@penvhq/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,3548 @@
+// src/index.ts
+import { setKeychain } from "@penvhq/core";
+import { runMain as cittyRunMain, defineCommand as defineCommand15 } from "citty";
+
+// src/commands/doctor.ts
+import {
+  accessPath as accessPath3,
+  effectiveMeta,
+  isPublicVariable,
+  isRequired,
+  isSecret,
+  resolveAll as resolveAll2,
+  variableName as variableName3
+} from "@penvhq/core";
+import { createGithubSink as createGithubSink2 } from "@penvhq/sink-github";
+import { defineCommand as defineCommand3 } from "citty";
+
+// src/project.ts
+import { dirname, resolve } from "path";
+import {
+  candidatesFor,
+  formatValueFile,
+  isReservedToken,
+  loadConfig,
+  openValue,
+  PenvError as PenvError2,
+  parameterId,
+  ReservedTokenError,
+  resolveEnvironment,
+  resolveKeySource
+} from "@penvhq/core";
+import { FilesystemProvider } from "@penvhq/provider-filesystem";
+
+// src/registry.ts
+import { PenvError } from "@penvhq/core";
+import { createFilesystemProvider } from "@penvhq/provider-filesystem";
+var LOCAL_TREE_TYPE = "filesystem";
+var REGISTRY = /* @__PURE__ */ new Map([
+  [LOCAL_TREE_TYPE, ({ root, config }) => createFilesystemProvider({ root, config })]
+]);
+function isProviderRegistered(type) {
+  return REGISTRY.has(type);
+}
+function createProvider(type, context) {
+  const factory = REGISTRY.get(type);
+  if (factory === void 0) {
+    throw unknownProvider(type);
+  }
+  return factory(context);
+}
+function assertProvidersRegistered(config) {
+  for (const [environment, provider] of Object.entries(config.providers)) {
+    if (!isProviderRegistered(provider.type)) {
+      throw unknownProvider(provider.type, environment);
+    }
+  }
+}
+function unknownProvider(type, environment) {
+  const known = [...REGISTRY.keys()].map((name) => `\`${name}\``).join(", ");
+  const where = environment === void 0 ? "" : ` for environment ${environment}`;
+  return new PenvError(
+    "UNKNOWN_PROVIDER",
+    `The provider type \`${type}\`${where} in penv.config.ts is not one this penv build carries`,
+    `This build registers ${known}. Name a registered provider, or install the build that carries \`${type}\`.`
+  );
+}
+
+// src/project.ts
+var PENV_DIR = ".penv";
+function openProject(cwd) {
+  const { config, file } = loadConfig(cwd);
+  const root = dirname(file);
+  const penvDir = resolve(root, PENV_DIR);
+  assertProvidersRegistered(config);
+  return {
+    root,
+    configFile: file,
+    config,
+    penvDir,
+    provider: createProvider(LOCAL_TREE_TYPE, { root: penvDir, config })
+  };
+}
+function localTree(project) {
+  if (!(project.provider instanceof FilesystemProvider)) {
+    throw new PenvError2(
+      "PROVIDER_NOT_LOCAL",
+      `This command reads the local .penv tree synchronously, which the \`${project.provider.type}\` provider is not`,
+      "Run this against a filesystem-backed project, or use a command that speaks the async provider contract."
+    );
+  }
+  return project.provider;
+}
+function targetEnvironment(project, explicit) {
+  return resolveEnvironment(project.config, explicit);
+}
+var KEY_SEPARATOR = /[./\\]/;
+var NO_ENVIRONMENTS = { environments: [], providers: {} };
+function refFromKey(key, config) {
+  const segments = key.split(KEY_SEPARATOR).filter((segment) => segment.length > 0);
+  const name = segments[segments.length - 1];
+  if (name === void 0) {
+    throw new PenvError2(
+      "PARAMETER_KEY",
+      `\`${key}\` names no parameter`,
+      "A key is `<namespace>/<name>` or `<namespace>.<name>`, e.g. `redis/password`."
+    );
+  }
+  if (isReservedToken(name, config ?? NO_ENVIRONMENTS)) {
+    throw new ReservedTokenError("parameter", name, key);
+  }
+  return { namespace: segments.slice(0, -1), name };
+}
+function keySourceFor(project, environment) {
+  return resolveKeySource(project.config, environment);
+}
+function resolveSync(provider, ref, environment, keys, skipPersonal) {
+  for (const file of candidatesFor(ref, environment, skipPersonal)) {
+    const read = provider.readSync(file);
+    if (read === void 0) {
+      continue;
+    }
+    const opened = openValue(file, read, keys);
+    return {
+      ref,
+      parameter: parameterId(ref),
+      value: opened.kind === "plaintext" ? opened.value : void 0,
+      ...opened.kind === "failed" ? { undecryptable: opened.failure } : {},
+      winner: { file, location: formatValueFile(file), present: true }
+    };
+  }
+  return { ref, parameter: parameterId(ref), value: void 0, winner: void 0 };
+}
+function resolveAllSync(provider, environment, keys, skipPersonal) {
+  return refsFrom(provider.listSync()).map(
+    (ref) => resolveSync(provider, ref, environment, keys, skipPersonal)
+  );
+}
+function refsFrom(files) {
+  const refs = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const ref = { namespace: file.namespace, name: file.name };
+    const id = parameterId(ref);
+    if (!refs.has(id)) {
+      refs.set(id, ref);
+    }
+  }
+  return [...refs.values()].sort((a, b) => {
+    const left = parameterId(a);
+    const right = parameterId(b);
+    return left < right ? -1 : left > right ? 1 : 0;
+  });
+}
+
+// src/schema.ts
+import {
+  accessPath,
+  isReservedToken as isReservedToken2,
+  parameterId as parameterId2,
+  refFromAccessPath,
+  variableName
+} from "@penvhq/core";
+function defOf(node) {
+  if (typeof node !== "object" || node === null) {
+    return void 0;
+  }
+  const def = node.def;
+  return typeof def === "object" && def !== null ? def : void 0;
+}
+function typeOf(node) {
+  const type = defOf(node)?.type;
+  return typeof type === "string" ? type : void 0;
+}
+function unwrap(node) {
+  let current = node;
+  for (let depth = 0; depth < 8; depth += 1) {
+    const inner = defOf(current)?.innerType;
+    if (inner === void 0) {
+      return current;
+    }
+    current = inner;
+  }
+  return current;
+}
+function shapeOf(node) {
+  if (typeOf(node) !== "object") {
+    return void 0;
+  }
+  const shape = node.shape;
+  return typeof shape === "object" && shape !== null ? shape : void 0;
+}
+function lookup(root, path) {
+  let node = unwrap(root);
+  for (const key of path) {
+    const shape = shapeOf(node);
+    if (shape === void 0) {
+      return { kind: "unknown" };
+    }
+    if (!Object.hasOwn(shape, key)) {
+      return { kind: "absent" };
+    }
+    node = unwrap(shape[key]);
+  }
+  return { kind: "found", node };
+}
+function minLengthOf(node) {
+  if (typeOf(node) !== "string") {
+    return void 0;
+  }
+  const min = node.minLength;
+  return typeof min === "number" ? min : void 0;
+}
+var ABSENCE_PERMITTED = /* @__PURE__ */ new Set(["optional", "default", "catch", "prefault"]);
+var ABSENCE_REFUSED = /* @__PURE__ */ new Set(["nullable", "nonoptional", "readonly"]);
+function permitsAbsence(node) {
+  let current = node;
+  for (let depth = 0; depth < 8; depth += 1) {
+    const type = typeOf(current);
+    if (type !== void 0 && ABSENCE_PERMITTED.has(type)) {
+      return true;
+    }
+    const inner = defOf(current)?.innerType;
+    if (inner === void 0) {
+      return type === void 0 ? void 0 : false;
+    }
+    if (type === void 0 || !ABSENCE_REFUSED.has(type)) {
+      return void 0;
+    }
+    current = inner;
+  }
+  return void 0;
+}
+function leaves(node, path, inherited, out) {
+  const own = permitsAbsence(node);
+  const absencePermitted = inherited === true || own === true ? true : combine(inherited, own);
+  const shape = shapeOf(unwrap(node));
+  if (shape === void 0) {
+    if (path.length > 0) {
+      out.push({ path, absencePermitted });
+    }
+    return;
+  }
+  for (const key of Object.keys(shape)) {
+    leaves(shape[key], [...path, key], absencePermitted, out);
+  }
+}
+function combine(left, right) {
+  return left === void 0 || right === void 0 ? void 0 : false;
+}
+function declaredLeaves(schema) {
+  const out = [];
+  leaves(schema, [], false, out);
+  return out;
+}
+var EMPTY_DRIFT = { declared: [], undeclared: [] };
+function hasValue(resolution) {
+  return resolution.winner !== void 0;
+}
+function computeDrift(input) {
+  const { schema, resolutions, config, environment } = input;
+  const valued = new Set(resolutions.filter(hasValue).map((resolution) => resolution.parameter));
+  const declared = [];
+  for (const leaf of declaredLeaves(schema)) {
+    if (leaf.absencePermitted !== false) {
+      continue;
+    }
+    const path = leaf.path.join(".");
+    const ref = refFromAccessPath(leaf.path);
+    if (ref === void 0 || isReservedToken2(ref.name, config)) {
+      declared.push({
+        subject: path,
+        remedy: `Rename the \`${path}\` key in .penv/env.ts \u2014 a parameter name is lower-case, hyphenated, and never a reserved token, so no value file reaches this key.`,
+        detail: "declared, no filename reaches it"
+      });
+      continue;
+    }
+    if (valued.has(parameterId2(ref))) {
+      continue;
+    }
+    declared.push({
+      subject: parameterId2(ref),
+      ref,
+      remedy: `penv set ${[...ref.namespace, ref.name].join("/")} --env ${environment}`,
+      detail: `declared in .penv/env.ts, no value for ${environment}`
+    });
+  }
+  const undeclared = [];
+  for (const resolution of resolutions) {
+    if (lookup(schema, accessPath(resolution.ref)).kind !== "absent") {
+      continue;
+    }
+    undeclared.push({
+      ref: resolution.ref,
+      variable: variableName(resolution.ref, config)
+    });
+  }
+  return { declared, undeclared };
+}
+
+// src/ui.ts
+import { PenvError as PenvError3 } from "@penvhq/core";
+var CHECK = "\u2713";
+var WARN = "\u26A0";
+var UNKNOWN = "?";
+var NOTE_COLUMN = 29;
+function widest(values) {
+  return values.reduce((max, value) => Math.max(max, value.length), 0);
+}
+function formatRows(rows) {
+  const labelWidth = widest(rows.map((row) => row.label)) + 2;
+  const detailed = rows.filter((row) => row.detail !== void 0);
+  const subjectWidth = widest(detailed.map((row) => row.subject ?? "")) + 1;
+  return rows.map((row) => {
+    const head = `${row.glyph} ${row.label.padEnd(labelWidth)}`;
+    if (row.detail === void 0) {
+      return `${head}${row.subject ?? ""}`.trimEnd();
+    }
+    return `${head}${(row.subject ?? "").padEnd(subjectWidth)}${row.detail}`.trimEnd();
+  });
+}
+function columns(rows, gap = 2) {
+  const count = rows.reduce((max, row) => Math.max(max, row.length), 0);
+  const widths = [];
+  for (let column = 0; column < count; column += 1) {
+    widths.push(widest(rows.map((row) => row[column] ?? "")) + gap);
+  }
+  return rows.map(
+    (row) => row.map((cell, index) => index === row.length - 1 ? cell : cell.padEnd(widths[index] ?? 0)).join("").trimEnd()
+  );
+}
+function formatSteps(steps) {
+  return steps.map((step) => {
+    if (step.note === void 0) {
+      return `${step.glyph} ${step.text}`;
+    }
+    const text = step.text.length >= NOTE_COLUMN ? `${step.text} ` : step.text.padEnd(NOTE_COLUMN);
+    return `${step.glyph} ${text}${step.note}`;
+  });
+}
+function write(lines) {
+  for (const line of lines) {
+    process.stdout.write(`${line}
+`);
+  }
+}
+function reportError(error) {
+  if (error instanceof PenvError3) {
+    process.stderr.write(`${error.message}
+`);
+  } else if (error instanceof Error) {
+    process.stderr.write(`${error.stack ?? error.message}
+`);
+  } else {
+    process.stderr.write(`${String(error)}
+`);
+  }
+  process.exitCode = 1;
+}
+async function guard(run) {
+  try {
+    await run();
+  } catch (error) {
+    reportError(error);
+  }
+}
+
+// src/commands/push.ts
+import { checkNameCollisions, PenvError as PenvError4, requireValue, variableName as variableName2 } from "@penvhq/core";
+import { checkGithubNames, createGithubSink } from "@penvhq/sink-github";
+import { defineCommand } from "citty";
+var LAST_PUSHED_KEY = "lastPushedAt";
+function sinkFor(project, environment, override) {
+  const declared = project.config.sinks?.[environment];
+  if (declared === void 0) {
+    throw new PenvError4(
+      "NO_SINK",
+      `Environment ${environment} declares no sink in penv.config.ts, so penv has nowhere to push`,
+      `Add a \`sinks\` entry, e.g. \`sinks: { ${environment}: { type: "github" } }\`, then run \`penv push --env ${environment}\` again.`
+    );
+  }
+  const repo = declared.repo;
+  if (override !== void 0) {
+    return { sink: override, repo };
+  }
+  if (declared.type === "github") {
+    return { sink: createGithubSink(repo === void 0 ? {} : { repo }), repo };
+  }
+  throw new PenvError4(
+    "UNKNOWN_SINK",
+    `Environment ${environment} declares sink type \`${declared.type}\`, which penv does not know`,
+    'The only sink in this release is `github`. Set `type: "github"`.'
+  );
+}
+function plan(resolutions, config, environment, allowDecrypt) {
+  const outbound = [];
+  for (const resolution of resolutions) {
+    const winner = resolution.winner;
+    if (winner === void 0) {
+      continue;
+    }
+    let encrypted = false;
+    if (winner.file.encrypted) {
+      if (!allowDecrypt) {
+        throw new PenvError4(
+          "ENCRYPTED_VALUE_REFUSED",
+          `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and a push sends plaintext for GitHub to re-seal`,
+          "Re-run with `--allow-decrypt` to decrypt it locally and push it, or push an environment whose values are plaintext. penv's encryption stops at the sink; the destination seals it under its own key."
+        );
+      }
+      requireValue(resolution, environment);
+      encrypted = true;
+    }
+    if (resolution.value === void 0) {
+      continue;
+    }
+    const scope = winner.file.scope.kind === "unscoped" ? { kind: "repository" } : { kind: "environment", environment };
+    outbound.push({
+      ref: resolution.ref,
+      variable: variableName2(resolution.ref, config),
+      value: resolution.value,
+      scope,
+      encrypted
+    });
+  }
+  return outbound;
+}
+function withLastPushed(meta, environment, iso) {
+  const base = meta ?? {};
+  const environments = { ...base.environments ?? {} };
+  environments[environment] = { ...environments[environment] ?? {}, [LAST_PUSHED_KEY]: iso };
+  return { ...base, environments };
+}
+function recordPush(tree, ref, environment, iso) {
+  const meta = withLastPushed(tree.readMetaSync(ref), environment, iso);
+  tree.writeMetaSync(ref, meta);
+}
+async function runPush(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const { sink, repo } = sinkFor(project, environment, options.sink);
+  const tree = localTree(project);
+  const keys = keySourceFor(project, environment);
+  const resolutions = resolveAllSync(tree, environment, keys, true);
+  const refs = refsFrom(resolutions.map((resolution) => resolution.ref));
+  const collision = checkNameCollisions(refs, project.config)[0];
+  if (collision !== void 0) {
+    throw collision;
+  }
+  const nameError = checkGithubNames(refs, project.config)[0];
+  if (nameError !== void 0) {
+    throw nameError;
+  }
+  const outbound = plan(resolutions, project.config, environment, options.allowDecrypt === true);
+  await sink.verify();
+  let repositorySecrets = 0;
+  let environmentSecrets = 0;
+  for (const item of outbound) {
+    await sink.push(item.variable, item.value, item.scope);
+    if (item.scope.kind === "repository") {
+      repositorySecrets += 1;
+    } else {
+      environmentSecrets += 1;
+    }
+    recordPush(tree, item.ref, environment, options.now ?? (/* @__PURE__ */ new Date()).toISOString());
+  }
+  return {
+    environment,
+    repo,
+    pushed: outbound.length,
+    repositorySecrets,
+    environmentSecrets,
+    decrypted: outbound.filter((item) => item.encrypted).length
+  };
+}
+function renderPush(result) {
+  if (result.pushed === 0) {
+    return formatRows([
+      {
+        glyph: CHECK,
+        label: "Nothing to push",
+        subject: `no values resolve for environment ${result.environment}`
+      }
+    ]);
+  }
+  const target = `GitHub Actions for environment ${result.environment}${result.repo === void 0 ? "" : ` (${result.repo})`}`;
+  const rows = [
+    {
+      glyph: CHECK,
+      label: "Pushed",
+      subject: `${result.pushed} ${result.pushed === 1 ? "secret" : "secrets"}`,
+      detail: `to ${target}`
+    },
+    {
+      glyph: CHECK,
+      label: "Scopes",
+      subject: `${result.environmentSecrets} environment, ${result.repositorySecrets} repository`,
+      detail: "environment secrets override repository secrets, as penv's env scope overrides the default"
+    }
+  ];
+  if (result.decrypted > 0) {
+    rows.push({
+      glyph: WARN,
+      label: "Decrypted",
+      subject: `${result.decrypted} ${result.decrypted === 1 ? "secret" : "secrets"}`,
+      detail: "sent as plaintext for GitHub to re-seal under its own key"
+    });
+  }
+  return formatRows(rows);
+}
+var pushCommand = defineCommand({
+  meta: {
+    name: "push",
+    description: "Push an environment's resolved values to its sink (GitHub Actions Secrets)"
+  },
+  args: {
+    env: { type: "string", description: "The environment to push" },
+    "allow-decrypt": {
+      type: "boolean",
+      description: "Decrypt sealed values locally and push them as plaintext for GitHub to re-seal"
+    }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const result = await runPush({
+        cwd: process.cwd(),
+        ...args.env === void 0 ? {} : { environment: args.env },
+        ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] }
+      });
+      write(renderPush(result));
+    });
+  }
+});
+
+// src/commands/validate.ts
+import { resolve as resolvePath } from "path";
+import { pathToFileURL } from "url";
+import {
+  accessPath as accessPath2,
+  checkNameCollisions as checkNameCollisions2,
+  NameCollisionError,
+  PenvError as PenvError5,
+  ReservedTokenError as ReservedTokenError2,
+  resolveAll,
+  schemaFileOf,
+  validateConfig
+} from "@penvhq/core";
+import { defineCommand as defineCommand2 } from "citty";
+import { createJiti } from "jiti";
+var SCHEMA_EXPORT = "schema";
+var LABELS = {
+  config: "Config",
+  reserved: "Reserved token",
+  collision: "Name collision",
+  schema: "Invalid parameter",
+  undecryptable: "Undecryptable value"
+};
+function firstLine(text) {
+  return text.split("\n")[0] ?? text;
+}
+function issueFrom(error, fallbackSubject) {
+  const base = {
+    message: firstLine(error.message),
+    ...error.remedy === void 0 ? {} : { remedy: error.remedy }
+  };
+  if (error instanceof ReservedTokenError2) {
+    return { kind: "reserved", subject: error.token, ...base };
+  }
+  if (error instanceof NameCollisionError) {
+    return { kind: "collision", subject: error.variable, ...base };
+  }
+  return { kind: "config", subject: fallbackSubject, ...base };
+}
+function place(root, path, value) {
+  const leaf = path[path.length - 1];
+  if (leaf === void 0) {
+    return;
+  }
+  let node = root;
+  for (const key of path.slice(0, -1)) {
+    const existing = node[key];
+    if (typeof existing === "object" && existing !== null) {
+      node = existing;
+      continue;
+    }
+    const child = {};
+    node[key] = child;
+    node = child;
+  }
+  node[leaf] = value;
+}
+function isZodType(value) {
+  return typeof value === "object" && value !== null && "safeParse" in value && typeof value.safeParse === "function";
+}
+function validationIssuesOf(cause, schemaPath) {
+  if (typeof cause !== "object" || cause === null) {
+    return void 0;
+  }
+  const error = cause;
+  if (error.code !== "VALIDATION_FAILED" || !Array.isArray(error.issues)) {
+    return void 0;
+  }
+  return error.issues.map((issue) => {
+    const { parameter, message } = issue;
+    return {
+      kind: "schema",
+      subject: typeof parameter === "string" && parameter !== "" ? parameter : schemaPath,
+      message: typeof message === "string" ? message : String(issue),
+      remedy: `Fix the value, or adjust the schema in ${schemaPath} if the shape is wrong.`
+    };
+  });
+}
+var schemaLoads = Promise.resolve();
+function exclusively(work) {
+  const result = schemaLoads.then(work, work);
+  schemaLoads = result.then(
+    () => void 0,
+    () => void 0
+  );
+  return result;
+}
+function loadSchema(project, environment) {
+  const schemaPath = schemaFileOf(project.config);
+  const file = pathToFileURL(resolvePath(project.root, schemaPath)).href;
+  return exclusively(() => loadSchemaExclusively(file, schemaPath, environment));
+}
+async function loadSchemaExclusively(file, schemaPath, environment) {
+  const jiti = createJiti(file, { interopDefault: false, moduleCache: false });
+  const previous = process.env.PENV_ENV;
+  process.env.PENV_ENV = environment;
+  let loaded;
+  try {
+    loaded = await jiti.import(file);
+  } catch (cause) {
+    const issues = validationIssuesOf(cause, schemaPath);
+    if (issues !== void 0) {
+      return { issues };
+    }
+    const detail = cause instanceof Error ? firstLine(cause.message) : String(cause);
+    return {
+      issues: [
+        {
+          kind: "config",
+          subject: schemaPath,
+          message: `${schemaPath} could not be loaded: ${detail}`,
+          remedy: `Fix the error above. penv reads the \`${SCHEMA_EXPORT}\` export of ${schemaPath}, which is yours to edit.`
+        }
+      ]
+    };
+  } finally {
+    if (previous === void 0) {
+      delete process.env.PENV_ENV;
+    } else {
+      process.env.PENV_ENV = previous;
+    }
+  }
+  const exported = typeof loaded === "object" && loaded !== null ? loaded[SCHEMA_EXPORT] : void 0;
+  if (!isZodType(exported)) {
+    return {
+      issues: [
+        {
+          kind: "config",
+          subject: schemaPath,
+          message: `${schemaPath} exports no \`${SCHEMA_EXPORT}\``,
+          remedy: `Export the shape as \`export const ${SCHEMA_EXPORT} = z.object({ ... })\`. One schema drives both validation and types.`
+        }
+      ]
+    };
+  }
+  return { schema: exported, issues: [] };
+}
+async function runValidate(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const schemaPath = schemaFileOf(project.config);
+  const issues = [];
+  let files;
+  try {
+    files = await project.provider.list();
+  } catch (error) {
+    if (!(error instanceof PenvError5)) {
+      throw error;
+    }
+    return {
+      ok: false,
+      environment,
+      parameters: 0,
+      issues: [issueFrom(error, schemaPath)],
+      drift: EMPTY_DRIFT
+    };
+  }
+  const refs = refsFrom(files);
+  for (const error of validateConfig(project.config)) {
+    issues.push(issueFrom(error, "penv.config.ts"));
+  }
+  for (const collision of checkNameCollisions2(refs, project.config)) {
+    issues.push(issueFrom(collision, collision.variable));
+  }
+  const { schema, issues: schemaIssues } = await loadSchema(project, environment);
+  issues.push(...schemaIssues);
+  let drift = EMPTY_DRIFT;
+  if (schema !== void 0) {
+    const resolutions = await resolveAll(
+      environment,
+      project.provider,
+      keySourceFor(project, environment)
+    );
+    const object = {};
+    const undecryptable = /* @__PURE__ */ new Set();
+    for (const resolution of resolutions) {
+      if (resolution.undecryptable !== void 0) {
+        undecryptable.add(accessPath2(resolution.ref).join("."));
+        issues.push({
+          kind: "undecryptable",
+          subject: resolution.parameter,
+          message: `${resolution.winner?.location ?? "the winning value file"} could not be decrypted: ${resolution.undecryptable.detail}`,
+          remedy: "Make the key available, or re-seal the value under a key you hold with `penv encrypt`. The value is there \u2014 penv cannot read it."
+        });
+        continue;
+      }
+      if (resolution.value !== void 0) {
+        place(object, accessPath2(resolution.ref), resolution.value);
+      }
+    }
+    drift = computeDrift({ schema, resolutions, config: project.config, environment });
+    const result = schema.safeParse(object);
+    if (!result.success) {
+      for (const problem of result.error.issues) {
+        const path = problem.path.join(".");
+        if (undecryptable.has(path)) {
+          continue;
+        }
+        issues.push({
+          kind: "schema",
+          subject: path || schemaPath,
+          message: problem.message,
+          remedy: `Fix the value, or adjust the schema in ${schemaPath} if the shape is wrong.`
+        });
+      }
+    }
+  }
+  return { ok: issues.length === 0, environment, parameters: refs.length, issues, drift };
+}
+function renderValidate(result) {
+  if (result.ok) {
+    return formatRows([
+      {
+        glyph: CHECK,
+        label: "Schema valid",
+        subject: `${result.parameters} parameters for environment ${result.environment}`
+      }
+    ]);
+  }
+  const rows = result.issues.map((issue) => ({
+    glyph: WARN,
+    label: LABELS[issue.kind],
+    subject: issue.subject,
+    detail: issue.message
+  }));
+  const lines = formatRows(rows);
+  const remedies = [...new Set(result.issues.map((issue) => issue.remedy))];
+  for (const remedy of remedies) {
+    if (remedy !== void 0) {
+      lines.push(`  ${remedy}`);
+    }
+  }
+  return lines;
+}
+var validateCommand = defineCommand2({
+  meta: {
+    name: "validate",
+    description: "Validate configuration against the schema; non-zero on failure"
+  },
+  args: {
+    env: { type: "string", description: "The environment to validate" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const result = await runValidate({
+        cwd: process.cwd(),
+        ...args.env === void 0 ? {} : { environment: args.env }
+      });
+      write(renderValidate(result));
+      if (!result.ok) {
+        process.exitCode = 1;
+      }
+    });
+  }
+});
+
+// src/commands/doctor.ts
+function skipped(check, label) {
+  return {
+    check,
+    severity: "unknown",
+    label,
+    subject: "not checked",
+    detail: "the schema did not load, so this check could not run"
+  };
+}
+async function runDoctor(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const findings = [];
+  const { schema, issues } = await loadSchema(project, environment);
+  if (schema !== void 0) {
+    findings.push({ check: "schema", severity: "pass", label: "Schema valid" });
+  } else {
+    for (const issue of issues) {
+      findings.push({
+        check: "schema",
+        severity: "failure",
+        label: "Schema",
+        subject: issue.subject,
+        detail: issue.message
+      });
+    }
+  }
+  const resolutions = await resolveAll2(
+    environment,
+    project.provider,
+    keySourceFor(project, environment)
+  );
+  const subjects = await Promise.all(
+    resolutions.map(async (resolution) => ({
+      resolution,
+      meta: await project.provider.readMeta(resolution.ref)
+    }))
+  );
+  const missing = missingFindings(subjects, environment);
+  findings.push(...missing);
+  if (schema === void 0) {
+    findings.push(
+      skipped("declared", "Schema coverage"),
+      skipped("weak", "Secret strength"),
+      skipped("unused", "Value coverage")
+    );
+  } else {
+    const drift = computeDrift({
+      schema,
+      resolutions: subjects.map(({ resolution }) => resolution),
+      config: project.config,
+      environment
+    });
+    findings.push(...declaredFindings(drift, missing, environment));
+    findings.push(...weakFindings(subjects, schema));
+    findings.push(...unusedFindings(drift));
+  }
+  findings.push(...fallbackFindings(subjects, environment));
+  findings.push(...plaintextSecretFindings(subjects, environment));
+  findings.push(...publicSecretFindings(subjects, environment, project.config));
+  findings.push(...encryptionFindings(subjects, environment));
+  findings.push(...await sinkFindings(project, environment, options.sink));
+  findings.push({
+    check: "provider",
+    severity: "pass",
+    label: "Provider",
+    subject: project.config.providers[environment]?.type ?? project.provider.type
+  });
+  return {
+    environment,
+    findings,
+    ok: !findings.some((finding) => finding.severity === "failure")
+  };
+}
+function missingFindings(subjects, environment) {
+  const required = subjects.filter(({ meta }) => isRequired(meta, environment));
+  const findings = required.filter(({ resolution }) => resolution.winner === void 0).map(({ resolution }) => ({
+    check: "missing",
+    severity: "failure",
+    label: "Missing parameter",
+    subject: resolution.parameter,
+    detail: `required for ${environment}, absent`,
+    remedy: `penv set ${[...resolution.ref.namespace, resolution.ref.name].join("/")} --env ${environment}`
+  }));
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "missing",
+      severity: "pass",
+      label: "Required parameters",
+      subject: required.length === 0 ? `none required for ${environment}` : `${required.length} required for ${environment}, all present`
+    }
+  ];
+}
+function declaredFindings(drift, missing, environment) {
+  const reported = new Set(missing.filter((f) => f.severity !== "pass").map((f) => f.subject));
+  const findings = drift.declared.filter((item) => !reported.has(item.subject)).map((item) => ({
+    check: "declared",
+    severity: "warning",
+    label: "Declared, no value",
+    subject: item.subject,
+    detail: item.detail,
+    remedy: item.remedy
+  }));
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "declared",
+      severity: "pass",
+      label: "Schema coverage",
+      subject: `every parameter .penv/env.ts requires has a value for ${environment}`
+    }
+  ];
+}
+function weakFindings(subjects, schema) {
+  const findings = [];
+  let checked = 0;
+  for (const { resolution } of subjects) {
+    const value = resolution.value;
+    if (value === void 0) {
+      continue;
+    }
+    const field = lookup(schema, accessPath3(resolution.ref));
+    if (field.kind !== "found") {
+      continue;
+    }
+    const minimum = minLengthOf(field.node);
+    if (minimum === void 0) {
+      continue;
+    }
+    checked += 1;
+    if (value.length >= minimum) {
+      continue;
+    }
+    findings.push({
+      check: "weak",
+      severity: "failure",
+      label: "Weak secret",
+      subject: resolution.parameter,
+      detail: `${value.length} chars, schema requires \u2265${minimum}`
+    });
+  }
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "weak",
+      severity: "pass",
+      label: "Secret strength",
+      subject: checked === 0 ? "no schema field declares a minimum length" : checked === 1 ? "1 value meets the schema minimum" : `${checked} values meet the schema minimum`
+    }
+  ];
+}
+function unusedFindings(drift) {
+  const findings = drift.undeclared.map((item) => ({
+    check: "unused",
+    severity: "warning",
+    label: "Unused parameter",
+    subject: item.variable,
+    detail: "present, not in schema"
+  }));
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "unused",
+      severity: "pass",
+      label: "Value coverage",
+      subject: "every value file has a schema key"
+    }
+  ];
+}
+function fallbackFindings(subjects, environment) {
+  const findings = subjects.filter(({ resolution }) => resolution.viaUnscopedFallback).map(({ resolution }) => ({
+    check: "unscoped-fallback",
+    severity: "warning",
+    label: "Unscoped fallback in use",
+    subject: resolution.parameter,
+    detail: `${environment} resolving to default`
+  }));
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "unscoped-fallback",
+      severity: "pass",
+      label: "Scoped resolution",
+      subject: `no parameter falls back to the unscoped default for ${environment}`
+    }
+  ];
+}
+function plaintextSecretFindings(subjects, environment) {
+  const secrets = subjects.filter(({ meta }) => isSecret(meta, environment));
+  const findings = [];
+  for (const { resolution } of secrets) {
+    const winner = resolution.winner;
+    if (winner === void 0 || winner.file.encrypted) {
+      continue;
+    }
+    findings.push({
+      check: "plaintext-secret",
+      severity: "failure",
+      label: "Plaintext secret",
+      subject: winner.location,
+      detail: "value file is not encrypted"
+    });
+  }
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "plaintext-secret",
+      severity: "pass",
+      label: "Encryption policy",
+      subject: secrets.length === 0 ? `no parameter is declared secret for ${environment}` : `every secret resolving for ${environment} is encrypted`
+    }
+  ];
+}
+function publicSecretFindings(subjects, environment, config) {
+  const prefixes = config.publicPrefixes ?? [];
+  if (prefixes.length === 0) {
+    return [
+      {
+        check: "public-secret",
+        severity: "unknown",
+        label: "Browser exposure",
+        subject: "not checked \u2014 penv.config.ts declares no `publicPrefixes`",
+        detail: "penv cannot tell which variables a framework inlines into the browser"
+      }
+    ];
+  }
+  const secrets = subjects.filter(({ meta }) => isSecret(meta, environment));
+  const findings = [];
+  for (const { resolution } of secrets) {
+    const variable = variableName3(resolution.ref, config);
+    if (!isPublicVariable(variable, config)) {
+      continue;
+    }
+    const prefix = prefixes.find((candidate) => variable.startsWith(candidate));
+    findings.push({
+      check: "public-secret",
+      severity: "failure",
+      label: "Secret exposed to the browser",
+      subject: variable,
+      detail: prefix === void 0 ? "meta declares this a secret, and its public prefix makes it public" : `meta declares this a secret, and the \`${prefix}\` prefix makes it public`,
+      remedy: "rename the parameter so it carries no public prefix, or drop `secret` from its meta if it is not one"
+    });
+  }
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "public-secret",
+      severity: "pass",
+      label: "Browser exposure",
+      subject: `no secret is exposed to the browser for ${environment}`
+    }
+  ];
+}
+function encryptionFindings(subjects, environment) {
+  const sealed = subjects.filter(({ resolution }) => resolution.winner?.file.encrypted === true);
+  const findings = [];
+  for (const { resolution } of sealed) {
+    const failure = resolution.undecryptable;
+    if (failure === void 0) {
+      continue;
+    }
+    findings.push({
+      check: "encryption",
+      severity: "failure",
+      label: "Undecryptable value",
+      subject: resolution.winner?.location ?? resolution.parameter,
+      detail: failure.detail
+    });
+  }
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "encryption",
+      severity: "pass",
+      label: "Encryption",
+      subject: sealed.length === 0 ? `no encrypted value resolves for ${environment}` : `every encrypted value resolving for ${environment} decrypts`
+    }
+  ];
+}
+var EDIT_SKEW_MS = 12e4;
+function buildSink(declared, override) {
+  if (override !== void 0) {
+    return override;
+  }
+  if (declared.type === "github") {
+    return createGithubSink2(declared.repo === void 0 ? {} : { repo: declared.repo });
+  }
+  return void 0;
+}
+function errorDetail(error) {
+  if (error instanceof Error) {
+    return error.message.split("\n")[0] ?? error.message;
+  }
+  return String(error);
+}
+function scopeLabel(scope) {
+  return scope.kind === "repository" ? "repository secrets" : `environment secrets for ${scope.environment}`;
+}
+async function sinkFindings(project, environment, override) {
+  const declared = project.config.sinks?.[environment];
+  if (declared === void 0) {
+    return [];
+  }
+  const sink = buildSink(declared, override);
+  if (sink === void 0) {
+    return [
+      {
+        check: "sink-unreachable",
+        severity: "unknown",
+        label: "Sink",
+        subject: `sink type \`${declared.type}\` is not one penv knows`,
+        detail: "penv cannot check a sink it cannot build"
+      }
+    ];
+  }
+  try {
+    await sink.verify();
+  } catch (error) {
+    return [
+      {
+        check: "sink-unreachable",
+        severity: "unknown",
+        label: "Sink",
+        subject: `could not reach the ${declared.type} sink for ${environment}`,
+        detail: errorDetail(error)
+      }
+    ];
+  }
+  let repoSecrets;
+  let envSecrets;
+  try {
+    repoSecrets = await sink.list({ kind: "repository" });
+    envSecrets = await sink.list({ kind: "environment", environment });
+  } catch (error) {
+    return [
+      {
+        check: "sink-unreachable",
+        severity: "unknown",
+        label: "Sink",
+        subject: `could not list secrets in the ${declared.type} sink for ${environment}`,
+        detail: errorDetail(error)
+      }
+    ];
+  }
+  const resolutions = await resolveAll2(
+    environment,
+    project.provider,
+    keySourceFor(project, environment),
+    true
+  );
+  const expected = [];
+  for (const resolution of resolutions) {
+    const winner = resolution.winner;
+    if (winner === void 0) {
+      continue;
+    }
+    expected.push({
+      ref: resolution.ref,
+      variable: variableName3(resolution.ref, project.config),
+      scope: winner.file.scope.kind === "unscoped" ? { kind: "repository" } : { kind: "environment", environment }
+    });
+  }
+  const upper = (name) => name.toUpperCase();
+  const repoByName = new Map(repoSecrets.map((secret) => [upper(secret.name), secret]));
+  const envByName = new Map(envSecrets.map((secret) => [upper(secret.name), secret]));
+  const destOf = (scope) => scope.kind === "repository" ? repoByName : envByName;
+  const nameDrift = [];
+  const expectedEnv = /* @__PURE__ */ new Set();
+  const allVariables = /* @__PURE__ */ new Set();
+  for (const item of expected) {
+    const key = upper(item.variable);
+    allVariables.add(key);
+    if (item.scope.kind === "environment") {
+      expectedEnv.add(key);
+    }
+    if (!destOf(item.scope).has(key)) {
+      nameDrift.push({
+        check: "sink-name-drift",
+        severity: "warning",
+        label: "Declared, not pushed",
+        subject: item.variable,
+        detail: `resolves for ${environment} but is absent from the ${scopeLabel(item.scope)}`,
+        remedy: `penv push --env ${environment}`
+      });
+    }
+  }
+  for (const secret of repoSecrets) {
+    if (!allVariables.has(upper(secret.name))) {
+      nameDrift.push({
+        check: "sink-name-drift",
+        severity: "warning",
+        label: "In destination, not declared",
+        subject: secret.name,
+        detail: `a repository secret with no parameter penv pushes for ${environment}`
+      });
+    }
+  }
+  for (const secret of envSecrets) {
+    if (!expectedEnv.has(upper(secret.name))) {
+      nameDrift.push({
+        check: "sink-name-drift",
+        severity: "warning",
+        label: "In destination, not declared",
+        subject: secret.name,
+        detail: `an environment secret with no parameter resolving for ${environment}`
+      });
+    }
+  }
+  const manualEdits = [];
+  for (const item of expected) {
+    const secret = destOf(item.scope).get(upper(item.variable));
+    if (secret === void 0) {
+      continue;
+    }
+    const pushed = effectiveMeta(await project.provider.readMeta(item.ref), environment)[LAST_PUSHED_KEY];
+    if (typeof pushed !== "string") {
+      continue;
+    }
+    const destTime = Date.parse(secret.updatedAt);
+    const pushTime = Date.parse(pushed);
+    if (Number.isNaN(destTime) || Number.isNaN(pushTime) || destTime <= pushTime + EDIT_SKEW_MS) {
+      continue;
+    }
+    manualEdits.push({
+      check: "sink-manual-edit",
+      severity: "warning",
+      label: "Edited outside penv",
+      subject: item.variable,
+      detail: `changed in the destination at ${secret.updatedAt}, after penv last pushed it`
+    });
+  }
+  const findings = [];
+  findings.push(
+    ...nameDrift.length > 0 ? nameDrift : [
+      {
+        check: "sink-name-drift",
+        severity: "pass",
+        label: "Sink names",
+        subject: `every parameter resolving for ${environment} is present, and nothing undeclared is`
+      }
+    ]
+  );
+  findings.push(
+    ...manualEdits.length > 0 ? manualEdits : [
+      {
+        check: "sink-manual-edit",
+        severity: "pass",
+        label: "Sink hand-edits",
+        subject: `no secret has changed outside penv since its last push for ${environment}`
+      }
+    ]
+  );
+  findings.push({
+    check: "sink-value-drift",
+    severity: "unknown",
+    label: "Sink values",
+    subject: "cannot be read back from a write-only destination",
+    detail: "value drift between the tree and the destination is unknowable by design"
+  });
+  return findings;
+}
+function renderDoctor(report) {
+  const rows = report.findings.map((finding) => ({
+    glyph: finding.severity === "pass" ? CHECK : finding.severity === "unknown" ? UNKNOWN : WARN,
+    label: finding.label,
+    ...finding.subject === void 0 ? {} : { subject: finding.subject },
+    ...finding.detail === void 0 ? {} : { detail: finding.detail }
+  }));
+  const lines = formatRows(rows);
+  const remedies = [
+    ...new Set(
+      report.findings.filter((finding) => finding.severity !== "pass").map((finding) => finding.remedy).filter((remedy) => remedy !== void 0)
+    )
+  ];
+  for (const remedy of remedies) {
+    lines.push(`  ${remedy}`);
+  }
+  return lines;
+}
+var doctorCommand = defineCommand3({
+  meta: {
+    name: "doctor",
+    description: "Report missing, weak, unused, fallback, plaintext-secret, and sink-drift issues"
+  },
+  args: {
+    env: { type: "string", description: "The environment to report on" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const report = await runDoctor({
+        cwd: process.cwd(),
+        ...args.env === void 0 ? {} : { environment: args.env }
+      });
+      write(renderDoctor(report));
+      if (!report.ok) {
+        process.exitCode = 1;
+      }
+    });
+  }
+});
+
+// src/commands/encrypt.ts
+import {
+  formatValueFile as formatValueFile3,
+  isSecret as isSecret3,
+  openValue as openValue2,
+  PenvError as PenvError7,
+  parameterId as parameterId4,
+  sealValue as sealValue2
+} from "@penvhq/core";
+import { defineCommand as defineCommand5 } from "citty";
+
+// src/commands/set.ts
+import { formatValueFile as formatValueFile2, isSecret as isSecret2, PenvError as PenvError6, parameterId as parameterId3, sealValue } from "@penvhq/core";
+import { defineCommand as defineCommand4 } from "citty";
+function scopeFrom(options) {
+  if (options.local === true) {
+    if (options.environment !== void 0) {
+      return { kind: "environment-local", environment: options.environment };
+    }
+    return { kind: "local" };
+  }
+  if (options.environment !== void 0) {
+    return { kind: "environment", environment: options.environment };
+  }
+  return { kind: "unscoped" };
+}
+function targetScope(project, options, key) {
+  const environment = options.environment;
+  if (environment === void 0) {
+    return scopeFrom(options);
+  }
+  if (environment.trim().length === 0) {
+    throw new PenvError6(
+      "ENVIRONMENT_FLAG_EMPTY",
+      `\`--env\` for parameter ${key} names no environment`,
+      `Pass a declared environment \u2014 ${project.config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
+    );
+  }
+  return scopeFrom({ ...options, environment: targetEnvironment(project, environment) });
+}
+function policyEnvironment(project, options) {
+  return options.environment === void 0 ? void 0 : targetEnvironment(project, options.environment);
+}
+function sealFor(project, file, value, parameter, environment) {
+  if (environment === void 0) {
+    throw new PenvError6(
+      "SECRET_SCOPE_AMBIGUOUS",
+      `Parameter ${parameter} is a secret, and ${PENV_DIR}/${formatValueFile2(file)} names no environment`,
+      "Keys are declared per environment in the `keys` block of penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
+    );
+  }
+  return sealValue(file, value, keySourceFor(project, environment), parameter, environment);
+}
+async function runSet(options) {
+  const project = openProject(options.cwd);
+  const ref = refFromKey(options.key, project.config);
+  const scope = targetScope(project, options, options.key);
+  const environment = policyEnvironment(project, options);
+  const secret = isSecret2(await project.provider.readMeta(ref), environment);
+  const file = {
+    namespace: ref.namespace,
+    name: ref.name,
+    scope,
+    encrypted: secret
+  };
+  const stored = secret ? sealFor(project, file, options.value, parameterId3(ref), environment) : options.value;
+  await project.provider.write(file, stored);
+  await project.provider.remove({ ...file, encrypted: !secret });
+  return { parameter: options.key, location: formatValueFile2(file), encrypted: secret };
+}
+function renderSet(result) {
+  return formatRows([
+    {
+      glyph: CHECK,
+      label: "Wrote",
+      subject: `${PENV_DIR}/${result.location}`,
+      // The `.enc` suffix says this already, but only to a reader who knows the
+      // grammar. Meta decided it, not the command line, so the command says so.
+      ...result.encrypted ? { detail: "encrypted, per the parameter's meta policy" } : {}
+    }
+  ]);
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  const text = Buffer.concat(chunks).toString("utf8");
+  return text.endsWith("\n") ? text.slice(0, -1) : text;
+}
+var setCommand = defineCommand4({
+  meta: { name: "set", description: "Update a parameter" },
+  args: {
+    key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
+    value: {
+      type: "positional",
+      required: false,
+      description: "The value; read from stdin if omitted"
+    },
+    env: { type: "string", description: "Write the <name>.<env> scope" },
+    local: {
+      type: "boolean",
+      description: "Write the personal override: <name>.<env>.local with --env, else <name>.local"
+    }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const value = args.value ?? await readStdin();
+      write(
+        renderSet(
+          await runSet({
+            cwd: process.cwd(),
+            key: args.key,
+            value,
+            ...args.env === void 0 ? {} : { environment: args.env },
+            ...args.local === void 0 ? {} : { local: args.local }
+          })
+        )
+      );
+    });
+  }
+});
+
+// src/commands/encrypt.ts
+function twins(project, key, options) {
+  const ref = refFromKey(key, project.config);
+  const scope = targetScope(project, options, key);
+  return [
+    { namespace: ref.namespace, name: ref.name, scope, encrypted: false },
+    { namespace: ref.namespace, name: ref.name, scope, encrypted: true }
+  ];
+}
+function environmentFor(project, options, verb) {
+  if (options.environment === void 0) {
+    throw new PenvError7(
+      "SECRET_SCOPE_AMBIGUOUS",
+      `\`penv ${verb}\` names no environment, and keys are declared per environment`,
+      "Pass `--env <environment>`. penv cannot tell which environment's key applies to a file that names none, and will not pick one for you."
+    );
+  }
+  return targetEnvironment(project, options.environment);
+}
+async function readOne(project, file) {
+  return project.provider.read(file);
+}
+async function runEncrypt(options) {
+  const project = openProject(options.cwd);
+  const environment = environmentFor(project, options, "encrypt");
+  const [plain, sealed] = twins(project, options.key, options);
+  const parameter = parameterId4(plain);
+  const value = await readOne(project, plain);
+  if (value === void 0) {
+    const already = await readOne(project, sealed);
+    throw new PenvError7(
+      "PARAMETER_ABSENT",
+      already === void 0 ? `Parameter ${parameter} has no value file at ${PENV_DIR}/${formatValueFile3(plain)}` : `Parameter ${parameter} is already encrypted at ${PENV_DIR}/${formatValueFile3(sealed)}`,
+      already === void 0 ? `Write it first with \`penv set ${options.key} --env ${environment}\`, which seals it automatically when the parameter's meta declares it a secret.` : "Nothing to do."
+    );
+  }
+  const text = sealValue2(sealed, value, keySourceFor(project, environment), parameter, environment);
+  await project.provider.write(sealed, text);
+  await project.provider.remove(plain);
+  return {
+    parameter,
+    location: formatValueFile3(sealed),
+    removed: formatValueFile3(plain)
+  };
+}
+async function runDecrypt(options) {
+  const project = openProject(options.cwd);
+  const environment = environmentFor(project, options, "decrypt");
+  const [plain, sealed] = twins(project, options.key, options);
+  const parameter = parameterId4(plain);
+  if (isSecret3(await project.provider.readMeta(plain), environment)) {
+    throw new PenvError7(
+      "SECRET_DECRYPT_REFUSED",
+      `Parameter ${parameter} is declared a secret for environment ${environment}, so penv will not write it in plaintext`,
+      "A secret with a plaintext value file is a `penv doctor` failure. Drop `secret` from the parameter's meta if it is not one, or run `penv generate --allow-decrypt` if you need the plaintext value in a `.env` artifact."
+    );
+  }
+  const stored = await readOne(project, sealed);
+  if (stored === void 0) {
+    throw new PenvError7(
+      "PARAMETER_ABSENT",
+      `Parameter ${parameter} has no encrypted value file at ${PENV_DIR}/${formatValueFile3(sealed)}`,
+      `Nothing to decrypt. \`penv get ${options.key} --env ${environment} --explain\` shows every file penv looked at.`
+    );
+  }
+  const opened = openValue2(sealed, stored, keySourceFor(project, environment));
+  if (opened.kind === "failed") {
+    throw new UndecryptableAt(
+      parameter,
+      environment,
+      formatValueFile3(sealed),
+      opened.failure.detail
+    );
+  }
+  await project.provider.write(plain, opened.value);
+  await project.provider.remove(sealed);
+  return {
+    parameter,
+    location: formatValueFile3(plain),
+    removed: formatValueFile3(sealed)
+  };
+}
+var UndecryptableAt = class extends PenvError7 {
+  constructor(parameter, environment, location, detail) {
+    super(
+      "VALUE_UNDECRYPTABLE",
+      `Parameter ${parameter} for environment ${environment} is sealed at ${PENV_DIR}/${location}, and penv could not open it: ${detail}`,
+      "Make the key available and run the command again. penv will not replace a value it cannot read."
+    );
+  }
+};
+function renderReseal(result, verb) {
+  return formatRows([
+    {
+      glyph: CHECK,
+      label: verb,
+      subject: `${PENV_DIR}/${result.location}`,
+      detail: `${PENV_DIR}/${result.removed} removed`
+    }
+  ]);
+}
+var SCOPE_ARGS = {
+  key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
+  env: { type: "string", description: "The environment whose value file to act on" },
+  local: {
+    type: "boolean",
+    description: "Act on the personal override rather than the shared file"
+  }
+};
+function scopeOptions(args) {
+  return {
+    ...args.env === void 0 ? {} : { environment: args.env },
+    ...args.local === void 0 ? {} : { local: args.local }
+  };
+}
+var encryptCommand = defineCommand5({
+  meta: { name: "encrypt", description: "Encrypt one parameter's value file at one scope" },
+  args: SCOPE_ARGS,
+  run({ args }) {
+    return guard(async () => {
+      const result = await runEncrypt({ cwd: process.cwd(), key: args.key, ...scopeOptions(args) });
+      write(renderReseal(result, "Encrypted"));
+    });
+  }
+});
+var decryptCommand = defineCommand5({
+  meta: { name: "decrypt", description: "Decrypt one parameter's value file at one scope" },
+  args: SCOPE_ARGS,
+  run({ args }) {
+    return guard(async () => {
+      const result = await runDecrypt({ cwd: process.cwd(), key: args.key, ...scopeOptions(args) });
+      write(renderReseal(result, "Decrypted"));
+    });
+  }
+});
+
+// src/commands/generate.ts
+import { writeFileSync } from "fs";
+import { isAbsolute, relative, resolve as resolve2 } from "path";
+import {
+  checkNameCollisions as checkNameCollisions3,
+  effectiveMeta as effectiveMeta2,
+  PenvError as PenvError8,
+  requireValue as requireValue2,
+  serializeDotenv,
+  variableName as variableName4
+} from "@penvhq/core";
+import { defineCommand as defineCommand6 } from "citty";
+var DEFAULT_OUTPUT = ".env";
+function entriesFor(project, environment, allowDecrypt) {
+  const keys = keySourceFor(project, environment);
+  const tree = localTree(project);
+  const resolutions = resolveAllSync(tree, environment, keys);
+  const collision = checkNameCollisions3(
+    refsFrom(resolutions.map((resolution) => resolution.ref)),
+    project.config
+  )[0];
+  if (collision !== void 0) {
+    throw collision;
+  }
+  const entries = [];
+  let decrypted = 0;
+  for (const resolution of resolutions) {
+    const winner = resolution.winner;
+    if (winner?.file.encrypted === true) {
+      if (!allowDecrypt) {
+        throw new PenvError8(
+          "ENCRYPTED_VALUE_REFUSED",
+          `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and \`penv generate\` writes plaintext`,
+          `Re-run with \`--allow-decrypt\` to write the decrypted value into the artifact, or generate for an environment whose values are plaintext. The artifact is gitignored; a committed plaintext secret is a \`penv doctor\` failure.`
+        );
+      }
+      requireValue2(resolution, environment);
+      decrypted += 1;
+    }
+    if (resolution.value === void 0) {
+      continue;
+    }
+    const description = effectiveMeta2(tree.readMetaSync(resolution.ref), environment).description;
+    entries.push({
+      key: variableName4(resolution.ref, project.config),
+      value: resolution.value,
+      ...typeof description === "string" ? { description } : {}
+    });
+  }
+  entries.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+  return { entries, decrypted };
+}
+function generateDotenv(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  return serializeDotenv(entriesFor(project, environment, options.allowDecrypt === true).entries);
+}
+function runGenerate(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const { entries, decrypted } = entriesFor(project, environment, options.allowDecrypt === true);
+  const file = options.out === void 0 ? resolve2(project.root, DEFAULT_OUTPUT) : isAbsolute(options.out) ? options.out : resolve2(options.cwd, options.out);
+  writeFileSync(file, serializeDotenv(entries), "utf8");
+  return { file, environment, entries: entries.length, decrypted };
+}
+function displayPath(cwd, file) {
+  const rel = relative(cwd, file);
+  return rel === "" || rel.startsWith("..") ? file : rel.split("\\").join("/");
+}
+function renderGenerate(result, cwd) {
+  const rows = [
+    {
+      glyph: CHECK,
+      label: "Generated",
+      subject: displayPath(cwd, result.file),
+      detail: `${result.entries} variables for environment ${result.environment}`
+    }
+  ];
+  if (result.decrypted > 0) {
+    rows.push({
+      glyph: WARN,
+      label: "Decrypted",
+      subject: `${result.decrypted} ${result.decrypted === 1 ? "secret" : "secrets"}`,
+      detail: "written as plaintext into the artifact"
+    });
+  }
+  return formatRows(rows);
+}
+var generateCommand = defineCommand6({
+  meta: { name: "generate", description: "Write a standard .env artifact for deploy targets" },
+  args: {
+    env: { type: "string", description: "The environment to generate for" },
+    out: { type: "string", description: "Where to write, instead of .env" },
+    "allow-decrypt": {
+      type: "boolean",
+      description: "Write encrypted values into the artifact as plaintext"
+    }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const cwd = process.cwd();
+      const result = runGenerate({
+        cwd,
+        ...args.env === void 0 ? {} : { environment: args.env },
+        ...args.out === void 0 ? {} : { out: args.out },
+        ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] }
+      });
+      write(renderGenerate(result, cwd));
+    });
+  }
+});
+
+// src/commands/get.ts
+import { PenvError as PenvError9, requireValue as requireValue3, resolveParameter } from "@penvhq/core";
+import { defineCommand as defineCommand7 } from "citty";
+async function runGet(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const ref = refFromKey(options.key);
+  const keys = keySourceFor(project, environment);
+  const resolution = await resolveParameter(ref, environment, project.provider, keys);
+  const value = requireValue3(resolution, environment);
+  if (value === void 0) {
+    throw new PenvError9(
+      "PARAMETER_ABSENT",
+      `Parameter ${resolution.parameter} resolves to no value for environment ${environment}`,
+      `Set it with \`penv set ${options.key} --env ${environment}\`, or run \`penv get ${options.key} --env ${environment} --explain\` to see every file penv looked at.`
+    );
+  }
+  return value;
+}
+function skipReason(reason) {
+  if (reason === "lower-precedence") {
+    return "skipped, a higher-precedence file wins";
+  }
+  if (reason === "local-skipped-in-test") {
+    return "skipped, .local never applies in test";
+  }
+  return void 0;
+}
+async function runExplain(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const ref = refFromKey(options.key);
+  const keys = keySourceFor(project, environment);
+  const resolution = await resolveParameter(ref, environment, project.provider, keys);
+  const winner = resolution.winner;
+  return {
+    parameter: resolution.parameter,
+    environment,
+    location: winner === void 0 ? void 0 : winner.location,
+    ...resolution.undecryptable === void 0 ? {} : { undecryptable: resolution.undecryptable.detail },
+    candidates: resolution.candidates.map((candidate) => ({
+      location: candidate.location,
+      present: candidate.present,
+      wins: candidate === winner,
+      skipped: skipReason(candidate.skippedReason)
+    }))
+  };
+}
+function renderExplain(explanation) {
+  const target = explanation.location === void 0 ? "nothing" : `${PENV_DIR}/${explanation.location}`;
+  const rows = explanation.candidates.map((candidate) => [
+    candidate.location,
+    candidate.wins ? "present, wins" : candidate.present ? candidate.skipped ?? "present" : candidate.skipped ?? "absent"
+  ]);
+  return [
+    `${explanation.parameter} resolves to ${target} for environment ${explanation.environment}`,
+    ...explanation.undecryptable === void 0 ? [] : [`  penv cannot decrypt it: ${explanation.undecryptable}`],
+    "",
+    ...columns(rows).map((line) => `  ${line}`)
+  ];
+}
+var getCommand = defineCommand7({
+  meta: { name: "get", description: "Read a parameter" },
+  args: {
+    key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
+    env: { type: "string", description: "The environment to read" },
+    explain: { type: "boolean", description: "Print which file wins, and why" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const options = {
+        cwd: process.cwd(),
+        key: args.key,
+        ...args.env === void 0 ? {} : { environment: args.env }
+      };
+      if (args.explain === true) {
+        write(renderExplain(await runExplain(options)));
+        return;
+      }
+      write([await runGet(options)]);
+    });
+  }
+});
+
+// src/commands/import.ts
+import { copyFileSync, existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { basename, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve4 } from "path";
+import {
+  accessPath as accessPath4,
+  assertNever,
+  checkNameCollisions as checkNameCollisions4,
+  FilenameGrammarError,
+  findConfigFile,
+  isReservedToken as isReservedToken3,
+  loadConfigFrom as loadConfigFrom2,
+  lookupEnvironment,
+  PenvError as PenvError11,
+  parseDotenv,
+  ReservedTokenError as ReservedTokenError3,
+  refFromVariable,
+  roundTripsCleanly,
+  schemaFileOf as schemaFileOf3,
+  UnknownEnvironmentError,
+  variableName as variableName5
+} from "@penvhq/core";
+import { defineCommand as defineCommand9 } from "citty";
+
+// src/detect.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { DEFAULT_SCHEMA_FILE } from "@penvhq/core";
+var SIGNATURES = [
+  { name: "Next.js", packages: ["next"], publicPrefixes: ["NEXT_PUBLIC_"] },
+  {
+    name: "TanStack Start",
+    packages: ["@tanstack/react-start", "@tanstack/start"],
+    publicPrefixes: ["VITE_"]
+  },
+  { name: "Astro", packages: ["astro"], publicPrefixes: ["PUBLIC_"] },
+  { name: "Vite", packages: ["vite"], publicPrefixes: ["VITE_"] }
+];
+function exportsSchema(file) {
+  let source;
+  try {
+    source = readFileSync(file, "utf8");
+  } catch {
+    return false;
+  }
+  return (
+    // `export const schema = z.object({ ... })` — what penv scaffolds.
+    /export\s+(?:const|let|var)\s+schema\b/.test(source) || // `export { schema }`, `export { shape as schema }`.
+    /export\s*\{[^}]*\bschema\b[^}]*\}/.test(source)
+  );
+}
+function occupied(cwd, relative3) {
+  const file = join(cwd, ...relative3.split("/"));
+  return existsSync(file) && !exportsSchema(file);
+}
+function schemaFileFor(cwd) {
+  const dir = existsSync(join(cwd, "src")) ? "src/" : "";
+  const preferred = `${dir}env.ts`;
+  if (!occupied(cwd, preferred)) {
+    return { file: preferred };
+  }
+  const beside = `${dir}penv-env.ts`;
+  if (!occupied(cwd, beside)) {
+    return { file: beside, displaced: preferred };
+  }
+  return { file: DEFAULT_SCHEMA_FILE, displaced: preferred };
+}
+function dependenciesOf(cwd) {
+  const manifest = manifestOf(cwd);
+  if (manifest === void 0) {
+    return void 0;
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies"]) {
+    const block = manifest[field];
+    if (block !== null && typeof block === "object" && !Array.isArray(block)) {
+      for (const name of Object.keys(block)) {
+        names.add(name);
+      }
+    }
+  }
+  return names;
+}
+function manifestOf(cwd) {
+  const file = join(cwd, "package.json");
+  if (!existsSync(file)) {
+    return void 0;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return void 0;
+  }
+  return manifest === null || typeof manifest !== "object" || Array.isArray(manifest) ? void 0 : manifest;
+}
+function detectFramework(cwd) {
+  const dependencies = dependenciesOf(cwd);
+  if (dependencies === void 0) {
+    return void 0;
+  }
+  for (const signature of SIGNATURES) {
+    if (signature.packages.some((name) => dependencies.has(name))) {
+      const schema = schemaFileFor(cwd);
+      return {
+        name: signature.name,
+        schemaFile: schema.file,
+        ...schema.displaced === void 0 ? {} : { displacedFrom: schema.displaced },
+        publicPrefixes: signature.publicPrefixes
+      };
+    }
+  }
+  return void 0;
+}
+var DEFAULT_ALIAS = "@env";
+var IMPORTS_ALIAS = "#env";
+function detectAlias(cwd) {
+  return hasImportsBlock(cwd) ? IMPORTS_ALIAS : DEFAULT_ALIAS;
+}
+function hasImportsBlock(cwd) {
+  const manifest = manifestOf(cwd);
+  const imports = manifest?.imports;
+  return imports !== null && typeof imports === "object" && !Array.isArray(imports);
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync2, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join2, resolve as resolve3 } from "path";
+import { createInterface } from "readline/promises";
+import {
+  DEFAULT_SCHEMA_FILE as DEFAULT_SCHEMA_FILE2,
+  isLegalEnvironmentName,
+  loadConfigFrom,
+  PenvError as PenvError10,
+  RESERVED_TOKENS,
+  schemaFileOf as schemaFileOf2,
+  schemaInsideTree,
+  validateSchemaFile
+} from "@penvhq/core";
+import { defineCommand as defineCommand8 } from "citty";
+var CONFIG_FILE = "penv.config.ts";
+var TSCONFIG_FILE = "tsconfig.json";
+var GITIGNORE_FILE = ".gitignore";
+var PENV_DIR2 = ".penv";
+var ALIAS_NAME = /^[@#][A-Za-z0-9_-]+$/;
+var IMPORTS_PREFIX = "#";
+var PACKAGE_FILE = "package.json";
+var DEFAULT_DECISIONS = {
+  environments: [],
+  schemaFile: DEFAULT_SCHEMA_FILE2,
+  publicPrefixes: [],
+  alias: DEFAULT_ALIAS
+};
+var NOT_ENVIRONMENTS = [...RESERVED_TOKENS, "example", "sample", "template"];
+function suggestEnvironments(root) {
+  let entries;
+  try {
+    entries = readdirSync(root);
+  } catch {
+    return [];
+  }
+  const found = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (!entry.startsWith(".env.")) {
+      continue;
+    }
+    const segments = entry.slice(".env.".length).split(".");
+    const withoutLocal = segments.at(-1) === "local" ? segments.slice(0, -1) : segments;
+    const name = withoutLocal.length === 1 ? withoutLocal[0] : void 0;
+    if (name === void 0 || !isLegalEnvironmentName(name) || NOT_ENVIRONMENTS.includes(name)) {
+      continue;
+    }
+    found.add(name);
+  }
+  return [...found].sort();
+}
+function emptyFlag(flag) {
+  return new PenvError10(
+    "INIT_FLAG_EMPTY",
+    `\`--${flag}\` was given without a value`,
+    flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${DEFAULT_SCHEMA_FILE2}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
+  );
+}
+function splitEnvironments(value) {
+  return value.split(",").map((name) => name.trim()).filter((name) => name.length > 0);
+}
+function environmentsFromFlag(flag) {
+  if (flag === void 0) {
+    return void 0;
+  }
+  const given = Array.isArray(flag) ? flag : [flag];
+  const names = given.flatMap((value) => splitEnvironments(String(value)));
+  if (names.length === 0) {
+    throw emptyFlag("env");
+  }
+  return [...new Set(names)];
+}
+function configOf(decisions) {
+  return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
+}
+function declaredIn(root) {
+  const file = join2(root, CONFIG_FILE);
+  if (!existsSync2(file)) {
+    return void 0;
+  }
+  return loadConfigFrom(file);
+}
+function planInit(root, flags = {}) {
+  const declared = declaredIn(root);
+  const detected = detectFramework(root);
+  const notes = [];
+  if (declared !== void 0) {
+    notes.push(`${CONFIG_FILE} already exists \u2014 init keeps every decision it records.`);
+  } else if (detected === void 0) {
+    notes.push(
+      `No framework detected in package.json \u2014 the schema goes to ${DEFAULT_SCHEMA_FILE2}.`
+    );
+  } else {
+    notes.push(`Detected ${detected.name}.`);
+    if (detected.displacedFrom !== void 0) {
+      notes.push(
+        `${detected.displacedFrom} is already a module of yours that exports no \`schema\`, so the schema goes to ${detected.schemaFile}. penv never writes over a file it did not write \u2014 delete yours and re-run if you want it there, or pass \`--schema\`.`
+      );
+    }
+  }
+  const schemaFile = flags.schema === void 0 ? declared !== void 0 ? schemaFileOf2(declared) : detected?.schemaFile ?? DEFAULT_SCHEMA_FILE2 : flags.schema.trim();
+  if (flags.schema !== void 0) {
+    if (schemaFile.length === 0) {
+      throw emptyFlag("schema");
+    }
+    const error = validateSchemaFile({ environments: [], providers: {}, schemaFile })[0];
+    if (error !== void 0) {
+      throw error;
+    }
+  }
+  const alias = flags.alias === void 0 ? detectAlias(root) : flags.alias.trim();
+  if (flags.alias !== void 0 && alias.length === 0) {
+    throw emptyFlag("alias");
+  }
+  if (!ALIAS_NAME.test(alias)) {
+    throw new PenvError10(
+      "INIT_ALIAS_INVALID",
+      `\`${alias}\` is not an alias penv can write`,
+      `An alias is \`@name\` \u2014 a tsconfig \`paths\` entry a bundler resolves \u2014 or \`#name\`, a package.json \`imports\` entry Node resolves itself. Those are the two things a module specifier can be that is not a package.`
+    );
+  }
+  if (flags.alias === void 0 && alias.startsWith(IMPORTS_PREFIX)) {
+    notes.push(
+      `Your ${PACKAGE_FILE} declares \`imports\`, so the alias is \`${alias}\` \u2014 Node resolves it without a bundler.`
+    );
+  }
+  const suggestedEnvironments = suggestEnvironments(root);
+  const environments = flags.environments ?? declared?.environments ?? [];
+  if (environments.length === 0) {
+    notes.push(
+      "No environments declared: penv does not infer them, and a `--yes` run cannot invent them."
+    );
+    if (suggestedEnvironments.length > 0) {
+      notes.push(
+        `Your \`.env\` files mention ${suggestedEnvironments.join(", ")} \u2014 declare the ones you really deploy in ${CONFIG_FILE}, with a provider for each.`
+      );
+    }
+  }
+  return {
+    detected,
+    decisions: {
+      environments,
+      schemaFile,
+      publicPrefixes: declared?.publicPrefixes ?? detected?.publicPrefixes ?? [],
+      alias
+    },
+    suggestedEnvironments,
+    notes
+  };
+}
+function renderPlan(plan2) {
+  const rows = [];
+  rows.push([
+    "  environments",
+    plan2.suggestedEnvironments.length === 0 ? "" : `[${plan2.suggestedEnvironments.join(", ")}]`,
+    plan2.suggestedEnvironments.length === 0 ? "<- name them, or Enter to leave the whitelist empty" : "<- from your .env files; edit, or Enter to accept"
+  ]);
+  rows.push([
+    "  schemaFile",
+    plan2.decisions.schemaFile,
+    plan2.decisions.schemaFile === DEFAULT_SCHEMA_FILE2 ? "" : `(default: ${DEFAULT_SCHEMA_FILE2})`
+  ]);
+  for (const prefix of plan2.decisions.publicPrefixes) {
+    rows.push(["  publicPrefix", prefix, ""]);
+  }
+  const headline = plan2.detected === void 0 ? "No framework detected in package.json." : `Detected ${plan2.detected.name}.`;
+  return [headline, "", ...columns(rows), ""];
+}
+function environmentsHint(plan2) {
+  return plan2.suggestedEnvironments.length === 0 ? "environments (comma-separated, Enter for none) > " : 'environments (Enter to accept, "none" for an empty whitelist) > ';
+}
+async function promptForDecisions(plan2, io) {
+  for (const line of renderPlan(plan2)) {
+    io.write(line);
+  }
+  const answer = (await io.ask(environmentsHint(plan2))).trim();
+  const environments = answer.length === 0 ? plan2.suggestedEnvironments : answer.toLowerCase() === "none" ? [] : splitEnvironments(answer);
+  if (answer.length > 0) {
+    io.write("");
+    io.write(
+      environments.length === 0 ? "  environments  [] (declare them later in penv.config.ts)" : `  environments  [${environments.join(", ")}]`
+    );
+    io.write("");
+  }
+  const proceed = (await io.ask("Proceed? [Y/n] ")).trim().toLowerCase();
+  if (proceed.length > 0 && proceed !== "y" && proceed !== "yes") {
+    return void 0;
+  }
+  return { ...plan2.decisions, environments };
+}
+var EMPTY_SCHEMA_BODY = "  // One key per parameter, e.g. `databaseUrl: z.url(),`. Nesting a key nests\n  // the parameter: `redis: z.object({ password: z.string() })` is redis/password.";
+var DRAFT_HEADER = "// DRAFT \u2014 generated by `penv import` from one sample of each value, and yours\n// to correct. Single-sample inference cannot know that a boolean seen as `true`\n// must also accept `1`/`0`, or that a string is really a URL. penv scaffolds\n// this file once and never regenerates it, so edits here are safe.\n";
+function renderSchemaModule(fields, draft) {
+  const body = fields.length === 0 ? EMPTY_SCHEMA_BODY : fields.map((field) => `  ${field.key}: ${field.type},`).join("\n");
+  return `${draft ? DRAFT_HEADER : ""}import { z } from "zod";
+import { load } from "@penvhq/penv";
+
+// The shape. Import this (or z.infer<typeof schema>) when you only need the
+// type \u2014 tests, tooling \u2014 so you don't trigger config loading.
+export const schema = z.object({
+${body}
+});
+
+// The loaded, validated values for the current environment. Import this in app
+// code. Importing it loads configuration and throws (naming the parameter and
+// environment) if anything required is missing or invalid.
+export const env = load(schema);
+`;
+}
+function renderEnvironments(decisions) {
+  const shared = "  // Environments are a whitelist. A filename segment is an environment only if\n  // it is declared here \u2014 penv never infers one from a folder or a filename.\n";
+  if (decisions.environments.length === 0) {
+    return `${shared}  // It starts empty because which environments you deploy is not something penv
+  // can read off your codebase, and an environment you do not have is worse
+  // than one you have not declared yet. Name yours, and give each a provider:
+  //   environments: ["development", "production"],
+  //   providers: { development: { type: "filesystem" }, production: { type: "filesystem" } },
+  environments: [],
+
+  providers: {},
+`;
+  }
+  const names = decisions.environments.map((name) => JSON.stringify(name)).join(", ");
+  const providers = decisions.environments.map((name) => `    ${JSON.stringify(name)}: { type: "filesystem" },
+`).join("");
+  return `${shared}  environments: [${names}],
+
+  // One entry per environment: where that environment's values are read from.
+  providers: {
+${providers}  },
+`;
+}
+function renderConfigModule(decisions) {
+  let body = renderEnvironments(decisions);
+  if (decisions.schemaFile !== DEFAULT_SCHEMA_FILE2) {
+    body += `
+  // The module that exports the schema. It is yours \u2014 penv scaffolds it once
+  // and never regenerates it \u2014 so this says where you keep it.
+  schemaFile: ${JSON.stringify(decisions.schemaFile)},
+`;
+  }
+  if (decisions.publicPrefixes.length > 0) {
+    const prefixes = decisions.publicPrefixes.map((prefix) => JSON.stringify(prefix)).join(", ");
+    body += `
+  // The prefixes your framework inlines into the browser bundle. \`penv doctor\`
+  // reports a parameter your meta declares \`secret: true\` whose variable name
+  // starts with one of these \u2014 penv is the only thing holding both facts.
+  publicPrefixes: [${prefixes}],
+`;
+  }
+  return `import { defineConfig } from "@penvhq/penv";
+
+export default defineConfig({
+${body}});
+`;
+}
+function renderGitignore(decisions) {
+  const inside = schemaInsideTree(configOf(decisions));
+  const listed = inside === void 0 ? "" : `${inside}, `;
+  return `# Written by penv. Value files hold configuration values and are never
+# committed; only the structure, ${listed}meta, and config are.
+*
+!*/
+!.gitignore
+${inside === void 0 ? "" : `!${inside}
+`}!*.json
+`;
+}
+function skipTrivia(source, index) {
+  let i = index;
+  for (; ; ) {
+    const ch = source.charAt(i);
+    if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") {
+      i += 1;
+      continue;
+    }
+    if (ch === "/" && source.charAt(i + 1) === "/") {
+      const end = source.indexOf("\n", i);
+      i = end === -1 ? source.length : end + 1;
+      continue;
+    }
+    if (ch === "/" && source.charAt(i + 1) === "*") {
+      const end = source.indexOf("*/", i + 2);
+      i = end === -1 ? source.length : end + 2;
+      continue;
+    }
+    return i;
+  }
+}
+function endOfString(source, index) {
+  let i = index + 1;
+  while (i < source.length) {
+    const ch = source.charAt(i);
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === '"') {
+      return i + 1;
+    }
+    i += 1;
+  }
+  return source.length;
+}
+function endOfBracket(source, index) {
+  const open = source.charAt(index);
+  const close = open === "{" ? "}" : "]";
+  let depth = 0;
+  let i = index;
+  while (i < source.length) {
+    const ch = source.charAt(i);
+    if (ch === '"') {
+      i = endOfString(source, i);
+      continue;
+    }
+    if (ch === "/" && (source.charAt(i + 1) === "/" || source.charAt(i + 1) === "*")) {
+      i = skipTrivia(source, i);
+      continue;
+    }
+    if (ch === open) {
+      depth += 1;
+      i += 1;
+      continue;
+    }
+    if (ch === close) {
+      depth -= 1;
+      i += 1;
+      if (depth === 0) {
+        return i;
+      }
+      continue;
+    }
+    i += 1;
+  }
+  return source.length;
+}
+function endOfValue(source, index) {
+  const ch = source.charAt(index);
+  if (ch === '"') {
+    return endOfString(source, index);
+  }
+  if (ch === "{" || ch === "[") {
+    return endOfBracket(source, index);
+  }
+  let i = index;
+  while (i < source.length) {
+    const c = source.charAt(i);
+    if (c === "," || c === "}" || c === "]" || c === "\n") {
+      return i;
+    }
+    i += 1;
+  }
+  return source.length;
+}
+function findMember(source, open, key) {
+  const close = endOfBracket(source, open) - 1;
+  let i = skipTrivia(source, open + 1);
+  while (i < close) {
+    if (source.charAt(i) !== '"') {
+      return void 0;
+    }
+    const keyEnd = endOfString(source, i);
+    const name = source.slice(i + 1, keyEnd - 1);
+    const colon = skipTrivia(source, keyEnd);
+    if (source.charAt(colon) !== ":") {
+      return void 0;
+    }
+    const valueStart = skipTrivia(source, colon + 1);
+    const valueEnd = endOfValue(source, valueStart);
+    if (name === key) {
+      return { valueStart };
+    }
+    let next = skipTrivia(source, valueEnd);
+    if (source.charAt(next) === ",") {
+      next = skipTrivia(source, next + 1);
+    }
+    i = next;
+  }
+  return void 0;
+}
+function lineIndent(source, index) {
+  const lineStart = source.lastIndexOf("\n", index) + 1;
+  const match = /^[ \t]*/.exec(source.slice(lineStart, index));
+  return match?.[0] ?? "";
+}
+function indentUnit(source) {
+  const match = /\n([ \t]+)"/.exec(source);
+  return match?.[1] ?? "  ";
+}
+function insertMember(source, open, member, unit) {
+  const objectIndent = lineIndent(source, open);
+  const entryIndent = objectIndent + unit;
+  const close = endOfBracket(source, open) - 1;
+  if (skipTrivia(source, open + 1) === close) {
+    return `${source.slice(0, open + 1)}
+${entryIndent}${member}
+${objectIndent}${source.slice(close)}`;
+  }
+  return `${source.slice(0, open + 1)}
+${entryIndent}${member},${source.slice(open + 1)}`;
+}
+function shapeError(what, target, alias) {
+  return new PenvError10(
+    "TSCONFIG_SHAPE",
+    `penv cannot add the \`${alias}\` path alias to tsconfig.json: ${what}`,
+    `Add it by hand: \`{ "compilerOptions": { "paths": { "${alias}": ["${target}"] } } }\`.`
+  );
+}
+function insertEnvAlias(source, target = DEFAULT_SCHEMA_FILE2, name = DEFAULT_ALIAS) {
+  const alias = `"${name}": ["${target}"]`;
+  const root = skipTrivia(source, 0);
+  if (source.charAt(root) !== "{") {
+    throw shapeError("its contents are not a JSON object", target, name);
+  }
+  const unit = indentUnit(source);
+  const compilerOptions = findMember(source, root, "compilerOptions");
+  if (compilerOptions === void 0) {
+    return {
+      source: insertMember(source, root, `"compilerOptions": { "paths": { ${alias} } }`, unit),
+      changed: true
+    };
+  }
+  if (source.charAt(compilerOptions.valueStart) !== "{") {
+    throw shapeError("`compilerOptions` is not an object", target, name);
+  }
+  const paths = findMember(source, compilerOptions.valueStart, "paths");
+  if (paths === void 0) {
+    return {
+      source: insertMember(source, compilerOptions.valueStart, `"paths": { ${alias} }`, unit),
+      changed: true
+    };
+  }
+  if (source.charAt(paths.valueStart) !== "{") {
+    throw shapeError("`compilerOptions.paths` is not an object", target, name);
+  }
+  const existing = findMember(source, paths.valueStart, name);
+  if (existing !== void 0) {
+    const points = source.slice(existing.valueStart, endOfValue(source, existing.valueStart));
+    return points.includes(`"${target}"`) ? { source, changed: false } : { source, changed: false, conflict: points.trim() };
+  }
+  return { source: insertMember(source, paths.valueStart, alias, unit), changed: true };
+}
+function insertImportsAlias(source, target, name) {
+  const entry = `"${name}": "./${target}"`;
+  const root = skipTrivia(source, 0);
+  if (source.charAt(root) !== "{") {
+    throw shapeError("its contents are not a JSON object", target, name);
+  }
+  const unit = indentUnit(source);
+  const imports = findMember(source, root, "imports");
+  if (imports === void 0) {
+    return { source: insertMember(source, root, `"imports": { ${entry} }`, unit), changed: true };
+  }
+  if (source.charAt(imports.valueStart) !== "{") {
+    throw shapeError("`imports` is not an object", target, name);
+  }
+  const existing = findMember(source, imports.valueStart, name);
+  if (existing !== void 0) {
+    const points = source.slice(existing.valueStart, endOfValue(source, existing.valueStart));
+    return points.includes(`"./${target}"`) ? { source, changed: false } : { source, changed: false, conflict: points.trim() };
+  }
+  return { source: insertMember(source, imports.valueStart, entry, unit), changed: true };
+}
+function renderTsconfig(target, alias) {
+  return `{
+  "compilerOptions": {
+    "paths": { "${alias}": ["${target}"] }
+  }
+}
+`;
+}
+function ensurePenvDir(root) {
+  const dir = resolve3(root, PENV_DIR2);
+  if (existsSync2(dir)) {
+    return { target: "penv-dir", action: "kept", text: `Found ${PENV_DIR2}/` };
+  }
+  mkdirSync(dir, { recursive: true });
+  return { target: "penv-dir", action: "created", text: `Created ${PENV_DIR2}/` };
+}
+function writeSchemaFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
+  const file = join2(root, ...decisions.schemaFile.split("/"));
+  if (existsSync2(file)) {
+    return {
+      target: "schema",
+      action: "kept",
+      text: `Kept ${decisions.schemaFile}`,
+      note: "(yours \u2014 penv never regenerates it)"
+    };
+  }
+  mkdirSync(dirname2(file), { recursive: true });
+  writeFileSync2(file, renderSchemaModule(fields, draft), "utf8");
+  return {
+    target: "schema",
+    action: "created",
+    text: `Generated ${decisions.schemaFile}`,
+    note: draft ? "(draft schema \u2014 review it, it's yours)" : "(schema + loader \u2014 yours to edit)"
+  };
+}
+function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
+  const file = join2(root, CONFIG_FILE);
+  if (existsSync2(file)) {
+    return { target: "config", action: "kept", text: `Kept ${CONFIG_FILE}` };
+  }
+  writeFileSync2(file, renderConfigModule(decisions), "utf8");
+  return { target: "config", action: "created", text: `Generated ${CONFIG_FILE}` };
+}
+function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
+  const alias = decisions.alias;
+  const imports = alias.startsWith(IMPORTS_PREFIX);
+  const file = join2(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
+  const where = imports ? PACKAGE_FILE : TSCONFIG_FILE;
+  if (!existsSync2(file)) {
+    if (imports) {
+      return {
+        target: "tsconfig",
+        action: "conflicted",
+        text: `No ${PACKAGE_FILE} to add the ${alias} import to`,
+        note: `(run \`npm init\` first, or use \`--alias @env\` to alias through ${TSCONFIG_FILE})`
+      };
+    }
+    writeFileSync2(file, renderTsconfig(decisions.schemaFile, alias), "utf8");
+    return {
+      target: "tsconfig",
+      action: "created",
+      text: `Created ${TSCONFIG_FILE} with the ${alias} path alias`
+    };
+  }
+  const source = readFileSync2(file, "utf8");
+  const edit = imports ? insertImportsAlias(source, decisions.schemaFile, alias) : insertEnvAlias(source, decisions.schemaFile, alias);
+  if (edit.conflict !== void 0) {
+    return {
+      target: "tsconfig",
+      action: "conflicted",
+      text: `${where} already maps ${alias} to ${edit.conflict}`,
+      note: `(left alone \u2014 \`import { env } from "${alias}"\` will not reach ${decisions.schemaFile})`
+    };
+  }
+  if (!edit.changed) {
+    return {
+      target: "tsconfig",
+      action: "kept",
+      text: `Kept the ${alias} alias in ${where}`
+    };
+  }
+  writeFileSync2(file, edit.source, "utf8");
+  return {
+    target: "tsconfig",
+    action: "updated",
+    text: `Added ${alias} alias to ${where}`
+  };
+}
+function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
+  const file = join2(root, PENV_DIR2, GITIGNORE_FILE);
+  const relative3 = `${PENV_DIR2}/${GITIGNORE_FILE}`;
+  const wanted = renderGitignore(decisions);
+  const existing = existsSync2(file) ? readFileSync2(file, "utf8") : void 0;
+  if (existing === wanted) {
+    return { target: "gitignore", action: "kept", text: `Kept ${relative3}` };
+  }
+  mkdirSync(join2(root, PENV_DIR2), { recursive: true });
+  writeFileSync2(file, wanted, "utf8");
+  return {
+    target: "gitignore",
+    action: existing === void 0 ? "created" : "updated",
+    text: `${existing === void 0 ? "Created" : "Updated"} ${relative3}`
+  };
+}
+function scaffold(root, fields, draft, decisions = DEFAULT_DECISIONS) {
+  return [
+    ensurePenvDir(root),
+    writeSchemaFile(root, fields, draft, decisions),
+    writeConfigFile(root, decisions),
+    writeTsconfigAlias(root, decisions),
+    writeGitignore(root, decisions)
+  ];
+}
+function runInit(options) {
+  const root = resolve3(options.cwd);
+  const decisions = options.decisions ?? planInit(root).decisions;
+  return { root, decisions, steps: scaffold(root, [], false, decisions) };
+}
+function renderInit(result) {
+  const steps = result.steps.map((step) => {
+    const glyph = step.action === "conflicted" ? WARN : CHECK;
+    return step.note === void 0 ? { glyph, text: step.text } : { glyph, text: step.text, note: step.note };
+  });
+  return [
+    ...formatSteps(steps),
+    "",
+    `Done. Declare your parameters in ${result.decisions.schemaFile}, then \`penv set <key>\`.`,
+    ...result.decisions.environments.length === 0 ? [
+      `Then declare your environments in ${CONFIG_FILE}: penv leaves the whitelist empty rather than inventing one, and every command needs it.`
+    ] : []
+  ];
+}
+async function askOnTty(plan2) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await promptForDecisions(plan2, {
+      ask: (question) => rl.question(question),
+      write: (line) => process.stdout.write(`${line}
+`)
+    });
+  } finally {
+    rl.close();
+  }
+}
+var initCommand = defineCommand8({
+  meta: { name: "init", description: "Initialize a project (.penv/, env.ts, config, @env alias)" },
+  args: {
+    yes: {
+      type: "boolean",
+      description: "Take the detected defaults without asking. Environments still start empty \u2014 penv cannot see your infrastructure"
+    },
+    schema: {
+      type: "string",
+      description: `Where the schema module goes, e.g. src/env.ts (default: ${DEFAULT_SCHEMA_FILE2})`
+    },
+    alias: {
+      type: "string",
+      description: "How your code names the schema: @env (tsconfig paths, needs a bundler) or #env (package.json imports, resolved by node itself)"
+    },
+    env: {
+      type: "string",
+      description: "Declare an environment. Repeatable, or comma-separated: --env development,production"
+    }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const root = resolve3(process.cwd());
+      const environments = environmentsFromFlag(args.env);
+      const plan2 = planInit(root, {
+        ...args.schema === void 0 ? {} : { schema: args.schema },
+        ...args.alias === void 0 ? {} : { alias: args.alias },
+        ...environments === void 0 ? {} : { environments }
+      });
+      const asked = process.stdin.isTTY === true && args.yes !== true && environments === void 0;
+      const decisions = asked ? await askOnTty(plan2) : plan2.decisions;
+      if (decisions === void 0) {
+        write(["Nothing written. Re-run `penv init` when you want to scaffold."]);
+        return;
+      }
+      if (!asked) {
+        write([...plan2.notes, ""]);
+      }
+      write(renderInit(runInit({ cwd: root, decisions })));
+    });
+  }
+});
+
+// src/commands/import.ts
+var BACKUP_SUFFIX = ".backup";
+var DOTENV_SEGMENT = "env";
+var LOCAL = "local";
+var URL_LIKE = /^[a-z][a-z0-9+.-]*:\/\/\S+$/i;
+var IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function inferType(value) {
+  if (URL_LIKE.test(value)) {
+    return "z.url()";
+  }
+  if (/^(true|false)$/i.test(value)) {
+    return "z.stringbool()";
+  }
+  if (value.trim() !== "" && Number.isFinite(Number(value))) {
+    return "z.coerce.number()";
+  }
+  return "z.string()";
+}
+function draftFields(entries) {
+  return entries.map((entry) => {
+    const key = accessPath4(refFromVariable(entry.key)).join(".");
+    return {
+      key: IDENTIFIER.test(key) ? key : JSON.stringify(key),
+      type: inferType(entry.value)
+    };
+  }).sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+}
+function assertImportable(ref, variable) {
+  if (!ref.name.includes(".")) {
+    return;
+  }
+  throw new PenvError11(
+    "IMPORT_UNPARSEABLE_NAME",
+    `The variable ${variable} becomes the parameter \`${ref.name}\`, whose \`.\` would be read as a scope`,
+    `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
+  );
+}
+function assertNotReserved(ref, variable, where, config) {
+  if (isReservedToken3(ref.name, config)) {
+    throw new ReservedTokenError3("parameter", variable, where);
+  }
+}
+function assertRoundTrips(ref, variable, config) {
+  if (roundTripsCleanly(variable)) {
+    return;
+  }
+  if (variableName5(ref, config) === variable) {
+    return;
+  }
+  const generated = variableName5(ref, config);
+  throw new PenvError11(
+    "IMPORT_LOSSY_NAME",
+    `The variable ${variable} becomes the parameter \`${ref.name}\`, which regenerates as ${generated}`,
+    `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`names\` block of penv.config.ts \u2014 \`names: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
+  );
+}
+function collisionsIn(refs, config) {
+  const errors = checkNameCollisions4(refs, config);
+  const first = errors[0];
+  if (first !== void 0) {
+    throw first;
+  }
+}
+function assertDeclared(segment, config) {
+  if (config.environments.includes(segment)) {
+    return segment;
+  }
+  throw new UnknownEnvironmentError(segment, config.environments);
+}
+function scopeFromFilename(file, config) {
+  const name = basename(file);
+  const segments = name.split(".");
+  const start = segments.indexOf(DOTENV_SEGMENT);
+  if (start === -1) {
+    return { kind: "unscoped" };
+  }
+  const rest = segments.slice(start + 1).filter((segment) => segment.length > 0);
+  const first = rest[0];
+  const second = rest[1];
+  if (first === void 0) {
+    return { kind: "unscoped" };
+  }
+  if (second === void 0) {
+    if (first === LOCAL) {
+      return { kind: LOCAL };
+    }
+    return { kind: "environment", environment: assertDeclared(first, config) };
+  }
+  if (rest.length === 2 && second === LOCAL && first !== LOCAL) {
+    return { kind: "environment-local", environment: assertDeclared(first, config) };
+  }
+  if (first === LOCAL && rest.length === 2) {
+    throw new FilenameGrammarError(
+      name,
+      "`local` precedes the environment segment",
+      `The environment segment always precedes \`local\` \u2014 \`.env.${second}.${LOCAL}\` is the file Next.js and Vite read, and \`.env.${LOCAL}.${second}\` is not a synonym for it. Rename it to \`.env.${second}.${LOCAL}\`, then import it again. Nothing was imported.`
+    );
+  }
+  throw new FilenameGrammarError(
+    name,
+    `\`${rest.join("` and `")}\` are ${rest.length} scope segments`,
+    "A dotenv file carries exactly one scope: `.env`, `.env.<environment>`, `.env.local`, or `.env.<environment>.local`. Point `penv import` at one of those. Nothing was imported."
+  );
+}
+function environmentOf(scope) {
+  switch (scope.kind) {
+    case "environment":
+    case "environment-local":
+      return scope.environment;
+    case "unscoped":
+    case "local":
+      return void 0;
+    default:
+      return assertNever(scope, "scope");
+  }
+}
+function scopeWithEnvironment(scope, environment) {
+  switch (scope.kind) {
+    case "unscoped":
+      return { kind: "environment", environment };
+    case LOCAL:
+      return { kind: "environment-local", environment };
+    case "environment":
+    case "environment-local":
+      return scope;
+    default:
+      return assertNever(scope, "scope");
+  }
+}
+function explicitEnvironment(options, source, config) {
+  const value = options.environment?.trim() ?? "";
+  if (value.length > 0) {
+    return value;
+  }
+  throw new PenvError11(
+    "IMPORT_ENV_FLAG_EMPTY",
+    `\`--env\` for the import of ${source} names no environment`,
+    `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
+  );
+}
+function assertEnvironmentAgrees(derived, explicit, source) {
+  if (derived === void 0 || explicit === void 0 || derived === explicit) {
+    return;
+  }
+  throw new PenvError11(
+    "IMPORT_ENV_CONFLICT",
+    `The file ${source} is scoped to environment ${derived}, but \`--env ${explicit}\` names ${explicit}`,
+    `Drop \`--env\` to import ${source} as ${derived}, pass \`--env ${derived}\` to say the same thing twice, or point \`penv import\` at the file that holds ${explicit}'s values. Nothing was imported.`
+  );
+}
+function environmentNamed(file, explicit) {
+  if (explicit !== void 0 && explicit.trim().length > 0) {
+    return explicit.trim();
+  }
+  const segments = basename(file).split(".");
+  const start = segments.indexOf(DOTENV_SEGMENT);
+  if (start === -1) {
+    return void 0;
+  }
+  const first = segments.slice(start + 1).filter((segment) => segment.length > 0)[0];
+  return first === void 0 || first === LOCAL ? void 0 : first;
+}
+function decisionsOf(config, cwd) {
+  return {
+    environments: config.environments,
+    schemaFile: schemaFileOf3(config),
+    publicPrefixes: config.publicPrefixes ?? [],
+    alias: detectAlias(cwd)
+  };
+}
+function configInEffect(cwd, environment) {
+  const existing = findConfigFile(cwd);
+  if (existing !== void 0) {
+    const config = loadConfigFrom2(existing);
+    return { config, decisions: decisionsOf(config, cwd) };
+  }
+  const planned = planInit(cwd).decisions;
+  const decisions = {
+    ...planned,
+    environments: environment === void 0 ? planned.environments : [environment]
+  };
+  writeConfigFile(cwd, decisions);
+  return { config: openProject(cwd).config, decisions };
+}
+function importDotenv(options) {
+  const cwd = resolve4(options.cwd);
+  const file = isAbsolute2(options.file) ? options.file : resolve4(cwd, options.file);
+  if (!existsSync3(file)) {
+    throw new PenvError11(
+      "IMPORT_FILE_MISSING",
+      `There is no file at ${file} to import`,
+      "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
+    );
+  }
+  const parsed = parseDotenv(readFileSync3(file, "utf8"));
+  const { config, decisions } = configInEffect(cwd, environmentNamed(file, options.environment));
+  const source = displayPath2(cwd, file);
+  const named = scopeFromFilename(file, config);
+  const derived = environmentOf(named);
+  const explicit = options.environment === void 0 ? void 0 : explicitEnvironment(options, source, config);
+  assertEnvironmentAgrees(derived, explicit, source);
+  const scope = explicit === void 0 ? named : scopeWithEnvironment(named, assertDeclared(explicit, config));
+  const environment = lookupEnvironment(config, explicit ?? derived);
+  const refs = [];
+  for (const entry of parsed.entries) {
+    const ref = refFromVariable(entry.key);
+    assertImportable(ref, entry.key);
+    assertNotReserved(ref, entry.key, source, config);
+    assertRoundTrips(ref, entry.key, config);
+    refs.push(ref);
+  }
+  collisionsIn(refs, config);
+  const steps = scaffold(cwd, draftFields(parsed.entries), true, decisions);
+  const project = openProject(cwd);
+  const tree = localTree(project);
+  for (const [index, entry] of parsed.entries.entries()) {
+    const ref = refs[index];
+    if (ref === void 0) {
+      continue;
+    }
+    tree.writeSync(
+      { namespace: ref.namespace, name: ref.name, scope, encrypted: false },
+      entry.value
+    );
+    if (entry.description !== void 0) {
+      const existing = tree.readMetaSync(ref);
+      const meta = { ...existing, description: entry.description };
+      tree.writeMetaSync(ref, meta);
+    }
+  }
+  const backup = `${file}${BACKUP_SUFFIX}`;
+  copyFileSync(file, backup);
+  return {
+    root: project.root,
+    file,
+    backup,
+    scope,
+    environment,
+    environments: config.environments,
+    variables: parsed.entries.length,
+    orphanComments: parsed.orphanComments,
+    steps
+  };
+}
+function displayPath2(root, file) {
+  const rel = relative2(root, file);
+  return rel === "" || rel.startsWith("..") ? file : rel.split("\\").join("/");
+}
+function keptSchemaStep(step, variables) {
+  const plural = variables === 1 ? "parameter" : "parameters";
+  return {
+    glyph: WARN,
+    // The step's own text, which names the file that was actually kept. This
+    // line rebuilt it from a hardcoded `.penv/env.ts`, so a project whose schema
+    // lives in `src/` was told penv had kept a file it does not have — the one
+    // line whose whole job is "your schema is untouched" naming the wrong
+    // schema. Only the glyph and the note are this function's business.
+    text: step.text,
+    note: `(yours \u2014 ${variables} imported ${plural} undeclared, draft schema skipped)`
+  };
+}
+function skippedValidationStep(environments) {
+  const example = environments[0] ?? "<environment>";
+  return {
+    glyph: WARN,
+    text: "Skipped validation",
+    note: `(no environment set \u2014 run \`penv validate --env ${example}\`)`
+  };
+}
+function renderImport(result, validation) {
+  const steps = [{ glyph: CHECK, text: `Found ${result.variables} variables` }];
+  if (result.orphanComments > 0) {
+    const plural = result.orphanComments === 1 ? "comment" : "comments";
+    steps.push({
+      glyph: WARN,
+      text: `Dropped ${result.orphanComments} orphan ${plural}`,
+      note: "attached to no variable, so nothing to describe"
+    });
+  }
+  for (const step of result.steps) {
+    if (step.target === "schema" && step.action === "kept") {
+      steps.push(keptSchemaStep(step, result.variables));
+      continue;
+    }
+    const glyph = step.action === "conflicted" ? WARN : CHECK;
+    steps.push(
+      step.note === void 0 ? { glyph, text: step.text } : { glyph, text: step.text, note: step.note }
+    );
+  }
+  steps.push({ glyph: CHECK, text: `Created ${displayPath2(result.root, result.backup)}` });
+  const lines = formatSteps(steps);
+  if (validation === void 0) {
+    lines.push(...formatSteps([skippedValidationStep(result.environments)]));
+  } else if (validation.ok) {
+    lines.push(...formatSteps([{ glyph: CHECK, text: "Validated configuration" }]));
+  } else {
+    lines.push(...renderValidate(validation));
+  }
+  lines.push("", "Done. .penv/ is now your source of truth.");
+  return lines;
+}
+var importCommand = defineCommand9({
+  meta: {
+    name: "import",
+    description: "Import an existing dotenv file; it becomes the source of truth"
+  },
+  args: {
+    file: {
+      type: "positional",
+      required: true,
+      description: "The dotenv file to import, e.g. .env"
+    },
+    env: {
+      type: "string",
+      description: "The environment these are the values of; scopes them to it. The filename supplies it when it carries one"
+    }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const cwd = process.cwd();
+      const report = importDotenv({
+        cwd,
+        file: args.file,
+        ...args.env === void 0 ? {} : { environment: args.env }
+      });
+      const validation = report.environment === void 0 ? void 0 : await runValidate({ cwd, environment: report.environment });
+      write(renderImport(report, validation));
+    });
+  }
+});
+
+// src/commands/key.ts
+import { randomBytes } from "crypto";
+import { KEY_BYTES, KEYCHAIN_SERVICE, PenvError as PenvError12 } from "@penvhq/core";
+import { defineCommand as defineCommand10 } from "citty";
+
+// src/keychain.ts
+import { createRequire } from "module";
+var cached;
+function entryConstructor() {
+  if (cached === void 0) {
+    const require2 = createRequire(import.meta.url);
+    cached = require2("@napi-rs/keyring").Entry;
+  }
+  return cached;
+}
+var defaultKeychain = {
+  getPassword(service, account) {
+    const Entry = entryConstructor();
+    return new Entry(service, account).getPassword();
+  },
+  setPassword(service, account, password) {
+    const Entry = entryConstructor();
+    new Entry(service, account).setPassword(password);
+  }
+};
+
+// src/commands/key.ts
+function envVarFor(id) {
+  return `PENV_KEY_${id.replace(/[^A-Za-z0-9]/g, "_").toUpperCase()}`;
+}
+function runKeyCreate(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const declared = project.config.keys?.[environment];
+  if (declared === void 0) {
+    throw new PenvError12(
+      "KEY_SOURCE_UNDECLARED",
+      `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
+      `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
+    );
+  }
+  const key = randomBytes(KEY_BYTES).toString("base64");
+  if (declared.source === "keychain") {
+    const keychain = options.keychain ?? defaultKeychain;
+    if (options.force !== true) {
+      let existing;
+      try {
+        existing = keychain.getPassword(KEYCHAIN_SERVICE, declared.id);
+      } catch (cause) {
+        throw new PenvError12(
+          "KEYCHAIN_UNAVAILABLE",
+          `penv could not read your OS keychain to check for an existing key \`${declared.id}\``,
+          `Unlock your keychain and run this again. Original error: ${cause instanceof Error ? cause.message : String(cause)}`
+        );
+      }
+      if (existing !== null) {
+        throw new PenvError12(
+          "KEY_EXISTS",
+          `Environment ${environment} already has a key \`${declared.id}\` in your OS keychain`,
+          "Replacing it would orphan every value already sealed under it \u2014 they could never be decrypted again. Re-run with `--force` only if you are certain nothing is sealed under the current key."
+        );
+      }
+    }
+    keychain.setPassword(KEYCHAIN_SERVICE, declared.id, key);
+    return { source: "keychain", environment, id: declared.id };
+  }
+  return {
+    source: "env",
+    environment,
+    id: declared.id,
+    variable: envVarFor(declared.id),
+    key
+  };
+}
+function renderKeyCreate(result) {
+  if (result.source === "keychain") {
+    return [
+      `A new key for environment ${result.environment}, stored in your OS keychain as \`${result.id}\`.`,
+      "",
+      "penv kept no copy. Anything sealed under it is unreadable without your keychain, and running",
+      "`penv key create` again would replace it \u2014 so it lives in exactly one place, on this machine."
+    ];
+  }
+  return [
+    `A new key for environment ${result.environment}. penv did not store it.`,
+    "",
+    `  ${result.variable}=${result.key}`,
+    "",
+    "Export it where penv runs, and put it wherever this environment's secrets already live \u2014",
+    "a KMS, your CI's secret store, a password manager. Anything sealed under it is unreadable",
+    "without it, and penv keeps no copy to fall back on."
+  ];
+}
+var keyCommand = defineCommand10({
+  meta: { name: "key", description: "Work with encryption keys" },
+  subCommands: {
+    create: defineCommand10({
+      meta: { name: "create", description: "Generate a key for an environment" },
+      args: {
+        env: { type: "string", description: "The environment the key is for" },
+        force: {
+          type: "boolean",
+          description: "Replace an existing keychain key (orphans values sealed under the old one)"
+        }
+      },
+      run({ args }) {
+        return guard(async () => {
+          write(
+            renderKeyCreate(
+              runKeyCreate({
+                cwd: process.cwd(),
+                ...args.env === void 0 ? {} : { environment: args.env },
+                ...args.force === void 0 ? {} : { force: args.force }
+              })
+            )
+          );
+        });
+      }
+    })
+  }
+});
+
+// src/commands/list.ts
+import { assertNever as assertNever2, resolveAll as resolveAll3, variableName as variableName6 } from "@penvhq/core";
+import { defineCommand as defineCommand11 } from "citty";
+function scopeLabel2(scope) {
+  switch (scope.kind) {
+    case "environment":
+      return scope.environment;
+    case "local":
+      return "local";
+    case "environment-local":
+      return `${scope.environment}.local`;
+    case "unscoped":
+      return "default";
+    default:
+      return assertNever2(scope, "scope");
+  }
+}
+async function runList(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment);
+  const keys = keySourceFor(project, environment);
+  const parameters = [];
+  for (const resolution of await resolveAll3(environment, project.provider, keys)) {
+    const winner = resolution.winner;
+    const scope = winner?.file.scope;
+    parameters.push({
+      parameter: resolution.parameter,
+      variable: variableName6(resolution.ref, project.config),
+      scope: scope === void 0 ? "absent" : scopeLabel2(scope),
+      location: winner?.location,
+      encrypted: winner?.file.encrypted === true,
+      viaUnscopedFallback: resolution.viaUnscopedFallback
+    });
+  }
+  return { environment, parameters };
+}
+function renderList(result) {
+  if (result.parameters.length === 0) {
+    return [`No parameters in ${PENV_DIR}/ for environment ${result.environment}.`];
+  }
+  return columns(result.parameters.map((entry) => [entry.parameter, entry.scope, entry.variable]));
+}
+var listCommand = defineCommand11({
+  meta: { name: "list", description: "List parameters" },
+  args: {
+    env: { type: "string", description: "The environment to resolve against" },
+    json: { type: "boolean", description: "Print machine-readable JSON" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const result = await runList({
+        cwd: process.cwd(),
+        ...args.env === void 0 ? {} : { environment: args.env }
+      });
+      write(args.json === true ? [JSON.stringify(result, null, 2)] : renderList(result));
+    });
+  }
+});
+
+// src/commands/mv.ts
+import {
+  accessPath as accessPath5,
+  formatMetaFile,
+  formatValueFile as formatValueFile4,
+  openValue as openValue3,
+  PenvError as PenvError13,
+  parameterId as parameterId5,
+  sealValue as sealValue3
+} from "@penvhq/core";
+import { defineCommand as defineCommand12 } from "citty";
+function environmentOf2(file) {
+  const scope = file.scope;
+  return scope.kind === "environment" || scope.kind === "environment-local" ? scope.environment : void 0;
+}
+async function planFile(project, source, target, parameter) {
+  const stored = await project.provider.read(source);
+  if (stored === void 0) {
+    return void 0;
+  }
+  if (!source.encrypted) {
+    return { source, target, contents: stored, resealed: false };
+  }
+  const environment = environmentOf2(source);
+  if (environment === void 0) {
+    throw new PenvError13(
+      "SECRET_SCOPE_AMBIGUOUS",
+      `${PENV_DIR}/${formatValueFile4(source)} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
+      "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
+    );
+  }
+  const keys = keySourceFor(project, environment);
+  const opened = openValue3(source, stored, keys);
+  if (opened.kind === "failed") {
+    throw new PenvError13(
+      "VALUE_UNDECRYPTABLE",
+      `${PENV_DIR}/${formatValueFile4(source)} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
+      "A sealed value is bound to the file it lives in, so moving it means opening it and sealing it again. Make the key available and run this again. Nothing has been moved."
+    );
+  }
+  return {
+    source,
+    target,
+    contents: sealValue3(target, opened.value, keys, parameter, environment),
+    resealed: true
+  };
+}
+function filesOf(all, ref) {
+  const id = parameterId5(ref);
+  return all.filter((file) => parameterId5(file) === id);
+}
+async function runMove(options) {
+  const project = openProject(options.cwd);
+  const from = refFromKey(options.from, project.config);
+  const to = refFromKey(options.to, project.config);
+  if (parameterId5(from) === parameterId5(to)) {
+    throw new PenvError13(
+      "PARAMETER_UNCHANGED",
+      `\`${options.from}\` and \`${options.to}\` are the same parameter`,
+      "Name a different destination, e.g. `penv mv redis-password redis/password`."
+    );
+  }
+  const all = await project.provider.list();
+  const sources = filesOf(all, from);
+  const meta = await project.provider.readMeta(from);
+  if (sources.length === 0 && meta === void 0) {
+    throw new PenvError13(
+      "PARAMETER_ABSENT",
+      `Parameter ${parameterId5(from)} has no value files and no meta, so there is nothing to move`,
+      `\`penv list\` shows every parameter penv holds.`
+    );
+  }
+  const occupied2 = filesOf(all, to);
+  if (occupied2.length > 0 || await project.provider.readMeta(to) !== void 0) {
+    throw new PenvError13(
+      "PARAMETER_EXISTS",
+      `Parameter ${parameterId5(to)} already exists, and penv will not merge two parameters into one`,
+      `Remove or rename ${parameterId5(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
+    );
+  }
+  const planned = [];
+  for (const source of sources) {
+    const target = { ...source, namespace: to.namespace, name: to.name };
+    const one = await planFile(project, source, target, parameterId5(to));
+    if (one !== void 0) {
+      planned.push(one);
+    }
+  }
+  for (const file of planned) {
+    await project.provider.write(file.target, file.contents);
+  }
+  if (meta !== void 0) {
+    await project.provider.writeMeta(to, meta);
+  }
+  for (const file of planned) {
+    await project.provider.remove(file.source);
+  }
+  if (meta !== void 0) {
+    await project.provider.removeMeta(from);
+  }
+  return {
+    from: parameterId5(from),
+    to: parameterId5(to),
+    files: planned.map((file) => ({
+      from: formatValueFile4(file.source),
+      to: formatValueFile4(file.target),
+      resealed: file.resealed
+    })),
+    // The meta's path, not the parameter's dotted id: `redis.password` is what
+    // the schema calls it and `redis/password.json` is the file, and a report
+    // that printed the first while moving the second names no file on disk.
+    meta: meta === void 0 ? void 0 : formatMetaFile({ ...to, format: "json" }),
+    schema: { was: accessPath5(from).join("."), now: accessPath5(to).join(".") }
+  };
+}
+function renderMove(result) {
+  const rows = result.files.map((file) => ({
+    glyph: CHECK,
+    label: "Moved",
+    subject: `${PENV_DIR}/${file.to}`,
+    ...file.resealed ? { detail: "re-sealed for its new address" } : {}
+  }));
+  if (result.meta !== void 0) {
+    rows.push({ glyph: CHECK, label: "Moved", subject: `${PENV_DIR}/${result.meta}` });
+  }
+  const lines = formatRows(rows);
+  lines.push(
+    "",
+    `  .penv/env.ts still declares \`${result.schema.was}\`. Rename it to \`${result.schema.now}\`,`,
+    "  or `penv validate` will report the value as unused and the declaration as unset."
+  );
+  return lines;
+}
+var mvCommand = defineCommand12({
+  meta: { name: "mv", description: "Rename a parameter, every scope and its meta at once" },
+  args: {
+    from: {
+      type: "positional",
+      required: true,
+      description: "The parameter now, e.g. redis-password"
+    },
+    to: {
+      type: "positional",
+      required: true,
+      description: "The parameter after, e.g. redis/password"
+    }
+  },
+  run({ args }) {
+    return guard(async () => {
+      write(renderMove(await runMove({ cwd: process.cwd(), from: args.from, to: args.to })));
+    });
+  }
+});
+
+// src/commands/remove.ts
+import { formatValueFile as formatValueFile5 } from "@penvhq/core";
+import { defineCommand as defineCommand13 } from "citty";
+async function runRemove(options) {
+  const project = openProject(options.cwd);
+  const ref = refFromKey(options.key);
+  const scope = targetScope(project, options, options.key);
+  const files = [false, true].map((encrypted) => ({
+    namespace: ref.namespace,
+    name: ref.name,
+    scope,
+    encrypted
+  }));
+  const removed = [];
+  for (const file of files) {
+    if (await project.provider.read(file) === void 0) {
+      continue;
+    }
+    await project.provider.remove(file);
+    removed.push(formatValueFile5(file));
+  }
+  return {
+    parameter: options.key,
+    removed,
+    considered: files.map((file) => formatValueFile5(file))
+  };
+}
+function renderRemove(result) {
+  if (result.removed.length === 0) {
+    const first = result.considered[0] ?? result.parameter;
+    return formatRows([
+      {
+        glyph: WARN,
+        label: "Nothing to remove",
+        subject: `${PENV_DIR}/${first}`,
+        detail: "no value file at that scope"
+      }
+    ]);
+  }
+  const rows = result.removed.map((location) => ({
+    glyph: CHECK,
+    label: "Removed",
+    subject: `${PENV_DIR}/${location}`
+  }));
+  return formatRows(rows);
+}
+var removeCommand = defineCommand13({
+  meta: { name: "remove", description: "Delete a parameter" },
+  args: {
+    key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
+    env: { type: "string", description: "Remove the <name>.<env> scope" },
+    local: {
+      type: "boolean",
+      description: "Remove the personal override: <name>.<env>.local with --env, else <name>.local"
+    }
+  },
+  run({ args }) {
+    return guard(async () => {
+      write(
+        renderRemove(
+          await runRemove({
+            cwd: process.cwd(),
+            key: args.key,
+            ...args.env === void 0 ? {} : { environment: args.env },
+            ...args.local === void 0 ? {} : { local: args.local }
+          })
+        )
+      );
+    });
+  }
+});
+
+// src/commands/watch.ts
+import { existsSync as existsSync4, watch } from "fs";
+import { basename as basename2, dirname as dirname3, resolve as resolve5 } from "path";
+import { schemaFileOf as schemaFileOf4, schemaInsideTree as schemaInsideTree2 } from "@penvhq/core";
+import { defineCommand as defineCommand14 } from "citty";
+var DEBOUNCE_MS = 100;
+function runWatch(options) {
+  const project = openProject(options.cwd);
+  const configFile = basename2(project.configFile);
+  const debounceMs = options.debounceMs ?? DEBOUNCE_MS;
+  const watchers = /* @__PURE__ */ new Set();
+  let timer;
+  let running = false;
+  let pending = false;
+  let closed = false;
+  async function validate() {
+    if (closed) {
+      return;
+    }
+    if (running) {
+      pending = true;
+      return;
+    }
+    running = true;
+    try {
+      const result = await runValidate({
+        cwd: options.cwd,
+        ...options.environment === void 0 ? {} : { environment: options.environment }
+      });
+      if (!closed) {
+        options.onResult?.(result);
+      }
+    } catch (error) {
+      if (!closed) {
+        options.onError?.(error);
+      }
+    } finally {
+      running = false;
+      if (pending && !closed) {
+        pending = false;
+        void validate();
+      }
+    }
+  }
+  function schedule() {
+    if (closed) {
+      return;
+    }
+    if (timer !== void 0) {
+      clearTimeout(timer);
+    }
+    timer = setTimeout(() => {
+      timer = void 0;
+      void validate();
+    }, debounceMs);
+  }
+  function stop(watcher) {
+    watchers.delete(watcher);
+    watcher.close();
+  }
+  function armRecovery(target, recursive, only) {
+    const parent = dirname3(target);
+    const name = basename2(target);
+    let recovery;
+    try {
+      recovery = watch(parent, { recursive: false }, (_event, filename) => {
+        if (closed || recovery === void 0) {
+          return;
+        }
+        if (!existsSync4(parent)) {
+          stop(recovery);
+          return;
+        }
+        if (filename !== null && basename2(filename) !== name) {
+          return;
+        }
+        if (!existsSync4(target)) {
+          return;
+        }
+        stop(recovery);
+        addWatcher(target, recursive, only);
+        schedule();
+      });
+    } catch (error) {
+      options.onError?.(error);
+      return;
+    }
+    recovery.on("error", (error) => {
+      if (!closed) {
+        options.onError?.(error);
+      }
+    });
+    watchers.add(recovery);
+  }
+  function addWatcher(target, recursive, only) {
+    let watcher;
+    const listen = (useRecursive) => watch(target, { recursive: useRecursive }, (_event, filename) => {
+      if (closed) {
+        return;
+      }
+      if (!existsSync4(target)) {
+        if (watcher !== void 0) {
+          stop(watcher);
+        }
+        armRecovery(target, recursive, only);
+        schedule();
+        return;
+      }
+      if (only !== void 0 && (filename === null || basename2(filename) !== only)) {
+        return;
+      }
+      schedule();
+    });
+    try {
+      watcher = listen(recursive);
+    } catch (error) {
+      if (!recursive) {
+        options.onError?.(error);
+        return;
+      }
+      try {
+        watcher = listen(false);
+      } catch (fallbackError) {
+        options.onError?.(fallbackError);
+        return;
+      }
+    }
+    watcher.on("error", (error) => {
+      if (!closed) {
+        options.onError?.(error);
+      }
+    });
+    watchers.add(watcher);
+  }
+  addWatcher(project.penvDir, true);
+  addWatcher(dirname3(project.configFile), false, configFile);
+  if (schemaInsideTree2(project.config) === void 0) {
+    const schemaFile = resolve5(project.root, schemaFileOf4(project.config));
+    addWatcher(dirname3(schemaFile), false, basename2(schemaFile));
+  }
+  void validate();
+  return {
+    close() {
+      closed = true;
+      if (timer !== void 0) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+      for (const watcher of [...watchers]) {
+        stop(watcher);
+      }
+    }
+  };
+}
+function renderWatch(result) {
+  return ["", ...renderValidate(result), ...renderDrift(result.drift, result.environment)];
+}
+function renderDrift(drift, environment) {
+  const rows = [
+    ...drift.declared.map((item) => ({
+      glyph: WARN,
+      label: "Declared, no value",
+      subject: item.subject,
+      detail: item.detail
+    })),
+    ...drift.undeclared.map((item) => ({
+      glyph: WARN,
+      label: "Unused parameter",
+      subject: item.variable,
+      detail: "present, not in schema"
+    }))
+  ];
+  if (rows.length === 0) {
+    return [];
+  }
+  const lines = ["", `Schema and tree differ for ${environment}:`, ...formatRows(rows)];
+  for (const remedy of new Set(drift.declared.map((item) => item.remedy))) {
+    lines.push(`  ${remedy}`);
+  }
+  return lines;
+}
+var watchCommand = defineCommand14({
+  meta: {
+    name: "watch",
+    description: "Re-validate whenever .penv/ or penv.config.ts changes"
+  },
+  args: {
+    env: { type: "string", description: "The environment to validate" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const handle = runWatch({
+        cwd: process.cwd(),
+        ...args.env === void 0 ? {} : { environment: args.env },
+        onResult: (result) => {
+          write(renderWatch(result));
+        },
+        // A failing cycle is reported and watching continues. `reportError`
+        // marks the process failed, which `validate` wants and a loop does not:
+        // a cycle that failed mid-save ten minutes ago must not decide the exit
+        // code of a session the user ended deliberately. The message is what is
+        // wanted here, not the verdict.
+        onError: (error) => {
+          const previous = process.exitCode;
+          reportError(error);
+          process.exitCode = previous;
+        }
+      });
+      write(["Watching .penv/ and penv.config.ts. Ctrl-C to stop."]);
+      await new Promise((resolve6) => {
+        process.once("SIGINT", () => {
+          handle.close();
+          resolve6();
+        });
+      });
+    });
+  }
+});
+
+// src/index.ts
+var main = defineCommand15({
+  meta: {
+    name: "penv",
+    description: "Configuration that shares a data model with your production secret manager"
+  },
+  subCommands: {
+    init: initCommand,
+    import: importCommand,
+    generate: generateCommand,
+    get: getCommand,
+    set: setCommand,
+    mv: mvCommand,
+    push: pushCommand,
+    remove: removeCommand,
+    list: listCommand,
+    encrypt: encryptCommand,
+    decrypt: decryptCommand,
+    key: keyCommand,
+    validate: validateCommand,
+    doctor: doctorCommand,
+    watch: watchCommand
+  }
+});
+function runMain() {
+  setKeychain(defaultKeychain);
+  return cittyRunMain(main);
+}
+export {
+  LAST_PUSHED_KEY,
+  generateDotenv,
+  importDotenv,
+  insertEnvAlias,
+  main,
+  renderDoctor,
+  renderMove,
+  renderPush,
+  renderWatch,
+  runDecrypt,
+  runDoctor,
+  runEncrypt,
+  runExplain,
+  runGenerate,
+  runGet,
+  runInit,
+  runList,
+  runMain,
+  runMove,
+  runPush,
+  runRemove,
+  runSet,
+  runValidate,
+  runWatch
+};
+//# sourceMappingURL=index.js.map