@penvhq/cli 0.9.0 → 0.9.1

package/dist/index.cjs

@@ -65,7 +65,7 @@ __export(src_exports, {
   runWatch: () => runWatch
 });
 module.exports = __toCommonJS(src_exports);
-var import_core34 = require("@penvhq/core");
+var import_core35 = require("@penvhq/core");
 var import_citty22 = require("citty");
 
 // src/commands/artifact.ts
@@ -471,9 +471,9 @@ function resolvePlugin(specifier, fromDir) {
   }
 }
 function importPlugin(resolvedPath) {
-  const cached2 = pluginModuleCache.get(resolvedPath);
-  if (cached2 !== void 0) {
-    return cached2;
+  const cached = pluginModuleCache.get(resolvedPath);
+  if (cached !== void 0) {
+    return cached;
   }
   const loading = import((0, import_node_url.pathToFileURL)(resolvedPath).href);
   pluginModuleCache.set(resolvedPath, loading);
@@ -6054,30 +6054,51 @@ var importCommand = (0, import_citty14.defineCommand)({
 
 // src/commands/key.ts
 var import_node_crypto = require("crypto");
-var import_core27 = require("@penvhq/core");
+var import_core28 = require("@penvhq/core");
 var import_citty15 = require("citty");
 
 // src/keychain.ts
 var import_node_module3 = require("module");
+var import_core27 = require("@penvhq/core");
 var import_meta2 = {};
-var cached;
-function entryConstructor() {
-  if (cached === void 0) {
-    const require2 = (0, import_node_module3.createRequire)(import_meta2.url);
-    cached = require2("@napi-rs/keyring").Entry;
-  }
-  return cached;
-}
-var defaultKeychain = {
-  getPassword(service, account) {
-    const Entry = entryConstructor();
-    return new Entry(service, account).getPassword();
-  },
-  setPassword(service, account, password) {
-    const Entry = entryConstructor();
-    new Entry(service, account).setPassword(password);
-  }
-};
+var KEYRING_MODULE = "@napi-rs/keyring";
+var nodeRequire = (id) => (0, import_node_module3.createRequire)(import_meta2.url)(id);
+function firstLine2(cause) {
+  return (cause instanceof Error ? cause.message : String(cause)).split("\n")[0] ?? "";
+}
+function keyringMissing(cause) {
+  return new import_core27.PenvError(
+    "KEYCHAIN_BINDING_MISSING",
+    `penv could not load ${KEYRING_MODULE}, the native binding it reads your OS keychain through`,
+    `This penv engine was installed as a plain tarball, which carries no native modules. Install penv with \`npm install -g @penvhq/launcher\`, or declare \`source: "env"\` for this environment and export its key. Original error: ${firstLine2(cause)}`
+  );
+}
+function createKeychain(load = nodeRequire) {
+  let cached;
+  const entryConstructor = () => {
+    if (cached === void 0) {
+      let module2;
+      try {
+        module2 = load(KEYRING_MODULE);
+      } catch (cause) {
+        throw keyringMissing(cause);
+      }
+      cached = module2.Entry;
+    }
+    return cached;
+  };
+  return {
+    getPassword(service, account) {
+      const Entry = entryConstructor();
+      return new Entry(service, account).getPassword();
+    },
+    setPassword(service, account, password) {
+      const Entry = entryConstructor();
+      new Entry(service, account).setPassword(password);
+    }
+  };
+}
+var defaultKeychain = createKeychain();
 
 // src/commands/key.ts
 function envVarFor(id) {
@@ -6088,35 +6109,38 @@ function runKeyCreate(options) {
   const environment = targetEnvironment(project, options.environment);
   const declared = project.config.keys?.[environment];
   if (declared === void 0) {
-    throw new import_core27.PenvError(
+    throw new import_core28.PenvError(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
       `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
     );
   }
-  const key = (0, import_node_crypto.randomBytes)(import_core27.KEY_BYTES).toString("base64");
+  const key = (0, import_node_crypto.randomBytes)(import_core28.KEY_BYTES).toString("base64");
   if (declared.source === "keychain") {
     const keychain = options.keychain ?? defaultKeychain;
     if (options.force !== true) {
       let existing;
       try {
-        existing = keychain.getPassword(import_core27.KEYCHAIN_SERVICE, declared.id);
+        existing = keychain.getPassword(import_core28.KEYCHAIN_SERVICE, declared.id);
       } catch (cause) {
-        throw new import_core27.PenvError(
+        if (cause instanceof import_core28.PenvError) {
+          throw cause;
+        }
+        throw new import_core28.PenvError(
           "KEYCHAIN_UNAVAILABLE",
           `penv could not read your OS keychain to check for an existing key \`${declared.id}\``,
           `Unlock your keychain and run this again. Original error: ${cause instanceof Error ? cause.message : String(cause)}`
         );
       }
       if (existing !== null) {
-        throw new import_core27.PenvError(
+        throw new import_core28.PenvError(
           "KEY_EXISTS",
           `Environment ${environment} already has a key \`${declared.id}\` in your OS keychain`,
           "Replacing it would orphan every value already sealed under it \u2014 they could never be decrypted again. Re-run with `--force` only if you are certain nothing is sealed under the current key."
         );
       }
     }
-    keychain.setPassword(import_core27.KEYCHAIN_SERVICE, declared.id, key);
+    keychain.setPassword(import_core28.KEYCHAIN_SERVICE, declared.id, key);
     return { source: "keychain", environment, id: declared.id };
   }
   return {
@@ -6184,7 +6208,7 @@ var keyCommand = (0, import_citty15.defineCommand)({
 });
 
 // src/commands/list.ts
-var import_core28 = require("@penvhq/core");
+var import_core29 = require("@penvhq/core");
 var import_citty16 = require("citty");
 function scopeLabel2(scope) {
   switch (scope.kind) {
@@ -6197,7 +6221,7 @@ function scopeLabel2(scope) {
     case "unscoped":
       return "default";
     default:
-      return (0, import_core28.assertNever)(scope, "scope");
+      return (0, import_core29.assertNever)(scope, "scope");
   }
 }
 async function runList(options) {
@@ -6205,12 +6229,12 @@ async function runList(options) {
   const environment = targetEnvironment(project, options.environment);
   const keys = keySourceFor(project, environment);
   const parameters = [];
-  for (const resolution of await (0, import_core28.resolveAll)(environment, project.provider, keys)) {
+  for (const resolution of await (0, import_core29.resolveAll)(environment, project.provider, keys)) {
     const winner = resolution.winner;
     const scope = winner?.file.scope;
     parameters.push({
       parameter: resolution.parameter,
-      variable: (0, import_core28.variableName)(resolution.ref, project.config),
+      variable: (0, import_core29.variableName)(resolution.ref, project.config),
       scope: scope === void 0 ? "absent" : scopeLabel2(scope),
       location: winner?.location,
       encrypted: winner?.file.encrypted === true,
@@ -6228,7 +6252,7 @@ function paintScope(entry) {
 function renderList(result2) {
   if (result2.parameters.length === 0) {
     return [
-      `No parameters in ${import_core28.RECORDS_PATH}/ for environment ${result2.environment}.`,
+      `No parameters in ${import_core29.RECORDS_PATH}/ for environment ${result2.environment}.`,
       tip(`penv set <key> --env ${result2.environment}`)
     ];
   }
@@ -6266,34 +6290,34 @@ var listCommand = (0, import_citty16.defineCommand)({
 var import_node_fs13 = require("fs");
 var import_node_path14 = require("path");
 var import_promises2 = require("readline/promises");
-var import_core29 = require("@penvhq/core");
+var import_core30 = require("@penvhq/core");
 var import_citty17 = require("citty");
-var OLD_GITIGNORE = `${import_core29.PENV_DIR}/.gitignore`;
+var OLD_GITIGNORE = `${import_core30.PENV_DIR}/.gitignore`;
 function planMigrate(cwd) {
-  const { config, file } = (0, import_core29.loadConfig)(cwd);
+  const { config, file } = (0, import_core30.loadConfig)(cwd);
   const root = (0, import_node_path14.dirname)(file);
-  const entries = (0, import_core29.oldLayoutEntries)(root, config);
-  const tree = (0, import_core29.recordsDir)(root);
+  const entries = (0, import_core30.oldLayoutEntries)(root, config);
+  const tree = (0, import_core30.recordsDir)(root);
   const collisions = collidingEntries(entries, tree);
   if (collisions.length > 0) {
-    throw new import_core29.PenvError(
+    throw new import_core30.PenvError(
       "HALF_MIGRATED",
-      `${describe(collisions)} in both \`${import_core29.PENV_DIR}/\` and \`${import_core29.RECORDS_PATH}/\`, and penv cannot tell which copy is current`,
-      `Move what is left under \`${import_core29.PENV_DIR}/\` into \`${import_core29.RECORDS_PATH}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
+      `${describe(collisions)} in both \`${import_core30.PENV_DIR}/\` and \`${import_core30.RECORDS_PATH}/\`, and penv cannot tell which copy is current`,
+      `Move what is left under \`${import_core30.PENV_DIR}/\` into \`${import_core30.RECORDS_PATH}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
     );
   }
   const creates = [];
   if (entries.length > 0 && !(0, import_node_fs13.existsSync)(tree)) {
-    creates.push(`${import_core29.RECORDS_PATH}/`);
+    creates.push(`${import_core30.RECORDS_PATH}/`);
   }
-  if (readIfPresent((0, import_node_path14.join)(root, ...import_core29.STATE_GITIGNORE_PATH.split("/"))) !== (0, import_core29.renderStateGitignore)(config)) {
-    creates.push(import_core29.STATE_GITIGNORE_PATH);
+  if (readIfPresent((0, import_node_path14.join)(root, ...import_core30.STATE_GITIGNORE_PATH.split("/"))) !== (0, import_core30.renderStateGitignore)(config)) {
+    creates.push(import_core30.STATE_GITIGNORE_PATH);
   }
   return {
     root,
     moves: entries.map((entry) => ({
-      from: `${import_core29.PENV_DIR}/${entry}`,
-      to: `${import_core29.RECORDS_PATH}/${entry}`
+      from: `${import_core30.PENV_DIR}/${entry}`,
+      to: `${import_core30.RECORDS_PATH}/${entry}`
     })),
     creates,
     removes: (0, import_node_fs13.existsSync)((0, import_node_path14.join)(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
@@ -6322,17 +6346,17 @@ function applyMigrate(plan2) {
   if (isNoop(plan2)) {
     return { ...plan2, status: "current" };
   }
-  const { config } = (0, import_core29.loadConfig)(plan2.root);
+  const { config } = (0, import_core30.loadConfig)(plan2.root);
   if (plan2.moves.length > 0) {
-    (0, import_node_fs13.mkdirSync)((0, import_core29.recordsDir)(plan2.root), { recursive: true });
+    (0, import_node_fs13.mkdirSync)((0, import_core30.recordsDir)(plan2.root), { recursive: true });
     for (const move of plan2.moves) {
       (0, import_node_fs13.renameSync)((0, import_node_path14.join)(plan2.root, ...move.from.split("/")), (0, import_node_path14.join)(plan2.root, ...move.to.split("/")));
     }
   }
-  if (plan2.creates.includes(import_core29.STATE_GITIGNORE_PATH)) {
-    const ignore = (0, import_node_path14.join)(plan2.root, ...import_core29.STATE_GITIGNORE_PATH.split("/"));
+  if (plan2.creates.includes(import_core30.STATE_GITIGNORE_PATH)) {
+    const ignore = (0, import_node_path14.join)(plan2.root, ...import_core30.STATE_GITIGNORE_PATH.split("/"));
     (0, import_node_fs13.mkdirSync)((0, import_node_path14.dirname)(ignore), { recursive: true });
-    (0, import_node_fs13.writeFileSync)(ignore, (0, import_core29.renderStateGitignore)(config), "utf8");
+    (0, import_node_fs13.writeFileSync)(ignore, (0, import_core30.renderStateGitignore)(config), "utf8");
   }
   for (const removed of plan2.removes) {
     (0, import_node_fs13.rmSync)((0, import_node_path14.join)(plan2.root, ...removed.split("/")), { force: true });
@@ -6348,7 +6372,7 @@ function runMigrate(options) {
 }
 function renderMigrate(result2) {
   if (result2.status === "current") {
-    return [`${out.green(CHECK)} Already on ${import_core29.RECORDS_PATH}/ \u2014 nothing to migrate.`];
+    return [`${out.green(CHECK)} Already on ${import_core30.RECORDS_PATH}/ \u2014 nothing to migrate.`];
   }
   const done = result2.status === "migrated";
   const glyph = done ? CHECK : "\u2192";
@@ -6362,7 +6386,7 @@ function renderMigrate(result2) {
     ...result2.removes.map((removed) => ({
       glyph,
       text: `${done ? "Removed" : "Remove"} ${removed}`,
-      note: `replaced by ${import_core29.STATE_GITIGNORE_PATH}`
+      note: `replaced by ${import_core30.STATE_GITIGNORE_PATH}`
     }))
   ];
   return [
@@ -6389,7 +6413,7 @@ async function approveOnTty() {
 var migrateCommand = (0, import_citty17.defineCommand)({
   meta: {
     name: "migrate",
-    description: `Move a project written under an earlier layout to ${import_core29.RECORDS_PATH}/`
+    description: `Move a project written under an earlier layout to ${import_core30.RECORDS_PATH}/`
   },
   args: {
     yes: { type: "boolean", description: "Apply the previewed move without asking" }
@@ -6412,7 +6436,7 @@ var migrateCommand = (0, import_citty17.defineCommand)({
 });
 
 // src/commands/mv.ts
-var import_core30 = require("@penvhq/core");
+var import_core31 = require("@penvhq/core");
 var import_citty18 = require("citty");
 function environmentOf2(file) {
   const scope = file.scope;
@@ -6428,39 +6452,39 @@ async function planFile(project, source, target, parameter) {
   }
   const environment = environmentOf2(source);
   if (environment === void 0) {
-    throw new import_core30.PenvError(
+    throw new import_core31.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
-      `${(0, import_core30.recordPath)((0, import_core30.formatValueFile)(source))} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
+      `${(0, import_core31.recordPath)((0, import_core31.formatValueFile)(source))} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
       "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
     );
   }
   const keys = keySourceFor(project, environment);
-  const opened = (0, import_core30.openValue)(source, stored, keys);
+  const opened = (0, import_core31.openValue)(source, stored, keys);
   if (opened.kind === "failed") {
-    throw new import_core30.PenvError(
+    throw new import_core31.PenvError(
       "VALUE_UNDECRYPTABLE",
-      `${(0, import_core30.recordPath)((0, import_core30.formatValueFile)(source))} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
+      `${(0, import_core31.recordPath)((0, import_core31.formatValueFile)(source))} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
       "A sealed value is bound to the file it lives in, so moving it means opening it and sealing it again. Make the key available and run this again. Nothing has been moved."
     );
   }
   return {
     source,
     target,
-    contents: (0, import_core30.sealValue)(target, opened.value, keys, parameter, environment),
+    contents: (0, import_core31.sealValue)(target, opened.value, keys, parameter, environment),
     resealed: true
   };
 }
 function filesOf(all, ref) {
-  const id = (0, import_core30.parameterId)(ref);
-  return all.filter((file) => (0, import_core30.parameterId)(file) === id);
+  const id = (0, import_core31.parameterId)(ref);
+  return all.filter((file) => (0, import_core31.parameterId)(file) === id);
 }
 async function runMove(options) {
   const project = openProject(options.cwd);
   const from = refFromKey(options.from, project.config);
   assertWritableKey(options.to);
   const to = refFromKey(options.to, project.config);
-  if ((0, import_core30.parameterId)(from) === (0, import_core30.parameterId)(to)) {
-    throw new import_core30.PenvError(
+  if ((0, import_core31.parameterId)(from) === (0, import_core31.parameterId)(to)) {
+    throw new import_core31.PenvError(
       "PARAMETER_UNCHANGED",
       `\`${options.from}\` and \`${options.to}\` are the same parameter`,
       "Name a different destination, e.g. `penv mv redis-password redis/password`."
@@ -6470,24 +6494,24 @@ async function runMove(options) {
   const sources = filesOf(all, from);
   const meta = await project.provider.readMeta(from);
   if (sources.length === 0 && meta === void 0) {
-    throw new import_core30.PenvError(
+    throw new import_core31.PenvError(
       "PARAMETER_ABSENT",
-      `Parameter ${(0, import_core30.parameterId)(from)} has no value files and no meta, so there is nothing to move`,
+      `Parameter ${(0, import_core31.parameterId)(from)} has no value files and no meta, so there is nothing to move`,
       `\`penv list\` shows every parameter penv holds.`
     );
   }
   const occupied2 = filesOf(all, to);
   if (occupied2.length > 0 || await project.provider.readMeta(to) !== void 0) {
-    throw new import_core30.PenvError(
+    throw new import_core31.PenvError(
       "PARAMETER_EXISTS",
-      `Parameter ${(0, import_core30.parameterId)(to)} already exists, and penv will not merge two parameters into one`,
-      `Remove or rename ${(0, import_core30.parameterId)(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
+      `Parameter ${(0, import_core31.parameterId)(to)} already exists, and penv will not merge two parameters into one`,
+      `Remove or rename ${(0, import_core31.parameterId)(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
     );
   }
   const planned = [];
   for (const source of sources) {
     const target = { ...source, namespace: to.namespace, name: to.name };
-    const one = await planFile(project, source, target, (0, import_core30.parameterId)(to));
+    const one = await planFile(project, source, target, (0, import_core31.parameterId)(to));
     if (one !== void 0) {
       planned.push(one);
     }
@@ -6505,18 +6529,18 @@ async function runMove(options) {
     await project.provider.removeMeta(from);
   }
   return {
-    from: (0, import_core30.parameterId)(from),
-    to: (0, import_core30.parameterId)(to),
+    from: (0, import_core31.parameterId)(from),
+    to: (0, import_core31.parameterId)(to),
     files: planned.map((file) => ({
-      from: (0, import_core30.formatValueFile)(file.source),
-      to: (0, import_core30.formatValueFile)(file.target),
+      from: (0, import_core31.formatValueFile)(file.source),
+      to: (0, import_core31.formatValueFile)(file.target),
       resealed: file.resealed
     })),
     // The meta's path, not the parameter's dotted id: `redis.password` is what
     // the schema calls it and `redis/password.json` is the file, and a report
     // that printed the first while moving the second names no file on disk.
-    meta: meta === void 0 ? void 0 : (0, import_core30.formatMetaFile)({ ...to, format: "json" }),
-    schema: { was: (0, import_core30.accessPath)(from).join("."), now: (0, import_core30.accessPath)(to).join(".") },
+    meta: meta === void 0 ? void 0 : (0, import_core31.formatMetaFile)({ ...to, format: "json" }),
+    schema: { was: (0, import_core31.accessPath)(from).join("."), now: (0, import_core31.accessPath)(to).join(".") },
     schemaFile: schemaShapeFileOf(project)
   };
 }
@@ -6524,11 +6548,11 @@ function renderMove(result2) {
   const rows = result2.files.map((file) => ({
     glyph: CHECK,
     label: "Moved",
-    subject: (0, import_core30.recordPath)(file.to),
+    subject: (0, import_core31.recordPath)(file.to),
     ...file.resealed ? { detail: "re-sealed for its new address" } : {}
   }));
   if (result2.meta !== void 0) {
-    rows.push({ glyph: CHECK, label: "Moved", subject: (0, import_core30.recordPath)(result2.meta) });
+    rows.push({ glyph: CHECK, label: "Moved", subject: (0, import_core31.recordPath)(result2.meta) });
   }
   const lines = formatRows(rows);
   lines.push(
@@ -6561,7 +6585,7 @@ var mvCommand = (0, import_citty18.defineCommand)({
 });
 
 // src/commands/remove.ts
-var import_core31 = require("@penvhq/core");
+var import_core32 = require("@penvhq/core");
 var import_citty19 = require("citty");
 async function runRemove(options) {
   const project = openProject(options.cwd);
@@ -6579,12 +6603,12 @@ async function runRemove(options) {
       continue;
     }
     await project.provider.remove(file);
-    removed.push((0, import_core31.formatValueFile)(file));
+    removed.push((0, import_core32.formatValueFile)(file));
   }
   return {
     parameter: options.key,
     removed,
-    considered: files.map((file) => (0, import_core31.formatValueFile)(file))
+    considered: files.map((file) => (0, import_core32.formatValueFile)(file))
   };
 }
 function renderRemove(result2) {
@@ -6594,7 +6618,7 @@ function renderRemove(result2) {
       {
         glyph: WARN,
         label: "Nothing to remove",
-        subject: (0, import_core31.recordPath)(first),
+        subject: (0, import_core32.recordPath)(first),
         detail: "no value file at that scope"
       }
     ]);
@@ -6602,7 +6626,7 @@ function renderRemove(result2) {
   const rows = result2.removed.map((location) => ({
     glyph: CHECK,
     label: "Removed",
-    subject: (0, import_core31.recordPath)(location)
+    subject: (0, import_core32.recordPath)(location)
   }));
   return formatRows(rows);
 }
@@ -6633,7 +6657,7 @@ var removeCommand = (0, import_citty19.defineCommand)({
 });
 
 // src/commands/rotate.ts
-var import_core32 = require("@penvhq/core");
+var import_core33 = require("@penvhq/core");
 var import_citty20 = require("citty");
 function rotatingFile(ref, environment) {
   return {
@@ -6659,7 +6683,7 @@ async function writeRotatedValue(project, provider, ref, environment, value) {
 }
 function requireNewValue(value, phase, key) {
   if (value === void 0) {
-    throw new import_core32.PenvError(
+    throw new import_core33.PenvError(
       "ROTATION_NO_VALUE",
       `A ${phase} rotation of ${key} writes a new value, and none was given`,
       "Pass the new value as the argument \u2014 `penv rotate <key> <value>` \u2014 or pipe it in on stdin."
@@ -6668,8 +6692,8 @@ function requireNewValue(value, phase, key) {
   return value;
 }
 function requireRetaining(provider, environment) {
-  if (!(0, import_core32.retainsPrevious)(provider)) {
-    throw new import_core32.PenvError(
+  if (!(0, import_core33.retainsPrevious)(provider)) {
+    throw new import_core33.PenvError(
       "ROTATION_NOT_RETAINING",
       `A dual-valid rotation needs the previous value to stay readable during the grace window, and the \`${provider.type}\` provider for environment ${environment} does not retain it`,
       "Point this environment at a provider that keeps prior versions (its `readPrevious` is what penv reads during the window), or, if a momentary overlap is not required, declare the parameter `atomic-cutover` in its meta and flip it in one step."
@@ -6682,8 +6706,8 @@ async function runRotate(options) {
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key, project.config);
   const source = await sourceProviderFor(project, environment);
-  if (!(0, import_core32.holdsRecords)(source)) {
-    throw new import_core32.PenvError(
+  if (!(0, import_core33.holdsRecords)(source)) {
+    throw new import_core33.PenvError(
       "ROTATION_NOT_RECORDS",
       `Environment ${environment} is backed by \`${source.type}\`, which holds a resolved projection penv cannot rotate in place`,
       "Rotate the parameter in the environment that holds the records (the local tree, Vault, SSM), then `penv push` the result to this destination."
@@ -6692,9 +6716,9 @@ async function runRotate(options) {
   const provider = source;
   const nowIso = options.now ?? (/* @__PURE__ */ new Date()).toISOString();
   const before = await provider.readMeta(ref);
-  const { mechanism } = (0, import_core32.rotationOf)(before, environment);
+  const { mechanism } = (0, import_core33.rotationOf)(before, environment);
   if (mechanism === void 0) {
-    throw new import_core32.PenvError(
+    throw new import_core33.PenvError(
       "ROTATION_NO_MECHANISM",
       `Parameter ${options.key} declares no rotation mechanism for environment ${environment}, so penv does not know how to rotate it`,
       'Set `rotationMechanism` in the parameter\'s meta to `"dual-valid"` (a grace-window overlap) or `"atomic-cutover"` (a single flip), then run `penv rotate` again.'
@@ -6704,7 +6728,7 @@ async function runRotate(options) {
   const complete = options.complete === true;
   if (mechanism === "atomic-cutover") {
     if (begin || complete) {
-      throw new import_core32.PenvError(
+      throw new import_core33.PenvError(
         "ROTATION_MECHANISM_MISMATCH",
         `Parameter ${options.key} is atomic-cutover, which flips in one step, so \`--begin\`/\`--complete\` do not apply`,
         "Run `penv rotate <key> <value>` with no phase flag to flip it. `--begin`/`--complete` bracket a dual-valid grace window, which atomic-cutover has none of."
@@ -6712,13 +6736,13 @@ async function runRotate(options) {
     }
     const value = requireNewValue(options.value, "cutover", options.key);
     await writeRotatedValue(project, provider, ref, environment, value);
-    const after2 = (0, import_core32.completeRotation)(before, environment, nowIso);
+    const after2 = (0, import_core33.completeRotation)(before, environment, nowIso);
     await provider.writeMeta(ref, after2);
     return result(ref, environment, mechanism, "cutover", provider.type, true, after2);
   }
   const retaining = requireRetaining(provider, environment);
   if (begin === complete) {
-    throw new import_core32.PenvError(
+    throw new import_core33.PenvError(
       "ROTATION_PHASE_REQUIRED",
       `A dual-valid rotation of ${options.key} needs exactly one of \`--begin\` or \`--complete\``,
       "`--begin` writes the new value and opens the grace window; `--complete` closes it once every reader has moved to the new value. Run them in that order, one at a time."
@@ -6727,16 +6751,16 @@ async function runRotate(options) {
   if (begin) {
     const value = requireNewValue(options.value, "begin", options.key);
     await writeRotatedValue(project, retaining, ref, environment, value);
-    const after2 = (0, import_core32.beginRotation)(before, environment, nowIso);
+    const after2 = (0, import_core33.beginRotation)(before, environment, nowIso);
     await retaining.writeMeta(ref, after2);
     return result(ref, environment, mechanism, "begin", retaining.type, true, after2);
   }
-  const after = (0, import_core32.completeRotation)(before, environment, nowIso);
+  const after = (0, import_core33.completeRotation)(before, environment, nowIso);
   await retaining.writeMeta(ref, after);
   return result(ref, environment, mechanism, "complete", retaining.type, false, after);
 }
 function result(ref, environment, mechanism, phase, source, wroteValue, after) {
-  const { state, rotatingSince, lastRotated } = (0, import_core32.rotationOf)(after, environment);
+  const { state, rotatingSince, lastRotated } = (0, import_core33.rotationOf)(after, environment);
   return {
     parameter: [...ref.namespace, ref.name].join("/"),
     environment,
@@ -6823,7 +6847,7 @@ var rotateCommand = (0, import_citty20.defineCommand)({
 // src/commands/watch.ts
 var import_node_fs14 = require("fs");
 var import_node_path15 = require("path");
-var import_core33 = require("@penvhq/core");
+var import_core34 = require("@penvhq/core");
 var import_citty21 = require("citty");
 var DEBOUNCE_MS2 = 100;
 function runWatch(options) {
@@ -6956,9 +6980,9 @@ function runWatch(options) {
   }
   addWatcher(project.recordsDir, true);
   addWatcher((0, import_node_path15.dirname)(project.configFile), false, configFile);
-  addWatcher(project.root, false, import_core33.SCHEMA_SHAPE_FILE);
-  if ((0, import_core33.schemaInsideTree)(project.config) === void 0) {
-    const schemaFile = (0, import_node_path15.resolve)(project.root, (0, import_core33.schemaFileOf)(project.config));
+  addWatcher(project.root, false, import_core34.SCHEMA_SHAPE_FILE);
+  if ((0, import_core34.schemaInsideTree)(project.config) === void 0) {
+    const schemaFile = (0, import_node_path15.resolve)(project.root, (0, import_core34.schemaFileOf)(project.config));
     addWatcher((0, import_node_path15.dirname)(schemaFile), false, (0, import_node_path15.basename)(schemaFile));
   }
   void validate();
@@ -7042,10 +7066,13 @@ var watchCommand = (0, import_citty21.defineCommand)({
 
 // src/index.ts
 var main = (0, import_citty22.defineCommand)({
-  meta: {
+  // Lazy, so reading the engine's own version off disk is something `--version`
+  // does rather than something importing this module does.
+  meta: () => ({
     name: "penv",
-    description: "Configuration that shares a data model with your production secret manager"
-  },
+    description: "Configuration that shares a data model with your production secret manager",
+    version: engineVersion()
+  }),
   subCommands: {
     init: initCommand,
     import: importCommand,
@@ -7072,7 +7099,7 @@ var main = (0, import_citty22.defineCommand)({
   }
 });
 function runMain() {
-  (0, import_core34.setKeychain)(defaultKeychain);
+  (0, import_core35.setKeychain)(defaultKeychain);
   return (0, import_citty22.runMain)(main);
 }
 // Annotate the CommonJS export names for ESM import in node: