@penvhq/cli 0.11.0 → 0.13.0

package/dist/index.js

@@ -2,11 +2,12 @@ import {
   detectPackageManager,
   engineVersion,
   installWithPackageManager,
+  installedPackages,
   noCommand,
   planInstall,
   renderInstallPlan,
   startChild
-} from "./chunk-JJY4RLDJ.js";
+} from "./chunk-OBIHFXCK.js";
 
 // src/index.ts
 import { setKeychain } from "@penvhq/core";
@@ -22,7 +23,7 @@ import {
   formatValueFile as formatValueFile2,
   isSecret as isSecret2,
   keySourceIdentifier,
-  PenvError as PenvError7,
+  PenvError as PenvError6,
   parameterId as parameterId3,
   serializeArtifact,
   variableName as variableName3
@@ -453,7 +454,7 @@ function refsFrom(files) {
 }
 
 // src/ui.ts
-import { PenvError as PenvError4 } from "@penvhq/core";
+import { isPenvErrorLike } from "@penvhq/core";
 
 // src/style.ts
 function supportsColor(stream) {
@@ -586,7 +587,7 @@ function writeError(lines) {
   }
 }
 function reportError(error) {
-  if (error instanceof PenvError4) {
+  if (isPenvErrorLike(error)) {
     process.stderr.write(`${err.red(CROSS)} ${error.summary}
 `);
     if (error.remedy !== void 0) {
@@ -629,7 +630,7 @@ import {
   MissingMaterializationError,
   openSealed,
   own,
-  PenvError as PenvError6,
+  PenvError as PenvError5,
   parseArtifact,
   RECORDS_PATH,
   UndecryptableValueError,
@@ -878,7 +879,7 @@ import {
   checkNameCollisions,
   jitiFor,
   NameCollisionError,
-  PenvError as PenvError5,
+  PenvError as PenvError4,
   ReservedTokenError as ReservedTokenError2,
   resolveAll,
   SCHEMA_HARVEST_ENV,
@@ -1227,7 +1228,7 @@ async function checkEnvironment(project, environment) {
   try {
     files = await project.provider.list();
   } catch (error) {
-    if (!(error instanceof PenvError5)) {
+    if (!(error instanceof PenvError4)) {
       throw error;
     }
     return {
@@ -1379,7 +1380,7 @@ function assertNotNested(host, inner) {
   if (outer === void 0) {
     return;
   }
-  throw new PenvError6(
+  throw new PenvError5(
     "RUN_NESTED",
     `\`${inner}\` is starting inside \`${outer}\`, and two penv environments cannot own one process`,
     `Drop one of the two wrappers \u2014 the inner one is in a package.json script \u2014 then run \`${outer}\` again.`
@@ -1389,7 +1390,7 @@ function assertSource(source, inner) {
   if (source === "project" || source === "snapshot") {
     return source;
   }
-  throw new PenvError6(
+  throw new PenvError5(
     "RUN_SOURCE_UNKNOWN",
     `\`--source ${source}\` names no source penv reads`,
     `A run reads ${SOURCES.map((name) => `\`${name}\``).join(" or ")}, and \`project\` is the default \u2014 so \`${inner}\` reads the local tree.`
@@ -1410,7 +1411,7 @@ async function assertNoPublicSecret(project, environment, refs, retry) {
     }
     const parameter = [...ref.namespace, ref.name].join("/");
     const prefix = prefixes.find((candidate) => variable.startsWith(candidate));
-    throw new PenvError6(
+    throw new PenvError5(
       "RUN_PUBLIC_SECRET",
       `The secret ${parameter} maps to ${variable}, which the \`${prefix}\` prefix publishes to the browser`,
       `Rename the parameter, or drop \`secret\` from its meta if it is not one \u2014 then \`${retry}\`.`
@@ -1419,7 +1420,7 @@ async function assertNoPublicSecret(project, environment, refs, retry) {
 }
 function invalidConfiguration(result2, inner) {
   const lines = result2.issues.map((issue) => `  ${issue.subject}: ${issue.message}`).join("\n");
-  return new PenvError6(
+  return new PenvError5(
     "RUN_INVALID_CONFIGURATION",
     `Configuration for environment ${result2.environment} is not valid, so nothing was started:
 ${lines}`,
@@ -1441,7 +1442,7 @@ function assertNoActiveDotenv(project) {
   if (first === void 0) {
     return;
   }
-  throw new PenvError6(
+  throw new PenvError5(
     "RUN_DOTENV_ACTIVE",
     `${first.name} is active configuration again, and your framework would read it beside penv's records`,
     `Adopt it with \`penv init\`, or delete ${first.name} \u2014 its values belong in ${RECORDS_PATH}/.`
@@ -1489,7 +1490,7 @@ function declaredCredentials(config, root) {
       continue;
     }
     if (!Array.isArray(credentials) || credentials.some((name) => typeof name !== "string" || !VARIABLE.test(name))) {
-      throw new PenvError6(
+      throw new PenvError5(
         "PROVIDER_CREDENTIALS_INVALID",
         `\`${provider.type}\` declares \`penv.credentials\`, and it is not a list of variable names`,
         `Its package.json should read \`"penv": { "credentials": ["ACME_TOKEN"] }\` \u2014 penv strips exactly what an extension declares, so it will not guess at a declaration it cannot read.`
@@ -1525,7 +1526,7 @@ async function prepare(project, environment, host, inner) {
 function snapshotPath(host) {
   const path = host[SNAPSHOT_VARIABLE]?.trim();
   if (path === void 0 || path.length === 0) {
-    throw new PenvError6(
+    throw new PenvError5(
       "RUN_SNAPSHOT_UNSET",
       `\`--source snapshot\` reads the sealed artifact ${SNAPSHOT_VARIABLE} names, and ${SNAPSHOT_VARIABLE} is not set`,
       `Build one with \`${ARTIFACT_BUILD_COMMAND}\` and point ${SNAPSHOT_VARIABLE} at it.`
@@ -1537,7 +1538,7 @@ function readSnapshot(path) {
   try {
     return readFileSync3(path, "utf8");
   } catch {
-    throw new PenvError6(
+    throw new PenvError5(
       "RUN_SNAPSHOT_MISSING",
       `${SNAPSHOT_VARIABLE} names ${path}, and penv cannot read a sealed artifact there`,
       `Point ${SNAPSHOT_VARIABLE} at the artifact your release mounted \u2014 \`${ARTIFACT_BUILD_COMMAND}\` writes one.`
@@ -1653,7 +1654,7 @@ async function runRun(options) {
   }
   if (source === "snapshot") {
     if (options.watch === true) {
-      throw new PenvError6(
+      throw new PenvError5(
         "RUN_SNAPSHOT_WATCH",
         "`--watch` re-syncs the project tree, and a run from a sealed artifact has no tree to watch",
         "Drop `--watch` \u2014 an artifact is built once and read unchanged. Watch the project instead: `penv run --watch -- <command>`."
@@ -1797,7 +1798,7 @@ function buildCommand(environment, out2) {
 function targetOf(options) {
   const environment = options.environment?.trim();
   if (environment === void 0 || environment.length === 0) {
-    throw new PenvError7(
+    throw new PenvError6(
       "ARTIFACT_ENV_REQUIRED",
       "`penv artifact build` names the environment it builds for, and `--env` was not given",
       `Name it: \`${buildCommand(void 0, options.out)}\`. An artifact carries one environment, and penv will not pick which.`
@@ -1808,7 +1809,7 @@ function targetOf(options) {
 function outputOf(options, environment) {
   const out2 = options.out?.trim();
   if (out2 === void 0 || out2.length === 0) {
-    throw new PenvError7(
+    throw new PenvError6(
       "ARTIFACT_OUT_REQUIRED",
       "`penv artifact build` writes where it is told, and `--out` was not given",
       `Name the path: \`${buildCommand(environment, void 0)}\`. The artifact belongs outside the repository, so there is no default worth having.`
@@ -1826,7 +1827,7 @@ async function winnerOf(project, ref, environment) {
   return void 0;
 }
 function plaintextSecret(parameter, location, environment) {
-  return new PenvError7(
+  return new PenvError6(
     "ARTIFACT_PLAINTEXT_SECRET",
     `${parameter} is a secret for environment ${environment}, and its value comes from ${location}, which is not sealed`,
     `Seal it with \`penv encrypt ${parameter} --env ${environment}\` \u2014 an artifact carries ciphertext or nothing.`
@@ -1840,7 +1841,7 @@ async function runArtifactBuild(options) {
   const { schema, issues } = await loadSchema(project, environment);
   if (schema === void 0) {
     const lines = issues.map((issue) => `  ${issue.subject}: ${issue.message}`).join("\n");
-    throw new PenvError7(
+    throw new PenvError6(
       "ARTIFACT_NO_SCHEMA",
       `The schema did not load, so penv cannot tell what this artifact should deliver:
 ${lines}`,
@@ -1965,7 +1966,7 @@ import { dirname as dirname4, join as join4, resolve as resolve4 } from "path";
 import {
   CUTOVER_PATH,
   findConfigFile,
-  PenvError as PenvError8,
+  PenvError as PenvError7,
   ROLLBACK_DOTENV_PATH,
   ROLLBACK_PATH
 } from "@penvhq/core";
@@ -2026,7 +2027,7 @@ function readCutover(root) {
   };
 }
 function unreadable(what) {
-  return new PenvError8(
+  return new PenvError7(
     "CUTOVER_UNREADABLE",
     `${CUTOVER_PATH} records the last dotenv cutover, and ${what}`,
     `Run \`penv cleanup\` to drop that record and the rollback bundle it names.`
@@ -2067,7 +2068,7 @@ function runUndo(options) {
   const cutover = readCutover(root);
   const bundled = bundledFiles(root);
   if (cutover === void 0 && bundled.length === 0) {
-    throw new PenvError8(
+    throw new PenvError7(
       "INIT_UNDO_NOTHING",
       "There is no dotenv cutover to undo in this project",
       "Run `penv init` to adopt your dotenv files; undo puts them back afterwards."
@@ -2081,7 +2082,7 @@ function runUndo(options) {
   if (occupied2.length > 0) {
     const listed = occupied2.join(", ");
     const many = occupied2.length > 1;
-    throw new PenvError8(
+    throw new PenvError7(
       "INIT_UNDO_OCCUPIED",
       `${listed} ${many ? "exist" : "exists"} again, and restoring what penv moved aside would write over ${many ? "them" : "it"}`,
       `Move ${listed} out of the way, or run \`penv cleanup\` to keep ${many ? "them" : "it"} and drop the bundle. Nothing was restored.`
@@ -2174,7 +2175,7 @@ import { defineCommand as defineCommand7 } from "citty";
 import {
   checkNameCollisions as checkNameCollisions2,
   holdsProjection as holdsProjection3,
-  PenvError as PenvError9,
+  PenvError as PenvError8,
   recordPath,
   requireValue,
   variableName as variableName4
@@ -2242,7 +2243,7 @@ async function destinationFor(project, environment, options) {
   const declared = project.config.providers[environment];
   const location = declared?.location;
   if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
-    throw new PenvError9(
+    throw new PenvError8(
       "NO_DESTINATION",
       `Environment ${environment}'s provider is the local records tree itself, so penv has nowhere to push`,
       `Declare a provider for it in penv.config.ts \u2014 e.g. \`${environment}: { type: "@penvhq/provider-github", location: "owner/repo" }\` \u2014 or push somewhere once with \`penv push --env ${environment} --destination <package> --location <place>\`.`
@@ -2269,7 +2270,7 @@ function plan(resolutions, config, environment, allowDecrypt) {
     let encrypted = false;
     if (winner.file.encrypted) {
       if (!allowDecrypt) {
-        throw new PenvError9(
+        throw new PenvError8(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${recordPath(winner.location)}, and a push sends plaintext for the destination to re-seal`,
           "Re-run with `--allow-decrypt` to decrypt it locally and push it, or push an environment whose values are plaintext. penv's encryption stops at the projection; the destination seals it under its own key."
@@ -2322,7 +2323,7 @@ async function ensureTargetApproved(provider, environment, options) {
     return false;
   }
   if (provider.ensureTarget === void 0) {
-    throw new PenvError9(
+    throw new PenvError8(
       "MISSING_TARGET",
       `The destination has no environment \`${environment}\` to receive this push, and this provider cannot create one`,
       `Create the environment on the destination side, then run \`penv push --env ${environment}\` again.`
@@ -2332,7 +2333,7 @@ async function ensureTargetApproved(provider, environment, options) {
     `The destination has no environment \`${environment}\`. Create it?`
   );
   if (!approved) {
-    throw new PenvError9(
+    throw new PenvError8(
       "MISSING_TARGET",
       `The destination has no environment \`${environment}\` to receive this push`,
       `Re-run with \`--yes\` to create it, answer \`y\` at the prompt, or create it on the destination side yourself.`
@@ -3496,7 +3497,7 @@ import {
   formatValueFile as formatValueFile5,
   isSecret as isSecret5,
   openValue as openValue3,
-  PenvError as PenvError11,
+  PenvError as PenvError10,
   parameterId as parameterId5,
   recordPath as recordPath3,
   sealValue as sealValue2
@@ -3507,7 +3508,7 @@ import { defineCommand as defineCommand9 } from "citty";
 import {
   formatValueFile as formatValueFile4,
   isSecret as isSecret4,
-  PenvError as PenvError10,
+  PenvError as PenvError9,
   parameterId as parameterId4,
   recordPath as recordPath2,
   sealValue
@@ -3531,7 +3532,7 @@ function targetScope(project, options, key) {
     return scopeFrom(options);
   }
   if (environment.trim().length === 0) {
-    throw new PenvError10(
+    throw new PenvError9(
       "ENVIRONMENT_FLAG_EMPTY",
       `\`--env\` for parameter ${key} names no environment`,
       `Pass a declared environment \u2014 ${project.config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
@@ -3544,7 +3545,7 @@ function policyEnvironment(project, options) {
 }
 function sealFor(project, file, value, parameter, environment) {
   if (environment === void 0) {
-    throw new PenvError10(
+    throw new PenvError9(
       "SECRET_SCOPE_AMBIGUOUS",
       `Parameter ${parameter} is a secret, and ${recordPath2(formatValueFile4(file))} names no environment`,
       "Keys are declared per environment in the `keys` block of penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
@@ -3646,7 +3647,7 @@ function twins(project, key, options) {
 }
 function environmentFor(project, options, verb) {
   if (options.environment === void 0) {
-    throw new PenvError11(
+    throw new PenvError10(
       "SECRET_SCOPE_AMBIGUOUS",
       `\`penv ${verb}\` names no environment, and keys are declared per environment`,
       "Pass `--env <environment>`. penv cannot tell which environment's key applies to a file that names none, and will not pick one for you."
@@ -3665,7 +3666,7 @@ async function runEncrypt(options) {
   const value = await readOne(project, plain);
   if (value === void 0) {
     const already = await readOne(project, sealed);
-    throw new PenvError11(
+    throw new PenvError10(
       "PARAMETER_ABSENT",
       already === void 0 ? `Parameter ${parameter} has no value file at ${recordPath3(formatValueFile5(plain))}` : `Parameter ${parameter} is already encrypted at ${recordPath3(formatValueFile5(sealed))}`,
       already === void 0 ? `Write it first with \`penv set ${options.key} --env ${environment}\`, which seals it automatically when the parameter's meta declares it a secret.` : "Nothing to do."
@@ -3686,7 +3687,7 @@ async function runDecrypt(options) {
   const [plain, sealed] = twins(project, options.key, options);
   const parameter = parameterId5(plain);
   if (isSecret5(await project.provider.readMeta(plain), environment)) {
-    throw new PenvError11(
+    throw new PenvError10(
       "SECRET_DECRYPT_REFUSED",
       `Parameter ${parameter} is declared a secret for environment ${environment}, so penv will not write it in plaintext`,
       "A secret with a plaintext value file is a `penv doctor` failure. Drop `secret` from the parameter's meta if it is not one, or run `penv generate --allow-decrypt` if you need the plaintext value in a `.env` artifact."
@@ -3694,7 +3695,7 @@ async function runDecrypt(options) {
   }
   const stored = await readOne(project, sealed);
   if (stored === void 0) {
-    throw new PenvError11(
+    throw new PenvError10(
       "PARAMETER_ABSENT",
       `Parameter ${parameter} has no encrypted value file at ${recordPath3(formatValueFile5(sealed))}`,
       `Nothing to decrypt. \`penv get ${options.key} --env ${environment} --explain\` shows every file penv looked at.`
@@ -3717,7 +3718,7 @@ async function runDecrypt(options) {
     removed: formatValueFile5(sealed)
   };
 }
-var UndecryptableAt = class extends PenvError11 {
+var UndecryptableAt = class extends PenvError10 {
   constructor(parameter, environment, location, detail) {
     super(
       "VALUE_UNDECRYPTABLE",
@@ -3772,7 +3773,7 @@ var decryptCommand = defineCommand9({
 });
 
 // src/commands/fill.ts
-import { PenvError as PenvError12, recordPath as recordPath4, SCHEMA_SHAPE_FILE as SCHEMA_SHAPE_FILE2 } from "@penvhq/core";
+import { PenvError as PenvError11, recordPath as recordPath4, SCHEMA_SHAPE_FILE as SCHEMA_SHAPE_FILE2 } from "@penvhq/core";
 import { defineCommand as defineCommand10 } from "citty";
 var BLOCKING = /* @__PURE__ */ new Set(["config", "collision", "reserved"]);
 async function runFill(options) {
@@ -3787,7 +3788,7 @@ async function runFill(options) {
     const detail = blockers.map(
       (issue) => `  - ${issue.message}${issue.remedy === void 0 ? "" : ` (${issue.remedy})`}`
     ).join("\n");
-    throw new PenvError12(
+    throw new PenvError11(
       "FILL_BLOCKED",
       `penv fill cannot run: environment ${environment} has ${blockers.length} unresolved configuration ${blockers.length === 1 ? "issue" : "issues"}:
 ${detail}`,
@@ -3927,7 +3928,7 @@ import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve5 }
 import {
   checkNameCollisions as checkNameCollisions3,
   effectiveMeta as effectiveMeta2,
-  PenvError as PenvError13,
+  PenvError as PenvError12,
   recordPath as recordPath5,
   requireValue as requireValue2,
   serializeDotenv,
@@ -3952,7 +3953,7 @@ function entriesFor(project, environment, allowDecrypt) {
     const winner = resolution.winner;
     if (winner?.file.encrypted === true) {
       if (!allowDecrypt) {
-        throw new PenvError13(
+        throw new PenvError12(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${recordPath5(winner.location)}, and \`penv generate\` writes plaintext`,
           `Re-run with \`--allow-decrypt\` to write the decrypted value into the artifact, or generate for an environment whose values are plaintext. The artifact is gitignored; a committed plaintext secret is a \`penv doctor\` failure.`
@@ -4036,7 +4037,7 @@ var generateCommand = defineCommand11({
 });
 
 // src/commands/get.ts
-import { PenvError as PenvError14, recordPath as recordPath6, requireValue as requireValue3, resolveParameter } from "@penvhq/core";
+import { PenvError as PenvError13, recordPath as recordPath6, requireValue as requireValue3, resolveParameter } from "@penvhq/core";
 import { defineCommand as defineCommand12 } from "citty";
 async function runGet(options) {
   const project = openProject(options.cwd);
@@ -4046,7 +4047,7 @@ async function runGet(options) {
   const resolution = await resolveParameter(ref, environment, project.provider, keys);
   const value = requireValue3(resolution, environment);
   if (value === void 0) {
-    throw new PenvError14(
+    throw new PenvError13(
       "PARAMETER_ABSENT",
       `Parameter ${resolution.parameter} resolves to no value for environment ${environment}`,
       `Set it with \`penv set ${options.key} --env ${environment}\`, or run \`penv get ${options.key} --env ${environment} --explain\` to see every file penv looked at.`
@@ -4130,7 +4131,7 @@ import {
   findConfigFile as findConfigFile2,
   loadConfigFrom as loadConfigFrom2,
   lookupEnvironment,
-  PenvError as PenvError17,
+  PenvError as PenvError16,
   parseDotenv as parseDotenv2,
   schemaFileOf as schemaFileOf4,
   UnknownEnvironmentError
@@ -4141,7 +4142,7 @@ import { defineCommand as defineCommand14 } from "citty";
 import {
   checkNameCollisions as checkNameCollisions4,
   isReservedToken as isReservedToken3,
-  PenvError as PenvError15,
+  PenvError as PenvError14,
   ReservedTokenError as ReservedTokenError3,
   refFromVariable as refFromVariable2,
   roundTripsCleanly,
@@ -4151,7 +4152,7 @@ function assertImportable(ref, variable) {
   if (!ref.name.includes(".")) {
     return;
   }
-  throw new PenvError15(
+  throw new PenvError14(
     "IMPORT_UNPARSEABLE_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, whose \`.\` would be read as a scope`,
     `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
@@ -4170,7 +4171,7 @@ function assertRoundTrips(ref, variable, config) {
     return;
   }
   const generated = variableName7(ref, config);
-  throw new PenvError15(
+  throw new PenvError14(
     "IMPORT_LOSSY_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, which regenerates as ${generated}`,
     `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`override\` block of penv.config.ts \u2014 \`override: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
@@ -4385,7 +4386,7 @@ import {
   isLegalEnvironmentName as isLegalEnvironmentName2,
   loadConfigFrom,
   PENV_DIR as PENV_DIR2,
-  PenvError as PenvError16,
+  PenvError as PenvError15,
   parameterId as parameterId6,
   parseDotenv,
   RECORDS_PATH as RECORDS_PATH3,
@@ -4666,7 +4667,7 @@ function suggestEnvironments(root) {
   return [...found].sort();
 }
 function emptyFlag(flag) {
-  return new PenvError16(
+  return new PenvError15(
     "INIT_FLAG_EMPTY",
     `\`--${flag}\` was given without a value`,
     flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${DEFAULT_SCHEMA_FILE2}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
@@ -4729,7 +4730,7 @@ function planInit(root, flags = {}) {
     throw emptyFlag("alias");
   }
   if (!ALIAS_NAME.test(alias)) {
-    throw new PenvError16(
+    throw new PenvError15(
       "INIT_ALIAS_INVALID",
       `\`${alias}\` is not an alias penv can write`,
       `An alias is \`@name\` \u2014 a tsconfig \`paths\` entry a bundler resolves \u2014 or \`#name\`, a package.json \`imports\` entry Node resolves itself. Those are the two things a module specifier can be that is not a package.`
@@ -5063,7 +5064,7 @@ ${objectIndent}${source.slice(close)}`;
 ${entryIndent}${member},${source.slice(open + 1)}`;
 }
 function shapeError(what, target, alias) {
-  return new PenvError16(
+  return new PenvError15(
     "TSCONFIG_SHAPE",
     `penv cannot add the \`${alias}\` path alias to tsconfig.json: ${what}`,
     `Add it by hand: \`{ "compilerOptions": { "paths": { "${alias}": ["${target}"] } } }\`.`
@@ -5405,7 +5406,7 @@ function planCutover(input) {
   assertBundleResolved(root);
   const selected = [...input.selected];
   if (selected.length === 0) {
-    throw new PenvError16(
+    throw new PenvError15(
       "INIT_NOTHING_SELECTED",
       "No dotenv file was selected, so there is nothing to migrate",
       "Run `penv init` again and choose the files penv should adopt."
@@ -5417,7 +5418,7 @@ function planCutover(input) {
   const environments = declared === void 0 ? chosen : declared.environments;
   for (const environment of chosen) {
     if (!environments.includes(environment)) {
-      throw new PenvError16(
+      throw new PenvError15(
         "INIT_ENVIRONMENT_UNDECLARED",
         `${CONFIG_FILE} declares ${describeList(environments)}, and adopting these files needs \`${environment}\` declared too`,
         `Add \`${environment}\` to \`environments\` in ${CONFIG_FILE}, with a provider for it, then run \`penv init\` again. Nothing was changed.`
@@ -5504,7 +5505,7 @@ function requireEnvironment(input) {
   if (environment.length > 0) {
     return environment;
   }
-  throw new PenvError16(
+  throw new PenvError15(
     "INIT_ENVIRONMENT_UNNAMED",
     "The selected files name no environment, and penv does not invent one",
     `Run \`penv init --env ${DEVELOPMENT}\` to say which environment these values are for.`
@@ -5516,7 +5517,7 @@ function assertCascadeComplete(root, selected, environments) {
   for (const environment of environments) {
     for (const name of cascadeFor(environment)) {
       if (present.has(name) && !taken.has(name)) {
-        throw new PenvError16(
+        throw new PenvError15(
           "INIT_CUTOVER_INCOMPLETE",
           `${name} is part of ${environment}'s cascade and was not selected, so your framework would keep reading it beside penv`,
           "Run `penv init` again and take every file penv listed for that environment. Nothing was changed."
@@ -5529,7 +5530,7 @@ function assertBundleResolved(root) {
   if (!bundleUnresolved(root)) {
     return;
   }
-  throw new PenvError16(
+  throw new PenvError15(
     "INIT_BUNDLE_UNRESOLVED",
     `The dotenv files from the last cutover are still in ${ROLLBACK_DOTENV_PATH3}/, and penv will not migrate a second time over them`,
     "Run `penv init undo` to put them back, or `penv cleanup` to drop them once you are happy with the migration."
@@ -5541,7 +5542,7 @@ function selectionForYes(plan2) {
     (file) => file.environment !== void 0 && file.environment !== DEVELOPMENT
   );
   if (shared !== void 0 && other !== void 0) {
-    throw new PenvError16(
+    throw new PenvError15(
       "INIT_YES_SHARED_FALLBACK",
       `${other.name} falls back to the shared ${shared.name} this cutover would move, so \`--yes\` will not decide what happens to ${other.environment ?? ""}`,
       "Run `penv init` without `--yes` and choose every file the cutover takes. Nothing was changed."
@@ -5587,7 +5588,7 @@ function issueLines(result2) {
 }
 var SCAFFOLD_ROLLED_BACK = "penv put the project back as it found it \u2014 your dotenv files and everything else are exactly where they were.";
 function invalidAfterImport(result2) {
-  return new PenvError16(
+  return new PenvError15(
     "INIT_CUTOVER_INVALID",
     `The imported values do not satisfy the draft schema for ${result2.environment}:
 ${issueLines(result2)}`,
@@ -5595,7 +5596,7 @@ ${issueLines(result2)}`,
   );
 }
 function draftNotLoaded(result2) {
-  return new PenvError16(
+  return new PenvError15(
     "INIT_DRAFT_NOT_LOADED",
     `penv could not load the schema it drafted for ${result2.environment}, so nothing was checked against it:
 ${issueLines(result2)}`,
@@ -5662,7 +5663,11 @@ function renderCutover(result2) {
       const glyph = step.action === "conflicted" ? WARN : step.action === "info" ? "\u2192" : CHECK;
       return step.note === void 0 ? { glyph, text: step.text } : { glyph, text: step.text, note: step.note };
     }),
-    ...plan2.install.packages.filter((entry) => !entry.satisfied).map((entry) => ({ glyph: CHECK, text: `Installed ${entry.name}`, note: entry.version })),
+    ...installedPackages(plan2.install).map((entry) => ({
+      glyph: CHECK,
+      text: `Installed ${entry.name}`,
+      note: entry.version
+    })),
     {
       glyph: CHECK,
       text: `Imported ${plan2.fields.length} parameters`,
@@ -5735,7 +5740,7 @@ async function promptForSelection(plan2, io) {
   for (const name of names) {
     const file = plan2.found.find((candidate) => candidate.name === name);
     if (file === void 0) {
-      throw new PenvError16(
+      throw new PenvError15(
         "INIT_SELECTION_UNKNOWN",
         `\`${name}\` is not one of the dotenv files penv found`,
         "Run `penv init` again and name the files exactly as they are listed, e.g. `.env.production`."
@@ -5898,7 +5903,7 @@ var initCommand = defineCommand13({
 });
 function runUndoAction(root, action) {
   if (action !== "undo") {
-    throw new PenvError16(
+    throw new PenvError15(
       "INIT_UNKNOWN_ACTION",
       `\`penv init ${action}\` is not something init does`,
       "Run `penv init undo` to put back the dotenv files of the last cutover."
@@ -6004,7 +6009,7 @@ function explicitEnvironment(options, source, config) {
   if (value.length > 0) {
     return value;
   }
-  throw new PenvError17(
+  throw new PenvError16(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
     `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
@@ -6014,7 +6019,7 @@ function assertEnvironmentAgrees(derived, explicit, source) {
   if (derived === void 0 || explicit === void 0 || derived === explicit) {
     return;
   }
-  throw new PenvError17(
+  throw new PenvError16(
     "IMPORT_ENV_CONFLICT",
     `The file ${source} is scoped to environment ${derived}, but \`--env ${explicit}\` names ${explicit}`,
     `Drop \`--env\` to import ${source} as ${derived}, pass \`--env ${derived}\` to say the same thing twice, or point \`penv import\` at the file that holds ${explicit}'s values. Nothing was imported.`
@@ -6061,7 +6066,7 @@ function importDotenv(options) {
   const cwd = resolve7(options.cwd);
   const file = isAbsolute3(options.file) ? options.file : resolve7(cwd, options.file);
   if (!existsSync7(file)) {
-    throw new PenvError17(
+    throw new PenvError16(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
@@ -6185,19 +6190,19 @@ var importCommand = defineCommand14({
 
 // src/commands/key.ts
 import { randomBytes } from "crypto";
-import { KEY_BYTES, KEYCHAIN_SERVICE, PenvError as PenvError19 } from "@penvhq/core";
+import { KEY_BYTES, KEYCHAIN_SERVICE, PenvError as PenvError18 } from "@penvhq/core";
 import { defineCommand as defineCommand15 } from "citty";
 
 // src/keychain.ts
 import { createRequire as createRequire3 } from "module";
-import { PenvError as PenvError18 } from "@penvhq/core";
+import { PenvError as PenvError17 } from "@penvhq/core";
 var KEYRING_MODULE = "@napi-rs/keyring";
 var nodeRequire = (id) => createRequire3(import.meta.url)(id);
 function firstLine2(cause) {
   return (cause instanceof Error ? cause.message : String(cause)).split("\n")[0] ?? "";
 }
 function keyringMissing(cause) {
-  return new PenvError18(
+  return new PenvError17(
     "KEYCHAIN_BINDING_MISSING",
     `penv could not load ${KEYRING_MODULE}, the native binding it reads your OS keychain through`,
     `This penv engine was installed as a plain tarball, which carries no native modules. Install penv with \`npm install -g @penvhq/launcher\`, or declare \`source: "env"\` for this environment and export its key. Original error: ${firstLine2(cause)}`
@@ -6239,7 +6244,7 @@ function runKeyCreate(options) {
   const environment = targetEnvironment(project, options.environment);
   const declared = project.config.keys?.[environment];
   if (declared === void 0) {
-    throw new PenvError19(
+    throw new PenvError18(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
       `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
@@ -6253,17 +6258,17 @@ function runKeyCreate(options) {
       try {
         existing = keychain.getPassword(KEYCHAIN_SERVICE, declared.id);
       } catch (cause) {
-        if (cause instanceof PenvError19) {
+        if (cause instanceof PenvError18) {
           throw cause;
         }
-        throw new PenvError19(
+        throw new PenvError18(
           "KEYCHAIN_UNAVAILABLE",
           `penv could not read your OS keychain to check for an existing key \`${declared.id}\``,
           `Unlock your keychain and run this again. Original error: ${cause instanceof Error ? cause.message : String(cause)}`
         );
       }
       if (existing !== null) {
-        throw new PenvError19(
+        throw new PenvError18(
           "KEY_EXISTS",
           `Environment ${environment} already has a key \`${declared.id}\` in your OS keychain`,
           "Replacing it would orphan every value already sealed under it \u2014 they could never be decrypted again. Re-run with `--force` only if you are certain nothing is sealed under the current key."
@@ -6432,7 +6437,7 @@ import {
   loadConfig as loadConfig2,
   oldLayoutEntries,
   PENV_DIR as PENV_DIR3,
-  PenvError as PenvError20,
+  PenvError as PenvError19,
   RECORDS_PATH as RECORDS_PATH5,
   recordsDir as recordsDir3,
   renderStateGitignore as renderStateGitignore2,
@@ -6447,7 +6452,7 @@ function planMigrate(cwd) {
   const tree = recordsDir3(root);
   const collisions = collidingEntries(entries, tree);
   if (collisions.length > 0) {
-    throw new PenvError20(
+    throw new PenvError19(
       "HALF_MIGRATED",
       `${describe(collisions)} in both \`${PENV_DIR3}/\` and \`${RECORDS_PATH5}/\`, and penv cannot tell which copy is current`,
       `Move what is left under \`${PENV_DIR3}/\` into \`${RECORDS_PATH5}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
@@ -6588,7 +6593,7 @@ import {
   formatMetaFile,
   formatValueFile as formatValueFile6,
   openValue as openValue4,
-  PenvError as PenvError21,
+  PenvError as PenvError20,
   parameterId as parameterId7,
   recordPath as recordPath7,
   sealValue as sealValue3
@@ -6608,7 +6613,7 @@ async function planFile(project, source, target, parameter) {
   }
   const environment = environmentOf2(source);
   if (environment === void 0) {
-    throw new PenvError21(
+    throw new PenvError20(
       "SECRET_SCOPE_AMBIGUOUS",
       `${recordPath7(formatValueFile6(source))} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
       "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
@@ -6617,7 +6622,7 @@ async function planFile(project, source, target, parameter) {
   const keys = keySourceFor(project, environment);
   const opened = openValue4(source, stored, keys);
   if (opened.kind === "failed") {
-    throw new PenvError21(
+    throw new PenvError20(
       "VALUE_UNDECRYPTABLE",
       `${recordPath7(formatValueFile6(source))} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
       "A sealed value is bound to the file it lives in, so moving it means opening it and sealing it again. Make the key available and run this again. Nothing has been moved."
@@ -6640,7 +6645,7 @@ async function runMove(options) {
   assertWritableKey(options.to);
   const to = refFromKey(options.to, project.config);
   if (parameterId7(from) === parameterId7(to)) {
-    throw new PenvError21(
+    throw new PenvError20(
       "PARAMETER_UNCHANGED",
       `\`${options.from}\` and \`${options.to}\` are the same parameter`,
       "Name a different destination, e.g. `penv mv redis-password redis/password`."
@@ -6650,7 +6655,7 @@ async function runMove(options) {
   const sources = filesOf(all, from);
   const meta = await project.provider.readMeta(from);
   if (sources.length === 0 && meta === void 0) {
-    throw new PenvError21(
+    throw new PenvError20(
       "PARAMETER_ABSENT",
       `Parameter ${parameterId7(from)} has no value files and no meta, so there is nothing to move`,
       `\`penv list\` shows every parameter penv holds.`
@@ -6658,7 +6663,7 @@ async function runMove(options) {
   }
   const occupied2 = filesOf(all, to);
   if (occupied2.length > 0 || await project.provider.readMeta(to) !== void 0) {
-    throw new PenvError21(
+    throw new PenvError20(
       "PARAMETER_EXISTS",
       `Parameter ${parameterId7(to)} already exists, and penv will not merge two parameters into one`,
       `Remove or rename ${parameterId7(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
@@ -6817,7 +6822,7 @@ import {
   beginRotation,
   completeRotation,
   holdsRecords as holdsRecords2,
-  PenvError as PenvError22,
+  PenvError as PenvError21,
   retainsPrevious,
   rotationOf as rotationOf2
 } from "@penvhq/core";
@@ -6846,7 +6851,7 @@ async function writeRotatedValue(project, provider, ref, environment, value) {
 }
 function requireNewValue(value, phase, key) {
   if (value === void 0) {
-    throw new PenvError22(
+    throw new PenvError21(
       "ROTATION_NO_VALUE",
       `A ${phase} rotation of ${key} writes a new value, and none was given`,
       "Pass the new value as the argument \u2014 `penv rotate <key> <value>` \u2014 or pipe it in on stdin."
@@ -6856,7 +6861,7 @@ function requireNewValue(value, phase, key) {
 }
 function requireRetaining(provider, environment) {
   if (!retainsPrevious(provider)) {
-    throw new PenvError22(
+    throw new PenvError21(
       "ROTATION_NOT_RETAINING",
       `A dual-valid rotation needs the previous value to stay readable during the grace window, and the \`${provider.type}\` provider for environment ${environment} does not retain it`,
       "Point this environment at a provider that keeps prior versions (its `readPrevious` is what penv reads during the window), or, if a momentary overlap is not required, declare the parameter `atomic-cutover` in its meta and flip it in one step."
@@ -6870,7 +6875,7 @@ async function runRotate(options) {
   const ref = refFromKey(options.key, project.config);
   const source = await sourceProviderFor(project, environment);
   if (!holdsRecords2(source)) {
-    throw new PenvError22(
+    throw new PenvError21(
       "ROTATION_NOT_RECORDS",
       `Environment ${environment} is backed by \`${source.type}\`, which holds a resolved projection penv cannot rotate in place`,
       "Rotate the parameter in the environment that holds the records (the local tree, Vault, SSM), then `penv push` the result to this destination."
@@ -6881,7 +6886,7 @@ async function runRotate(options) {
   const before = await provider.readMeta(ref);
   const { mechanism } = rotationOf2(before, environment);
   if (mechanism === void 0) {
-    throw new PenvError22(
+    throw new PenvError21(
       "ROTATION_NO_MECHANISM",
       `Parameter ${options.key} declares no rotation mechanism for environment ${environment}, so penv does not know how to rotate it`,
       'Set `rotationMechanism` in the parameter\'s meta to `"dual-valid"` (a grace-window overlap) or `"atomic-cutover"` (a single flip), then run `penv rotate` again.'
@@ -6891,7 +6896,7 @@ async function runRotate(options) {
   const complete = options.complete === true;
   if (mechanism === "atomic-cutover") {
     if (begin || complete) {
-      throw new PenvError22(
+      throw new PenvError21(
         "ROTATION_MECHANISM_MISMATCH",
         `Parameter ${options.key} is atomic-cutover, which flips in one step, so \`--begin\`/\`--complete\` do not apply`,
         "Run `penv rotate <key> <value>` with no phase flag to flip it. `--begin`/`--complete` bracket a dual-valid grace window, which atomic-cutover has none of."
@@ -6905,7 +6910,7 @@ async function runRotate(options) {
   }
   const retaining = requireRetaining(provider, environment);
   if (begin === complete) {
-    throw new PenvError22(
+    throw new PenvError21(
       "ROTATION_PHASE_REQUIRED",
       `A dual-valid rotation of ${options.key} needs exactly one of \`--begin\` or \`--complete\``,
       "`--begin` writes the new value and opens the grace window; `--complete` closes it once every reader has moved to the new value. Run them in that order, one at a time."