) {
-    const schemaFile = (0, import_node_path7.resolve)(project.root, (0, import_core19.schemaFileOf)(project.config));
-    addWatcher((0, import_node_path7.dirname)(schemaFile), false, (0, import_node_path7.basename)(schemaFile));
+  addWatcher((0, import_node_path8.dirname)(project.configFile), false, configFile);
+  if ((0, import_core21.schemaInsideTree)(project.config) === void 0) {
+    const schemaFile = (0, import_node_path8.resolve)(project.root, (0, import_core21.schemaFileOf)(project.config));
+    addWatcher((0, import_node_path8.dirname)(schemaFile), false, (0, import_node_path8.basename)(schemaFile));
   }
   void validate();
   return {
@@ -3392,8 +4164,8 @@ function runWatch(options) {
     }
   };
 }
-function renderWatch(result) {
-  return ["", ...renderValidate(result), ...renderDrift(result.drift, result.environment)];
+function renderWatch(result2) {
+  return ["", ...renderValidate(result2), ...renderDrift(result2.drift, result2.environment)];
 }
 function renderDrift(drift, environment) {
   const rows = [
@@ -3419,7 +4191,7 @@ function renderDrift(drift, environment) {
   }
   return lines;
 }
-var watchCommand = (0, import_citty14.defineCommand)({
+var watchCommand = (0, import_citty17.defineCommand)({
   meta: {
     name: "watch",
     description: "Re-validate whenever .penv/ or penv.config.ts changes"
@@ -3432,8 +4204,8 @@ var watchCommand = (0, import_citty14.defineCommand)({
       const handle = runWatch({
         cwd: process.cwd(),
         ...args.env === void 0 ? {} : { environment: args.env },
-        onResult: (result) => {
-          write(renderWatch(result));
+        onResult: (result2) => {
+          write(renderWatch(result2));
         },
         // A failing cycle is reported and watching continues. `reportError`
         // marks the process failed, which `validate` wants and a loop does not:
@@ -3447,10 +4219,10 @@ var watchCommand = (0, import_citty14.defineCommand)({
         }
       });
       write(["Watching .penv/ and penv.config.ts. Ctrl-C to stop."]);
-      await new Promise((resolve6) => {
+      await new Promise((resolve7) => {
         process.once("SIGINT", () => {
           handle.close();
-          resolve6();
+          resolve7();
         });
       });
     });
@@ -3458,7 +4230,7 @@ var watchCommand = (0, import_citty14.defineCommand)({
 });
 
 // src/index.ts
-var main = (0, import_citty15.defineCommand)({
+var main = (0, import_citty18.defineCommand)({
   meta: {
     name: "penv",
     description: "Configuration that shares a data model with your production secret manager"
@@ -3469,8 +4241,11 @@ var main = (0, import_citty15.defineCommand)({
     generate: generateCommand,
     get: getCommand,
     set: setCommand,
+    fill: fillCommand,
     mv: mvCommand,
+    pull: pullCommand,
     push: pushCommand,
+    rotate: rotateCommand,
     remove: removeCommand,
     list: listCommand,
     encrypt: encryptCommand,
@@ -3482,8 +4257,8 @@ var main = (0, import_citty15.defineCommand)({
   }
 });
 function runMain() {
-  (0, import_core20.setKeychain)(defaultKeychain);
-  return (0, import_citty15.runMain)(main);
+  (0, import_core22.setKeychain)(defaultKeychain);
+  return (0, import_citty18.runMain)(main);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -3493,21 +4268,27 @@ function runMain() {
   insertEnvAlias,
   main,
   renderDoctor,
+  renderFill,
   renderMove,
+  renderPull,
   renderPush,
+  renderRotate,
   renderWatch,
   runDecrypt,
   runDoctor,
   runEncrypt,
   runExplain,
+  runFill,
   runGenerate,
   runGet,
   runInit,
   runList,
   runMain,
   runMove,
+  runPull,
   runPush,
   runRemove,
+  runRotate,
   runSet,
   runValidate,
   runWatch