@penvhq/cli 0.7.0 → 0.8.0

package/dist/index.cjs

@@ -31,6 +31,7 @@ __export(index_exports, {
   renderPull: () => renderPull,
   renderPush: () => renderPush,
   renderRotate: () => renderRotate,
+  renderSnapshot: () => renderSnapshot,
   renderWatch: () => renderWatch,
   runDecrypt: () => runDecrypt,
   runDoctor: () => runDoctor,
@@ -48,15 +49,18 @@ __export(index_exports, {
   runRemove: () => runRemove,
   runRotate: () => runRotate,
   runSet: () => runSet,
+  runSnapshot: () => runSnapshot,
   runValidate: () => runValidate,
   runWatch: () => runWatch
 });
 module.exports = __toCommonJS(index_exports);
-var import_core24 = require("@penvhq/core");
-var import_citty18 = require("citty");
+var import_core25 = require("@penvhq/core");
+var import_citty19 = require("citty");
 
 // src/commands/doctor.ts
-var import_core8 = require("@penvhq/core");
+var import_node_fs3 = require("fs");
+var import_node_path5 = require("path");
+var import_core9 = require("@penvhq/core");
 var import_citty3 = require("citty");
 
 // src/env-flags.ts
@@ -118,6 +122,7 @@ function environmentFromShorthand(config, candidates, explicit) {
 }
 
 // src/project.ts
+var import_node_fs = require("fs");
 var import_node_path2 = require("path");
 var import_core3 = require("@penvhq/core");
 var import_provider_filesystem2 = require("@penvhq/provider-filesystem");
@@ -272,6 +277,18 @@ function localTree(project) {
   }
   return project.provider;
 }
+function selfContainedSchemaModule(root, schemaFile) {
+  const file = (0, import_node_path2.join)(root, ...schemaFile.split("/"));
+  if (!(0, import_node_fs.existsSync)(file)) {
+    return void 0;
+  }
+  const source = (0, import_node_fs.readFileSync)(file, "utf8");
+  return source.includes("PenvSchemaShape") || source.includes("z.object") ? schemaFile : void 0;
+}
+function schemaShapeFileOf(project) {
+  const schemaFile = (0, import_core3.schemaFileOf)(project.config);
+  return selfContainedSchemaModule(project.root, schemaFile) ?? import_core3.SCHEMA_SHAPE_FILE;
+}
 async function sourceProviderFor(project, environment) {
   const providerConfig = project.config.providers[environment];
   if (providerConfig === void 0) {
@@ -497,7 +514,7 @@ function hasValue(resolution) {
   return resolution.winner !== void 0;
 }
 function computeDrift(input) {
-  const { schema, resolutions, config, environment } = input;
+  const { schema, resolutions, config, environment, schemaShapeFile } = input;
   const valued = new Set(resolutions.filter(hasValue).map((resolution) => resolution.parameter));
   const declared = [];
   const optional = [];
@@ -507,7 +524,7 @@ function computeDrift(input) {
     }
     const path = leaf.path.join(".");
     const ref = (0, import_core4.refFromAccessPath)(leaf.path);
-    const renameRemedy = `Rename the \`${path}\` key in .penv/env.ts \u2014 a parameter name is lower-case, hyphenated, and never a reserved token, so no value file reaches this key.`;
+    const renameRemedy = `Rename the \`${path}\` key in ${schemaShapeFile} \u2014 a parameter name is lower-case, hyphenated, and never a reserved token, so no value file reaches this key.`;
     if (ref === void 0 || (0, import_core4.isReservedToken)(ref.name, config)) {
       if (leaf.absencePermitted) {
         optional.push({ subject: path, remedy: renameRemedy });
@@ -537,7 +554,7 @@ function computeDrift(input) {
       subject: (0, import_core4.parameterId)(ref),
       ref,
       remedy: `penv set ${[...ref.namespace, ref.name].join("/")} --env ${environment}`,
-      detail: `declared in .penv/env.ts, no value for ${environment}`
+      detail: `declared in ${schemaShapeFile}, no value for ${environment}`
     });
   }
   const undeclared = [];
@@ -553,6 +570,133 @@ function computeDrift(input) {
   return { declared, undeclared, optional };
 }
 
+// src/snapshot.ts
+var import_node_fs2 = require("fs");
+var import_node_path3 = require("path");
+var import_core5 = require("@penvhq/core");
+var import_provider_filesystem3 = require("@penvhq/provider-filesystem");
+var SNAPSHOT_FILE = "penv.snapshot.ts";
+function sealedValues(tree) {
+  const collected = {};
+  for (const file of tree.listSync()) {
+    if (!file.encrypted) {
+      continue;
+    }
+    if (file.scope.kind === "local" || file.scope.kind === "environment-local") {
+      continue;
+    }
+    const stored = tree.readSync(file);
+    if (stored === void 0) {
+      continue;
+    }
+    collected[(0, import_core5.formatValueFile)(file)] = stored;
+  }
+  const values = {};
+  for (const key of Object.keys(collected).sort()) {
+    values[key] = collected[key];
+  }
+  return values;
+}
+function buildSnapshotFrom(root, config) {
+  const tree = (0, import_provider_filesystem3.createFilesystemProvider)({ root: (0, import_node_path3.join)(root, PENV_DIR), config });
+  return { v: 1, config, values: sealedValues(tree) };
+}
+function buildSnapshot(project) {
+  return { v: 1, config: project.config, values: sealedValues(localTree(project)) };
+}
+function renderSnapshotModule(snapshot) {
+  const body = JSON.stringify(snapshot, null, 2);
+  return `// penv.snapshot.ts \u2014 GENERATED by penv. Do not edit; run \`penv snapshot\` to refresh.
+// It embeds the evaluated config and every committed sealed (.enc) value, so \`load()\`
+// resolves in a bundled or serverless runtime where no penv.config.ts is on disk.
+import type { PenvSnapshot } from "@penvhq/penv";
+
+export const snapshot = ${body} satisfies PenvSnapshot;
+`;
+}
+function equalsIgnoringEol(a, b) {
+  return a.replace(/\r\n/g, "\n") === b.replace(/\r\n/g, "\n");
+}
+function writeSnapshotFile(project) {
+  const path = (0, import_node_path3.join)(project.root, SNAPSHOT_FILE);
+  const wanted = renderSnapshotModule(buildSnapshot(project));
+  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : void 0;
+  if (existing !== void 0 && equalsIgnoringEol(existing, wanted)) {
+    return { file: SNAPSHOT_FILE, action: "unchanged" };
+  }
+  (0, import_node_fs2.writeFileSync)(path, wanted, "utf8");
+  return { file: SNAPSHOT_FILE, action: existing === void 0 ? "created" : "updated" };
+}
+function snapshotExists(root) {
+  return (0, import_node_fs2.existsSync)((0, import_node_path3.join)(root, SNAPSHOT_FILE));
+}
+function refreshSnapshot(project) {
+  if (snapshotExists(project.root)) {
+    writeSnapshotFile(project);
+  }
+}
+function snapshotSpecifier(schemaFile) {
+  const depth = schemaFile.split("/").length - 1;
+  const climb = depth === 0 ? "./" : "../".repeat(depth);
+  return `${climb}penv.snapshot.js`;
+}
+function insertSnapshotImport(source, importLine) {
+  const afterSchema = /^import\s*\{\s*schema\s*\}\s*from\s*["'][^"']*penv\.schema\.js["'];?[ \t]*\r?\n/m;
+  const schemaMatch = afterSchema.exec(source);
+  if (schemaMatch !== null) {
+    const index = schemaMatch.index + schemaMatch[0].length;
+    return `${source.slice(0, index)}${importLine}
+${source.slice(index)}`;
+  }
+  const afterLoad = /^import\s*\{[^}]*\}\s*from\s*["']@penvhq\/penv["'];?[ \t]*\r?\n/m;
+  const loadMatch = afterLoad.exec(source);
+  if (loadMatch !== null) {
+    const index = loadMatch.index + loadMatch[0].length;
+    return `${source.slice(0, index)}${importLine}
+${source.slice(index)}`;
+  }
+  return `${importLine}
+${source}`;
+}
+function wireEnvModule(project) {
+  const schemaFile = (0, import_core5.schemaFileOf)(project.config);
+  const specifier = snapshotSpecifier(schemaFile);
+  const importLine = `import { snapshot } from "${specifier}";`;
+  const loadHint = "pass it to load: `load(schema, { snapshot })`";
+  const manual = { file: schemaFile, action: "manual", importLine, loadHint };
+  const path = (0, import_node_path3.join)(project.root, ...schemaFile.split("/"));
+  if (!(0, import_node_fs2.existsSync)(path)) {
+    return manual;
+  }
+  const source = (0, import_node_fs2.readFileSync)(path, "utf8");
+  const loadCall = /load\(\s*schema\s*(\)|,\s*\{([\s\S]*?)\}\s*\))/;
+  const match = loadCall.exec(source);
+  if (match === null) {
+    return manual;
+  }
+  const options = match[2];
+  const snapshotProperty = /(?:^|[,{\s])snapshot\s*(?=[,:}]|$)/;
+  const snapshotInOptions = options !== void 0 && snapshotProperty.test(options);
+  const importPresent = source.includes(importLine);
+  if (snapshotInOptions && importPresent) {
+    return { file: schemaFile, action: "kept", importLine, loadHint };
+  }
+  let updated = source;
+  if (!snapshotInOptions) {
+    const trimmed = (options ?? "").trim();
+    const replacement = match[1] === ")" || trimmed.length === 0 ? "load(schema, { snapshot })" : `load(schema, { ${trimmed}, snapshot })`;
+    updated = updated.replace(loadCall, replacement);
+  }
+  if (!importPresent) {
+    updated = insertSnapshotImport(updated, importLine);
+  }
+  if (updated === source) {
+    return { file: schemaFile, action: "kept", importLine, loadHint };
+  }
+  (0, import_node_fs2.writeFileSync)(path, updated, "utf8");
+  return { file: schemaFile, action: "wired", importLine, loadHint };
+}
+
 // src/style.ts
 function supportsColor(stream) {
   const env = process.env;
@@ -602,7 +746,7 @@ function padVisible(text, width) {
 }
 
 // src/ui.ts
-var import_core5 = require("@penvhq/core");
+var import_core6 = require("@penvhq/core");
 var CHECK = "\u2713";
 var WARN = "\u26A0";
 var CROSS = "\u2717";
@@ -676,7 +820,7 @@ function write(lines) {
   }
 }
 function reportError(error) {
-  if (error instanceof import_core5.PenvError) {
+  if (error instanceof import_core6.PenvError) {
     const suffix = error.remedy === void 0 ? void 0 : `
   ${error.remedy}`;
     const message = suffix !== void 0 && error.message.endsWith(suffix) ? error.message.slice(0, -suffix.length) : error.message;
@@ -710,7 +854,7 @@ async function guard(run) {
 }
 
 // src/commands/push.ts
-var import_core6 = require("@penvhq/core");
+var import_core7 = require("@penvhq/core");
 var import_citty = require("citty");
 
 // src/input.ts
@@ -774,7 +918,7 @@ async function destinationFor(project, environment, options) {
   const declared = project.config.providers[environment];
   const location = declared?.location;
   if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
-    throw new import_core6.PenvError(
+    throw new import_core7.PenvError(
       "NO_DESTINATION",
       `Environment ${environment}'s provider is the local .penv tree itself, so penv has nowhere to push`,
       `Declare a provider for it in penv.config.ts \u2014 e.g. \`${environment}: { type: "@penvhq/provider-github", location: "owner/repo" }\` \u2014 or push somewhere once with \`penv push --env ${environment} --destination <package> --location <place>\`.`
@@ -801,13 +945,13 @@ function plan(resolutions, config, environment, allowDecrypt) {
     let encrypted = false;
     if (winner.file.encrypted) {
       if (!allowDecrypt) {
-        throw new import_core6.PenvError(
+        throw new import_core7.PenvError(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and a push sends plaintext for the destination to re-seal`,
           "Re-run with `--allow-decrypt` to decrypt it locally and push it, or push an environment whose values are plaintext. penv's encryption stops at the projection; the destination seals it under its own key."
         );
       }
-      (0, import_core6.requireValue)(resolution, environment);
+      (0, import_core7.requireValue)(resolution, environment);
       encrypted = true;
     }
     if (resolution.value === void 0) {
@@ -816,7 +960,7 @@ function plan(resolutions, config, environment, allowDecrypt) {
     const scope = winner.file.scope.kind === "unscoped" ? { kind: "repository" } : { kind: "environment", environment };
     outbound.push({
       ref: resolution.ref,
-      variable: (0, import_core6.variableName)(resolution.ref, config),
+      variable: (0, import_core7.variableName)(resolution.ref, config),
       value: resolution.value,
       scope,
       encrypted
@@ -854,7 +998,7 @@ async function ensureTargetApproved(provider, environment, options) {
     return false;
   }
   if (provider.ensureTarget === void 0) {
-    throw new import_core6.PenvError(
+    throw new import_core7.PenvError(
       "MISSING_TARGET",
       `The destination has no environment \`${environment}\` to receive this push, and this provider cannot create one`,
       `Create the environment on the destination side, then run \`penv push --env ${environment}\` again.`
@@ -864,7 +1008,7 @@ async function ensureTargetApproved(provider, environment, options) {
     `The destination has no environment \`${environment}\`. Create it?`
   );
   if (!approved) {
-    throw new import_core6.PenvError(
+    throw new import_core7.PenvError(
       "MISSING_TARGET",
       `The destination has no environment \`${environment}\` to receive this push`,
       `Re-run with \`--yes\` to create it, answer \`y\` at the prompt, or create it on the destination side yourself.`
@@ -878,7 +1022,7 @@ async function pushProjection(project, provider, environment, location, options)
   const keys = keySourceFor(project, environment);
   const resolutions = resolveAllSync(tree, environment, keys, true);
   const refs = refsFrom(resolutions.map((resolution) => resolution.ref));
-  const collision = (0, import_core6.checkNameCollisions)(refs, project.config)[0];
+  const collision = (0, import_core7.checkNameCollisions)(refs, project.config)[0];
   if (collision !== void 0) {
     throw collision;
   }
@@ -959,7 +1103,7 @@ async function runPush(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment, options.envFlags);
   const { provider, location } = await destinationFor(project, environment, options);
-  if ((0, import_core6.holdsProjection)(provider)) {
+  if ((0, import_core7.holdsProjection)(provider)) {
     return pushProjection(project, provider, environment, location, options);
   }
   return pushRecords(project, provider, environment, location);
@@ -1078,9 +1222,9 @@ var pushCommand = (0, import_citty.defineCommand)({
 });
 
 // src/commands/validate.ts
-var import_node_path3 = require("path");
+var import_node_path4 = require("path");
 var import_node_url2 = require("url");
-var import_core7 = require("@penvhq/core");
+var import_core8 = require("@penvhq/core");
 var import_citty2 = require("citty");
 var SCHEMA_EXPORT = "schema";
 var LABELS = {
@@ -1098,10 +1242,10 @@ function issueFrom(error, fallbackSubject) {
     message: firstLine(error.message),
     ...error.remedy === void 0 ? {} : { remedy: error.remedy }
   };
-  if (error instanceof import_core7.ReservedTokenError) {
+  if (error instanceof import_core8.ReservedTokenError) {
     return { kind: "reserved", subject: error.token, ...base };
   }
-  if (error instanceof import_core7.NameCollisionError) {
+  if (error instanceof import_core8.NameCollisionError) {
     return { kind: "collision", subject: error.variable, ...base };
   }
   return { kind: "config", subject: fallbackSubject, ...base };
@@ -1127,7 +1271,7 @@ function place(root, path, value) {
 function isZodType(value) {
   return typeof value === "object" && value !== null && "safeParse" in value && typeof value.safeParse === "function";
 }
-function validationIssuesOf(cause, schemaPath) {
+function validationIssuesOf(cause, schemaPath, schemaShapeFile) {
   if (typeof cause !== "object" || cause === null) {
     return void 0;
   }
@@ -1141,7 +1285,10 @@ function validationIssuesOf(cause, schemaPath) {
       kind: "schema",
       subject: typeof parameter === "string" && parameter !== "" ? parameter : schemaPath,
       message: typeof message === "string" ? message : String(issue),
-      remedy: `Fix the value, or adjust the schema in ${schemaPath} if the shape is wrong.`
+      // `schemaPath` is the loader penv evaluated; the shape to adjust lives in
+      // `schemaShapeFile`, which is that same file for an old-layout project and
+      // `penv.schema.ts` for one on the split.
+      remedy: `Fix the value, or adjust the schema in ${schemaShapeFile} if the shape is wrong.`
     };
   });
 }
@@ -1155,21 +1302,22 @@ function exclusively(work) {
   return result2;
 }
 function loadSchema(project, environment) {
-  const schemaPath = (0, import_core7.schemaFileOf)(project.config);
-  const file = (0, import_node_url2.pathToFileURL)((0, import_node_path3.resolve)(project.root, schemaPath)).href;
-  return exclusively(() => loadSchemaExclusively(file, schemaPath, environment));
+  const schemaPath = (0, import_core8.schemaFileOf)(project.config);
+  const schemaShapeFile = schemaShapeFileOf(project);
+  const file = (0, import_node_url2.pathToFileURL)((0, import_node_path4.resolve)(project.root, schemaPath)).href;
+  return exclusively(() => loadSchemaExclusively(file, schemaPath, schemaShapeFile, environment));
 }
-async function loadSchemaExclusively(file, schemaPath, environment) {
-  const jiti = (0, import_core7.jitiFor)(file);
+async function loadSchemaExclusively(file, schemaPath, schemaShapeFile, environment) {
+  const jiti = (0, import_core8.jitiFor)(file);
   const previous = process.env.PENV_ENV;
-  const previousHarvest = process.env[import_core7.SCHEMA_HARVEST_ENV];
+  const previousHarvest = process.env[import_core8.SCHEMA_HARVEST_ENV];
   process.env.PENV_ENV = environment;
-  process.env[import_core7.SCHEMA_HARVEST_ENV] = "1";
+  process.env[import_core8.SCHEMA_HARVEST_ENV] = "1";
   let loaded;
   try {
     loaded = await jiti.import(file);
   } catch (cause) {
-    const issues = validationIssuesOf(cause, schemaPath);
+    const issues = validationIssuesOf(cause, schemaPath, schemaShapeFile);
     if (issues !== void 0) {
       return { issues };
     }
@@ -1191,9 +1339,9 @@ async function loadSchemaExclusively(file, schemaPath, environment) {
       process.env.PENV_ENV = previous;
     }
     if (previousHarvest === void 0) {
-      delete process.env[import_core7.SCHEMA_HARVEST_ENV];
+      delete process.env[import_core8.SCHEMA_HARVEST_ENV];
     } else {
-      process.env[import_core7.SCHEMA_HARVEST_ENV] = previousHarvest;
+      process.env[import_core8.SCHEMA_HARVEST_ENV] = previousHarvest;
     }
   }
   const exported = typeof loaded === "object" && loaded !== null ? loaded[SCHEMA_EXPORT] : void 0;
@@ -1214,13 +1362,14 @@ async function loadSchemaExclusively(file, schemaPath, environment) {
 async function runValidate(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment, options.envFlags);
-  const schemaPath = (0, import_core7.schemaFileOf)(project.config);
+  const schemaPath = (0, import_core8.schemaFileOf)(project.config);
+  const schemaShapeFile = schemaShapeFileOf(project);
   const issues = [];
   let files;
   try {
     files = await project.provider.list();
   } catch (error) {
-    if (!(error instanceof import_core7.PenvError)) {
+    if (!(error instanceof import_core8.PenvError)) {
       throw error;
     }
     return {
@@ -1232,17 +1381,17 @@ async function runValidate(options) {
     };
   }
   const refs = refsFrom(files);
-  for (const error of (0, import_core7.validateConfig)(project.config)) {
+  for (const error of (0, import_core8.validateConfig)(project.config)) {
     issues.push(issueFrom(error, "penv.config.ts"));
   }
-  for (const collision of (0, import_core7.checkNameCollisions)(refs, project.config)) {
+  for (const collision of (0, import_core8.checkNameCollisions)(refs, project.config)) {
     issues.push(issueFrom(collision, collision.variable));
   }
   const { schema, issues: schemaIssues } = await loadSchema(project, environment);
   issues.push(...schemaIssues);
   let drift = EMPTY_DRIFT;
   if (schema !== void 0) {
-    const resolutions = await (0, import_core7.resolveAll)(
+    const resolutions = await (0, import_core8.resolveAll)(
       environment,
       project.provider,
       keySourceFor(project, environment)
@@ -1251,7 +1400,7 @@ async function runValidate(options) {
     const undecryptable = /* @__PURE__ */ new Set();
     for (const resolution of resolutions) {
       if (resolution.undecryptable !== void 0) {
-        undecryptable.add((0, import_core7.accessPath)(resolution.ref).join("."));
+        undecryptable.add((0, import_core8.accessPath)(resolution.ref).join("."));
         issues.push({
           kind: "undecryptable",
           subject: resolution.parameter,
@@ -1261,10 +1410,16 @@ async function runValidate(options) {
         continue;
       }
       if (resolution.value !== void 0) {
-        place(object, (0, import_core7.accessPath)(resolution.ref), resolution.value);
+        place(object, (0, import_core8.accessPath)(resolution.ref), resolution.value);
       }
     }
-    drift = computeDrift({ schema, resolutions, config: project.config, environment });
+    drift = computeDrift({
+      schema,
+      resolutions,
+      config: project.config,
+      environment,
+      schemaShapeFile
+    });
     const result2 = schema.safeParse(object);
     if (!result2.success) {
       for (const problem of result2.error.issues) {
@@ -1276,7 +1431,7 @@ async function runValidate(options) {
           kind: "schema",
           subject: path || schemaPath,
           message: problem.message,
-          remedy: `Fix the value, or adjust the schema in ${schemaPath} if the shape is wrong.`
+          remedy: `Fix the value, or adjust the schema in ${schemaShapeFile} if the shape is wrong.`
         });
       }
     }
@@ -1379,7 +1534,7 @@ async function runDoctor(options) {
       });
     }
   }
-  const resolutions = await (0, import_core8.resolveAll)(
+  const resolutions = await (0, import_core9.resolveAll)(
     environment,
     project.provider,
     keySourceFor(project, environment)
@@ -1399,13 +1554,15 @@ async function runDoctor(options) {
       skipped("unused", "Value coverage")
     );
   } else {
+    const schemaShapeFile = schemaShapeFileOf(project);
     const drift = computeDrift({
       schema,
       resolutions: subjects.map(({ resolution }) => resolution),
       config: project.config,
-      environment
+      environment,
+      schemaShapeFile
     });
-    findings.push(...declaredFindings(drift, missing, environment));
+    findings.push(...declaredFindings(drift, missing, environment, schemaShapeFile));
     findings.push(...weakFindings(subjects, schema));
     findings.push(...unusedFindings(drift));
   }
@@ -1421,6 +1578,8 @@ async function runDoctor(options) {
     findings.push(...stuckFindings(rotation.subjects, environment, now, stuckThresholdMs));
   }
   findings.push(...await providerDriftFindings(project, environment, options.source));
+  findings.push(...snapshotStaleFindings(project));
+  findings.push(...bundleInvisibleFindings(project, subjects, environment));
   findings.push(...await projectionFindings(project, environment, options.projection));
   findings.push({
     check: "provider",
@@ -1435,7 +1594,7 @@ async function runDoctor(options) {
   };
 }
 function missingFindings(subjects, environment) {
-  const required = subjects.filter(({ meta }) => (0, import_core8.isRequired)(meta, environment));
+  const required = subjects.filter(({ meta }) => (0, import_core9.isRequired)(meta, environment));
   const findings = required.filter(({ resolution }) => resolution.winner === void 0).map(({ resolution }) => ({
     check: "missing",
     severity: "failure",
@@ -1456,7 +1615,7 @@ function missingFindings(subjects, environment) {
     }
   ];
 }
-function declaredFindings(drift, missing, environment) {
+function declaredFindings(drift, missing, environment, schemaShapeFile) {
   const reported = new Set(missing.filter((f) => f.severity !== "pass").map((f) => f.subject));
   const findings = drift.declared.filter((item) => !reported.has(item.subject)).map((item) => ({
     check: "declared",
@@ -1474,7 +1633,7 @@ function declaredFindings(drift, missing, environment) {
       check: "declared",
       severity: "pass",
       label: "Schema coverage",
-      subject: `every parameter .penv/env.ts requires has a value for ${environment}`
+      subject: `every parameter ${schemaShapeFile} requires has a value for ${environment}`
     }
   ];
 }
@@ -1486,7 +1645,7 @@ function weakFindings(subjects, schema) {
     if (value === void 0) {
       continue;
     }
-    const field = lookup(schema, (0, import_core8.accessPath)(resolution.ref));
+    const field = lookup(schema, (0, import_core9.accessPath)(resolution.ref));
     if (field.kind !== "found") {
       continue;
     }
@@ -1559,7 +1718,7 @@ function fallbackFindings(subjects, environment) {
   ];
 }
 function plaintextSecretFindings(subjects, environment) {
-  const secrets = subjects.filter(({ meta }) => (0, import_core8.isSecret)(meta, environment));
+  const secrets = subjects.filter(({ meta }) => (0, import_core9.isSecret)(meta, environment));
   const findings = [];
   for (const { resolution } of secrets) {
     const winner = resolution.winner;
@@ -1599,11 +1758,11 @@ function publicSecretFindings(subjects, environment, config) {
       }
     ];
   }
-  const secrets = subjects.filter(({ meta }) => (0, import_core8.isSecret)(meta, environment));
+  const secrets = subjects.filter(({ meta }) => (0, import_core9.isSecret)(meta, environment));
   const findings = [];
   for (const { resolution } of secrets) {
-    const variable = (0, import_core8.variableName)(resolution.ref, config);
-    if (!(0, import_core8.isPublicVariable)(variable, config)) {
+    const variable = (0, import_core9.variableName)(resolution.ref, config);
+    if (!(0, import_core9.isPublicVariable)(variable, config)) {
       continue;
     }
     const prefix = prefixes.find((candidate) => variable.startsWith(candidate));
@@ -1689,7 +1848,7 @@ async function projectionFindings(project, environment, override) {
         }
       ];
     }
-    if (!(0, import_core8.holdsProjection)(source)) {
+    if (!(0, import_core9.holdsProjection)(source)) {
       return [];
     }
     projection = source;
@@ -1723,7 +1882,7 @@ async function projectionFindings(project, environment, override) {
       }
     ];
   }
-  const resolutions = await (0, import_core8.resolveAll)(
+  const resolutions = await (0, import_core9.resolveAll)(
     environment,
     project.provider,
     keySourceFor(project, environment),
@@ -1737,7 +1896,7 @@ async function projectionFindings(project, environment, override) {
     }
     expected.push({
       ref: resolution.ref,
-      variable: (0, import_core8.variableName)(resolution.ref, project.config),
+      variable: (0, import_core9.variableName)(resolution.ref, project.config),
       scope: winner.file.scope.kind === "unscoped" ? { kind: "repository" } : { kind: "environment", environment }
     });
   }
@@ -1793,7 +1952,7 @@ async function projectionFindings(project, environment, override) {
     if (secret === void 0) {
       continue;
     }
-    const pushed = (0, import_core8.effectiveMeta)(await project.provider.readMeta(item.ref), environment)[LAST_PUSHED_KEY];
+    const pushed = (0, import_core9.effectiveMeta)(await project.provider.readMeta(item.ref), environment)[LAST_PUSHED_KEY];
     if (typeof pushed !== "string") {
       continue;
     }
@@ -1863,7 +2022,7 @@ async function rotationSubjects(project, environment, local, override) {
     return { kind: "read", subjects: local };
   }
   const source = override ?? await sourceProviderFor(project, environment);
-  if (!(0, import_core8.holdsRecords)(source)) {
+  if (!(0, import_core9.holdsRecords)(source)) {
     return { kind: "read", subjects: local };
   }
   try {
@@ -1890,11 +2049,11 @@ async function rotationSubjects(project, environment, local, override) {
 function overdueFindings(subjects, environment, now) {
   const findings = [];
   for (const { resolution, meta } of subjects) {
-    const { policy, lastRotated } = (0, import_core8.rotationOf)(meta, environment);
+    const { policy, lastRotated } = (0, import_core9.rotationOf)(meta, environment);
     if (policy === void 0 || lastRotated === null) {
       continue;
     }
-    const interval = (0, import_core8.tryParseDuration)(policy);
+    const interval = (0, import_core9.tryParseDuration)(policy);
     if (interval === void 0) {
       findings.push({
         check: "rotation-overdue",
@@ -1937,10 +2096,10 @@ function overdueFindings(subjects, environment, now) {
 function stuckFindings(subjects, environment, now, stuckThresholdMs) {
   const findings = [];
   for (const { resolution, meta } of subjects) {
-    if (!(0, import_core8.isStuck)(meta, environment, now, stuckThresholdMs)) {
+    if (!(0, import_core9.isStuck)(meta, environment, now, stuckThresholdMs)) {
       continue;
     }
-    const { rotatingSince } = (0, import_core8.rotationOf)(meta, environment);
+    const { rotatingSince } = (0, import_core9.rotationOf)(meta, environment);
     if (rotatingSince === null) {
       continue;
     }
@@ -1980,7 +2139,7 @@ function scopeKey(scope) {
     case "environment-local":
       return `environment-local:${scope.environment}`;
     default:
-      return (0, import_core8.assertNever)(scope, "scope");
+      return (0, import_core9.assertNever)(scope, "scope");
   }
 }
 function relevantToEnvironment(file, environment) {
@@ -2014,7 +2173,7 @@ async function providerDriftFindings(project, environment, override) {
     ];
   }
   const source = override ?? await sourceProviderFor(project, environment);
-  if (!(0, import_core8.holdsRecords)(source)) {
+  if (!(0, import_core9.holdsRecords)(source)) {
     return [];
   }
   let local;
@@ -2040,13 +2199,13 @@ async function providerDriftFindings(project, environment, override) {
     const here = local.get(address);
     const there = remote.get(address);
     if (here !== void 0 && there !== void 0) {
-      const opened = (0, import_core8.openValue)(here.file, here.stored, keys);
+      const opened = (0, import_core9.openValue)(here.file, here.stored, keys);
       if (opened.kind !== "plaintext") {
         findings.push({
           check: "provider-value-drift",
           severity: "unknown",
           label: "Provider value unreadable",
-          subject: (0, import_core8.formatValueFile)(here.file),
+          subject: (0, import_core9.formatValueFile)(here.file),
           detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.type} source of truth`
         });
         continue;
@@ -2056,7 +2215,7 @@ async function providerDriftFindings(project, environment, override) {
           check: "provider-value-drift",
           severity: "failure",
           label: "Provider value drift",
-          subject: (0, import_core8.formatValueFile)(here.file),
+          subject: (0, import_core9.formatValueFile)(here.file),
           detail: `the local tree and the ${providerConfig.type} source of truth hold different values`
         });
       }
@@ -2070,7 +2229,7 @@ async function providerDriftFindings(project, environment, override) {
       check: "provider-value-drift",
       severity: "warning",
       label: here !== void 0 ? "Only in the local tree" : "Only in the source",
-      subject: (0, import_core8.formatValueFile)(present.file),
+      subject: (0, import_core9.formatValueFile)(present.file),
       detail: here !== void 0 ? `present locally, absent from the ${providerConfig.type} source of truth` : `present in the ${providerConfig.type} source of truth, absent from the local tree`
     });
   }
@@ -2086,6 +2245,68 @@ async function providerDriftFindings(project, environment, override) {
     }
   ];
 }
+function snapshotStaleFindings(project) {
+  if (!snapshotExists(project.root)) {
+    return [];
+  }
+  const wanted = renderSnapshotModule(buildSnapshot(project));
+  const committed = (0, import_node_fs3.readFileSync)((0, import_node_path5.join)(project.root, SNAPSHOT_FILE), "utf8");
+  if (equalsIgnoringEol(committed, wanted)) {
+    return [
+      {
+        check: "snapshot-stale",
+        severity: "pass",
+        label: "Snapshot",
+        subject: `${SNAPSHOT_FILE} matches the committed sealed values and config`
+      }
+    ];
+  }
+  return [
+    {
+      check: "snapshot-stale",
+      severity: "failure",
+      label: "Snapshot stale",
+      subject: SNAPSHOT_FILE,
+      detail: "does not match the current sealed values or config, so a bundle resolves stale data",
+      remedy: "penv snapshot"
+    }
+  ];
+}
+function bundleInvisibleFindings(project, subjects, environment) {
+  if (!snapshotExists(project.root)) {
+    return [];
+  }
+  const findings = [];
+  for (const { resolution } of subjects) {
+    const winner = resolution.winner;
+    if (winner === void 0 || winner.file.encrypted) {
+      continue;
+    }
+    const scope = winner.file.scope;
+    if (scope.kind === "local" || scope.kind === "environment-local") {
+      continue;
+    }
+    findings.push({
+      check: "bundle-invisible-plaintext",
+      severity: "warning",
+      label: "Invisible to bundles",
+      subject: winner.location,
+      detail: "plaintext is gitignored and not embedded in the snapshot, so a bundle cannot see it",
+      remedy: `penv encrypt ${refPathOf(resolution.ref)} --env ${environment}`
+    });
+  }
+  if (findings.length > 0) {
+    return findings;
+  }
+  return [
+    {
+      check: "bundle-invisible-plaintext",
+      severity: "pass",
+      label: "Bundle coverage",
+      subject: `every value resolving for ${environment} is embeddable in ${SNAPSHOT_FILE}`
+    }
+  ];
+}
 var GLYPHS = {
   pass: CHECK,
   warning: WARN,
@@ -2157,11 +2378,11 @@ var doctorCommand = (0, import_citty3.defineCommand)({
 });
 
 // src/commands/encrypt.ts
-var import_core10 = require("@penvhq/core");
+var import_core11 = require("@penvhq/core");
 var import_citty5 = require("citty");
 
 // src/commands/set.ts
-var import_core9 = require("@penvhq/core");
+var import_core10 = require("@penvhq/core");
 var import_citty4 = require("citty");
 function scopeFrom(options) {
   if (options.local === true) {
@@ -2181,7 +2402,7 @@ function targetScope(project, options, key) {
     return scopeFrom(options);
   }
   if (environment.trim().length === 0) {
-    throw new import_core9.PenvError(
+    throw new import_core10.PenvError(
       "ENVIRONMENT_FLAG_EMPTY",
       `\`--env\` for parameter ${key} names no environment`,
       `Pass a declared environment \u2014 ${project.config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
@@ -2194,27 +2415,27 @@ function policyEnvironment(project, options) {
 }
 function sealFor(project, file, value, parameter, environment) {
   if (environment === void 0) {
-    throw new import_core9.PenvError(
+    throw new import_core10.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
-      `Parameter ${parameter} is a secret, and ${PENV_DIR}/${(0, import_core9.formatValueFile)(file)} names no environment`,
+      `Parameter ${parameter} is a secret, and ${PENV_DIR}/${(0, import_core10.formatValueFile)(file)} names no environment`,
       "Keys are declared per environment in the `keys` block of penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
     );
   }
-  return (0, import_core9.sealValue)(file, value, keySourceFor(project, environment), parameter, environment);
+  return (0, import_core10.sealValue)(file, value, keySourceFor(project, environment), parameter, environment);
 }
 async function sealAwareWrite(options) {
   const { project, provider, ref, scope, value, environment } = options;
-  const secret = (0, import_core9.isSecret)(await provider.readMeta(ref), environment);
+  const secret = (0, import_core10.isSecret)(await provider.readMeta(ref), environment);
   const file = {
     namespace: ref.namespace,
     name: ref.name,
     scope,
     encrypted: secret
   };
-  const stored = secret ? sealFor(project, file, value, (0, import_core9.parameterId)(ref), environment) : value;
+  const stored = secret ? sealFor(project, file, value, (0, import_core10.parameterId)(ref), environment) : value;
   await provider.write(file, stored);
   await provider.remove({ ...file, encrypted: !secret });
-  return { encrypted: secret, location: (0, import_core9.formatValueFile)(file) };
+  return { encrypted: secret, location: (0, import_core10.formatValueFile)(file) };
 }
 async function runSet(options) {
   const project = openProject(options.cwd);
@@ -2230,6 +2451,7 @@ async function runSet(options) {
     value: options.value,
     environment
   });
+  refreshSnapshot(project);
   return { parameter: options.key, location, encrypted };
 }
 function renderSet(result2) {
@@ -2296,7 +2518,7 @@ function twins(project, key, options) {
 }
 function environmentFor(project, options, verb) {
   if (options.environment === void 0) {
-    throw new import_core10.PenvError(
+    throw new import_core11.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
       `\`penv ${verb}\` names no environment, and keys are declared per environment`,
       "Pass `--env <environment>`. penv cannot tell which environment's key applies to a file that names none, and will not pick one for you."
@@ -2311,32 +2533,33 @@ async function runEncrypt(options) {
   const project = openProject(options.cwd);
   const environment = environmentFor(project, options, "encrypt");
   const [plain, sealed] = twins(project, options.key, options);
-  const parameter = (0, import_core10.parameterId)(plain);
+  const parameter = (0, import_core11.parameterId)(plain);
   const value = await readOne(project, plain);
   if (value === void 0) {
     const already = await readOne(project, sealed);
-    throw new import_core10.PenvError(
+    throw new import_core11.PenvError(
       "PARAMETER_ABSENT",
-      already === void 0 ? `Parameter ${parameter} has no value file at ${PENV_DIR}/${(0, import_core10.formatValueFile)(plain)}` : `Parameter ${parameter} is already encrypted at ${PENV_DIR}/${(0, import_core10.formatValueFile)(sealed)}`,
+      already === void 0 ? `Parameter ${parameter} has no value file at ${PENV_DIR}/${(0, import_core11.formatValueFile)(plain)}` : `Parameter ${parameter} is already encrypted at ${PENV_DIR}/${(0, import_core11.formatValueFile)(sealed)}`,
       already === void 0 ? `Write it first with \`penv set ${options.key} --env ${environment}\`, which seals it automatically when the parameter's meta declares it a secret.` : "Nothing to do."
     );
   }
-  const text = (0, import_core10.sealValue)(sealed, value, keySourceFor(project, environment), parameter, environment);
+  const text = (0, import_core11.sealValue)(sealed, value, keySourceFor(project, environment), parameter, environment);
   await project.provider.write(sealed, text);
   await project.provider.remove(plain);
+  refreshSnapshot(project);
   return {
     parameter,
-    location: (0, import_core10.formatValueFile)(sealed),
-    removed: (0, import_core10.formatValueFile)(plain)
+    location: (0, import_core11.formatValueFile)(sealed),
+    removed: (0, import_core11.formatValueFile)(plain)
   };
 }
 async function runDecrypt(options) {
   const project = openProject(options.cwd);
   const environment = environmentFor(project, options, "decrypt");
   const [plain, sealed] = twins(project, options.key, options);
-  const parameter = (0, import_core10.parameterId)(plain);
-  if ((0, import_core10.isSecret)(await project.provider.readMeta(plain), environment)) {
-    throw new import_core10.PenvError(
+  const parameter = (0, import_core11.parameterId)(plain);
+  if ((0, import_core11.isSecret)(await project.provider.readMeta(plain), environment)) {
+    throw new import_core11.PenvError(
       "SECRET_DECRYPT_REFUSED",
       `Parameter ${parameter} is declared a secret for environment ${environment}, so penv will not write it in plaintext`,
       "A secret with a plaintext value file is a `penv doctor` failure. Drop `secret` from the parameter's meta if it is not one, or run `penv generate --allow-decrypt` if you need the plaintext value in a `.env` artifact."
@@ -2344,30 +2567,31 @@ async function runDecrypt(options) {
   }
   const stored = await readOne(project, sealed);
   if (stored === void 0) {
-    throw new import_core10.PenvError(
+    throw new import_core11.PenvError(
       "PARAMETER_ABSENT",
-      `Parameter ${parameter} has no encrypted value file at ${PENV_DIR}/${(0, import_core10.formatValueFile)(sealed)}`,
+      `Parameter ${parameter} has no encrypted value file at ${PENV_DIR}/${(0, import_core11.formatValueFile)(sealed)}`,
       `Nothing to decrypt. \`penv get ${options.key} --env ${environment} --explain\` shows every file penv looked at.`
     );
   }
-  const opened = (0, import_core10.openValue)(sealed, stored, keySourceFor(project, environment));
+  const opened = (0, import_core11.openValue)(sealed, stored, keySourceFor(project, environment));
   if (opened.kind === "failed") {
     throw new UndecryptableAt(
       parameter,
       environment,
-      (0, import_core10.formatValueFile)(sealed),
+      (0, import_core11.formatValueFile)(sealed),
       opened.failure.detail
     );
   }
   await project.provider.write(plain, opened.value);
   await project.provider.remove(sealed);
+  refreshSnapshot(project);
   return {
     parameter,
-    location: (0, import_core10.formatValueFile)(plain),
-    removed: (0, import_core10.formatValueFile)(sealed)
+    location: (0, import_core11.formatValueFile)(plain),
+    removed: (0, import_core11.formatValueFile)(sealed)
   };
 }
-var UndecryptableAt = class extends import_core10.PenvError {
+var UndecryptableAt = class extends import_core11.PenvError {
   constructor(parameter, environment, location, detail) {
     super(
       "VALUE_UNDECRYPTABLE",
@@ -2422,7 +2646,7 @@ var decryptCommand = (0, import_citty5.defineCommand)({
 });
 
 // src/commands/fill.ts
-var import_core11 = require("@penvhq/core");
+var import_core12 = require("@penvhq/core");
 var import_citty6 = require("citty");
 var BLOCKING = /* @__PURE__ */ new Set(["config", "collision", "reserved"]);
 async function runFill(options) {
@@ -2437,7 +2661,7 @@ async function runFill(options) {
     const detail = blockers.map(
       (issue) => `  - ${issue.message}${issue.remedy === void 0 ? "" : ` (${issue.remedy})`}`
     ).join("\n");
-    throw new import_core11.PenvError(
+    throw new import_core12.PenvError(
       "FILL_BLOCKED",
       `penv fill cannot run: environment ${environment} has ${blockers.length} unresolved configuration ${blockers.length === 1 ? "issue" : "issues"}:
 ${detail}`,
@@ -2572,16 +2796,16 @@ var fillCommand = (0, import_citty6.defineCommand)({
 });
 
 // src/commands/generate.ts
-var import_node_fs = require("fs");
-var import_node_path4 = require("path");
-var import_core12 = require("@penvhq/core");
+var import_node_fs4 = require("fs");
+var import_node_path6 = require("path");
+var import_core13 = require("@penvhq/core");
 var import_citty7 = require("citty");
 var DEFAULT_OUTPUT = ".env";
 function entriesFor(project, environment, allowDecrypt) {
   const keys = keySourceFor(project, environment);
   const tree = localTree(project);
   const resolutions = resolveAllSync(tree, environment, keys);
-  const collision = (0, import_core12.checkNameCollisions)(
+  const collision = (0, import_core13.checkNameCollisions)(
     refsFrom(resolutions.map((resolution) => resolution.ref)),
     project.config
   )[0];
@@ -2594,21 +2818,21 @@ function entriesFor(project, environment, allowDecrypt) {
     const winner = resolution.winner;
     if (winner?.file.encrypted === true) {
       if (!allowDecrypt) {
-        throw new import_core12.PenvError(
+        throw new import_core13.PenvError(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and \`penv generate\` writes plaintext`,
           `Re-run with \`--allow-decrypt\` to write the decrypted value into the artifact, or generate for an environment whose values are plaintext. The artifact is gitignored; a committed plaintext secret is a \`penv doctor\` failure.`
         );
       }
-      (0, import_core12.requireValue)(resolution, environment);
+      (0, import_core13.requireValue)(resolution, environment);
       decrypted += 1;
     }
     if (resolution.value === void 0) {
       continue;
     }
-    const description = (0, import_core12.effectiveMeta)(tree.readMetaSync(resolution.ref), environment).description;
+    const description = (0, import_core13.effectiveMeta)(tree.readMetaSync(resolution.ref), environment).description;
     entries.push({
-      key: (0, import_core12.variableName)(resolution.ref, project.config),
+      key: (0, import_core13.variableName)(resolution.ref, project.config),
       value: resolution.value,
       ...typeof description === "string" ? { description } : {}
     });
@@ -2619,18 +2843,18 @@ function entriesFor(project, environment, allowDecrypt) {
 function generateDotenv(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment, options.envFlags);
-  return (0, import_core12.serializeDotenv)(entriesFor(project, environment, options.allowDecrypt === true).entries);
+  return (0, import_core13.serializeDotenv)(entriesFor(project, environment, options.allowDecrypt === true).entries);
 }
 function runGenerate(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment, options.envFlags);
   const { entries, decrypted } = entriesFor(project, environment, options.allowDecrypt === true);
-  const file = options.out === void 0 ? (0, import_node_path4.resolve)(project.root, DEFAULT_OUTPUT) : (0, import_node_path4.isAbsolute)(options.out) ? options.out : (0, import_node_path4.resolve)(options.cwd, options.out);
-  (0, import_node_fs.writeFileSync)(file, (0, import_core12.serializeDotenv)(entries), "utf8");
+  const file = options.out === void 0 ? (0, import_node_path6.resolve)(project.root, DEFAULT_OUTPUT) : (0, import_node_path6.isAbsolute)(options.out) ? options.out : (0, import_node_path6.resolve)(options.cwd, options.out);
+  (0, import_node_fs4.writeFileSync)(file, (0, import_core13.serializeDotenv)(entries), "utf8");
   return { file, environment, entries: entries.length, decrypted };
 }
 function displayPath(cwd, file) {
-  const rel = (0, import_node_path4.relative)(cwd, file);
+  const rel = (0, import_node_path6.relative)(cwd, file);
   return rel === "" || rel.startsWith("..") ? file : rel.split("\\").join("/");
 }
 function renderGenerate(result2, cwd) {
@@ -2678,17 +2902,17 @@ var generateCommand = (0, import_citty7.defineCommand)({
 });
 
 // src/commands/get.ts
-var import_core13 = require("@penvhq/core");
+var import_core14 = require("@penvhq/core");
 var import_citty8 = require("citty");
 async function runGet(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key);
   const keys = keySourceFor(project, environment);
-  const resolution = await (0, import_core13.resolveParameter)(ref, environment, project.provider, keys);
-  const value = (0, import_core13.requireValue)(resolution, environment);
+  const resolution = await (0, import_core14.resolveParameter)(ref, environment, project.provider, keys);
+  const value = (0, import_core14.requireValue)(resolution, environment);
   if (value === void 0) {
-    throw new import_core13.PenvError(
+    throw new import_core14.PenvError(
       "PARAMETER_ABSENT",
       `Parameter ${resolution.parameter} resolves to no value for environment ${environment}`,
       `Set it with \`penv set ${options.key} --env ${environment}\`, or run \`penv get ${options.key} --env ${environment} --explain\` to see every file penv looked at.`
@@ -2710,7 +2934,7 @@ async function runExplain(options) {
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key);
   const keys = keySourceFor(project, environment);
-  const resolution = await (0, import_core13.resolveParameter)(ref, environment, project.provider, keys);
+  const resolution = await (0, import_core14.resolveParameter)(ref, environment, project.provider, keys);
   const winner = resolution.winner;
   return {
     parameter: resolution.parameter,
@@ -2764,15 +2988,15 @@ var getCommand = (0, import_citty8.defineCommand)({
 });
 
 // src/commands/import.ts
-var import_node_fs4 = require("fs");
-var import_node_path7 = require("path");
-var import_core16 = require("@penvhq/core");
+var import_node_fs7 = require("fs");
+var import_node_path9 = require("path");
+var import_core17 = require("@penvhq/core");
 var import_citty10 = require("citty");
 
 // src/detect.ts
-var import_node_fs2 = require("fs");
-var import_node_path5 = require("path");
-var import_core14 = require("@penvhq/core");
+var import_node_fs5 = require("fs");
+var import_node_path7 = require("path");
+var import_core15 = require("@penvhq/core");
 var SIGNATURES = [
   { name: "Next.js", packages: ["next"], publicPrefixes: ["NEXT_PUBLIC_"] },
   { name: "SvelteKit", packages: ["@sveltejs/kit"], publicPrefixes: ["PUBLIC_"] },
@@ -2788,7 +3012,7 @@ var SIGNATURES = [
 function exportsSchema(file) {
   let source;
   try {
-    source = (0, import_node_fs2.readFileSync)(file, "utf8");
+    source = (0, import_node_fs5.readFileSync)(file, "utf8");
   } catch {
     return false;
   }
@@ -2799,8 +3023,8 @@ function exportsSchema(file) {
   );
 }
 function occupied(cwd, relative3) {
-  const file = (0, import_node_path5.join)(cwd, ...relative3.split("/"));
-  return (0, import_node_fs2.existsSync)(file) && !exportsSchema(file);
+  const file = (0, import_node_path7.join)(cwd, ...relative3.split("/"));
+  return (0, import_node_fs5.existsSync)(file) && !exportsSchema(file);
 }
 function schemaFileFor(cwd) {
   const dir = srcPrefix(cwd);
@@ -2812,10 +3036,10 @@ function schemaFileFor(cwd) {
   if (!occupied(cwd, beside)) {
     return { file: beside, displaced: preferred };
   }
-  return { file: import_core14.DEFAULT_SCHEMA_FILE, displaced: preferred };
+  return { file: import_core15.DEFAULT_SCHEMA_FILE, displaced: preferred };
 }
 function srcPrefix(cwd) {
-  return (0, import_node_fs2.existsSync)((0, import_node_path5.join)(cwd, "src")) ? "src/" : "";
+  return (0, import_node_fs5.existsSync)((0, import_node_path7.join)(cwd, "src")) ? "src/" : "";
 }
 function dependenciesOf(cwd) {
   const manifest = manifestOf(cwd);
@@ -2834,13 +3058,13 @@ function dependenciesOf(cwd) {
   return names;
 }
 function manifestOf(cwd) {
-  const file = (0, import_node_path5.join)(cwd, "package.json");
-  if (!(0, import_node_fs2.existsSync)(file)) {
+  const file = (0, import_node_path7.join)(cwd, "package.json");
+  if (!(0, import_node_fs5.existsSync)(file)) {
     return void 0;
   }
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs2.readFileSync)(file, "utf8"));
+    manifest = JSON.parse((0, import_node_fs5.readFileSync)(file, "utf8"));
   } catch {
     return void 0;
   }
@@ -2856,7 +3080,7 @@ function detectFramework(cwd) {
       return detectedFrom(cwd, signature.name, signature.publicPrefixes);
     }
   }
-  if ((0, import_node_fs2.existsSync)((0, import_node_path5.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
+  if ((0, import_node_fs5.existsSync)((0, import_node_path7.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
     return detectedFrom(cwd, "Bun", []);
   }
   return void 0;
@@ -2882,10 +3106,10 @@ function hasImportsBlock(cwd) {
 }
 
 // src/commands/init.ts
-var import_node_fs3 = require("fs");
-var import_node_path6 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path8 = require("path");
 var import_promises = require("readline/promises");
-var import_core15 = require("@penvhq/core");
+var import_core16 = require("@penvhq/core");
 var import_citty9 = require("citty");
 
 // src/seams.ts
@@ -3026,6 +3250,7 @@ function seamFor(framework, context) {
 }
 
 // src/commands/init.ts
+var SCHEMA_SHAPE_BASENAME = "penv.schema";
 var CONFIG_FILE = "penv.config.ts";
 var TSCONFIG_FILE = "tsconfig.json";
 var GITIGNORE_FILE = ".gitignore";
@@ -3036,15 +3261,15 @@ var PACKAGE_FILE = "package.json";
 var DEFAULT_DECISIONS = {
   environments: [],
   inject: false,
-  schemaFile: import_core15.DEFAULT_SCHEMA_FILE,
+  schemaFile: import_core16.DEFAULT_SCHEMA_FILE,
   publicPrefixes: [],
   alias: DEFAULT_ALIAS
 };
-var NOT_ENVIRONMENTS = [...import_core15.RESERVED_TOKENS, "example", "sample", "template"];
+var NOT_ENVIRONMENTS = [...import_core16.RESERVED_TOKENS, "example", "sample", "template"];
 function suggestEnvironments(root) {
   let entries;
   try {
-    entries = (0, import_node_fs3.readdirSync)(root);
+    entries = (0, import_node_fs6.readdirSync)(root);
   } catch {
     return [];
   }
@@ -3056,7 +3281,7 @@ function suggestEnvironments(root) {
     const segments = entry.slice(".env.".length).split(".");
     const withoutLocal = segments.at(-1) === "local" ? segments.slice(0, -1) : segments;
     const name = withoutLocal.length === 1 ? withoutLocal[0] : void 0;
-    if (name === void 0 || !(0, import_core15.isLegalEnvironmentName)(name) || NOT_ENVIRONMENTS.includes(name)) {
+    if (name === void 0 || !(0, import_core16.isLegalEnvironmentName)(name) || NOT_ENVIRONMENTS.includes(name)) {
       continue;
     }
     found.add(name);
@@ -3064,10 +3289,10 @@ function suggestEnvironments(root) {
   return [...found].sort();
 }
 function emptyFlag(flag) {
-  return new import_core15.PenvError(
+  return new import_core16.PenvError(
     "INIT_FLAG_EMPTY",
     `\`--${flag}\` was given without a value`,
-    flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${import_core15.DEFAULT_SCHEMA_FILE}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
+    flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${import_core16.DEFAULT_SCHEMA_FILE}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
   );
 }
 function splitEnvironments(value) {
@@ -3088,11 +3313,11 @@ function configOf(decisions) {
   return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
 }
 function declaredIn(root) {
-  const file = (0, import_node_path6.join)(root, CONFIG_FILE);
-  if (!(0, import_node_fs3.existsSync)(file)) {
+  const file = (0, import_node_path8.join)(root, CONFIG_FILE);
+  if (!(0, import_node_fs6.existsSync)(file)) {
     return void 0;
   }
-  return (0, import_core15.loadConfigFrom)(file);
+  return (0, import_core16.loadConfigFrom)(file);
 }
 function planInit(root, flags = {}) {
   const declared = declaredIn(root);
@@ -3102,7 +3327,7 @@ function planInit(root, flags = {}) {
     notes.push(`${CONFIG_FILE} already exists \u2014 init keeps every decision it records.`);
   } else if (detected === void 0) {
     notes.push(
-      `No framework detected in package.json \u2014 the schema goes to ${import_core15.DEFAULT_SCHEMA_FILE}.`
+      `No framework detected in package.json \u2014 the schema goes to ${import_core16.DEFAULT_SCHEMA_FILE}.`
     );
   } else {
     notes.push(`Detected ${detected.name}.`);
@@ -3112,12 +3337,12 @@ function planInit(root, flags = {}) {
       );
     }
   }
-  const schemaFile = flags.schema === void 0 ? declared !== void 0 ? (0, import_core15.schemaFileOf)(declared) : detected?.schemaFile ?? import_core15.DEFAULT_SCHEMA_FILE : flags.schema.trim();
+  const schemaFile = flags.schema === void 0 ? declared !== void 0 ? (0, import_core16.schemaFileOf)(declared) : detected?.schemaFile ?? import_core16.DEFAULT_SCHEMA_FILE : flags.schema.trim();
   if (flags.schema !== void 0) {
     if (schemaFile.length === 0) {
       throw emptyFlag("schema");
     }
-    const error = (0, import_core15.validateSchemaFile)({ environments: [], providers: {}, schemaFile })[0];
+    const error = (0, import_core16.validateSchemaFile)({ environments: [], providers: {}, schemaFile })[0];
     if (error !== void 0) {
       throw error;
     }
@@ -3127,7 +3352,7 @@ function planInit(root, flags = {}) {
     throw emptyFlag("alias");
   }
   if (!ALIAS_NAME.test(alias)) {
-    throw new import_core15.PenvError(
+    throw new import_core16.PenvError(
       "INIT_ALIAS_INVALID",
       `\`${alias}\` is not an alias penv can write`,
       `An alias is \`@name\` \u2014 a tsconfig \`paths\` entry a bundler resolves \u2014 or \`#name\`, a package.json \`imports\` entry Node resolves itself. Those are the two things a module specifier can be that is not a package.`
@@ -3177,7 +3402,7 @@ function renderPlan(plan2) {
   rows.push([
     `  ${out.dim("schemaFile")}`,
     plan2.decisions.schemaFile,
-    plan2.decisions.schemaFile === import_core15.DEFAULT_SCHEMA_FILE ? "" : out.dim(`(default: ${import_core15.DEFAULT_SCHEMA_FILE})`)
+    plan2.decisions.schemaFile === import_core16.DEFAULT_SCHEMA_FILE ? "" : out.dim(`(default: ${import_core16.DEFAULT_SCHEMA_FILE})`)
   ]);
   for (const prefix of plan2.decisions.publicPrefixes) {
     rows.push([`  ${out.dim("publicPrefix")}`, prefix, ""]);
@@ -3227,20 +3452,17 @@ async function askInject(io) {
 }
 var EMPTY_SCHEMA_BODY = "  // One key per parameter, e.g. `databaseUrl: z.url(),`. Nesting a key nests\n  // the parameter: `redis: z.object({ password: z.string() })` is redis/password.";
 var DRAFT_HEADER = "// DRAFT \u2014 generated by `penv import` from one sample of each value, and yours\n// to correct. Single-sample inference cannot know that a boolean seen as `true`\n// must also accept `1`/`0`, or that a string is really a URL. penv scaffolds\n// this file once and never regenerates it, so edits here are safe.\n";
-function renderSchemaModule(fields, draft, inject = false) {
+function renderSchemaShapeModule(fields, draft) {
   const body = fields.length === 0 ? EMPTY_SCHEMA_BODY : fields.map((field) => `  ${field.key}: ${field.type},`).join("\n");
-  const loadComment = inject ? "// The loaded, validated values for the current environment. Import this in app\n// code. `inject: true` also copies the values into process.env, for libraries\n// that read process.env directly (WorkOS, Prisma) instead of importing @env.\n" : "// The loaded, validated values for the current environment. Import this in app\n// code. Importing it loads configuration and throws (naming the parameter and\n// environment) if anything required is missing or invalid.\n";
-  const loadCall = inject ? "export const env = load(schema, { inject: true });\n" : "export const env = load(schema);\n";
   return `${draft ? DRAFT_HEADER : ""}import { z } from "zod";
-import { load } from "@penvhq/penv";
 
-// The shape. Import this (or z.infer<typeof schema>) when you only need the
-// type \u2014 tests, tooling \u2014 so you don't trigger config loading.
+// The shape \u2014 the one definition every consumer derives from. Import this (or
+// z.infer<typeof schema>) when you only need the type \u2014 tests, tooling \u2014 so you
+// don't trigger config loading. .penv/env.ts wraps it with load().
 export const schema = z.object({
 ${body}
 });
 
-` + loadComment + loadCall + `
 // Registers the schema's shape with penv's types (erased at runtime, so
 // nothing cycles). This is what makes \`override\` keys in penv.config.ts
 // autocomplete from this schema \u2014 a typo'd parameter id is a compile error.
@@ -3251,6 +3473,24 @@ declare module "@penvhq/core" {
 }
 `;
 }
+function shapeSpecifier(schemaFile) {
+  const depth = schemaFile.split("/").length - 1;
+  const climb = depth === 0 ? "./" : "../".repeat(depth);
+  return `${climb}${SCHEMA_SHAPE_BASENAME}.js`;
+}
+function renderEnvModule(schemaFile, inject = false) {
+  const loadComment = inject ? "// The loaded, validated values for the current environment. Import this in app\n// code. `inject: true` also copies the values into process.env, for libraries\n// that read process.env directly. `snapshot` lets load() resolve in a bundled or\n// serverless runtime where no penv.config.ts is on disk.\n" : "// The loaded, validated values for the current environment. Import this in app\n// code. Importing it loads configuration and throws (naming the parameter and\n// environment) if anything required is missing or invalid. `snapshot` lets load()\n// resolve in a bundled or serverless runtime where no penv.config.ts is on disk.\n";
+  const loadCall = inject ? "export const env = load(schema, { inject: true, snapshot });\n" : "export const env = load(schema, { snapshot });\n";
+  return `import { load } from "@penvhq/penv";
+import { schema } from "${shapeSpecifier(schemaFile)}";
+import { snapshot } from "${snapshotSpecifier(schemaFile)}";
+
+// Re-exported so type-only consumers can import the shape through @env without
+// triggering config loading \u2014 the shape itself lives in ${import_core16.SCHEMA_SHAPE_FILE}.
+export { schema };
+
+` + loadComment + loadCall;
+}
 function renderEnvironments(decisions) {
   const shared = "  // Environments are a whitelist. A filename segment is an environment only if\n  // it is declared here \u2014 penv never infers one from a folder or a filename.\n";
   if (decisions.environments.length === 0) {
@@ -3258,7 +3498,7 @@ function renderEnvironments(decisions) {
   // can read off your codebase, and an environment you do not have is worse
   // than one you have not declared yet. Name yours, and give each a provider:
   //   environments: ["development", "production"],
-  //   providers: { development: { type: "@penvhq/provider-filesystem" }, production: { type: "@penvhq/provider-filesystem" } },
+  //   providers: { development: { type: "@penvhq/provider-filesystem" }, production: { type: "@penvhq/provider-vault" } },
   environments: [],
 
   providers: {},
@@ -3276,7 +3516,7 @@ ${providers}  },
 }
 function renderConfigModule(decisions) {
   let body = renderEnvironments(decisions);
-  if (decisions.schemaFile !== import_core15.DEFAULT_SCHEMA_FILE) {
+  if (decisions.schemaFile !== import_core16.DEFAULT_SCHEMA_FILE) {
     body += `
   // The module that exports the schema. It is yours \u2014 penv scaffolds it once
   // and never regenerates it \u2014 so this says where you keep it.
@@ -3299,7 +3539,7 @@ ${body}});
 `;
 }
 function renderGitignore(decisions) {
-  const inside = (0, import_core15.schemaInsideTree)(configOf(decisions));
+  const inside = (0, import_core16.schemaInsideTree)(configOf(decisions));
   const listed = inside === void 0 ? "" : `${inside}, `;
   return `# Written by penv. Value files hold configuration values and are never
 # committed; only the structure, ${listed}meta, and config are.
@@ -3444,13 +3684,13 @@ ${objectIndent}${source.slice(close)}`;
 ${entryIndent}${member},${source.slice(open + 1)}`;
 }
 function shapeError(what, target, alias) {
-  return new import_core15.PenvError(
+  return new import_core16.PenvError(
     "TSCONFIG_SHAPE",
     `penv cannot add the \`${alias}\` path alias to tsconfig.json: ${what}`,
     `Add it by hand: \`{ "compilerOptions": { "paths": { "${alias}": ["${target}"] } } }\`.`
   );
 }
-function insertEnvAlias(source, target = import_core15.DEFAULT_SCHEMA_FILE, name = DEFAULT_ALIAS) {
+function insertEnvAlias(source, target = import_core16.DEFAULT_SCHEMA_FILE, name = DEFAULT_ALIAS) {
   const alias = `"${name}": ["${target}"]`;
   const root = skipTrivia(source, 0);
   if (source.charAt(root) !== "{") {
@@ -3514,46 +3754,102 @@ function renderTsconfig(target, alias) {
 `;
 }
 function ensurePenvDir(root) {
-  const dir = (0, import_node_path6.resolve)(root, PENV_DIR2);
-  if ((0, import_node_fs3.existsSync)(dir)) {
+  const dir = (0, import_node_path8.resolve)(root, PENV_DIR2);
+  if ((0, import_node_fs6.existsSync)(dir)) {
     return { target: "penv-dir", action: "kept", text: `Found ${PENV_DIR2}/` };
   }
-  (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
   return { target: "penv-dir", action: "created", text: `Created ${PENV_DIR2}/` };
 }
-function writeSchemaFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
-  const file = (0, import_node_path6.join)(root, ...decisions.schemaFile.split("/"));
-  if ((0, import_node_fs3.existsSync)(file)) {
+function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
+  const file = (0, import_node_path8.join)(root, import_core16.SCHEMA_SHAPE_FILE);
+  if ((0, import_node_fs6.existsSync)(file)) {
     return {
       target: "schema",
       action: "kept",
-      text: `Kept ${decisions.schemaFile}`,
+      text: `Kept ${import_core16.SCHEMA_SHAPE_FILE}`,
       note: "(yours \u2014 penv never regenerates it)"
     };
   }
-  (0, import_node_fs3.mkdirSync)((0, import_node_path6.dirname)(file), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(file, renderSchemaModule(fields, draft, decisions.inject), "utf8");
+  const oldLayout = selfContainedSchemaModule(root, decisions.schemaFile);
+  if (oldLayout !== void 0) {
+    return {
+      target: "schema",
+      action: "conflicted",
+      text: `Kept your schema in ${oldLayout}`,
+      note: `(the shape lives there, from before the ${import_core16.SCHEMA_SHAPE_FILE} split \u2014 penv did not add a second one. To adopt the split: move the \`z.object\` (and any \`declare module\` block) into ${import_core16.SCHEMA_SHAPE_FILE}, leaving ${oldLayout} importing \`schema\` from it and calling \`load\`.)`
+    };
+  }
+  (0, import_node_fs6.writeFileSync)(file, renderSchemaShapeModule(fields, draft), "utf8");
   return {
     target: "schema",
     action: "created",
+    text: `Generated ${import_core16.SCHEMA_SHAPE_FILE}`,
+    note: draft ? "(draft schema \u2014 review it, it's yours)" : "(the shape \u2014 yours to edit)"
+  };
+}
+function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
+  const file = (0, import_node_path8.join)(root, ...decisions.schemaFile.split("/"));
+  if ((0, import_node_fs6.existsSync)(file)) {
+    return {
+      target: "env",
+      action: "kept",
+      text: `Kept ${decisions.schemaFile}`,
+      note: "(yours \u2014 penv never regenerates it)"
+    };
+  }
+  (0, import_node_fs6.mkdirSync)((0, import_node_path8.dirname)(file), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(file, renderEnvModule(decisions.schemaFile, decisions.inject), "utf8");
+  return {
+    target: "env",
+    action: "created",
     text: `Generated ${decisions.schemaFile}`,
-    note: draft ? "(draft schema \u2014 review it, it's yours)" : "(schema + loader \u2014 yours to edit)"
+    note: "(loads the shape \u2014 yours to edit)"
   };
 }
 function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
-  const file = (0, import_node_path6.join)(root, CONFIG_FILE);
-  if ((0, import_node_fs3.existsSync)(file)) {
+  const file = (0, import_node_path8.join)(root, CONFIG_FILE);
+  if ((0, import_node_fs6.existsSync)(file)) {
     return { target: "config", action: "kept", text: `Kept ${CONFIG_FILE}` };
   }
-  (0, import_node_fs3.writeFileSync)(file, renderConfigModule(decisions), "utf8");
+  (0, import_node_fs6.writeFileSync)(file, renderConfigModule(decisions), "utf8");
   return { target: "config", action: "created", text: `Generated ${CONFIG_FILE}` };
 }
+function snapshotConfig(decisions) {
+  const providers = {};
+  for (const environment of decisions.environments) {
+    providers[environment] = { type: "@penvhq/provider-filesystem" };
+  }
+  return {
+    environments: decisions.environments,
+    providers,
+    ...decisions.schemaFile === import_core16.DEFAULT_SCHEMA_FILE ? {} : { schemaFile: decisions.schemaFile },
+    ...decisions.publicPrefixes.length === 0 ? {} : { publicPrefixes: decisions.publicPrefixes }
+  };
+}
+function writeSnapshotModule(root, decisions = DEFAULT_DECISIONS) {
+  const file = (0, import_node_path8.join)(root, SNAPSHOT_FILE);
+  if ((0, import_node_fs6.existsSync)(file)) {
+    return { target: "snapshot", action: "kept", text: `Kept ${SNAPSHOT_FILE}` };
+  }
+  (0, import_node_fs6.writeFileSync)(
+    file,
+    renderSnapshotModule(buildSnapshotFrom(root, snapshotConfig(decisions))),
+    "utf8"
+  );
+  return {
+    target: "snapshot",
+    action: "created",
+    text: `Generated ${SNAPSHOT_FILE}`,
+    note: "(committed \u2014 the bundle resolves load() from it)"
+  };
+}
 function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   const alias = decisions.alias;
   const imports = alias.startsWith(IMPORTS_PREFIX);
-  const file = (0, import_node_path6.join)(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
+  const file = (0, import_node_path8.join)(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
   const where = imports ? PACKAGE_FILE : TSCONFIG_FILE;
-  if (!(0, import_node_fs3.existsSync)(file)) {
+  if (!(0, import_node_fs6.existsSync)(file)) {
     if (imports) {
       return {
         target: "tsconfig",
@@ -3562,14 +3858,14 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
         note: `(run \`npm init\` first, or use \`--alias @env\` to alias through ${TSCONFIG_FILE})`
       };
     }
-    (0, import_node_fs3.writeFileSync)(file, renderTsconfig(decisions.schemaFile, alias), "utf8");
+    (0, import_node_fs6.writeFileSync)(file, renderTsconfig(decisions.schemaFile, alias), "utf8");
     return {
       target: "tsconfig",
       action: "created",
       text: `Created ${TSCONFIG_FILE} with the ${alias} path alias`
     };
   }
-  const source = (0, import_node_fs3.readFileSync)(file, "utf8");
+  const source = (0, import_node_fs6.readFileSync)(file, "utf8");
   const edit = imports ? insertImportsAlias(source, decisions.schemaFile, alias) : insertEnvAlias(source, decisions.schemaFile, alias);
   if (edit.conflict !== void 0) {
     return {
@@ -3586,7 +3882,7 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
       text: `Kept the ${alias} alias in ${where}`
     };
   }
-  (0, import_node_fs3.writeFileSync)(file, edit.source, "utf8");
+  (0, import_node_fs6.writeFileSync)(file, edit.source, "utf8");
   return {
     target: "tsconfig",
     action: "updated",
@@ -3594,15 +3890,15 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   };
 }
 function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
-  const file = (0, import_node_path6.join)(root, PENV_DIR2, GITIGNORE_FILE);
+  const file = (0, import_node_path8.join)(root, PENV_DIR2, GITIGNORE_FILE);
   const relative3 = `${PENV_DIR2}/${GITIGNORE_FILE}`;
   const wanted = renderGitignore(decisions);
-  const existing = (0, import_node_fs3.existsSync)(file) ? (0, import_node_fs3.readFileSync)(file, "utf8") : void 0;
+  const existing = (0, import_node_fs6.existsSync)(file) ? (0, import_node_fs6.readFileSync)(file, "utf8") : void 0;
   if (existing === wanted) {
     return { target: "gitignore", action: "kept", text: `Kept ${relative3}` };
   }
-  (0, import_node_fs3.mkdirSync)((0, import_node_path6.join)(root, PENV_DIR2), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(file, wanted, "utf8");
+  (0, import_node_fs6.mkdirSync)((0, import_node_path8.join)(root, PENV_DIR2), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(file, wanted, "utf8");
   return {
     target: "gitignore",
     action: existing === void 0 ? "created" : "updated",
@@ -3618,12 +3914,12 @@ function outdatedRuntimeWarning(root) {
   return `Injection needs @penvhq/penv ${INJECT_MIN_VERSION}+ \u2014 this project has ${version}, whose \`load\` ignores \`{ inject: true }\`. Upgrade, or process.env stays empty.`;
 }
 function installedPenvVersion(root) {
-  const file = (0, import_node_path6.join)(root, "node_modules", "@penvhq", "penv", "package.json");
-  if (!(0, import_node_fs3.existsSync)(file)) {
+  const file = (0, import_node_path8.join)(root, "node_modules", "@penvhq", "penv", "package.json");
+  if (!(0, import_node_fs6.existsSync)(file)) {
     return void 0;
   }
   try {
-    const version = JSON.parse((0, import_node_fs3.readFileSync)(file, "utf8")).version;
+    const version = JSON.parse((0, import_node_fs6.readFileSync)(file, "utf8")).version;
     return typeof version === "string" ? version : void 0;
   } catch {
     return void 0;
@@ -3663,11 +3959,11 @@ function writeSeam(root, decisions = DEFAULT_DECISIONS, framework = detectFramew
     };
   }
   const alsoNote = writeAlso(root, seam.also);
-  const file = (0, import_node_path6.join)(root, ...seam.file.split("/"));
+  const file = (0, import_node_path8.join)(root, ...seam.file.split("/"));
   const baseNotes = [...seam.notes, ...alsoNote === void 0 ? [] : [alsoNote]];
   const notes = baseNotes.length === 0 ? "" : `
 ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
-  if ((0, import_node_fs3.existsSync)(file)) {
+  if ((0, import_node_fs6.existsSync)(file)) {
     return {
       target: "seam",
       action: "info",
@@ -3675,8 +3971,8 @@ ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
       note: withWarning(`${seam.ifPresent}${notes}`, outdated)
     };
   }
-  (0, import_node_fs3.mkdirSync)((0, import_node_path6.dirname)(file), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(file, seam.content, "utf8");
+  (0, import_node_fs6.mkdirSync)((0, import_node_path8.dirname)(file), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(file, seam.content, "utf8");
   return {
     target: "seam",
     action: outdated === void 0 ? "created" : "info",
@@ -3688,12 +3984,12 @@ function writeAlso(root, also) {
   if (also === void 0) {
     return void 0;
   }
-  const file = (0, import_node_path6.join)(root, ...also.file.split("/"));
-  if ((0, import_node_fs3.existsSync)(file)) {
+  const file = (0, import_node_path8.join)(root, ...also.file.split("/"));
+  if ((0, import_node_fs6.existsSync)(file)) {
     return also.ifPresent;
   }
-  (0, import_node_fs3.mkdirSync)((0, import_node_path6.dirname)(file), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(file, also.content, "utf8");
+  (0, import_node_fs6.mkdirSync)((0, import_node_path8.dirname)(file), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(file, also.content, "utf8");
   return `Wrote ${also.file} to register it.`;
 }
 function withWarning(note, warning) {
@@ -3706,8 +4002,15 @@ function withWarning(note, warning) {
 function scaffold(root, fields, draft, decisions = DEFAULT_DECISIONS, framework = detectFramework(root)?.name) {
   const steps = [
     ensurePenvDir(root),
-    writeSchemaFile(root, fields, draft, decisions),
+    // The shape at the root, then the wrapper that loads it — both write-once.
+    // The shape step needs the decisions too: an old-layout `schemaFile` already
+    // holds the shape, and a second `penv.schema.ts` beside it would not compile.
+    writeSchemaShapeFile(root, fields, draft, decisions),
+    writeEnvFile(root, decisions),
     writeConfigFile(root, decisions),
+    // After the config, whose evaluated shape the snapshot embeds; the wrapper
+    // env.ts written above already imports it.
+    writeSnapshotModule(root, decisions),
     writeTsconfigAlias(root, decisions),
     writeGitignore(root, decisions)
   ];
@@ -3715,7 +4018,7 @@ function scaffold(root, fields, draft, decisions = DEFAULT_DECISIONS, framework
   return seam === void 0 ? steps : [...steps, seam];
 }
 function runInit(options) {
-  const root = (0, import_node_path6.resolve)(options.cwd);
+  const root = (0, import_node_path8.resolve)(options.cwd);
   const decisions = options.decisions ?? planInit(root).decisions;
   return { root, decisions, steps: scaffold(root, [], false, decisions, options.framework) };
 }
@@ -3724,10 +4027,12 @@ function renderInit(result2) {
     const glyph = step.action === "conflicted" ? WARN : step.action === "info" ? "\u2192" : CHECK;
     return step.note === void 0 ? { glyph, text: step.text } : { glyph, text: step.text, note: step.note };
   });
+  const schemaStep = result2.steps.find((step) => step.target === "schema");
+  const shapeFile = schemaStep?.action === "conflicted" ? result2.decisions.schemaFile : import_core16.SCHEMA_SHAPE_FILE;
   return [
     ...formatSteps(steps),
     "",
-    `${out.green(CHECK)} ${out.bold("Done.")} Declare your parameters in ${result2.decisions.schemaFile}, then:`,
+    `${out.green(CHECK)} ${out.bold("Done.")} Declare your parameters in ${shapeFile}, then:`,
     tip(out.cyan("penv set <key>")),
     ...result2.decisions.environments.length === 0 ? [
       `Then declare your environments in ${CONFIG_FILE}: penv leaves the whitelist empty rather than inventing one, and every command needs it.`
@@ -3755,7 +4060,7 @@ var initCommand = (0, import_citty9.defineCommand)({
     },
     schema: {
       type: "string",
-      description: `Where the schema module goes, e.g. src/env.ts (default: ${import_core15.DEFAULT_SCHEMA_FILE})`
+      description: `Where the schema module goes, e.g. src/env.ts (default: ${import_core16.DEFAULT_SCHEMA_FILE})`
     },
     alias: {
       type: "string",
@@ -3768,7 +4073,7 @@ var initCommand = (0, import_citty9.defineCommand)({
   },
   run({ args }) {
     return guard(async () => {
-      const root = (0, import_node_path6.resolve)(process.cwd());
+      const root = (0, import_node_path8.resolve)(process.cwd());
       const environments = environmentsFromFlag(args.env);
       const plan2 = planInit(root, {
         ...args.schema === void 0 ? {} : { schema: args.schema },
@@ -3817,7 +4122,7 @@ function inferType(value) {
 }
 function draftFields(entries) {
   return entries.map((entry) => {
-    const key = (0, import_core16.accessPath)((0, import_core16.refFromVariable)(entry.key)).join(".");
+    const key = (0, import_core17.accessPath)((0, import_core17.refFromVariable)(entry.key)).join(".");
     return {
       key: IDENTIFIER.test(key) ? key : JSON.stringify(key),
       type: inferType(entry.value)
@@ -3828,33 +4133,33 @@ function assertImportable(ref, variable) {
   if (!ref.name.includes(".")) {
     return;
   }
-  throw new import_core16.PenvError(
+  throw new import_core17.PenvError(
     "IMPORT_UNPARSEABLE_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, whose \`.\` would be read as a scope`,
     `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
   );
 }
 function assertNotReserved(ref, variable, where, config) {
-  if ((0, import_core16.isReservedToken)(ref.name, config)) {
-    throw new import_core16.ReservedTokenError("parameter", variable, where);
+  if ((0, import_core17.isReservedToken)(ref.name, config)) {
+    throw new import_core17.ReservedTokenError("parameter", variable, where);
   }
 }
 function assertRoundTrips(ref, variable, config) {
-  if ((0, import_core16.roundTripsCleanly)(variable)) {
+  if ((0, import_core17.roundTripsCleanly)(variable)) {
     return;
   }
-  if ((0, import_core16.variableName)(ref, config) === variable) {
+  if ((0, import_core17.variableName)(ref, config) === variable) {
     return;
   }
-  const generated = (0, import_core16.variableName)(ref, config);
-  throw new import_core16.PenvError(
+  const generated = (0, import_core17.variableName)(ref, config);
+  throw new import_core17.PenvError(
     "IMPORT_LOSSY_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, which regenerates as ${generated}`,
     `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`override\` block of penv.config.ts \u2014 \`override: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
   );
 }
 function collisionsIn(refs, config) {
-  const errors = (0, import_core16.checkNameCollisions)(refs, config);
+  const errors = (0, import_core17.checkNameCollisions)(refs, config);
   const first = errors[0];
   if (first !== void 0) {
     throw first;
@@ -3864,10 +4169,10 @@ function assertDeclared(segment, config) {
   if (config.environments.includes(segment)) {
     return segment;
   }
-  throw new import_core16.UnknownEnvironmentError(segment, config.environments);
+  throw new import_core17.UnknownEnvironmentError(segment, config.environments);
 }
 function scopeFromFilename(file, config) {
-  const name = (0, import_node_path7.basename)(file);
+  const name = (0, import_node_path9.basename)(file);
   const segments = name.split(".");
   const start = segments.indexOf(DOTENV_SEGMENT);
   if (start === -1) {
@@ -3889,13 +4194,13 @@ function scopeFromFilename(file, config) {
     return { kind: "environment-local", environment: assertDeclared(first, config) };
   }
   if (first === LOCAL && rest.length === 2) {
-    throw new import_core16.FilenameGrammarError(
+    throw new import_core17.FilenameGrammarError(
       name,
       "`local` precedes the environment segment",
       `The environment segment always precedes \`local\` \u2014 \`.env.${second}.${LOCAL}\` is the file Next.js and Vite read, and \`.env.${LOCAL}.${second}\` is not a synonym for it. Rename it to \`.env.${second}.${LOCAL}\`, then import it again. Nothing was imported.`
     );
   }
-  throw new import_core16.FilenameGrammarError(
+  throw new import_core17.FilenameGrammarError(
     name,
     `\`${rest.join("` and `")}\` are ${rest.length} scope segments`,
     "A dotenv file carries exactly one scope: `.env`, `.env.<environment>`, `.env.local`, or `.env.<environment>.local`. Point `penv import` at one of those. Nothing was imported."
@@ -3910,7 +4215,7 @@ function environmentOf(scope) {
     case "local":
       return void 0;
     default:
-      return (0, import_core16.assertNever)(scope, "scope");
+      return (0, import_core17.assertNever)(scope, "scope");
   }
 }
 function scopeWithEnvironment(scope, environment) {
@@ -3923,7 +4228,7 @@ function scopeWithEnvironment(scope, environment) {
     case "environment-local":
       return scope;
     default:
-      return (0, import_core16.assertNever)(scope, "scope");
+      return (0, import_core17.assertNever)(scope, "scope");
   }
 }
 function explicitEnvironment(options, source, config) {
@@ -3931,7 +4236,7 @@ function explicitEnvironment(options, source, config) {
   if (value.length > 0) {
     return value;
   }
-  throw new import_core16.PenvError(
+  throw new import_core17.PenvError(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
     `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
@@ -3941,7 +4246,7 @@ function assertEnvironmentAgrees(derived, explicit, source) {
   if (derived === void 0 || explicit === void 0 || derived === explicit) {
     return;
   }
-  throw new import_core16.PenvError(
+  throw new import_core17.PenvError(
     "IMPORT_ENV_CONFLICT",
     `The file ${source} is scoped to environment ${derived}, but \`--env ${explicit}\` names ${explicit}`,
     `Drop \`--env\` to import ${source} as ${derived}, pass \`--env ${derived}\` to say the same thing twice, or point \`penv import\` at the file that holds ${explicit}'s values. Nothing was imported.`
@@ -3951,7 +4256,7 @@ function environmentNamed(file, explicit) {
   if (explicit !== void 0 && explicit.trim().length > 0) {
     return explicit.trim();
   }
-  const segments = (0, import_node_path7.basename)(file).split(".");
+  const segments = (0, import_node_path9.basename)(file).split(".");
   const start = segments.indexOf(DOTENV_SEGMENT);
   if (start === -1) {
     return void 0;
@@ -3965,15 +4270,15 @@ function decisionsOf(config, cwd) {
     // `import` re-scaffolds env.ts for an existing project; injection is an init
     // choice, so it is not turned on here.
     inject: false,
-    schemaFile: (0, import_core16.schemaFileOf)(config),
+    schemaFile: (0, import_core17.schemaFileOf)(config),
     publicPrefixes: config.publicPrefixes ?? [],
     alias: detectAlias(cwd)
   };
 }
 function configInEffect(cwd, environment) {
-  const existing = (0, import_core16.findConfigFile)(cwd);
+  const existing = (0, import_core17.findConfigFile)(cwd);
   if (existing !== void 0) {
-    const config = (0, import_core16.loadConfigFrom)(existing);
+    const config = (0, import_core17.loadConfigFrom)(existing);
     return { config, decisions: decisionsOf(config, cwd) };
   }
   const planned = planInit(cwd).decisions;
@@ -3985,16 +4290,16 @@ function configInEffect(cwd, environment) {
   return { config: openProject(cwd).config, decisions };
 }
 function importDotenv(options) {
-  const cwd = (0, import_node_path7.resolve)(options.cwd);
-  const file = (0, import_node_path7.isAbsolute)(options.file) ? options.file : (0, import_node_path7.resolve)(cwd, options.file);
-  if (!(0, import_node_fs4.existsSync)(file)) {
-    throw new import_core16.PenvError(
+  const cwd = (0, import_node_path9.resolve)(options.cwd);
+  const file = (0, import_node_path9.isAbsolute)(options.file) ? options.file : (0, import_node_path9.resolve)(cwd, options.file);
+  if (!(0, import_node_fs7.existsSync)(file)) {
+    throw new import_core17.PenvError(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = (0, import_core16.parseDotenv)((0, import_node_fs4.readFileSync)(file, "utf8"));
+  const parsed = (0, import_core17.parseDotenv)((0, import_node_fs7.readFileSync)(file, "utf8"));
   const { config, decisions } = configInEffect(cwd, environmentNamed(file, options.environment));
   const source = displayPath2(cwd, file);
   const named = scopeFromFilename(file, config);
@@ -4002,10 +4307,10 @@ function importDotenv(options) {
   const explicit = options.environment === void 0 ? void 0 : explicitEnvironment(options, source, config);
   assertEnvironmentAgrees(derived, explicit, source);
   const scope = explicit === void 0 ? named : scopeWithEnvironment(named, assertDeclared(explicit, config));
-  const environment = (0, import_core16.lookupEnvironment)(config, explicit ?? derived);
+  const environment = (0, import_core17.lookupEnvironment)(config, explicit ?? derived);
   const refs = [];
   for (const entry of parsed.entries) {
-    const ref = (0, import_core16.refFromVariable)(entry.key);
+    const ref = (0, import_core17.refFromVariable)(entry.key);
     assertImportable(ref, entry.key);
     assertNotReserved(ref, entry.key, source, config);
     assertRoundTrips(ref, entry.key, config);
@@ -4031,7 +4336,8 @@ function importDotenv(options) {
     }
   }
   const backup = `${file}${BACKUP_SUFFIX}`;
-  (0, import_node_fs4.copyFileSync)(file, backup);
+  (0, import_node_fs7.copyFileSync)(file, backup);
+  refreshSnapshot(project);
   return {
     root: project.root,
     file,
@@ -4045,7 +4351,7 @@ function importDotenv(options) {
   };
 }
 function displayPath2(root, file) {
-  const rel = (0, import_node_path7.relative)(root, file);
+  const rel = (0, import_node_path9.relative)(root, file);
   return rel === "" || rel.startsWith("..") ? file : rel.split("\\").join("/");
 }
 function keptSchemaStep(step, variables) {
@@ -4133,7 +4439,7 @@ var importCommand = (0, import_citty10.defineCommand)({
 
 // src/commands/key.ts
 var import_node_crypto = require("crypto");
-var import_core17 = require("@penvhq/core");
+var import_core18 = require("@penvhq/core");
 var import_citty11 = require("citty");
 
 // src/keychain.ts
@@ -4167,35 +4473,35 @@ function runKeyCreate(options) {
   const environment = targetEnvironment(project, options.environment);
   const declared = project.config.keys?.[environment];
   if (declared === void 0) {
-    throw new import_core17.PenvError(
+    throw new import_core18.PenvError(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
       `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
     );
   }
-  const key = (0, import_node_crypto.randomBytes)(import_core17.KEY_BYTES).toString("base64");
+  const key = (0, import_node_crypto.randomBytes)(import_core18.KEY_BYTES).toString("base64");
   if (declared.source === "keychain") {
     const keychain = options.keychain ?? defaultKeychain;
     if (options.force !== true) {
       let existing;
       try {
-        existing = keychain.getPassword(import_core17.KEYCHAIN_SERVICE, declared.id);
+        existing = keychain.getPassword(import_core18.KEYCHAIN_SERVICE, declared.id);
       } catch (cause) {
-        throw new import_core17.PenvError(
+        throw new import_core18.PenvError(
           "KEYCHAIN_UNAVAILABLE",
           `penv could not read your OS keychain to check for an existing key \`${declared.id}\``,
           `Unlock your keychain and run this again. Original error: ${cause instanceof Error ? cause.message : String(cause)}`
         );
       }
       if (existing !== null) {
-        throw new import_core17.PenvError(
+        throw new import_core18.PenvError(
           "KEY_EXISTS",
           `Environment ${environment} already has a key \`${declared.id}\` in your OS keychain`,
           "Replacing it would orphan every value already sealed under it \u2014 they could never be decrypted again. Re-run with `--force` only if you are certain nothing is sealed under the current key."
         );
       }
     }
-    keychain.setPassword(import_core17.KEYCHAIN_SERVICE, declared.id, key);
+    keychain.setPassword(import_core18.KEYCHAIN_SERVICE, declared.id, key);
     return { source: "keychain", environment, id: declared.id };
   }
   return {
@@ -4263,7 +4569,7 @@ var keyCommand = (0, import_citty11.defineCommand)({
 });
 
 // src/commands/list.ts
-var import_core18 = require("@penvhq/core");
+var import_core19 = require("@penvhq/core");
 var import_citty12 = require("citty");
 function scopeLabel2(scope) {
   switch (scope.kind) {
@@ -4276,7 +4582,7 @@ function scopeLabel2(scope) {
     case "unscoped":
       return "default";
     default:
-      return (0, import_core18.assertNever)(scope, "scope");
+      return (0, import_core19.assertNever)(scope, "scope");
   }
 }
 async function runList(options) {
@@ -4284,12 +4590,12 @@ async function runList(options) {
   const environment = targetEnvironment(project, options.environment);
   const keys = keySourceFor(project, environment);
   const parameters = [];
-  for (const resolution of await (0, import_core18.resolveAll)(environment, project.provider, keys)) {
+  for (const resolution of await (0, import_core19.resolveAll)(environment, project.provider, keys)) {
     const winner = resolution.winner;
     const scope = winner?.file.scope;
     parameters.push({
       parameter: resolution.parameter,
-      variable: (0, import_core18.variableName)(resolution.ref, project.config),
+      variable: (0, import_core19.variableName)(resolution.ref, project.config),
       scope: scope === void 0 ? "absent" : scopeLabel2(scope),
       location: winner?.location,
       encrypted: winner?.file.encrypted === true,
@@ -4342,7 +4648,7 @@ var listCommand = (0, import_citty12.defineCommand)({
 });
 
 // src/commands/mv.ts
-var import_core19 = require("@penvhq/core");
+var import_core20 = require("@penvhq/core");
 var import_citty13 = require("citty");
 function environmentOf2(file) {
   const scope = file.scope;
@@ -4358,39 +4664,39 @@ async function planFile(project, source, target, parameter) {
   }
   const environment = environmentOf2(source);
   if (environment === void 0) {
-    throw new import_core19.PenvError(
+    throw new import_core20.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
-      `${PENV_DIR}/${(0, import_core19.formatValueFile)(source)} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
+      `${PENV_DIR}/${(0, import_core20.formatValueFile)(source)} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
       "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
     );
   }
   const keys = keySourceFor(project, environment);
-  const opened = (0, import_core19.openValue)(source, stored, keys);
+  const opened = (0, import_core20.openValue)(source, stored, keys);
   if (opened.kind === "failed") {
-    throw new import_core19.PenvError(
+    throw new import_core20.PenvError(
       "VALUE_UNDECRYPTABLE",
-      `${PENV_DIR}/${(0, import_core19.formatValueFile)(source)} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
+      `${PENV_DIR}/${(0, import_core20.formatValueFile)(source)} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
       "A sealed value is bound to the file it lives in, so moving it means opening it and sealing it again. Make the key available and run this again. Nothing has been moved."
     );
   }
   return {
     source,
     target,
-    contents: (0, import_core19.sealValue)(target, opened.value, keys, parameter, environment),
+    contents: (0, import_core20.sealValue)(target, opened.value, keys, parameter, environment),
     resealed: true
   };
 }
 function filesOf(all, ref) {
-  const id = (0, import_core19.parameterId)(ref);
-  return all.filter((file) => (0, import_core19.parameterId)(file) === id);
+  const id = (0, import_core20.parameterId)(ref);
+  return all.filter((file) => (0, import_core20.parameterId)(file) === id);
 }
 async function runMove(options) {
   const project = openProject(options.cwd);
   const from = refFromKey(options.from, project.config);
   assertWritableKey(options.to);
   const to = refFromKey(options.to, project.config);
-  if ((0, import_core19.parameterId)(from) === (0, import_core19.parameterId)(to)) {
-    throw new import_core19.PenvError(
+  if ((0, import_core20.parameterId)(from) === (0, import_core20.parameterId)(to)) {
+    throw new import_core20.PenvError(
       "PARAMETER_UNCHANGED",
       `\`${options.from}\` and \`${options.to}\` are the same parameter`,
       "Name a different destination, e.g. `penv mv redis-password redis/password`."
@@ -4400,24 +4706,24 @@ async function runMove(options) {
   const sources = filesOf(all, from);
   const meta = await project.provider.readMeta(from);
   if (sources.length === 0 && meta === void 0) {
-    throw new import_core19.PenvError(
+    throw new import_core20.PenvError(
       "PARAMETER_ABSENT",
-      `Parameter ${(0, import_core19.parameterId)(from)} has no value files and no meta, so there is nothing to move`,
+      `Parameter ${(0, import_core20.parameterId)(from)} has no value files and no meta, so there is nothing to move`,
       `\`penv list\` shows every parameter penv holds.`
     );
   }
   const occupied2 = filesOf(all, to);
   if (occupied2.length > 0 || await project.provider.readMeta(to) !== void 0) {
-    throw new import_core19.PenvError(
+    throw new import_core20.PenvError(
       "PARAMETER_EXISTS",
-      `Parameter ${(0, import_core19.parameterId)(to)} already exists, and penv will not merge two parameters into one`,
-      `Remove or rename ${(0, import_core19.parameterId)(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
+      `Parameter ${(0, import_core20.parameterId)(to)} already exists, and penv will not merge two parameters into one`,
+      `Remove or rename ${(0, import_core20.parameterId)(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
     );
   }
   const planned = [];
   for (const source of sources) {
     const target = { ...source, namespace: to.namespace, name: to.name };
-    const one = await planFile(project, source, target, (0, import_core19.parameterId)(to));
+    const one = await planFile(project, source, target, (0, import_core20.parameterId)(to));
     if (one !== void 0) {
       planned.push(one);
     }
@@ -4434,19 +4740,21 @@ async function runMove(options) {
   if (meta !== void 0) {
     await project.provider.removeMeta(from);
   }
+  refreshSnapshot(project);
   return {
-    from: (0, import_core19.parameterId)(from),
-    to: (0, import_core19.parameterId)(to),
+    from: (0, import_core20.parameterId)(from),
+    to: (0, import_core20.parameterId)(to),
     files: planned.map((file) => ({
-      from: (0, import_core19.formatValueFile)(file.source),
-      to: (0, import_core19.formatValueFile)(file.target),
+      from: (0, import_core20.formatValueFile)(file.source),
+      to: (0, import_core20.formatValueFile)(file.target),
       resealed: file.resealed
     })),
     // The meta's path, not the parameter's dotted id: `redis.password` is what
     // the schema calls it and `redis/password.json` is the file, and a report
     // that printed the first while moving the second names no file on disk.
-    meta: meta === void 0 ? void 0 : (0, import_core19.formatMetaFile)({ ...to, format: "json" }),
-    schema: { was: (0, import_core19.accessPath)(from).join("."), now: (0, import_core19.accessPath)(to).join(".") }
+    meta: meta === void 0 ? void 0 : (0, import_core20.formatMetaFile)({ ...to, format: "json" }),
+    schema: { was: (0, import_core20.accessPath)(from).join("."), now: (0, import_core20.accessPath)(to).join(".") },
+    schemaFile: schemaShapeFileOf(project)
   };
 }
 function renderMove(result2) {
@@ -4463,7 +4771,7 @@ function renderMove(result2) {
   lines.push(
     "",
     tip(
-      `.penv/env.ts still declares \`${result2.schema.was}\` \u2014 rename it to \`${result2.schema.now}\`, or \`penv validate\` will report the value as unused and the declaration as unset.`
+      `${result2.schemaFile} still declares \`${result2.schema.was}\` \u2014 rename it to \`${result2.schema.now}\`, or \`penv validate\` will report the value as unused and the declaration as unset.`
     )
   );
   return lines;
@@ -4490,7 +4798,7 @@ var mvCommand = (0, import_citty13.defineCommand)({
 });
 
 // src/commands/pull.ts
-var import_core20 = require("@penvhq/core");
+var import_core21 = require("@penvhq/core");
 var import_citty14 = require("citty");
 async function pullProjection(project, source, environment) {
   const tree = localTree(project);
@@ -4503,7 +4811,7 @@ async function pullProjection(project, source, environment) {
   }
   let meta = 0;
   for (const name of [...names].sort()) {
-    const ref = (0, import_core20.refFromVariable)(name);
+    const ref = (0, import_core21.refFromVariable)(name);
     if (tree.readMetaSync(ref) === void 0) {
       tree.writeMetaSync(ref, {});
       meta += 1;
@@ -4526,7 +4834,7 @@ async function runPull(options) {
   if (source.type === LOCAL_TREE_TYPE) {
     return { environment, source: source.type, localSource: true, values: 0, meta: 0, refs: 0 };
   }
-  if ((0, import_core20.holdsProjection)(source)) {
+  if ((0, import_core21.holdsProjection)(source)) {
     return pullProjection(project, source, environment);
   }
   const tree = localTree(project);
@@ -4550,6 +4858,7 @@ async function runPull(options) {
     tree.writeMetaSync(ref, block);
     meta += 1;
   }
+  refreshSnapshot(project);
   return { environment, source: source.type, localSource: false, values, meta, refs: refs.length };
 }
 function renderPull(result2) {
@@ -4618,7 +4927,7 @@ var pullCommand = (0, import_citty14.defineCommand)({
 });
 
 // src/commands/remove.ts
-var import_core21 = require("@penvhq/core");
+var import_core22 = require("@penvhq/core");
 var import_citty15 = require("citty");
 async function runRemove(options) {
   const project = openProject(options.cwd);
@@ -4636,12 +4945,13 @@ async function runRemove(options) {
       continue;
     }
     await project.provider.remove(file);
-    removed.push((0, import_core21.formatValueFile)(file));
+    removed.push((0, import_core22.formatValueFile)(file));
   }
+  refreshSnapshot(project);
   return {
     parameter: options.key,
     removed,
-    considered: files.map((file) => (0, import_core21.formatValueFile)(file))
+    considered: files.map((file) => (0, import_core22.formatValueFile)(file))
   };
 }
 function renderRemove(result2) {
@@ -4690,7 +5000,7 @@ var removeCommand = (0, import_citty15.defineCommand)({
 });
 
 // src/commands/rotate.ts
-var import_core22 = require("@penvhq/core");
+var import_core23 = require("@penvhq/core");
 var import_citty16 = require("citty");
 function rotatingFile(ref, environment) {
   return {
@@ -4710,13 +5020,14 @@ async function writeRotatedValue(project, provider, ref, environment, value) {
       value,
       environment
     });
+    refreshSnapshot(project);
     return;
   }
   await provider.write(rotatingFile(ref, environment), value);
 }
 function requireNewValue(value, phase, key) {
   if (value === void 0) {
-    throw new import_core22.PenvError(
+    throw new import_core23.PenvError(
       "ROTATION_NO_VALUE",
       `A ${phase} rotation of ${key} writes a new value, and none was given`,
       "Pass the new value as the argument \u2014 `penv rotate <key> <value>` \u2014 or pipe it in on stdin."
@@ -4725,8 +5036,8 @@ function requireNewValue(value, phase, key) {
   return value;
 }
 function requireRetaining(provider, environment) {
-  if (!(0, import_core22.retainsPrevious)(provider)) {
-    throw new import_core22.PenvError(
+  if (!(0, import_core23.retainsPrevious)(provider)) {
+    throw new import_core23.PenvError(
       "ROTATION_NOT_RETAINING",
       `A dual-valid rotation needs the previous value to stay readable during the grace window, and the \`${provider.type}\` provider for environment ${environment} does not retain it`,
       "Point this environment at a provider that keeps prior versions (its `readPrevious` is what penv reads during the window), or, if a momentary overlap is not required, declare the parameter `atomic-cutover` in its meta and flip it in one step."
@@ -4739,8 +5050,8 @@ async function runRotate(options) {
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key, project.config);
   const source = await sourceProviderFor(project, environment);
-  if (!(0, import_core22.holdsRecords)(source)) {
-    throw new import_core22.PenvError(
+  if (!(0, import_core23.holdsRecords)(source)) {
+    throw new import_core23.PenvError(
       "ROTATION_NOT_RECORDS",
       `Environment ${environment} is backed by \`${source.type}\`, which holds a resolved projection penv cannot rotate in place`,
       "Rotate the parameter in the environment that holds the records (the local tree, Vault, SSM), then `penv push` the result to this destination."
@@ -4749,9 +5060,9 @@ async function runRotate(options) {
   const provider = source;
   const nowIso = options.now ?? (/* @__PURE__ */ new Date()).toISOString();
   const before = await provider.readMeta(ref);
-  const { mechanism } = (0, import_core22.rotationOf)(before, environment);
+  const { mechanism } = (0, import_core23.rotationOf)(before, environment);
   if (mechanism === void 0) {
-    throw new import_core22.PenvError(
+    throw new import_core23.PenvError(
       "ROTATION_NO_MECHANISM",
       `Parameter ${options.key} declares no rotation mechanism for environment ${environment}, so penv does not know how to rotate it`,
       'Set `rotationMechanism` in the parameter\'s meta to `"dual-valid"` (a grace-window overlap) or `"atomic-cutover"` (a single flip), then run `penv rotate` again.'
@@ -4761,7 +5072,7 @@ async function runRotate(options) {
   const complete = options.complete === true;
   if (mechanism === "atomic-cutover") {
     if (begin || complete) {
-      throw new import_core22.PenvError(
+      throw new import_core23.PenvError(
         "ROTATION_MECHANISM_MISMATCH",
         `Parameter ${options.key} is atomic-cutover, which flips in one step, so \`--begin\`/\`--complete\` do not apply`,
         "Run `penv rotate <key> <value>` with no phase flag to flip it. `--begin`/`--complete` bracket a dual-valid grace window, which atomic-cutover has none of."
@@ -4769,13 +5080,13 @@ async function runRotate(options) {
     }
     const value = requireNewValue(options.value, "cutover", options.key);
     await writeRotatedValue(project, provider, ref, environment, value);
-    const after2 = (0, import_core22.completeRotation)(before, environment, nowIso);
+    const after2 = (0, import_core23.completeRotation)(before, environment, nowIso);
     await provider.writeMeta(ref, after2);
     return result(ref, environment, mechanism, "cutover", provider.type, true, after2);
   }
   const retaining = requireRetaining(provider, environment);
   if (begin === complete) {
-    throw new import_core22.PenvError(
+    throw new import_core23.PenvError(
       "ROTATION_PHASE_REQUIRED",
       `A dual-valid rotation of ${options.key} needs exactly one of \`--begin\` or \`--complete\``,
       "`--begin` writes the new value and opens the grace window; `--complete` closes it once every reader has moved to the new value. Run them in that order, one at a time."
@@ -4784,16 +5095,16 @@ async function runRotate(options) {
   if (begin) {
     const value = requireNewValue(options.value, "begin", options.key);
     await writeRotatedValue(project, retaining, ref, environment, value);
-    const after2 = (0, import_core22.beginRotation)(before, environment, nowIso);
+    const after2 = (0, import_core23.beginRotation)(before, environment, nowIso);
     await retaining.writeMeta(ref, after2);
     return result(ref, environment, mechanism, "begin", retaining.type, true, after2);
   }
-  const after = (0, import_core22.completeRotation)(before, environment, nowIso);
+  const after = (0, import_core23.completeRotation)(before, environment, nowIso);
   await retaining.writeMeta(ref, after);
   return result(ref, environment, mechanism, "complete", retaining.type, false, after);
 }
 function result(ref, environment, mechanism, phase, source, wroteValue, after) {
-  const { state, rotatingSince, lastRotated } = (0, import_core22.rotationOf)(after, environment);
+  const { state, rotatingSince, lastRotated } = (0, import_core23.rotationOf)(after, environment);
   return {
     parameter: [...ref.namespace, ref.name].join("/"),
     environment,
@@ -4877,15 +5188,57 @@ var rotateCommand = (0, import_citty16.defineCommand)({
   }
 });
 
-// src/commands/watch.ts
-var import_node_fs5 = require("fs");
-var import_node_path8 = require("path");
-var import_core23 = require("@penvhq/core");
+// src/commands/snapshot.ts
 var import_citty17 = require("citty");
+function runSnapshot(options) {
+  const project = openProject(options.cwd);
+  return { write: writeSnapshotFile(project), wire: wireEnvModule(project) };
+}
+function renderSnapshot(result2) {
+  const label = result2.write.action === "created" ? "Generated" : result2.write.action === "updated" ? "Updated" : "Up to date";
+  const rows = [{ glyph: CHECK, label, subject: SNAPSHOT_FILE }];
+  if (result2.wire.action === "wired") {
+    rows.push({
+      glyph: CHECK,
+      label: "Wired",
+      subject: result2.wire.file,
+      detail: "load reads the snapshot"
+    });
+  } else if (result2.wire.action === "kept") {
+    rows.push({ glyph: CHECK, label: "Wired", subject: result2.wire.file });
+  }
+  const lines = formatRows(rows);
+  if (result2.wire.action === "manual") {
+    lines.push(
+      "",
+      `${WARN} penv could not wire ${result2.wire.file} automatically \u2014 add these two lines yourself:`,
+      tip(result2.wire.importLine),
+      tip(result2.wire.loadHint)
+    );
+  }
+  return lines;
+}
+var snapshotCommand = (0, import_citty17.defineCommand)({
+  meta: {
+    name: "snapshot",
+    description: "Generate penv.snapshot.ts so load() resolves in a bundled/serverless runtime"
+  },
+  run() {
+    return guard(async () => {
+      write(renderSnapshot(runSnapshot({ cwd: process.cwd() })));
+    });
+  }
+});
+
+// src/commands/watch.ts
+var import_node_fs8 = require("fs");
+var import_node_path10 = require("path");
+var import_core24 = require("@penvhq/core");
+var import_citty18 = require("citty");
 var DEBOUNCE_MS = 100;
 function runWatch(options) {
   const project = openProject(options.cwd);
-  const configFile = (0, import_node_path8.basename)(project.configFile);
+  const configFile = (0, import_node_path10.basename)(project.configFile);
   const debounceMs = options.debounceMs ?? DEBOUNCE_MS;
   const watchers = /* @__PURE__ */ new Set();
   let timer;
@@ -4938,22 +5291,22 @@ function runWatch(options) {
     watcher.close();
   }
   function armRecovery(target, recursive, only) {
-    const parent = (0, import_node_path8.dirname)(target);
-    const name = (0, import_node_path8.basename)(target);
+    const parent = (0, import_node_path10.dirname)(target);
+    const name = (0, import_node_path10.basename)(target);
     let recovery;
     try {
-      recovery = (0, import_node_fs5.watch)(parent, { recursive: false }, (_event, filename) => {
+      recovery = (0, import_node_fs8.watch)(parent, { recursive: false }, (_event, filename) => {
         if (closed || recovery === void 0) {
           return;
         }
-        if (!(0, import_node_fs5.existsSync)(parent)) {
+        if (!(0, import_node_fs8.existsSync)(parent)) {
           stop(recovery);
           return;
         }
-        if (filename !== null && (0, import_node_path8.basename)(filename) !== name) {
+        if (filename !== null && (0, import_node_path10.basename)(filename) !== name) {
           return;
         }
-        if (!(0, import_node_fs5.existsSync)(target)) {
+        if (!(0, import_node_fs8.existsSync)(target)) {
           return;
         }
         stop(recovery);
@@ -4973,11 +5326,11 @@ function runWatch(options) {
   }
   function addWatcher(target, recursive, only) {
     let watcher;
-    const listen = (useRecursive) => (0, import_node_fs5.watch)(target, { recursive: useRecursive }, (_event, filename) => {
+    const listen = (useRecursive) => (0, import_node_fs8.watch)(target, { recursive: useRecursive }, (_event, filename) => {
       if (closed) {
         return;
       }
-      if (!(0, import_node_fs5.existsSync)(target)) {
+      if (!(0, import_node_fs8.existsSync)(target)) {
         if (watcher !== void 0) {
           stop(watcher);
         }
@@ -4985,7 +5338,7 @@ function runWatch(options) {
         schedule();
         return;
       }
-      if (only !== void 0 && (filename === null || (0, import_node_path8.basename)(filename) !== only)) {
+      if (only !== void 0 && (filename === null || (0, import_node_path10.basename)(filename) !== only)) {
         return;
       }
       schedule();
@@ -5012,10 +5365,11 @@ function runWatch(options) {
     watchers.add(watcher);
   }
   addWatcher(project.penvDir, true);
-  addWatcher((0, import_node_path8.dirname)(project.configFile), false, configFile);
-  if ((0, import_core23.schemaInsideTree)(project.config) === void 0) {
-    const schemaFile = (0, import_node_path8.resolve)(project.root, (0, import_core23.schemaFileOf)(project.config));
-    addWatcher((0, import_node_path8.dirname)(schemaFile), false, (0, import_node_path8.basename)(schemaFile));
+  addWatcher((0, import_node_path10.dirname)(project.configFile), false, configFile);
+  addWatcher(project.root, false, import_core24.SCHEMA_SHAPE_FILE);
+  if ((0, import_core24.schemaInsideTree)(project.config) === void 0) {
+    const schemaFile = (0, import_node_path10.resolve)(project.root, (0, import_core24.schemaFileOf)(project.config));
+    addWatcher((0, import_node_path10.dirname)(schemaFile), false, (0, import_node_path10.basename)(schemaFile));
   }
   void validate();
   return {
@@ -5058,7 +5412,7 @@ function renderDrift(drift, environment) {
   }
   return lines;
 }
-var watchCommand = (0, import_citty17.defineCommand)({
+var watchCommand = (0, import_citty18.defineCommand)({
   meta: {
     name: "watch",
     description: "Re-validate whenever .penv/ or penv.config.ts changes"
@@ -5097,7 +5451,7 @@ var watchCommand = (0, import_citty17.defineCommand)({
 });
 
 // src/index.ts
-var main = (0, import_citty18.defineCommand)({
+var main = (0, import_citty19.defineCommand)({
   meta: {
     name: "penv",
     description: "Configuration that shares a data model with your production secret manager"
@@ -5118,14 +5472,15 @@ var main = (0, import_citty18.defineCommand)({
     encrypt: encryptCommand,
     decrypt: decryptCommand,
     key: keyCommand,
+    snapshot: snapshotCommand,
     validate: validateCommand,
     doctor: doctorCommand,
     watch: watchCommand
   }
 });
 function runMain() {
-  (0, import_core24.setKeychain)(defaultKeychain);
-  return (0, import_citty18.runMain)(main);
+  (0, import_core25.setKeychain)(defaultKeychain);
+  return (0, import_citty19.runMain)(main);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -5140,6 +5495,7 @@ function runMain() {
   renderPull,
   renderPush,
   renderRotate,
+  renderSnapshot,
   renderWatch,
   runDecrypt,
   runDoctor,
@@ -5157,6 +5513,7 @@ function runMain() {
   runRemove,
   runRotate,
   runSet,
+  runSnapshot,
   runValidate,
   runWatch
 });