@penvhq/cli 0.9.3 → 0.9.5

package/dist/bin.cjs

@@ -47374,17 +47374,55 @@ var import_url = require("url");
 var import_crypto2 = require("crypto");
 var import_fs2 = require("fs");
 var import_path2 = require("path");
+var REMEDY_ARROW = "\u2192";
+function framesOf(stack) {
+  return (stack ?? "").split("\n").filter((line) => /^\s+at\s/.test(line));
+}
+function renderRefusal(error51) {
+  const captured = error51.stack;
+  Object.defineProperty(error51, "stack", {
+    configurable: true,
+    get: () => [error51.toString(), ...framesOf(captured)].join("\n"),
+    set(value2) {
+      Object.defineProperty(error51, "stack", { value: value2, writable: true, configurable: true });
+    }
+  });
+}
 var PenvError = class extends Error {
   name = "PenvError";
   /** A stable, machine-readable discriminator. */
   code;
   /** What the user should do about it. */
   remedy;
+  /** The message alone, without the remedy the constructor folds into it. */
+  summary;
   constructor(code, message, remedy) {
     super(remedy ? `${message}
   ${remedy}` : message);
     this.code = code;
     this.remedy = remedy;
+    this.summary = message;
+    renderRefusal(this);
+  }
+  /**
+   * Drops every frame from `below` upward, so the stack shows where the
+   * application called in rather than the path penv took inside itself. The
+   * caller names its own entry point; nothing here guesses which files are
+   * penv's.
+   */
+  hideFramesAbove(below) {
+    const capture = Error.captureStackTrace;
+    if (capture !== void 0) {
+      capture(this, below);
+      renderRefusal(this);
+    }
+    return this;
+  }
+  /** The refusal as every penv command prints it: the message, then the remedy. */
+  toString() {
+    const head = `${this.name}: ${this.summary}`;
+    return this.remedy === void 0 ? head : `${head}
+  ${REMEDY_ARROW} ${this.remedy}`;
   }
 };
 var FilenameGrammarError = class extends PenvError {
@@ -47720,8 +47758,8 @@ var META_FORMATS = ["json", "toml", "yml"];
 function assertNever2(value2, context) {
   throw new Error(`Unhandled ${context}: ${JSON.stringify(value2)}`);
 }
-function own(record2, key) {
-  return record2 !== void 0 && Object.hasOwn(record2, key) ? record2[key] : void 0;
+function own(record3, key) {
+  return record3 !== void 0 && Object.hasOwn(record3, key) ? record3[key] : void 0;
 }
 function retainsPrevious(provider) {
   return typeof provider.readPrevious === "function";
@@ -48912,6 +48950,7 @@ var RECORDS_PATH2 = `${STATE_PATH}/records`;
 var STATE_GITIGNORE_PATH = `${STATE_PATH}/.gitignore`;
 var MANIFEST_PATH = `${STATE_PATH}/manifest.json`;
 var EXTENSIONS_PATH = `${STATE_PATH}/extensions`;
+var LOCAL_EXTENSIONS_PATH = `${STATE_PATH}/local-extensions.json`;
 var CUTOVER_FILE = "cutover.json";
 var ROLLBACK_DIR = "rollback";
 var CUTOVER_PATH = `${STATE_PATH}/${CUTOVER_FILE}`;
@@ -48920,6 +48959,9 @@ var ROLLBACK_DOTENV_PATH = `${ROLLBACK_PATH}/dotenv`;
 function penvDir(projectRoot) {
   return (0, import_path2.resolve)(projectRoot, PENV_DIR);
 }
+function localExtensionsFile(projectRoot) {
+  return (0, import_path2.resolve)(projectRoot, ...LOCAL_EXTENSIONS_PATH.split("/"));
+}
 function recordsDir(projectRoot) {
   return (0, import_path2.resolve)(projectRoot, ...RECORDS_PATH2.split("/"));
 }
@@ -48964,6 +49006,33 @@ ${inside === void 0 ? "" : `!${inside}
 ${ROLLBACK_DIR}/
 `;
 }
+function invalid(problem) {
+  return new PenvError(
+    "LOCAL_EXTENSIONS_INVALID",
+    `${LOCAL_EXTENSIONS_PATH} does not hold the list penv writes: ${problem}`,
+    "It is a JSON array of package names. Delete it and run `penv add --local <package>` for each extension this project develops."
+  );
+}
+function parseLocalExtensions(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw invalid("it is not valid JSON");
+  }
+  if (!Array.isArray(parsed)) {
+    throw invalid("its root is not an array");
+  }
+  for (const name of parsed) {
+    if (typeof name !== "string" || name.trim() === "") {
+      throw invalid("it holds something that is not a package name");
+    }
+  }
+  return normalize(parsed);
+}
+function normalize(names) {
+  return [...new Set(names.map((name) => name.trim()))].sort();
+}
 var MANIFEST_FORMAT = 1;
 var ENGINE_PACKAGE = "@penvhq/cli";
 var OFFICIAL_SCOPE = "@penvhq/";
@@ -49969,7 +50038,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 
 // src/commands/artifact.ts
 init_cjs_shims();
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_node_path7 = require("path");
 
 // ../runtime/dist/index.js
@@ -50139,11 +50208,13 @@ var RUN_MARKER = "PENV_RUN";
 var ENVIRONMENT_VARIABLE = "PENV_ENV";
 var DELIVERY_VARIABLE = "PENV_DELIVERY";
 var SNAPSHOT_VARIABLE = "PENV_SNAPSHOT";
+var LAUNCHER_HOME = "PENV_HOME";
 var CONTROL_VARIABLES = [
   RUN_MARKER,
   DELIVERY_VARIABLE,
   SCHEMA_HARVEST_ENV,
-  SNAPSHOT_VARIABLE
+  SNAPSHOT_VARIABLE,
+  LAUNCHER_HOME
 ];
 var RESERVED_VARIABLES = [...CONTROL_VARIABLES, ENVIRONMENT_VARIABLE];
 function assertDeliverableNames(refs, config2) {
@@ -50275,15 +50346,15 @@ function caseInsensitiveNames() {
   return process.platform === "win32";
 }
 function childRecord(host) {
-  const record2 = { ...host };
+  const record3 = { ...host };
   if (!caseInsensitiveNames()) {
-    return record2;
+    return record3;
   }
   const spelling = (name) => {
     const upper = name.toUpperCase();
-    return Object.keys(record2).find((key) => key.toUpperCase() === upper);
+    return Object.keys(record3).find((key) => key.toUpperCase() === upper);
   };
-  return new Proxy(record2, {
+  return new Proxy(record3, {
     get: (target, property) => typeof property === "string" ? target[spelling(property) ?? property] : Reflect.get(target, property),
     set(target, property, value2) {
       if (typeof property !== "string") {
@@ -50437,7 +50508,7 @@ var startChild = (invocation) => {
   const ended = new Promise((resolve12, reject) => {
     child.on("error", (cause) => {
       release();
-      reject(cannotStart(executable, cause));
+      reject(cannotStart(executable, cause, invocation.purpose));
     });
     child.on("exit", (code, signal) => {
       release();
@@ -50458,8 +50529,15 @@ function noCommand() {
     "Put the command after `--`, e.g. `penv run -- pnpm dev`."
   );
 }
-function cannotStart(executable, cause) {
+function cannotStart(executable, cause, purpose) {
   const detail = cause instanceof Error ? cause.message : String(cause);
+  if (purpose !== void 0) {
+    return new PenvError(
+      "PENV_COMMAND_NOT_STARTED",
+      `penv could not start \`${executable}\` to ${purpose}: ${detail}`,
+      `Check that \`${executable}\` runs on its own \u2014 penv starts it the way your shell does, so it has to be on PATH. Nothing was changed.`
+    );
+  }
   return new PenvError(
     "RUN_COMMAND_NOT_STARTED",
     `\`${executable}\` could not be started: ${detail}`,
@@ -50488,12 +50566,15 @@ function cmdCommandLine(resolved, args) {
     " "
   );
 }
-function extensions(env) {
+function extensions(env, platform) {
+  if (platform !== "win32") {
+    return [""];
+  }
   const declared = env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD";
-  return ["", ...declared.split(";").filter((extension) => extension.length > 0)];
+  return [...declared.split(";").filter((extension) => extension.length > 0), ""];
 }
-function findExecutable(executable, env) {
-  const candidates = extensions(env);
+function findExecutable(executable, env, platform = process.platform) {
+  const candidates = extensions(env, platform);
   const isFile = (path2) => (0, import_node_fs.existsSync)(path2) && (0, import_node_fs.statSync)(path2).isFile();
   if (executable.includes("/") || executable.includes("\\") || (0, import_node_path.isAbsolute)(executable)) {
     return candidates.map((extension) => executable + extension).find(isFile);
@@ -50519,6 +50600,7 @@ function escapeArgument(argument, doubleEscape) {
 
 // src/install.ts
 var RUNTIME_PACKAGE = "@penvhq/penv";
+var SCHEMA_PACKAGE = "zod";
 var LOCKFILES = [
   ["pnpm", "pnpm-lock.yaml"],
   ["yarn", "yarn.lock"],
@@ -50533,13 +50615,9 @@ var ADD = {
   bun: ["bun", "add", "--exact"]
 };
 function engineVersion() {
-  const manifest = new URL("../package.json", importMetaUrl);
-  try {
-    const version2 = JSON.parse((0, import_node_fs2.readFileSync)(manifest, "utf8")).version;
-    if (typeof version2 === "string" && version2.length > 0) {
-      return version2;
-    }
-  } catch {
+  const version2 = ownManifest()?.version;
+  if (typeof version2 === "string" && version2.length > 0) {
+    return version2;
   }
   throw new PenvError(
     "ENGINE_VERSION_UNREADABLE",
@@ -50547,6 +50625,29 @@ function engineVersion() {
     `Reinstall penv, then run \`penv init\` again.`
   );
 }
+function schemaPackageVersion() {
+  const peers = ownManifest()?.peerDependencies;
+  const declared = peers !== null && typeof peers === "object" && !Array.isArray(peers) ? peers[SCHEMA_PACKAGE] : void 0;
+  const floor = typeof declared === "string" ? declared.replace(/^[\^~>=\s]+/, "").trim() : "";
+  if (floor.length > 0) {
+    return floor;
+  }
+  throw new PenvError(
+    "ENGINE_PEER_UNREADABLE",
+    `penv could not read its own \`${SCHEMA_PACKAGE}\` peer range, so it cannot say which ${SCHEMA_PACKAGE} this project needs`,
+    `Reinstall penv, then run \`penv init\` again.`
+  );
+}
+function ownManifest() {
+  try {
+    const parsed = JSON.parse(
+      (0, import_node_fs2.readFileSync)(new URL("../package.json", importMetaUrl), "utf8")
+    );
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function detectPackageManager(root) {
   for (const [manager, lockfile] of LOCKFILES) {
     if ((0, import_node_fs2.existsSync)((0, import_node_path2.join)(root, lockfile))) {
@@ -50575,12 +50676,12 @@ function manifestOf(root) {
     return void 0;
   }
 }
-function declaredVersion(root) {
+function declaredVersion(root, name) {
   const manifest = manifestOf(root);
   for (const field of ["dependencies", "devDependencies"]) {
     const block = manifest?.[field];
     if (block !== null && typeof block === "object" && !Array.isArray(block)) {
-      const version2 = block[RUNTIME_PACKAGE];
+      const version2 = block[name];
       if (typeof version2 === "string") {
         return version2;
       }
@@ -50593,27 +50694,61 @@ function planInstall(root, version2 = engineVersion()) {
   const lockfile = LOCKFILES.find(
     ([name, file2]) => name === manager && (0, import_node_fs2.existsSync)((0, import_node_path2.join)(root, file2))
   )?.[1];
-  const declared = declaredVersion(root);
+  const runtimeDeclared = declaredVersion(root, RUNTIME_PACKAGE);
+  const zodDeclared = declaredVersion(root, SCHEMA_PACKAGE);
+  const packages = [
+    {
+      name: RUNTIME_PACKAGE,
+      version: version2,
+      ...runtimeDeclared === void 0 ? {} : { declared: runtimeDeclared },
+      satisfied: runtimeDeclared === version2
+    },
+    {
+      name: SCHEMA_PACKAGE,
+      version: schemaPackageVersion(),
+      ...zodDeclared === void 0 ? {} : { declared: zodDeclared },
+      // Any declared zod counts: which zod a project uses is the project's
+      // decision, and penv is here to make sure there is one, not to move it.
+      satisfied: zodDeclared !== void 0
+    }
+  ];
+  const pending = packages.filter((entry) => !entry.satisfied);
+  const specs = (pending.length === 0 ? packages : pending).map(
+    (entry) => `${entry.name}@${entry.version}`
+  );
   return {
     root,
     manager,
-    package: RUNTIME_PACKAGE,
-    version: version2,
-    command: [...ADD[manager], `${RUNTIME_PACKAGE}@${version2}`],
+    packages,
+    command: [...ADD[manager], ...specs],
     ...lockfile === void 0 ? {} : { lockfile },
-    ...declared === void 0 ? {} : { declared },
-    satisfied: declared === version2
+    satisfied: pending.length === 0
   };
 }
+function describe4(entry) {
+  return `${entry.name} ${entry.version}`;
+}
 function renderInstallPlan(plan2) {
   if (plan2.satisfied) {
-    return [`package.json already pins ${plan2.package} ${plan2.version} \u2014 nothing to install.`];
+    return [
+      `package.json already has ${plan2.packages.map(describe4).join(" and ")} \u2014 nothing to install.`
+    ];
   }
-  const line = `"${plan2.package}": "${plan2.version}"`;
+  const pending = plan2.packages.filter((entry) => !entry.satisfied);
+  const added = pending.filter((entry) => entry.declared === void 0);
+  const replaced = pending.filter((entry) => entry.declared !== void 0);
   return [
     "package.json",
-    ...plan2.declared === void 0 ? ['  + "dependencies": {', `  +   ${line}`, "  + }"] : [`  - "${plan2.package}": "${plan2.declared}"`, `  + ${line}`],
-    ...plan2.lockfile === void 0 ? [] : [plan2.lockfile, `  + ${plan2.package}@${plan2.version}`],
+    ...added.length === 0 ? [] : [
+      '  + "dependencies": {',
+      ...added.map((entry) => `  +   "${entry.name}": "${entry.version}"`),
+      "  + }"
+    ],
+    ...replaced.flatMap((entry) => [
+      `  - "${entry.name}": "${entry.declared}"`,
+      `  + "${entry.name}": "${entry.version}"`
+    ]),
+    ...plan2.lockfile === void 0 ? [] : [plan2.lockfile, ...pending.map((entry) => `  + ${entry.name}@${entry.version}`)],
     "",
     `Run with: ${plan2.command.join(" ")}`
   ];
@@ -50622,7 +50757,8 @@ var installWithPackageManager = async (plan2) => {
   const child = startChild({
     command: plan2.command,
     env: process.env,
-    cwd: plan2.root
+    cwd: plan2.root,
+    purpose: `install ${plan2.packages.map(describe4).join(" and ")}`
   });
   const ended = await child.ended;
   if (ended.exitCode !== 0 || ended.signal !== null) {
@@ -50639,7 +50775,7 @@ function installFailed(plan2) {
 
 // src/project.ts
 init_cjs_shims();
-var import_node_fs3 = require("fs");
+var import_node_fs4 = require("fs");
 var import_node_path4 = require("path");
 
 // src/env-flags.ts
@@ -50702,6 +50838,7 @@ function environmentFromShorthand(config2, candidates, explicit) {
 
 // src/registry.ts
 init_cjs_shims();
+var import_node_fs3 = require("fs");
 var import_node_module = require("module");
 var import_node_path3 = require("path");
 var import_node_url = require("url");
@@ -50889,16 +51026,40 @@ async function loadPluginProvider(type, context) {
   assertSatisfiesContract(provider, type);
   return provider;
 }
-function assertProvidersRegistered(config2, projectRoot) {
+function assertProvidersRegistered(config2, projectRoot, options) {
+  const local = localExtensions(projectRoot);
+  const ci = options?.ci ?? isCi(process.env.CI);
   for (const [environment, provider] of Object.entries(config2.providers)) {
     if (isProviderRegistered(provider.type)) {
       continue;
     }
+    if (ci && local.includes(provider.type)) {
+      throw localExtensionInCi(provider.type, environment);
+    }
     if (resolvePlugin(provider.type, projectRoot) === void 0) {
       throw unknownProvider(provider.type, environment);
     }
   }
 }
+function localExtensions(projectRoot) {
+  let text;
+  try {
+    text = (0, import_node_fs3.readFileSync)(localExtensionsFile(projectRoot), "utf8");
+  } catch {
+    return [];
+  }
+  return parseLocalExtensions(text);
+}
+function isCi(value2) {
+  return value2 !== void 0 && value2 !== "" && value2 !== "0" && value2.toLowerCase() !== "false";
+}
+function localExtensionInCi(type, environment) {
+  return new PenvError(
+    "LOCAL_EXTENSION_IN_CI",
+    `The provider \`${type}\` for environment ${environment} is a local extension, and this is CI`,
+    `${LOCAL_EXTENSIONS_PATH} records it as a package this project develops, so nothing pins the bytes CI would run. Publish it and run \`penv add ${type}\` to pin a release.`
+  );
+}
 function resolvePlugin(specifier, fromDir) {
   try {
     const require2 = (0, import_node_module.createRequire)((0, import_node_path3.resolve)(fromDir, "noop.js"));
@@ -50936,7 +51097,7 @@ function unknownProvider(type, environment) {
   return new PenvError(
     "UNKNOWN_PROVIDER",
     `The provider \`${type}\`${where} in penv.config.ts is not installed in this project`,
-    `Install it with \`npm i ${type}\` \u2014 a provider's \`type\` is the package penv imports. The CLI ships ${preinstalled} pre-installed.`
+    `A provider's \`type\` is the package penv imports, so it has to resolve from this project: install it with \`npm i ${type}\`, or \u2014 if this repository is the one that builds it \u2014 run \`penv add --local ${type}\` once it is a dependency of the root. The CLI ships ${preinstalled} pre-installed.`
   );
 }
 
@@ -50966,10 +51127,10 @@ function localTree(project) {
 }
 function selfContainedSchemaModule(root, schemaFile) {
   const file2 = (0, import_node_path4.join)(root, ...schemaFile.split("/"));
-  if (!(0, import_node_fs3.existsSync)(file2)) {
+  if (!(0, import_node_fs4.existsSync)(file2)) {
     return void 0;
   }
-  const source = (0, import_node_fs3.readFileSync)(file2, "utf8");
+  const source = (0, import_node_fs4.readFileSync)(file2, "utf8");
   return source.includes("PenvSchemaShape") || source.includes("z.object") ? schemaFile : void 0;
 }
 function schemaShapeFileOf(project) {
@@ -51206,10 +51367,7 @@ function writeError(lines) {
 }
 function reportError(error51) {
   if (error51 instanceof PenvError) {
-    const suffix = error51.remedy === void 0 ? void 0 : `
-  ${error51.remedy}`;
-    const message = suffix !== void 0 && error51.message.endsWith(suffix) ? error51.message.slice(0, -suffix.length) : error51.message;
-    process.stderr.write(`${err.red(CROSS)} ${message}
+    process.stderr.write(`${err.red(CROSS)} ${error51.summary}
 `);
     if (error51.remedy !== void 0) {
       process.stderr.write(`  ${err.cyan("\u2192")} ${error51.remedy}
@@ -51240,13 +51398,13 @@ async function guard(run) {
 
 // src/commands/run.ts
 init_cjs_shims();
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_module2 = require("module");
 var import_node_path6 = require("path");
 
 // src/dotenv-files.ts
 init_cjs_shims();
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var SHARED = ".env";
 var LOCAL2 = "local";
 var NOT_ENVIRONMENTS = [
@@ -51305,7 +51463,7 @@ function order(file2) {
 function discoverDotenvFiles(root) {
   let entries;
   try {
-    entries = (0, import_node_fs4.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+    entries = (0, import_node_fs5.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
   } catch {
     return [];
   }
@@ -52040,9 +52198,9 @@ function packageManifest(specifier, root) {
   }
   for (; ; ) {
     const file2 = (0, import_node_path6.join)(directory, "package.json");
-    if ((0, import_node_fs5.existsSync)(file2)) {
+    if ((0, import_node_fs6.existsSync)(file2)) {
       try {
-        const parsed = JSON.parse((0, import_node_fs5.readFileSync)(file2, "utf8"));
+        const parsed = JSON.parse((0, import_node_fs6.readFileSync)(file2, "utf8"));
         if (isPlainObject4(parsed) && parsed.name === specifier) {
           return parsed;
         }
@@ -52115,7 +52273,7 @@ function snapshotPath(host) {
 }
 function readSnapshot(path) {
   try {
-    return (0, import_node_fs5.readFileSync)(path, "utf8");
+    return (0, import_node_fs6.readFileSync)(path, "utf8");
   } catch {
     throw new PenvError(
       "RUN_SNAPSHOT_MISSING",
@@ -52194,11 +52352,11 @@ function watchProject(project, onChange) {
     timer = setTimeout(onChange, DEBOUNCE_MS);
   };
   const add = (target, recursive, only) => {
-    if (!(0, import_node_fs5.existsSync)(target)) {
+    if (!(0, import_node_fs6.existsSync)(target)) {
       return;
     }
     try {
-      const watcher = (0, import_node_fs5.watch)(target, { recursive }, (_event, filename) => {
+      const watcher = (0, import_node_fs6.watch)(target, { recursive }, (_event, filename) => {
         if (only !== void 0 && (filename === null || (0, import_node_path6.basename)(filename) !== only)) {
           return;
         }
@@ -52461,8 +52619,8 @@ ${lines}`,
     keySource: keySourceIdentifier(project.config, environment),
     values
   };
-  (0, import_node_fs6.mkdirSync)((0, import_node_path7.dirname)(file2), { recursive: true });
-  (0, import_node_fs6.writeFileSync)(file2, serializeArtifact(artifact), "utf8");
+  (0, import_node_fs7.mkdirSync)((0, import_node_path7.dirname)(file2), { recursive: true });
+  (0, import_node_fs7.writeFileSync)(file2, serializeArtifact(artifact), "utf8");
   const inside = (0, import_node_path7.relative)(project.root, file2);
   return {
     file: file2,
@@ -52532,7 +52690,7 @@ init_cjs_shims();
 
 // src/cutover.ts
 init_cjs_shims();
-var import_node_fs7 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_path8 = require("path");
 var CUTOVER_FORMAT = 1;
 function fileFor(root, relativePosix) {
@@ -52550,7 +52708,7 @@ function cutoverRoot(cwd) {
 }
 function bundledFiles(root) {
   try {
-    return (0, import_node_fs7.readdirSync)(bundleDir(root)).sort();
+    return (0, import_node_fs8.readdirSync)(bundleDir(root)).sort();
   } catch {
     return [];
   }
@@ -52560,32 +52718,32 @@ function bundleUnresolved(root) {
 }
 function readCutover(root) {
   const file2 = cutoverFile(root);
-  if (!(0, import_node_fs7.existsSync)(file2)) {
+  if (!(0, import_node_fs8.existsSync)(file2)) {
     return void 0;
   }
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs7.readFileSync)(file2, "utf8"));
+    parsed = JSON.parse((0, import_node_fs8.readFileSync)(file2, "utf8"));
   } catch {
     throw unreadable("it is not JSON");
   }
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw unreadable("it is not an object");
   }
-  const record2 = parsed;
-  if (record2.format !== CUTOVER_FORMAT) {
+  const record3 = parsed;
+  if (record3.format !== CUTOVER_FORMAT) {
     throw unreadable(
-      `it is format ${JSON.stringify(record2.format)}, and penv reads format ${CUTOVER_FORMAT}`
+      `it is format ${JSON.stringify(record3.format)}, and penv reads format ${CUTOVER_FORMAT}`
     );
   }
-  const files = record2.files;
+  const files = record3.files;
   if (!Array.isArray(files) || files.some((name) => typeof name !== "string")) {
     throw unreadable("it lists no filenames");
   }
-  const environments = Array.isArray(record2.environments) ? record2.environments.filter((name) => typeof name === "string") : [];
+  const environments = Array.isArray(record3.environments) ? record3.environments.filter((name) => typeof name === "string") : [];
   return {
     format: CUTOVER_FORMAT,
-    movedAt: typeof record2.movedAt === "string" ? record2.movedAt : "",
+    movedAt: typeof record3.movedAt === "string" ? record3.movedAt : "",
     files,
     environments
   };
@@ -52618,12 +52776,12 @@ function bundleDotenvFiles(root, files, environments, now = /* @__PURE__ */ new
     environments: [...environments]
   };
   const file2 = cutoverFile(root);
-  (0, import_node_fs7.mkdirSync)((0, import_node_path8.dirname)(file2), { recursive: true });
-  (0, import_node_fs7.writeFileSync)(file2, serializeCutover(cutover), "utf8");
+  (0, import_node_fs8.mkdirSync)((0, import_node_path8.dirname)(file2), { recursive: true });
+  (0, import_node_fs8.writeFileSync)(file2, serializeCutover(cutover), "utf8");
   const bundle = bundleDir(root);
-  (0, import_node_fs7.mkdirSync)(bundle, { recursive: true });
+  (0, import_node_fs8.mkdirSync)(bundle, { recursive: true });
   for (const name of files) {
-    (0, import_node_fs7.renameSync)((0, import_node_path8.join)(root, name), (0, import_node_path8.join)(bundle, name));
+    (0, import_node_fs8.renameSync)((0, import_node_path8.join)(root, name), (0, import_node_path8.join)(bundle, name));
   }
   return cutover;
 }
@@ -52642,7 +52800,7 @@ function runUndo(options) {
   const names = [...recorded, ...bundled.filter((name) => !recorded.includes(name))];
   const bundle = bundleDir(root);
   const held = new Set(bundled);
-  const occupied2 = names.filter((name) => held.has(name) && (0, import_node_fs7.existsSync)((0, import_node_path8.join)(root, name)));
+  const occupied2 = names.filter((name) => held.has(name) && (0, import_node_fs8.existsSync)((0, import_node_path8.join)(root, name)));
   if (occupied2.length > 0) {
     const listed = occupied2.join(", ");
     const many = occupied2.length > 1;
@@ -52657,9 +52815,9 @@ function runUndo(options) {
   const missing = [];
   for (const name of names) {
     if (held.has(name)) {
-      (0, import_node_fs7.renameSync)((0, import_node_path8.join)(bundle, name), (0, import_node_path8.join)(root, name));
+      (0, import_node_fs8.renameSync)((0, import_node_path8.join)(bundle, name), (0, import_node_path8.join)(root, name));
       restored.push(name);
-    } else if ((0, import_node_fs7.existsSync)((0, import_node_path8.join)(root, name))) {
+    } else if ((0, import_node_fs8.existsSync)((0, import_node_path8.join)(root, name))) {
       alreadyBack.push(name);
     } else {
       missing.push(name);
@@ -52671,13 +52829,13 @@ function runUndo(options) {
 function runCleanup(options) {
   const root = cutoverRoot(options.cwd);
   const held = bundledFiles(root);
-  const cleaned = held.length > 0 || (0, import_node_fs7.existsSync)(cutoverFile(root)) || (0, import_node_fs7.existsSync)(fileFor(root, ROLLBACK_PATH));
+  const cleaned = held.length > 0 || (0, import_node_fs8.existsSync)(cutoverFile(root)) || (0, import_node_fs8.existsSync)(fileFor(root, ROLLBACK_PATH));
   removeBundle(root);
   return { root, removed: held, cleaned };
 }
 function removeBundle(root) {
-  (0, import_node_fs7.rmSync)(fileFor(root, ROLLBACK_PATH), { recursive: true, force: true });
-  (0, import_node_fs7.rmSync)(cutoverFile(root), { force: true });
+  (0, import_node_fs8.rmSync)(fileFor(root, ROLLBACK_PATH), { recursive: true, force: true });
+  (0, import_node_fs8.rmSync)(cutoverFile(root), { force: true });
 }
 
 // src/commands/cleanup.ts
@@ -52713,7 +52871,7 @@ var cleanupCommand = defineCommand({
 
 // src/commands/doctor.ts
 init_cjs_shims();
-var import_node_fs8 = require("fs");
+var import_node_fs9 = require("fs");
 var import_node_path9 = require("path");
 
 // src/commands/push.ts
@@ -53157,6 +53315,7 @@ async function runDoctor(options) {
     findings.push(...unusedFindings(drift));
   }
   findings.push(...fallbackFindings(subjects, environment));
+  findings.push(...secrecyFindings(subjects, environment));
   findings.push(...plaintextSecretFindings(subjects, environment));
   findings.push(...publicSecretFindings(subjects, environment, project.config));
   findings.push(...encryptionFindings(subjects, environment));
@@ -53169,6 +53328,7 @@ async function runDoctor(options) {
   }
   findings.push(...await providerDriftFindings(project, environment, options.source));
   findings.push(...await projectionFindings(project, environment, options.projection));
+  findings.push(...localExtensionFindings(project));
   findings.push(...artifactFindings(project));
   findings.push({
     check: "provider",
@@ -53306,6 +53466,31 @@ function fallbackFindings(subjects, environment) {
     }
   ];
 }
+function secrecyFindings(subjects, environment) {
+  const undeclared = subjects.filter(
+    ({ meta: meta3 }) => effectiveMeta(meta3, environment).secret === void 0
+  );
+  if (undeclared.length === 0) {
+    return [
+      {
+        check: "secrecy-undeclared",
+        severity: "pass",
+        label: "Secrecy policy",
+        subject: subjects.length === 0 ? `no parameter resolves for ${environment}` : `every parameter declares whether it is secret for ${environment}`
+      }
+    ];
+  }
+  return [
+    {
+      check: "secrecy-undeclared",
+      severity: "unknown",
+      label: "Secrecy policy",
+      subject: `${undeclared.length} of ${subjects.length} declare neither way for ${environment}`,
+      detail: "penv was never told which of these values must be encrypted",
+      remedy: `declare \`"secret": true\` or \`"secret": false\` in a parameter's meta file, ${RECORDS_PATH2}/<name>.json`
+    }
+  ];
+}
 function plaintextSecretFindings(subjects, environment) {
   const secrets = subjects.filter(({ meta: meta3 }) => isSecret(meta3, environment));
   const findings = [];
@@ -53609,7 +53794,7 @@ function looksLikeArtifact(text) {
 function scannableFiles(directory, out2) {
   let entries;
   try {
-    entries = (0, import_node_fs8.readdirSync)(directory, { withFileTypes: true });
+    entries = (0, import_node_fs9.readdirSync)(directory, { withFileTypes: true });
   } catch {
     return;
   }
@@ -53626,6 +53811,29 @@ function scannableFiles(directory, out2) {
     }
   }
 }
+function localExtensionFindings(project) {
+  const names = localExtensions(project.root);
+  if (names.length === 0) {
+    return [
+      {
+        check: "local-extension",
+        severity: "pass",
+        label: "Extensions",
+        subject: "every extension this project names is pinned"
+      }
+    ];
+  }
+  return [
+    {
+      check: "local-extension",
+      severity: "unknown",
+      label: "Extensions",
+      subject: names.join(", "),
+      detail: "resolved from this project's node_modules \u2014 no release, no pinned bytes",
+      remedy: `publish it and run \`penv add ${names[0]}\` when this stops being a development path`
+    }
+  ];
+}
 function artifactFindings(project) {
   const files = [];
   scannableFiles(project.root, files);
@@ -53633,10 +53841,10 @@ function artifactFindings(project) {
   for (const file2 of files) {
     let text;
     try {
-      if ((0, import_node_fs8.statSync)(file2).size > ARTIFACT_SCAN_LIMIT) {
+      if ((0, import_node_fs9.statSync)(file2).size > ARTIFACT_SCAN_LIMIT) {
         continue;
       }
-      text = (0, import_node_fs8.readFileSync)(file2, "utf8");
+      text = (0, import_node_fs9.readFileSync)(file2, "utf8");
     } catch {
       continue;
     }
@@ -54394,7 +54602,7 @@ var fillCommand = defineCommand({
 
 // src/commands/generate.ts
 init_cjs_shims();
-var import_node_fs9 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_path10 = require("path");
 var DEFAULT_OUTPUT = ".env";
 function entriesFor(project, environment, allowDecrypt) {
@@ -54441,7 +54649,7 @@ function runGenerate(options) {
   const environment = targetEnvironment(project, options.environment, options.envFlags);
   const { entries, decrypted } = entriesFor(project, environment, options.allowDecrypt === true);
   const file2 = options.out === void 0 ? (0, import_node_path10.resolve)(project.root, DEFAULT_OUTPUT) : (0, import_node_path10.isAbsolute)(options.out) ? options.out : (0, import_node_path10.resolve)(options.cwd, options.out);
-  (0, import_node_fs9.writeFileSync)(file2, serializeDotenv(entries), "utf8");
+  (0, import_node_fs10.writeFileSync)(file2, serializeDotenv(entries), "utf8");
   return { file: file2, environment, entries: entries.length, decrypted };
 }
 function displayPath2(cwd, file2) {
@@ -54579,8 +54787,8 @@ var getCommand = defineCommand({
 
 // src/commands/import.ts
 init_cjs_shims();
-var import_node_fs12 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path14 = require("path");
 
 // src/adopt.ts
 init_cjs_shims();
@@ -54649,7 +54857,7 @@ function writeEntries(tree, entries, refs, scope) {
 
 // src/detect.ts
 init_cjs_shims();
-var import_node_fs10 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_path11 = require("path");
 var SIGNATURES = [
   { name: "Next.js", packages: ["next"], publicPrefixes: ["NEXT_PUBLIC_"] },
@@ -54666,7 +54874,7 @@ var SIGNATURES = [
 function exportsSchema(file2) {
   let source;
   try {
-    source = (0, import_node_fs10.readFileSync)(file2, "utf8");
+    source = (0, import_node_fs11.readFileSync)(file2, "utf8");
   } catch {
     return false;
   }
@@ -54678,7 +54886,7 @@ function exportsSchema(file2) {
 }
 function occupied(cwd, relative5) {
   const file2 = (0, import_node_path11.join)(cwd, ...relative5.split("/"));
-  return (0, import_node_fs10.existsSync)(file2) && !exportsSchema(file2);
+  return (0, import_node_fs11.existsSync)(file2) && !exportsSchema(file2);
 }
 function schemaFileFor(cwd) {
   const dir = srcPrefix(cwd);
@@ -54693,7 +54901,7 @@ function schemaFileFor(cwd) {
   return { file: DEFAULT_SCHEMA_FILE, displaced: preferred };
 }
 function srcPrefix(cwd) {
-  return (0, import_node_fs10.existsSync)((0, import_node_path11.join)(cwd, "src")) ? "src/" : "";
+  return (0, import_node_fs11.existsSync)((0, import_node_path11.join)(cwd, "src")) ? "src/" : "";
 }
 function dependenciesOf(cwd) {
   const manifest = manifestOf2(cwd);
@@ -54713,12 +54921,12 @@ function dependenciesOf(cwd) {
 }
 function manifestOf2(cwd) {
   const file2 = (0, import_node_path11.join)(cwd, "package.json");
-  if (!(0, import_node_fs10.existsSync)(file2)) {
+  if (!(0, import_node_fs11.existsSync)(file2)) {
     return void 0;
   }
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs10.readFileSync)(file2, "utf8"));
+    manifest = JSON.parse((0, import_node_fs11.readFileSync)(file2, "utf8"));
   } catch {
     return void 0;
   }
@@ -54734,7 +54942,7 @@ function detectFramework(cwd) {
       return detectedFrom(cwd, signature.name, signature.publicPrefixes);
     }
   }
-  if ((0, import_node_fs10.existsSync)((0, import_node_path11.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
+  if ((0, import_node_fs11.existsSync)((0, import_node_path11.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
     return detectedFrom(cwd, "Bun", []);
   }
   return void 0;
@@ -54814,10 +55022,93 @@ function draftFieldsAcross(sources, environments) {
 
 // src/commands/init.ts
 init_cjs_shims();
-var import_node_fs11 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs13 = require("fs");
+var import_node_path13 = require("path");
 var import_promises = require("readline/promises");
 
+// src/scaffold-undo.ts
+init_cjs_shims();
+var import_node_fs12 = require("fs");
+var import_node_path12 = require("path");
+function record2(path, files, dirs) {
+  let stats;
+  try {
+    stats = (0, import_node_fs12.statSync)(path);
+  } catch {
+    return;
+  }
+  if (stats.isDirectory()) {
+    dirs.add(path);
+    for (const entry of (0, import_node_fs12.readdirSync)(path)) {
+      record2((0, import_node_path12.join)(path, entry), files, dirs);
+    }
+    return;
+  }
+  if (stats.isFile()) {
+    files.set(path, (0, import_node_fs12.readFileSync)(path));
+  }
+}
+function captureScaffold(root, paths) {
+  const files = /* @__PURE__ */ new Map();
+  const dirs = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    for (let dir = (0, import_node_path12.dirname)(path); dir.startsWith(root) && dir !== root; dir = (0, import_node_path12.dirname)(dir)) {
+      if ((0, import_node_fs12.existsSync)(dir)) {
+        dirs.add(dir);
+      }
+    }
+    record2(path, files, dirs);
+  }
+  return { root, paths: [...paths], files, dirs };
+}
+function restoreScaffold(undo) {
+  for (const path of undo.paths) {
+    removeAdded(path, undo);
+  }
+  for (const path of undo.paths) {
+    pruneAncestors(path, undo);
+  }
+  for (const [file2, contents] of undo.files) {
+    (0, import_node_fs12.mkdirSync)((0, import_node_path12.dirname)(file2), { recursive: true });
+    (0, import_node_fs12.writeFileSync)(file2, contents);
+  }
+}
+function removeAdded(path, undo) {
+  let stats;
+  try {
+    stats = (0, import_node_fs12.statSync)(path);
+  } catch {
+    return;
+  }
+  if (stats.isFile()) {
+    if (!undo.files.has(path)) {
+      (0, import_node_fs12.unlinkSync)(path);
+    }
+    return;
+  }
+  if (!stats.isDirectory()) {
+    return;
+  }
+  for (const entry of (0, import_node_fs12.readdirSync)(path)) {
+    removeAdded((0, import_node_path12.join)(path, entry), undo);
+  }
+  if (!undo.dirs.has(path) && (0, import_node_fs12.readdirSync)(path).length === 0) {
+    (0, import_node_fs12.rmdirSync)(path);
+  }
+}
+function pruneAncestors(path, undo) {
+  for (let dir = (0, import_node_path12.dirname)(path); dir.startsWith(undo.root) && dir !== undo.root; dir = (0, import_node_path12.dirname)(dir)) {
+    if (undo.dirs.has(dir)) {
+      return;
+    }
+    try {
+      (0, import_node_fs12.rmdirSync)(dir);
+    } catch {
+      return;
+    }
+  }
+}
+
 // src/seams.ts
 init_cjs_shims();
 function nextjs({ alias, srcDir }) {
@@ -54974,7 +55265,7 @@ var NOT_ENVIRONMENTS2 = [...RESERVED_TOKENS, "example", "sample", "template"];
 function suggestEnvironments(root) {
   let entries;
   try {
-    entries = (0, import_node_fs11.readdirSync)(root);
+    entries = (0, import_node_fs13.readdirSync)(root);
   } catch {
     return [];
   }
@@ -55018,8 +55309,8 @@ function configOf(decisions) {
   return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
 }
 function declaredIn(root) {
-  const file2 = (0, import_node_path12.join)(root, CONFIG_FILE);
-  if (!(0, import_node_fs11.existsSync)(file2)) {
+  const file2 = (0, import_node_path13.join)(root, CONFIG_FILE);
+  if (!(0, import_node_fs13.existsSync)(file2)) {
     return void 0;
   }
   return loadConfigFrom(file2);
@@ -55461,16 +55752,16 @@ function renderTsconfig(target, alias) {
 `;
 }
 function ensurePenvDir(root) {
-  const dir = (0, import_node_path12.resolve)(root, PENV_DIR);
-  if ((0, import_node_fs11.existsSync)(dir)) {
+  const dir = (0, import_node_path13.resolve)(root, PENV_DIR);
+  if ((0, import_node_fs13.existsSync)(dir)) {
     return { target: "penv-dir", action: "kept", text: `Found ${PENV_DIR}/` };
   }
-  (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
   return { target: "penv-dir", action: "created", text: `Created ${PENV_DIR}/` };
 }
 function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
-  const file2 = (0, import_node_path12.join)(root, SCHEMA_SHAPE_FILE);
-  if ((0, import_node_fs11.existsSync)(file2)) {
+  const file2 = (0, import_node_path13.join)(root, SCHEMA_SHAPE_FILE);
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return {
       target: "schema",
       action: "kept",
@@ -55487,7 +55778,7 @@ function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS
       note: `(the shape lives there, from before the ${SCHEMA_SHAPE_FILE} split \u2014 penv did not add a second one. To adopt the split: move the \`z.object\` (and any \`declare module\` block) into ${SCHEMA_SHAPE_FILE}, leaving ${oldLayout} importing \`schema\` from it and calling \`load\`.)`
     };
   }
-  (0, import_node_fs11.writeFileSync)(file2, renderSchemaShapeModule(fields, draft), "utf8");
+  (0, import_node_fs13.writeFileSync)(file2, renderSchemaShapeModule(fields, draft), "utf8");
   return {
     target: "schema",
     action: "created",
@@ -55496,8 +55787,8 @@ function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS
   };
 }
 function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
-  const file2 = (0, import_node_path12.join)(root, ...decisions.schemaFile.split("/"));
-  if ((0, import_node_fs11.existsSync)(file2)) {
+  const file2 = (0, import_node_path13.join)(root, ...decisions.schemaFile.split("/"));
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return {
       target: "env",
       action: "kept",
@@ -55505,8 +55796,8 @@ function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
       note: "(yours \u2014 penv never regenerates it)"
     };
   }
-  (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(file2), { recursive: true });
-  (0, import_node_fs11.writeFileSync)(file2, renderEnvModule(decisions.schemaFile, decisions.inject), "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file2, renderEnvModule(decisions.schemaFile, decisions.inject), "utf8");
   return {
     target: "env",
     action: "created",
@@ -55515,19 +55806,19 @@ function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
   };
 }
 function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
-  const file2 = (0, import_node_path12.join)(root, CONFIG_FILE);
-  if ((0, import_node_fs11.existsSync)(file2)) {
+  const file2 = (0, import_node_path13.join)(root, CONFIG_FILE);
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return { target: "config", action: "kept", text: `Kept ${CONFIG_FILE}` };
   }
-  (0, import_node_fs11.writeFileSync)(file2, renderConfigModule(decisions), "utf8");
+  (0, import_node_fs13.writeFileSync)(file2, renderConfigModule(decisions), "utf8");
   return { target: "config", action: "created", text: `Generated ${CONFIG_FILE}` };
 }
 function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   const alias = decisions.alias;
   const imports = alias.startsWith(IMPORTS_PREFIX);
-  const file2 = (0, import_node_path12.join)(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
+  const file2 = (0, import_node_path13.join)(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
   const where = imports ? PACKAGE_FILE : TSCONFIG_FILE;
-  if (!(0, import_node_fs11.existsSync)(file2)) {
+  if (!(0, import_node_fs13.existsSync)(file2)) {
     if (imports) {
       return {
         target: "tsconfig",
@@ -55536,14 +55827,14 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
         note: `(run \`npm init\` first, or use \`--alias @env\` to alias through ${TSCONFIG_FILE})`
       };
     }
-    (0, import_node_fs11.writeFileSync)(file2, renderTsconfig(decisions.schemaFile, alias), "utf8");
+    (0, import_node_fs13.writeFileSync)(file2, renderTsconfig(decisions.schemaFile, alias), "utf8");
     return {
       target: "tsconfig",
       action: "created",
       text: `Created ${TSCONFIG_FILE} with the ${alias} path alias`
     };
   }
-  const source = (0, import_node_fs11.readFileSync)(file2, "utf8");
+  const source = (0, import_node_fs13.readFileSync)(file2, "utf8");
   const edit = imports ? insertImportsAlias(source, decisions.schemaFile, alias) : insertEnvAlias(source, decisions.schemaFile, alias);
   if (edit.conflict !== void 0) {
     return {
@@ -55560,7 +55851,7 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
       text: `Kept the ${alias} alias in ${where}`
     };
   }
-  (0, import_node_fs11.writeFileSync)(file2, edit.source, "utf8");
+  (0, import_node_fs13.writeFileSync)(file2, edit.source, "utf8");
   return {
     target: "tsconfig",
     action: "updated",
@@ -55568,14 +55859,14 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   };
 }
 function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
-  const file2 = (0, import_node_path12.join)(root, ...STATE_GITIGNORE_PATH.split("/"));
+  const file2 = (0, import_node_path13.join)(root, ...STATE_GITIGNORE_PATH.split("/"));
   const wanted = renderStateGitignore(configOf(decisions));
-  const existing = (0, import_node_fs11.existsSync)(file2) ? (0, import_node_fs11.readFileSync)(file2, "utf8") : void 0;
+  const existing = (0, import_node_fs13.existsSync)(file2) ? (0, import_node_fs13.readFileSync)(file2, "utf8") : void 0;
   if (existing === wanted) {
     return { target: "gitignore", action: "kept", text: `Kept ${STATE_GITIGNORE_PATH}` };
   }
-  (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(file2), { recursive: true });
-  (0, import_node_fs11.writeFileSync)(file2, wanted, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file2, wanted, "utf8");
   return {
     target: "gitignore",
     action: existing === void 0 ? "created" : "updated",
@@ -55591,12 +55882,12 @@ function outdatedRuntimeWarning(root) {
   return `Injection needs @penvhq/penv ${INJECT_MIN_VERSION}+ \u2014 this project has ${version2}, whose \`load\` ignores \`{ inject: true }\`. Upgrade, or process.env stays empty.`;
 }
 function installedPenvVersion(root) {
-  const file2 = (0, import_node_path12.join)(root, "node_modules", "@penvhq", "penv", "package.json");
-  if (!(0, import_node_fs11.existsSync)(file2)) {
+  const file2 = (0, import_node_path13.join)(root, "node_modules", "@penvhq", "penv", "package.json");
+  if (!(0, import_node_fs13.existsSync)(file2)) {
     return void 0;
   }
   try {
-    const version2 = JSON.parse((0, import_node_fs11.readFileSync)(file2, "utf8")).version;
+    const version2 = JSON.parse((0, import_node_fs13.readFileSync)(file2, "utf8")).version;
     return typeof version2 === "string" ? version2 : void 0;
   } catch {
     return void 0;
@@ -55636,11 +55927,11 @@ function writeSeam(root, decisions = DEFAULT_DECISIONS, framework = detectFramew
     };
   }
   const alsoNote = writeAlso(root, seam.also);
-  const file2 = (0, import_node_path12.join)(root, ...seam.file.split("/"));
+  const file2 = (0, import_node_path13.join)(root, ...seam.file.split("/"));
   const baseNotes = [...seam.notes, ...alsoNote === void 0 ? [] : [alsoNote]];
   const notes = baseNotes.length === 0 ? "" : `
 ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
-  if ((0, import_node_fs11.existsSync)(file2)) {
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return {
       target: "seam",
       action: "info",
@@ -55648,8 +55939,8 @@ ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
       note: withWarning(`${seam.ifPresent}${notes}`, outdated)
     };
   }
-  (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(file2), { recursive: true });
-  (0, import_node_fs11.writeFileSync)(file2, seam.content, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file2, seam.content, "utf8");
   return {
     target: "seam",
     action: outdated === void 0 ? "created" : "info",
@@ -55661,12 +55952,12 @@ function writeAlso(root, also) {
   if (also === void 0) {
     return void 0;
   }
-  const file2 = (0, import_node_path12.join)(root, ...also.file.split("/"));
-  if ((0, import_node_fs11.existsSync)(file2)) {
+  const file2 = (0, import_node_path13.join)(root, ...also.file.split("/"));
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return also.ifPresent;
   }
-  (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(file2), { recursive: true });
-  (0, import_node_fs11.writeFileSync)(file2, also.content, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file2, also.content, "utf8");
   return `Wrote ${also.file} to register it.`;
 }
 function withWarning(note, warning) {
@@ -55691,6 +55982,23 @@ function scaffold(root, fields, draft, decisions = DEFAULT_DECISIONS, framework
   const seam = writeSeam(root, decisions, framework);
   return seam === void 0 ? steps : [...steps, seam];
 }
+function scaffoldPaths(root, decisions = DEFAULT_DECISIONS, framework = detectFramework(root)?.name) {
+  const fileAt = (relative5) => (0, import_node_path13.join)(root, ...relative5.split("/"));
+  const seam = decisions.inject ? seamFor(framework, {
+    alias: decisions.alias,
+    srcDir: srcPrefix(root),
+    schemaFile: decisions.schemaFile
+  }) : void 0;
+  return [
+    fileAt(PENV_DIR),
+    fileAt(SCHEMA_SHAPE_FILE),
+    fileAt(decisions.schemaFile),
+    fileAt(CONFIG_FILE),
+    fileAt(TSCONFIG_FILE),
+    fileAt(PACKAGE_FILE),
+    ...seam?.kind === "scaffold" ? [fileAt(seam.file), ...seam.also === void 0 ? [] : [fileAt(seam.also.file)]] : []
+  ];
+}
 var DEVELOPMENT = "development";
 var LOCAL_PROVIDER = "@penvhq/provider-filesystem";
 function planAdoption(root) {
@@ -55753,7 +56061,7 @@ function planCutover(input) {
   const diagnostics = [];
   let variables = 0;
   for (const file2 of selected) {
-    const parsed = parseDotenv((0, import_node_fs11.readFileSync)((0, import_node_path12.join)(root, file2.name), "utf8"));
+    const parsed = parseDotenv((0, import_node_fs13.readFileSync)((0, import_node_path13.join)(root, file2.name), "utf8"));
     const fileRefs = refsForEntries(parsed.entries, file2.name, config2);
     adopted.push({ file: file2, entries: parsed.entries, refs: fileRefs, scope: scopeOf(file2) });
     refs.push(...fileRefs);
@@ -55864,17 +56172,27 @@ async function applyCutover(plan2, options = {}) {
   if (!plan2.install.satisfied) {
     await (options.install ?? installWithPackageManager)(plan2.install);
   }
-  const steps = scaffold(plan2.root, plan2.fields, true, plan2.decisions, plan2.framework);
-  const project = openProject(plan2.root);
-  const tree = localTree(project);
-  for (const adopted of plan2.adopted) {
-    writeEntries(tree, adopted.entries, adopted.refs, adopted.scope);
-  }
-  for (const environment of plan2.adopting) {
-    const check2 = await checkEnvironment(project, environment);
-    if (!check2.result.ok) {
-      throw invalidAfterImport(check2.result);
+  const undo = captureScaffold(plan2.root, scaffoldPaths(plan2.root, plan2.decisions, plan2.framework));
+  let steps;
+  try {
+    steps = scaffold(plan2.root, plan2.fields, true, plan2.decisions, plan2.framework);
+    const project = openProject(plan2.root);
+    const tree = localTree(project);
+    for (const adopted of plan2.adopted) {
+      writeEntries(tree, adopted.entries, adopted.refs, adopted.scope);
     }
+    for (const environment of plan2.adopting) {
+      const check2 = await checkEnvironment(project, environment);
+      if (check2.schema === void 0) {
+        throw draftNotLoaded(check2.result);
+      }
+      if (!check2.result.ok) {
+        throw invalidAfterImport(check2.result);
+      }
+    }
+  } catch (error51) {
+    restoreScaffold(undo);
+    throw error51;
   }
   const cutover = bundleDotenvFiles(
     plan2.root,
@@ -55883,13 +56201,24 @@ async function applyCutover(plan2, options = {}) {
   );
   return { plan: plan2, steps, moved: cutover.files, validated: plan2.adopting };
 }
+function issueLines(result2) {
+  return result2.issues.map((issue2) => `  ${issue2.subject}: ${issue2.message}`).join("\n");
+}
+var SCAFFOLD_ROLLED_BACK = "penv put the project back as it found it \u2014 your dotenv files and everything else are exactly where they were.";
 function invalidAfterImport(result2) {
-  const lines = result2.issues.map((issue2) => `  ${issue2.subject}: ${issue2.message}`).join("\n");
   return new PenvError(
     "INIT_CUTOVER_INVALID",
-    `The imported values do not satisfy the draft schema for ${result2.environment}, so your dotenv files were left where they are:
-${lines}`,
-    `Correct ${SCHEMA_SHAPE_FILE} or the values above, then run \`penv init\` again.`
+    `The imported values do not satisfy the draft schema for ${result2.environment}:
+${issueLines(result2)}`,
+    `Correct the values above, then run \`penv init\` again. ${SCAFFOLD_ROLLED_BACK}`
+  );
+}
+function draftNotLoaded(result2) {
+  return new PenvError(
+    "INIT_DRAFT_NOT_LOADED",
+    `penv could not load the schema it drafted for ${result2.environment}, so nothing was checked against it:
+${issueLines(result2)}`,
+    `Fix the error above, then run \`penv init\` again. ${SCAFFOLD_ROLLED_BACK}`
   );
 }
 function renderSelection(plan2, selected = plan2.preselected) {
@@ -55952,7 +56281,7 @@ function renderCutover(result2) {
       const glyph = step.action === "conflicted" ? WARN : step.action === "info" ? "\u2192" : CHECK;
       return step.note === void 0 ? { glyph, text: step.text } : { glyph, text: step.text, note: step.note };
     }),
-    ...plan2.install.satisfied ? [] : [{ glyph: CHECK, text: `Installed ${plan2.install.package}`, note: plan2.install.version }],
+    ...plan2.install.packages.filter((entry) => !entry.satisfied).map((entry) => ({ glyph: CHECK, text: `Installed ${entry.name}`, note: entry.version })),
     {
       glyph: CHECK,
       text: `Imported ${plan2.fields.length} parameters`,
@@ -55976,12 +56305,12 @@ function dailyCommand(root) {
   return `penv run -- ${detectPackageManager(root)} ${devScript(root)}`;
 }
 function devScript(root) {
-  const file2 = (0, import_node_path12.join)(root, PACKAGE_FILE);
-  if (!(0, import_node_fs11.existsSync)(file2)) {
+  const file2 = (0, import_node_path13.join)(root, PACKAGE_FILE);
+  if (!(0, import_node_fs13.existsSync)(file2)) {
     return "dev";
   }
   try {
-    const scripts = JSON.parse((0, import_node_fs11.readFileSync)(file2, "utf8")).scripts;
+    const scripts = JSON.parse((0, import_node_fs13.readFileSync)(file2, "utf8")).scripts;
     if (scripts !== null && typeof scripts === "object" && !Array.isArray(scripts)) {
       const named = Object.keys(scripts);
       return ["dev", "start"].find((script) => named.includes(script)) ?? named[0] ?? "dev";
@@ -55991,7 +56320,7 @@ function devScript(root) {
   return "dev";
 }
 function runInit(options) {
-  const root = (0, import_node_path12.resolve)(options.cwd);
+  const root = (0, import_node_path13.resolve)(options.cwd);
   const decisions = options.decisions ?? planInit(root).decisions;
   return { root, decisions, steps: scaffold(root, [], false, decisions, options.framework) };
 }
@@ -56154,7 +56483,7 @@ var initCommand = defineCommand({
   },
   run({ args }) {
     return guard(async () => {
-      const root = (0, import_node_path12.resolve)(process.cwd());
+      const root = (0, import_node_path13.resolve)(process.cwd());
       if (args.action !== void 0) {
         runUndoAction(root, String(args.action));
         return;
@@ -56230,7 +56559,7 @@ function assertDeclared(segment, config2) {
   throw new UnknownEnvironmentError(segment, config2.environments);
 }
 function scopeFromFilename(file2, config2) {
-  const name = (0, import_node_path13.basename)(file2);
+  const name = (0, import_node_path14.basename)(file2);
   const segments = name.split(".");
   const start = segments.indexOf(DOTENV_SEGMENT);
   if (start === -1) {
@@ -56314,7 +56643,7 @@ function environmentNamed(file2, explicit) {
   if (explicit !== void 0 && explicit.trim().length > 0) {
     return explicit.trim();
   }
-  const segments = (0, import_node_path13.basename)(file2).split(".");
+  const segments = (0, import_node_path14.basename)(file2).split(".");
   const start = segments.indexOf(DOTENV_SEGMENT);
   if (start === -1) {
     return void 0;
@@ -56348,16 +56677,16 @@ function configInEffect(cwd, environment) {
   return { config: openProject(cwd).config, decisions };
 }
 function importDotenv(options) {
-  const cwd = (0, import_node_path13.resolve)(options.cwd);
-  const file2 = (0, import_node_path13.isAbsolute)(options.file) ? options.file : (0, import_node_path13.resolve)(cwd, options.file);
-  if (!(0, import_node_fs12.existsSync)(file2)) {
+  const cwd = (0, import_node_path14.resolve)(options.cwd);
+  const file2 = (0, import_node_path14.isAbsolute)(options.file) ? options.file : (0, import_node_path14.resolve)(cwd, options.file);
+  if (!(0, import_node_fs14.existsSync)(file2)) {
     throw new PenvError(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file2} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = parseDotenv((0, import_node_fs12.readFileSync)(file2, "utf8"));
+  const parsed = parseDotenv((0, import_node_fs14.readFileSync)(file2, "utf8"));
   const { config: config2, decisions } = configInEffect(cwd, environmentNamed(file2, options.environment));
   const source = displayPath3(cwd, file2);
   const named = scopeFromFilename(file2, config2);
@@ -56373,7 +56702,7 @@ function importDotenv(options) {
   const tree = localTree(project);
   writeEntries(tree, parsed.entries, refs, scope);
   const backup = `${file2}${BACKUP_SUFFIX}`;
-  (0, import_node_fs12.copyFileSync)(file2, backup);
+  (0, import_node_fs14.copyFileSync)(file2, backup);
   return {
     root: project.root,
     file: file2,
@@ -56387,7 +56716,7 @@ function importDotenv(options) {
   };
 }
 function displayPath3(root, file2) {
-  const rel = (0, import_node_path13.relative)(root, file2);
+  const rel = (0, import_node_path14.relative)(root, file2);
   return rel === "" || rel.startsWith("..") ? file2 : rel.split("\\").join("/");
 }
 function keptSchemaStep(step, variables) {
@@ -56706,28 +57035,28 @@ var listCommand = defineCommand({
 
 // src/commands/migrate.ts
 init_cjs_shims();
-var import_node_fs13 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path15 = require("path");
 var import_promises2 = require("readline/promises");
 var OLD_GITIGNORE = `${PENV_DIR}/.gitignore`;
 function planMigrate(cwd) {
   const { config: config2, file: file2 } = loadConfig(cwd);
-  const root = (0, import_node_path14.dirname)(file2);
+  const root = (0, import_node_path15.dirname)(file2);
   const entries = oldLayoutEntries(root, config2);
   const tree = recordsDir(root);
   const collisions = collidingEntries(entries, tree);
   if (collisions.length > 0) {
     throw new PenvError(
       "HALF_MIGRATED",
-      `${describe4(collisions)} in both \`${PENV_DIR}/\` and \`${RECORDS_PATH2}/\`, and penv cannot tell which copy is current`,
+      `${describe5(collisions)} in both \`${PENV_DIR}/\` and \`${RECORDS_PATH2}/\`, and penv cannot tell which copy is current`,
       `Move what is left under \`${PENV_DIR}/\` into \`${RECORDS_PATH2}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
     );
   }
   const creates = [];
-  if (entries.length > 0 && !(0, import_node_fs13.existsSync)(tree)) {
+  if (entries.length > 0 && !(0, import_node_fs15.existsSync)(tree)) {
     creates.push(`${RECORDS_PATH2}/`);
   }
-  if (readIfPresent((0, import_node_path14.join)(root, ...STATE_GITIGNORE_PATH.split("/"))) !== renderStateGitignore(config2)) {
+  if (readIfPresent((0, import_node_path15.join)(root, ...STATE_GITIGNORE_PATH.split("/"))) !== renderStateGitignore(config2)) {
     creates.push(STATE_GITIGNORE_PATH);
   }
   return {
@@ -56737,23 +57066,23 @@ function planMigrate(cwd) {
       to: `${RECORDS_PATH2}/${entry}`
     })),
     creates,
-    removes: (0, import_node_fs13.existsSync)((0, import_node_path14.join)(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
+    removes: (0, import_node_fs15.existsSync)((0, import_node_path15.join)(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
   };
 }
 function readIfPresent(file2) {
-  return (0, import_node_fs13.existsSync)(file2) ? (0, import_node_fs13.readFileSync)(file2, "utf8") : void 0;
+  return (0, import_node_fs15.existsSync)(file2) ? (0, import_node_fs15.readFileSync)(file2, "utf8") : void 0;
 }
 function collidingEntries(entries, tree) {
   let held;
   try {
-    held = (0, import_node_fs13.readdirSync)(tree);
+    held = (0, import_node_fs15.readdirSync)(tree);
   } catch {
     return [];
   }
   const taken = new Set(held.map((name) => name.toLowerCase()));
   return entries.filter((entry) => taken.has(entry.toLowerCase())).sort();
 }
-function describe4(names) {
+function describe5(names) {
   return names.length === 1 ? `\`${names[0]}\` is` : `${names.map((name) => `\`${name}\``).join(", ")} are`;
 }
 function isNoop(plan2) {
@@ -56765,18 +57094,18 @@ function applyMigrate(plan2) {
   }
   const { config: config2 } = loadConfig(plan2.root);
   if (plan2.moves.length > 0) {
-    (0, import_node_fs13.mkdirSync)(recordsDir(plan2.root), { recursive: true });
+    (0, import_node_fs15.mkdirSync)(recordsDir(plan2.root), { recursive: true });
     for (const move of plan2.moves) {
-      (0, import_node_fs13.renameSync)((0, import_node_path14.join)(plan2.root, ...move.from.split("/")), (0, import_node_path14.join)(plan2.root, ...move.to.split("/")));
+      (0, import_node_fs15.renameSync)((0, import_node_path15.join)(plan2.root, ...move.from.split("/")), (0, import_node_path15.join)(plan2.root, ...move.to.split("/")));
     }
   }
   if (plan2.creates.includes(STATE_GITIGNORE_PATH)) {
-    const ignore = (0, import_node_path14.join)(plan2.root, ...STATE_GITIGNORE_PATH.split("/"));
-    (0, import_node_fs13.mkdirSync)((0, import_node_path14.dirname)(ignore), { recursive: true });
-    (0, import_node_fs13.writeFileSync)(ignore, renderStateGitignore(config2), "utf8");
+    const ignore = (0, import_node_path15.join)(plan2.root, ...STATE_GITIGNORE_PATH.split("/"));
+    (0, import_node_fs15.mkdirSync)((0, import_node_path15.dirname)(ignore), { recursive: true });
+    (0, import_node_fs15.writeFileSync)(ignore, renderStateGitignore(config2), "utf8");
   }
   for (const removed of plan2.removes) {
-    (0, import_node_fs13.rmSync)((0, import_node_path14.join)(plan2.root, ...removed.split("/")), { force: true });
+    (0, import_node_fs15.rmSync)((0, import_node_path15.join)(plan2.root, ...removed.split("/")), { force: true });
   }
   return { ...plan2, status: "migrated" };
 }
@@ -57253,12 +57582,12 @@ var rotateCommand = defineCommand({
 
 // src/commands/watch.ts
 init_cjs_shims();
-var import_node_fs14 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs16 = require("fs");
+var import_node_path16 = require("path");
 var DEBOUNCE_MS2 = 100;
 function runWatch(options) {
   const project = openProject(options.cwd);
-  const configFile = (0, import_node_path15.basename)(project.configFile);
+  const configFile = (0, import_node_path16.basename)(project.configFile);
   const debounceMs = options.debounceMs ?? DEBOUNCE_MS2;
   const watchers = /* @__PURE__ */ new Set();
   let timer;
@@ -57311,22 +57640,22 @@ function runWatch(options) {
     watcher.close();
   }
   function armRecovery(target, recursive, only) {
-    const parent = (0, import_node_path15.dirname)(target);
-    const name = (0, import_node_path15.basename)(target);
+    const parent = (0, import_node_path16.dirname)(target);
+    const name = (0, import_node_path16.basename)(target);
     let recovery;
     try {
-      recovery = (0, import_node_fs14.watch)(parent, { recursive: false }, (_event, filename) => {
+      recovery = (0, import_node_fs16.watch)(parent, { recursive: false }, (_event, filename) => {
         if (closed || recovery === void 0) {
           return;
         }
-        if (!(0, import_node_fs14.existsSync)(parent)) {
+        if (!(0, import_node_fs16.existsSync)(parent)) {
           stop2(recovery);
           return;
         }
-        if (filename !== null && (0, import_node_path15.basename)(filename) !== name) {
+        if (filename !== null && (0, import_node_path16.basename)(filename) !== name) {
           return;
         }
-        if (!(0, import_node_fs14.existsSync)(target)) {
+        if (!(0, import_node_fs16.existsSync)(target)) {
           return;
         }
         stop2(recovery);
@@ -57346,11 +57675,11 @@ function runWatch(options) {
   }
   function addWatcher(target, recursive, only) {
     let watcher;
-    const listen = (useRecursive) => (0, import_node_fs14.watch)(target, { recursive: useRecursive }, (_event, filename) => {
+    const listen = (useRecursive) => (0, import_node_fs16.watch)(target, { recursive: useRecursive }, (_event, filename) => {
       if (closed) {
         return;
       }
-      if (!(0, import_node_fs14.existsSync)(target)) {
+      if (!(0, import_node_fs16.existsSync)(target)) {
         if (watcher !== void 0) {
           stop2(watcher);
         }
@@ -57358,7 +57687,7 @@ function runWatch(options) {
         schedule();
         return;
       }
-      if (only !== void 0 && (filename === null || (0, import_node_path15.basename)(filename) !== only)) {
+      if (only !== void 0 && (filename === null || (0, import_node_path16.basename)(filename) !== only)) {
         return;
       }
       schedule();
@@ -57385,11 +57714,11 @@ function runWatch(options) {
     watchers.add(watcher);
   }
   addWatcher(project.recordsDir, true);
-  addWatcher((0, import_node_path15.dirname)(project.configFile), false, configFile);
+  addWatcher((0, import_node_path16.dirname)(project.configFile), false, configFile);
   addWatcher(project.root, false, SCHEMA_SHAPE_FILE);
   if (schemaInsideTree(project.config) === void 0) {
-    const schemaFile = (0, import_node_path15.resolve)(project.root, schemaFileOf(project.config));
-    addWatcher((0, import_node_path15.dirname)(schemaFile), false, (0, import_node_path15.basename)(schemaFile));
+    const schemaFile = (0, import_node_path16.resolve)(project.root, schemaFileOf(project.config));
+    addWatcher((0, import_node_path16.dirname)(schemaFile), false, (0, import_node_path16.basename)(schemaFile));
   }
   void validate();
   return {