@penvhq/cli 0.9.4 → 0.10.0

package/dist/bin.cjs

@@ -3023,7 +3023,7 @@ var require_jiti = __commonJS({
         }
         const isAbsolute6 = function(e3) {
           return ze.test(e3);
-        }, extname = function(e3) {
+        }, extname2 = function(e3) {
           if (".." === e3) return "";
           const t3 = Ye.exec(pathe_M_eThtNZ_normalizeWindowsPath(e3));
           return t3 && t3[1] || "";
@@ -3725,7 +3725,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           }
           const a2 = jitiResolve(e3, t3, i2);
           if (!a2 && i2.try) return;
-          const c2 = extname(a2);
+          const c2 = extname2(a2);
           if (".json" === c2) {
             debug(e3, "[json]", a2);
             const t4 = e3.nativeRequire(a2);
@@ -3797,7 +3797,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           return i2.startsWith("#!") && (i2 = "// " + i2), i2;
         }
         function eval_evalModule(t3, i2, n2 = {}) {
-          const a2 = n2.id || (n2.filename ? basename4(n2.filename) : `_jitiEval.${n2.ext || (n2.async ? "mjs" : "js")}`), c2 = n2.filename || jitiResolve(t3, a2, { async: n2.async }), l2 = n2.ext || extname(c2), y2 = n2.cache || t3.parentCache || {}, E2 = /\.[cm]?tsx?$/.test(l2), w2 = ".mjs" === l2 || ".js" === l2 && "module" === (function(e3) {
+          const a2 = n2.id || (n2.filename ? basename4(n2.filename) : `_jitiEval.${n2.ext || (n2.async ? "mjs" : "js")}`), c2 = n2.filename || jitiResolve(t3, a2, { async: n2.async }), l2 = n2.ext || extname2(c2), y2 = n2.cache || t3.parentCache || {}, E2 = /\.[cm]?tsx?$/.test(l2), w2 = ".mjs" === l2 || ".js" === l2 && "module" === (function(e3) {
             for (; e3 && "." !== e3 && "/" !== e3; ) {
               e3 = pathe_M_eThtNZ_join(e3, "..");
               try {
@@ -3845,7 +3845,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
                     (0, $e.mkdirSync)(n4, { recursive: true });
                   } catch {
                   }
-                  const a4 = pathe_M_eThtNZ_join(n4, `${basename4(i6, extname(i6))}-${Date.now()}-${Math.random().toString(36).slice(2)}.mjs`);
+                  const a4 = pathe_M_eThtNZ_join(n4, `${basename4(i6, extname2(i6))}-${Date.now()}-${Math.random().toString(36).slice(2)}.mjs`);
                   return (0, $e.writeFileSync)(a4, t5), a4;
                 })(l3, n3), debug(t4, "[esm]", "[tempfile]", c4), a3(pathToFileURL3(c4))), E3 = y3 ? a3(y3).catch((e3) => {
                   if ("ENAMETOOLONG" !== e3?.code) throw e3;
@@ -4222,7 +4222,7 @@ Did you specify these with the most recent transformation maps first?`);
             for (let e5 = 1; e5 < s; e5++) a += "/" + n[e5];
             (!a || o && !a.endsWith("/..")) && (a += "/"), e4.path = a;
           }
-          function resolve12(e4, t3) {
+          function resolve13(e4, t3) {
             if (!e4 && !t3) return "";
             const r3 = parseUrl(e4);
             let n = r3.type;
@@ -4259,7 +4259,7 @@ Did you specify these with the most recent transformation maps first?`);
                 return r3.scheme + "//" + r3.user + r3.host + r3.port + r3.path + s;
             }
           }
-          return resolve12;
+          return resolve13;
         })();
       }, "./node_modules/.pnpm/@jridgewell+sourcemap-codec@1.5.5/node_modules/@jridgewell/sourcemap-codec/dist/sourcemap-codec.umd.js"(e2, t2, r2) {
         var n;
@@ -47374,17 +47374,58 @@ var import_url = require("url");
 var import_crypto2 = require("crypto");
 var import_fs2 = require("fs");
 var import_path2 = require("path");
+var import_fs3 = require("fs");
+var import_os = require("os");
+var import_path3 = require("path");
+var REMEDY_ARROW = "\u2192";
+function framesOf(stack) {
+  return (stack ?? "").split("\n").filter((line) => /^\s+at\s/.test(line));
+}
+function renderRefusal(error51) {
+  const captured = error51.stack;
+  Object.defineProperty(error51, "stack", {
+    configurable: true,
+    get: () => [error51.toString(), ...framesOf(captured)].join("\n"),
+    set(value2) {
+      Object.defineProperty(error51, "stack", { value: value2, writable: true, configurable: true });
+    }
+  });
+}
 var PenvError = class extends Error {
   name = "PenvError";
   /** A stable, machine-readable discriminator. */
   code;
   /** What the user should do about it. */
   remedy;
+  /** The message alone, without the remedy the constructor folds into it. */
+  summary;
   constructor(code, message, remedy) {
     super(remedy ? `${message}
   ${remedy}` : message);
     this.code = code;
     this.remedy = remedy;
+    this.summary = message;
+    renderRefusal(this);
+  }
+  /**
+   * Drops every frame from `below` upward, so the stack shows where the
+   * application called in rather than the path penv took inside itself. The
+   * caller names its own entry point; nothing here guesses which files are
+   * penv's.
+   */
+  hideFramesAbove(below) {
+    const capture = Error.captureStackTrace;
+    if (capture !== void 0) {
+      capture(this, below);
+      renderRefusal(this);
+    }
+    return this;
+  }
+  /** The refusal as every penv command prints it: the message, then the remedy. */
+  toString() {
+    const head = `${this.name}: ${this.summary}`;
+    return this.remedy === void 0 ? head : `${head}
+  ${REMEDY_ARROW} ${this.remedy}`;
   }
 };
 var FilenameGrammarError = class extends PenvError {
@@ -47398,10 +47439,10 @@ var FilenameGrammarError = class extends PenvError {
 var ReservedTokenError = class extends PenvError {
   name = "ReservedTokenError";
   token;
-  constructor(subject, token, where) {
+  constructor(subject, token, where2) {
     super(
       "RESERVED_TOKEN",
-      `The ${subject} name \`${token}\` in ${where} is a reserved token`,
+      `The ${subject} name \`${token}\` in ${where2} is a reserved token`,
       `Filenames are split on \`.\`, so \`${token}\` cannot be a ${subject} name. Rename it.`
     );
     this.token = token;
@@ -48912,6 +48953,7 @@ var RECORDS_PATH2 = `${STATE_PATH}/records`;
 var STATE_GITIGNORE_PATH = `${STATE_PATH}/.gitignore`;
 var MANIFEST_PATH = `${STATE_PATH}/manifest.json`;
 var EXTENSIONS_PATH = `${STATE_PATH}/extensions`;
+var LOCAL_EXTENSIONS_PATH = `${STATE_PATH}/local-extensions.json`;
 var CUTOVER_FILE = "cutover.json";
 var ROLLBACK_DIR = "rollback";
 var CUTOVER_PATH = `${STATE_PATH}/${CUTOVER_FILE}`;
@@ -48920,6 +48962,9 @@ var ROLLBACK_DOTENV_PATH = `${ROLLBACK_PATH}/dotenv`;
 function penvDir(projectRoot) {
   return (0, import_path2.resolve)(projectRoot, PENV_DIR);
 }
+function localExtensionsFile(projectRoot) {
+  return (0, import_path2.resolve)(projectRoot, ...LOCAL_EXTENSIONS_PATH.split("/"));
+}
 function recordsDir(projectRoot) {
   return (0, import_path2.resolve)(projectRoot, ...RECORDS_PATH2.split("/"));
 }
@@ -48964,10 +49009,60 @@ ${inside === void 0 ? "" : `!${inside}
 ${ROLLBACK_DIR}/
 `;
 }
+function invalid(problem) {
+  return new PenvError(
+    "LOCAL_EXTENSIONS_INVALID",
+    `${LOCAL_EXTENSIONS_PATH} does not hold the list penv writes: ${problem}`,
+    "It is a JSON array of package names. Delete it and run `penv add --local <package>` for each extension this project develops."
+  );
+}
+function parseLocalExtensions(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw invalid("it is not valid JSON");
+  }
+  if (!Array.isArray(parsed)) {
+    throw invalid("its root is not an array");
+  }
+  for (const name of parsed) {
+    if (typeof name !== "string" || name.trim() === "") {
+      throw invalid("it holds something that is not a package name");
+    }
+  }
+  return normalize(parsed);
+}
+function normalize(names) {
+  return [...new Set(names.map((name) => name.trim()))].sort();
+}
+var MANIFEST_PATH2 = ".penv/state/manifest.json";
 var MANIFEST_FORMAT = 1;
 var ENGINE_PACKAGE = "@penvhq/cli";
 var OFFICIAL_SCOPE = "@penvhq/";
 var DEFAULT_REGISTRY_HOSTS = ["registry.npmjs.org", "registry.npmjs.com", "npmjs.org"];
+var ManifestError = class extends PenvError {
+  name = "ManifestError";
+};
+var UnsupportedManifestFormatError = class _UnsupportedManifestFormatError extends PenvError {
+  name = "UnsupportedManifestFormatError";
+  /** The format the file declares. */
+  found;
+  /** The format this engine implements. */
+  supported = MANIFEST_FORMAT;
+  constructor(found, update) {
+    super(
+      "MANIFEST_FORMAT_UNSUPPORTED",
+      `${MANIFEST_PATH2} is format ${found}, and this penv understands format ${MANIFEST_FORMAT}`,
+      update === void 0 ? "Update penv, then run the command again." : `Run \`${update.updateCommand}\`, then \`${update.invokedCommand}\` again.`
+    );
+    this.found = found;
+  }
+  /** The same refusal, with the launcher's own update command and the user's command. */
+  withLauncherUpdate(update) {
+    return new _UnsupportedManifestFormatError(this.found, update);
+  }
+};
 var EXACT_VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 var INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
 var PACKAGE_NAME2 = /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
@@ -49107,6 +49202,224 @@ var MANIFEST = external_exports.strictObject({
   }),
   extensions: EXTENSIONS2
 });
+var FORBIDDEN = [
+  {
+    pattern: /(?:^|[\s"'=(])(?:\/(?:[A-Za-z0-9._-]+\/)+|~\/|[A-Za-z]:[\\/]|\\\\[A-Za-z0-9._-]+\\)/,
+    code: "MANIFEST_ABSOLUTE_PATH",
+    problem: "holds an absolute path",
+    remedy: "Remove it. The manifest is committed and read on every machine that clones the repo, so it names packages and versions only \u2014 never a location on one of them."
+  },
+  {
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|xox[abopsr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|hv[sb]\.[A-Za-z0-9._-]{10,}|sk-[A-Za-z0-9]{16,}|sk_live_[A-Za-z0-9]{10,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b|:\/\/[^/\s:@]+:[^/\s@]+@/,
+    code: "MANIFEST_CREDENTIAL",
+    problem: "holds something shaped like a credential",
+    remedy: "Remove it and rotate that credential. Anything committed here is readable by everyone with the repository, and by everyone who ever had it."
+  },
+  {
+    pattern: /\b[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+\s*=|\b(?:postgres|postgresql|mysql|mongodb|redis|amqps?|s3)(?:\+[a-z]+)?:\/\//,
+    code: "MANIFEST_PROVIDER_CONFIG",
+    problem: "holds provider configuration or a value",
+    remedy: "Move it to penv.config.ts. The manifest records which extension is pinned and why it is trusted, never how it is configured or what it holds."
+  }
+];
+var UNSCANNED_KEY = "integrity";
+function pathText(path) {
+  return path.map((segment, index) => {
+    if (typeof segment === "number") return `[${segment}]`;
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(segment)) return `[${JSON.stringify(segment)}]`;
+    return index === 0 ? segment : `.${segment}`;
+  }).join("");
+}
+function fieldName(path) {
+  return path.length === 0 ? "root" : `\`${pathText(path)}\``;
+}
+function isPlainObject22(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function valueAt(root, path) {
+  let current = root;
+  for (const segment of path) {
+    if (Array.isArray(current) && typeof segment === "number") {
+      current = current[segment];
+      continue;
+    }
+    if (!isPlainObject22(current)) return void 0;
+    current = current[String(segment)];
+  }
+  return current;
+}
+function scanForbidden(value2, path) {
+  if (typeof value2 === "string") {
+    for (const rule of FORBIDDEN) {
+      if (rule.pattern.test(value2)) {
+        return new ManifestError(
+          rule.code,
+          `${fieldName(path)} in ${MANIFEST_PATH2} ${rule.problem}: \`${value2}\``,
+          rule.remedy
+        );
+      }
+    }
+    return void 0;
+  }
+  if (Array.isArray(value2)) {
+    for (const [index, item] of value2.entries()) {
+      const found = scanForbidden(item, [...path, index]);
+      if (found) return found;
+    }
+    return void 0;
+  }
+  if (isPlainObject22(value2)) {
+    for (const [key, item] of Object.entries(value2)) {
+      if (key === UNSCANNED_KEY) continue;
+      const found = scanForbidden(item, [...path, key]);
+      if (found) return found;
+    }
+  }
+  return void 0;
+}
+function sectionRemedy(path) {
+  const [section, name] = path;
+  if (section === "engine") {
+    return `Restore it with \`git checkout ${MANIFEST_PATH2}\`, or write the exact version and the \`integrity\` npm published for that ${ENGINE_PACKAGE} release. penv runs the bytes this pin names, so it will not guess one.`;
+  }
+  if (section === "extensions" && typeof name === "string") {
+    return `Run \`penv add ${name}\` to rewrite that entry.`;
+  }
+  return `Restore it \u2014 format ${MANIFEST_FORMAT} requires it.`;
+}
+function describeType2(value2) {
+  if (value2 === null) return "null";
+  if (Array.isArray(value2)) return "an array";
+  return `a ${typeof value2}`;
+}
+function customParams(issue2) {
+  if (issue2.code !== "custom") return void 0;
+  const params = issue2.params;
+  if (!isPlainObject22(params)) return void 0;
+  const code = params.code;
+  const remedy = params.remedy;
+  if (typeof code !== "string" || typeof remedy !== "string") return void 0;
+  return { code, remedy };
+}
+function toManifestError(issue2, raw) {
+  const path = issue2.path;
+  const custom2 = customParams(issue2);
+  if (custom2) {
+    return new ManifestError(
+      custom2.code,
+      `${fieldName(path)} in ${MANIFEST_PATH2} ${issue2.message}`,
+      custom2.remedy
+    );
+  }
+  switch (issue2.code) {
+    case "unrecognized_keys": {
+      const key = issue2.keys[0] ?? "";
+      const where2 = path.length === 0 ? "at its root" : `in ${fieldName(path)}`;
+      return new ManifestError(
+        "MANIFEST_UNKNOWN_KEY",
+        `${MANIFEST_PATH2} has an unknown key \`${key}\` ${where2}`,
+        `Remove it. Format ${MANIFEST_FORMAT} is a closed shape, so a key penv does not know is either a typo or a file a newer penv wrote.`
+      );
+    }
+    case "invalid_key":
+      return new ManifestError(
+        "MANIFEST_PACKAGE_NAME",
+        `\`${String(path[path.length - 1] ?? "")}\` in ${MANIFEST_PATH2} is not an npm package name`,
+        "Name the package exactly as npm does, e.g. `@acme/provider-consul`."
+      );
+    case "invalid_union":
+      return new ManifestError(
+        "MANIFEST_TRUST_TIER",
+        `${fieldName(path)} in ${MANIFEST_PATH2} is \`${String(valueAt(raw, path))}\`, which is not a trust tier`,
+        "Use `third-party` for a package published outside your organisation, or `private` for one your own team publishes."
+      );
+    case "invalid_value":
+      return new ManifestError(
+        "MANIFEST_FIELD_VALUE",
+        `${fieldName(path)} in ${MANIFEST_PATH2} is \`${String(valueAt(raw, path))}\`, and format ${MANIFEST_FORMAT} requires \`${String(issue2.values[0])}\``,
+        sectionRemedy(path)
+      );
+    case "invalid_format": {
+      if (issue2.format !== "datetime") break;
+      return new ManifestError(
+        "MANIFEST_TIMESTAMP",
+        `${fieldName(path)} in ${MANIFEST_PATH2} is \`${String(valueAt(raw, path))}\`, which is not a UTC timestamp`,
+        "Write it as ISO 8601 in UTC, e.g. `2026-08-17T00:00:00Z`."
+      );
+    }
+    default:
+      break;
+  }
+  const actual = valueAt(raw, path);
+  if (actual === void 0) {
+    return new ManifestError(
+      "MANIFEST_FIELD_MISSING",
+      `${MANIFEST_PATH2} is missing ${fieldName(path)}`,
+      sectionRemedy(path)
+    );
+  }
+  return new ManifestError(
+    "MANIFEST_FIELD_TYPE",
+    `${fieldName(path)} in ${MANIFEST_PATH2} is ${describeType2(actual)}, not what format ${MANIFEST_FORMAT} declares`,
+    sectionRemedy(path)
+  );
+}
+function assertFormat(root) {
+  const format = root.format;
+  if (typeof format === "number" && Number.isInteger(format) && format > 0) {
+    if (format !== MANIFEST_FORMAT) {
+      throw new UnsupportedManifestFormatError(format);
+    }
+    return;
+  }
+  const declared = format === void 0 ? "no format" : `\`${String(format)}\` as its format`;
+  throw new ManifestError(
+    "MANIFEST_FORMAT_INVALID",
+    `${MANIFEST_PATH2} declares ${declared}, so penv cannot tell how to read it`,
+    `Restore the key as \`"format": ${MANIFEST_FORMAT}\` \u2014 every manifest says its format first.`
+  );
+}
+function validateManifest(value2) {
+  if (!isPlainObject22(value2)) {
+    throw new ManifestError(
+      "MANIFEST_ROOT",
+      `${MANIFEST_PATH2} holds ${describeType2(value2)} at its root, not a manifest object`,
+      `Restore it with \`git checkout ${MANIFEST_PATH2}\` \u2014 penv writes this file, and every manifest is a JSON object.`
+    );
+  }
+  assertFormat(value2);
+  const forbidden = scanForbidden(value2, []);
+  if (forbidden) {
+    throw forbidden;
+  }
+  const result2 = MANIFEST.safeParse(value2);
+  if (!result2.success) {
+    const issue2 = result2.error.issues[0];
+    if (issue2 === void 0) {
+      throw new ManifestError(
+        "MANIFEST_INVALID",
+        `${MANIFEST_PATH2} is not a format ${MANIFEST_FORMAT} manifest`,
+        `Restore it with \`git checkout ${MANIFEST_PATH2}\` \u2014 penv writes this file, and it is committed.`
+      );
+    }
+    throw toManifestError(issue2, value2);
+  }
+  return result2.data;
+}
+function parseManifest(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    throw new ManifestError(
+      "MANIFEST_PARSE",
+      `${MANIFEST_PATH2} is not valid JSON: ${detail}`,
+      `Restore it with \`git checkout ${MANIFEST_PATH2}\` \u2014 penv writes this file, so a syntax error in it is an edit that went wrong.`
+    );
+  }
+  return validateManifest(parsed);
+}
 var ENVIRONMENTS_KEY = "environments";
 var PRIORITY_KEYS = ["description", "owner"];
 function isPlainObject3(value2) {
@@ -49489,6 +49802,80 @@ function completeRotation(meta3, environment, nowIso) {
   };
   return { ...base, environments };
 }
+var PENV_HOME_VAR = "PENV_HOME";
+function penvHome(env) {
+  const declared = env[PENV_HOME_VAR];
+  if (declared !== void 0 && declared.trim() !== "") {
+    return (0, import_path3.resolve)(declared);
+  }
+  return (0, import_path3.join)((0, import_os.homedir)(), ".penv");
+}
+function packageDir(home, kind, name, version2) {
+  const bucket = (0, import_path3.resolve)(home, kind);
+  const dir = (0, import_path3.resolve)(bucket, ...name.split("/"), version2);
+  if (!dir.startsWith(bucket + import_path3.sep)) {
+    throw new PenvError(
+      "PENV_HOME_ESCAPE",
+      `\`${name}\` at \`${version2}\` resolves to ${dir}, which is outside ${bucket}`,
+      "Name the package exactly as npm does, e.g. `@penvhq/provider-vault`."
+    );
+  }
+  return dir;
+}
+var IMPORTABLE = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".node"]);
+function isImportableEntry(file2) {
+  return IMPORTABLE.has((0, import_path3.extname)(file2).toLowerCase());
+}
+var IMPORT_CONDITIONS = ["node", "import", "default"];
+function isPlainObject4(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function pickCondition(value2) {
+  if (typeof value2 === "string") {
+    return value2;
+  }
+  if (!isPlainObject4(value2)) {
+    return void 0;
+  }
+  for (const condition of IMPORT_CONDITIONS) {
+    const picked = pickCondition(value2[condition]);
+    if (picked !== void 0) {
+      return picked;
+    }
+  }
+  return void 0;
+}
+function mainExport(exports2) {
+  if (typeof exports2 === "string") {
+    return exports2;
+  }
+  if (!isPlainObject4(exports2)) {
+    return void 0;
+  }
+  return Object.keys(exports2).some((key) => key.startsWith(".")) ? pickCondition(exports2["."]) : pickCondition(exports2);
+}
+function stringField(source, key) {
+  if (!isPlainObject4(source)) {
+    return void 0;
+  }
+  const value2 = source[key];
+  return typeof value2 === "string" && value2.trim() !== "" ? value2.trim() : void 0;
+}
+function packageEntry(dir) {
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_fs3.readFileSync)((0, import_path3.join)(dir, "package.json"), "utf8"));
+  } catch {
+    return void 0;
+  }
+  const declared = mainExport(isPlainObject4(parsed) ? parsed.exports : void 0) ?? stringField(parsed, "main") ?? "index.js";
+  const root = (0, import_path3.resolve)(dir);
+  const file2 = (0, import_path3.resolve)(root, ...declared.split("/"));
+  if (!file2.startsWith(root + import_path3.sep)) {
+    return void 0;
+  }
+  return { file: file2, importable: isImportableEntry(file2) && (0, import_fs3.existsSync)(file2) };
+}
 
 // src/bin.ts
 var import_jiti = __toESM(require_jiti2(), 1);
@@ -49969,7 +50356,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 
 // src/commands/artifact.ts
 init_cjs_shims();
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_node_path7 = require("path");
 
 // ../runtime/dist/index.js
@@ -49980,8 +50367,8 @@ init_cjs_shims();
 
 // ../providers/filesystem/dist/index.js
 init_cjs_shims();
-var import_fs3 = require("fs");
-var import_path3 = require("path");
+var import_fs4 = require("fs");
+var import_path4 = require("path");
 var META_FORMAT = "json";
 function isErrnoCode(error51, code) {
   return error51 instanceof Error && error51.code === code;
@@ -49991,7 +50378,7 @@ var FilesystemProvider = class {
   #root;
   #config;
   constructor(options) {
-    this.#root = (0, import_path3.resolve)(options.root);
+    this.#root = (0, import_path4.resolve)(options.root);
     this.#config = options.config;
   }
   /** The records directory this provider is rooted at, absolute. */
@@ -50061,19 +50448,19 @@ var FilesystemProvider = class {
   /** Deletes a file that may not be there, and tidies the namespace it emptied. */
   #unlink(path) {
     try {
-      (0, import_fs3.unlinkSync)(path);
+      (0, import_fs4.unlinkSync)(path);
     } catch (error51) {
       if (!isErrnoCode(error51, "ENOENT")) throw error51;
       return;
     }
-    this.#pruneEmpty((0, import_path3.dirname)(path));
+    this.#pruneEmpty((0, import_path4.dirname)(path));
   }
   #pathOf(relativePosix) {
-    return (0, import_path3.join)(this.#root, ...relativePosix.split("/"));
+    return (0, import_path4.join)(this.#root, ...relativePosix.split("/"));
   }
   #readFile(path) {
     try {
-      return (0, import_fs3.readFileSync)(path, "utf8");
+      return (0, import_fs4.readFileSync)(path, "utf8");
     } catch (error51) {
       if (isErrnoCode(error51, "ENOENT") || isErrnoCode(error51, "EISDIR")) return void 0;
       throw error51;
@@ -50081,32 +50468,32 @@ var FilesystemProvider = class {
   }
   #writeFile(relativePosix, contents) {
     const path = this.#pathOf(relativePosix);
-    (0, import_fs3.mkdirSync)((0, import_path3.dirname)(path), { recursive: true });
-    (0, import_fs3.writeFileSync)(path, contents, "utf8");
+    (0, import_fs4.mkdirSync)((0, import_path4.dirname)(path), { recursive: true });
+    (0, import_fs4.writeFileSync)(path, contents, "utf8");
   }
   /** Namespaces are folders, so a namespace with no parameters left is no namespace. */
   #pruneEmpty(directory) {
     let current = directory;
-    while (current !== this.#root && current.startsWith(this.#root + import_path3.sep)) {
+    while (current !== this.#root && current.startsWith(this.#root + import_path4.sep)) {
       try {
-        (0, import_fs3.rmdirSync)(current);
+        (0, import_fs4.rmdirSync)(current);
       } catch {
         return;
       }
-      current = (0, import_path3.dirname)(current);
+      current = (0, import_path4.dirname)(current);
     }
   }
   #walk(directory, namespace, out2) {
     let entries;
     try {
-      entries = (0, import_fs3.readdirSync)(directory, { withFileTypes: true });
+      entries = (0, import_fs4.readdirSync)(directory, { withFileTypes: true });
     } catch (error51) {
       if (isErrnoCode(error51, "ENOENT")) return;
       throw error51;
     }
     for (const entry of [...entries].sort((a, b) => a.name < b.name ? -1 : 1)) {
       if (entry.isDirectory()) {
-        this.#walk((0, import_path3.join)(directory, entry.name), [...namespace, entry.name], out2);
+        this.#walk((0, import_path4.join)(directory, entry.name), [...namespace, entry.name], out2);
         continue;
       }
       const relativePath = [...namespace, entry.name].join("/");
@@ -50139,11 +50526,13 @@ var RUN_MARKER = "PENV_RUN";
 var ENVIRONMENT_VARIABLE = "PENV_ENV";
 var DELIVERY_VARIABLE = "PENV_DELIVERY";
 var SNAPSHOT_VARIABLE = "PENV_SNAPSHOT";
+var LAUNCHER_HOME = "PENV_HOME";
 var CONTROL_VARIABLES = [
   RUN_MARKER,
   DELIVERY_VARIABLE,
   SCHEMA_HARVEST_ENV,
-  SNAPSHOT_VARIABLE
+  SNAPSHOT_VARIABLE,
+  LAUNCHER_HOME
 ];
 var RESERVED_VARIABLES = [...CONTROL_VARIABLES, ENVIRONMENT_VARIABLE];
 function assertDeliverableNames(refs, config2) {
@@ -50217,7 +50606,7 @@ function inject(input) {
       written += 1;
       continue;
     }
-    const defaulted = validated === void 0 ? void 0 : valueAt(validated, accessPath(ref));
+    const defaulted = validated === void 0 ? void 0 : valueAt2(validated, accessPath(ref));
     if (defaulted !== void 0) {
       target[variable] = toEnvString(defaulted);
       written += 1;
@@ -50233,7 +50622,7 @@ function inject(input) {
 function slashId(ref) {
   return [...ref.namespace, ref.name].join("/");
 }
-function valueAt(root, path) {
+function valueAt2(root, path) {
   let node2 = root;
   for (const key of path) {
     if (typeof node2 !== "object" || node2 === null) {
@@ -50434,14 +50823,14 @@ var startChild = (invocation) => {
       process.off(signal, handler);
     }
   };
-  const ended = new Promise((resolve12, reject) => {
+  const ended = new Promise((resolve13, reject) => {
     child.on("error", (cause) => {
       release();
       reject(cannotStart(executable, cause, invocation.purpose));
     });
     child.on("exit", (code, signal) => {
       release();
-      resolve12({ exitCode: code ?? 1, signal });
+      resolve13({ exitCode: code ?? 1, signal });
     });
   });
   return {
@@ -50704,7 +51093,7 @@ function installFailed(plan2) {
 
 // src/project.ts
 init_cjs_shims();
-var import_node_fs3 = require("fs");
+var import_node_fs4 = require("fs");
 var import_node_path4 = require("path");
 
 // src/env-flags.ts
@@ -50767,14 +51156,15 @@ function environmentFromShorthand(config2, candidates, explicit) {
 
 // src/registry.ts
 init_cjs_shims();
+var import_node_fs3 = require("fs");
 var import_node_module = require("module");
 var import_node_path3 = require("path");
 var import_node_url = require("url");
 
 // ../providers/mock/dist/index.js
 init_cjs_shims();
-var import_fs4 = require("fs");
-var import_path4 = require("path");
+var import_fs5 = require("fs");
+var import_path5 = require("path");
 function scopeKey(scope) {
   switch (scope.kind) {
     case "unscoped":
@@ -50867,7 +51257,7 @@ var MockProvider = class {
   #load() {
     let contents;
     try {
-      contents = (0, import_fs4.readFileSync)(this.#storePath, "utf8");
+      contents = (0, import_fs5.readFileSync)(this.#storePath, "utf8");
     } catch (error51) {
       if (error51.code === "ENOENT") return emptyStore();
       throw error51;
@@ -50879,8 +51269,8 @@ var MockProvider = class {
     };
   }
   #save(store) {
-    (0, import_fs4.mkdirSync)((0, import_path4.dirname)(this.#storePath), { recursive: true });
-    (0, import_fs4.writeFileSync)(this.#storePath, JSON.stringify(store, null, 2), "utf8");
+    (0, import_fs5.mkdirSync)((0, import_path5.dirname)(this.#storePath), { recursive: true });
+    (0, import_fs5.writeFileSync)(this.#storePath, JSON.stringify(store, null, 2), "utf8");
   }
 };
 function createMockProvider(options) {
@@ -50928,19 +51318,12 @@ async function createSourceProvider(type, context) {
   return loadPluginProvider(type, context);
 }
 async function loadPluginProvider(type, context) {
-  const resolved = resolvePlugin(type, context.root);
-  if (resolved === void 0) {
-    throw unknownProvider(type, context.environment);
-  }
+  const path = resolveExtension(type, context.root, context.environment);
   let mod;
   try {
-    mod = await importPlugin(resolved);
-  } catch {
-    throw new PenvError(
-      "PROVIDER_PLUGIN_LOAD",
-      `The provider package \`${type}\` failed to load`,
-      "It resolved but threw while importing. Check it builds and its dependencies are installed."
-    );
+    mod = await importPlugin(path);
+  } catch (cause) {
+    throw providerLoadFailed(type, path, cause);
   }
   const factory = mod[PLUGIN_FACTORY_EXPORT];
   if (typeof factory !== "function") {
@@ -50954,16 +51337,72 @@ async function loadPluginProvider(type, context) {
   assertSatisfiesContract(provider, type);
   return provider;
 }
-function assertProvidersRegistered(config2, projectRoot) {
+function assertProvidersRegistered(config2, projectRoot, options) {
+  const local = localExtensions(projectRoot);
+  const ci = options?.ci ?? isCi(process.env.CI);
   for (const [environment, provider] of Object.entries(config2.providers)) {
     if (isProviderRegistered(provider.type)) {
       continue;
     }
-    if (resolvePlugin(provider.type, projectRoot) === void 0) {
-      throw unknownProvider(provider.type, environment);
+    if (ci && local.includes(provider.type)) {
+      throw localExtensionInCi(provider.type, environment);
     }
+    resolveExtension(provider.type, projectRoot, environment, local);
   }
 }
+function resolveExtension(type, projectRoot, environment, local = localExtensions(projectRoot)) {
+  const fromProject = resolvePlugin(type, projectRoot);
+  if (local.includes(type)) {
+    if (fromProject === void 0) {
+      throw localExtensionUnresolved(type, projectRoot, environment);
+    }
+    return fromProject;
+  }
+  if (fromProject !== void 0) {
+    return fromProject;
+  }
+  const version2 = pinnedVersion(type, projectRoot);
+  if (version2 === void 0) {
+    throw unknownProvider(type, environment);
+  }
+  const stored = storedExtension(type, version2);
+  if (stored === void 0) {
+    throw extensionNotInstalled(type, version2, environment);
+  }
+  return stored;
+}
+function pinnedVersion(type, projectRoot) {
+  let manifest;
+  try {
+    manifest = parseManifest((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(projectRoot, ...MANIFEST_PATH.split("/")), "utf8"));
+  } catch {
+    return void 0;
+  }
+  return manifest.extensions[type]?.version;
+}
+function storedExtension(type, version2) {
+  const entry = packageEntry(packageDir(penvHome(process.env), "extensions", type, version2));
+  return entry?.file;
+}
+function localExtensions(projectRoot) {
+  let text;
+  try {
+    text = (0, import_node_fs3.readFileSync)(localExtensionsFile(projectRoot), "utf8");
+  } catch {
+    return [];
+  }
+  return parseLocalExtensions(text);
+}
+function isCi(value2) {
+  return value2 !== void 0 && value2 !== "" && value2 !== "0" && value2.toLowerCase() !== "false";
+}
+function localExtensionInCi(type, environment) {
+  return new PenvError(
+    "LOCAL_EXTENSION_IN_CI",
+    `The provider \`${type}\` for environment ${environment} is a local extension, and this is CI`,
+    `${LOCAL_EXTENSIONS_PATH} records it as a package this project develops, so nothing pins the bytes CI would run. Publish it and run \`penv add ${type}\` to pin a release.`
+  );
+}
 function resolvePlugin(specifier, fromDir) {
   try {
     const require2 = (0, import_node_module.createRequire)((0, import_node_path3.resolve)(fromDir, "noop.js"));
@@ -50995,13 +51434,37 @@ function assertSatisfiesContract(provider, specifier) {
     }
   }
 }
+function where(environment) {
+  return environment === void 0 ? "" : ` for environment ${environment}`;
+}
 function unknownProvider(type, environment) {
   const preinstalled = [...REGISTRY.keys()].map((name) => `\`${name}\``).join(", ");
-  const where = environment === void 0 ? "" : ` for environment ${environment}`;
   return new PenvError(
     "UNKNOWN_PROVIDER",
-    `The provider \`${type}\`${where} in penv.config.ts is not installed in this project`,
-    `Install it with \`npm i ${type}\` \u2014 a provider's \`type\` is the package penv imports. The CLI ships ${preinstalled} pre-installed.`
+    `The provider \`${type}\`${where(environment)} in penv.config.ts is nowhere penv looks for it`,
+    `Run \`penv add ${type}\` to pin a release, or \`penv add --local ${type}\` if this repository is the one that builds it. penv looks in ${LOCAL_EXTENSIONS_PATH}, this project's node_modules, and then $PENV_HOME at the version ${MANIFEST_PATH} pins. The CLI ships ${preinstalled} pre-installed.`
+  );
+}
+function extensionNotInstalled(type, version2, environment) {
+  return new PenvError(
+    "EXTENSION_NOT_INSTALLED",
+    `${MANIFEST_PATH} pins \`${type}\` ${version2}${where(environment)}, and it is not installed in ${penvHome(process.env)}`,
+    "Run `penv install` \u2014 it downloads and verifies every version the manifest pins, extensions included."
+  );
+}
+function localExtensionUnresolved(type, projectRoot, environment) {
+  return new PenvError(
+    "LOCAL_EXTENSION_UNRESOLVED",
+    `${LOCAL_EXTENSIONS_PATH} records \`${type}\`${where(environment)} as a package this project develops, and it does not resolve from ${projectRoot}`,
+    `Add it as a dependency of the root (a workspace link is one) and run \`pnpm install\`, or drop the name from ${LOCAL_EXTENSIONS_PATH} if this project no longer builds it.`
+  );
+}
+function providerLoadFailed(type, path, cause) {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new PenvError(
+    "PROVIDER_PLUGIN_LOAD",
+    `The provider package \`${type}\` failed to load from ${path}: ${detail}`,
+    "penv imports that file exactly as it stands, with no transform, so it has to be built JavaScript with its dependencies installed."
   );
 }
 
@@ -51031,10 +51494,10 @@ function localTree(project) {
 }
 function selfContainedSchemaModule(root, schemaFile) {
   const file2 = (0, import_node_path4.join)(root, ...schemaFile.split("/"));
-  if (!(0, import_node_fs3.existsSync)(file2)) {
+  if (!(0, import_node_fs4.existsSync)(file2)) {
     return void 0;
   }
-  const source = (0, import_node_fs3.readFileSync)(file2, "utf8");
+  const source = (0, import_node_fs4.readFileSync)(file2, "utf8");
   return source.includes("PenvSchemaShape") || source.includes("z.object") ? schemaFile : void 0;
 }
 function schemaShapeFileOf(project) {
@@ -51271,10 +51734,7 @@ function writeError(lines) {
 }
 function reportError(error51) {
   if (error51 instanceof PenvError) {
-    const suffix = error51.remedy === void 0 ? void 0 : `
-  ${error51.remedy}`;
-    const message = suffix !== void 0 && error51.message.endsWith(suffix) ? error51.message.slice(0, -suffix.length) : error51.message;
-    process.stderr.write(`${err.red(CROSS)} ${message}
+    process.stderr.write(`${err.red(CROSS)} ${error51.summary}
 `);
     if (error51.remedy !== void 0) {
       process.stderr.write(`  ${err.cyan("\u2192")} ${error51.remedy}
@@ -51305,13 +51765,13 @@ async function guard(run) {
 
 // src/commands/run.ts
 init_cjs_shims();
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_module2 = require("module");
 var import_node_path6 = require("path");
 
 // src/dotenv-files.ts
 init_cjs_shims();
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var SHARED = ".env";
 var LOCAL2 = "local";
 var NOT_ENVIRONMENTS = [
@@ -51370,7 +51830,7 @@ function order(file2) {
 function discoverDotenvFiles(root) {
   let entries;
   try {
-    entries = (0, import_node_fs4.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+    entries = (0, import_node_fs5.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
   } catch {
     return [];
   }
@@ -52093,7 +52553,7 @@ function assertNoActiveDotenv(project) {
   );
 }
 var VARIABLE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function isPlainObject4(value2) {
+function isPlainObject5(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function packageManifest(specifier, root) {
@@ -52105,10 +52565,10 @@ function packageManifest(specifier, root) {
   }
   for (; ; ) {
     const file2 = (0, import_node_path6.join)(directory, "package.json");
-    if ((0, import_node_fs5.existsSync)(file2)) {
+    if ((0, import_node_fs6.existsSync)(file2)) {
       try {
-        const parsed = JSON.parse((0, import_node_fs5.readFileSync)(file2, "utf8"));
-        if (isPlainObject4(parsed) && parsed.name === specifier) {
+        const parsed = JSON.parse((0, import_node_fs6.readFileSync)(file2, "utf8"));
+        if (isPlainObject5(parsed) && parsed.name === specifier) {
           return parsed;
         }
       } catch {
@@ -52129,7 +52589,7 @@ function declaredCredentials(config2, root) {
       continue;
     }
     const penv = packageManifest(provider.type, root)?.penv;
-    const credentials = isPlainObject4(penv) ? penv.credentials : void 0;
+    const credentials = isPlainObject5(penv) ? penv.credentials : void 0;
     if (credentials === void 0) {
       continue;
     }
@@ -52180,7 +52640,7 @@ function snapshotPath(host) {
 }
 function readSnapshot(path) {
   try {
-    return (0, import_node_fs5.readFileSync)(path, "utf8");
+    return (0, import_node_fs6.readFileSync)(path, "utf8");
   } catch {
     throw new PenvError(
       "RUN_SNAPSHOT_MISSING",
@@ -52259,11 +52719,11 @@ function watchProject(project, onChange) {
     timer = setTimeout(onChange, DEBOUNCE_MS);
   };
   const add = (target, recursive, only) => {
-    if (!(0, import_node_fs5.existsSync)(target)) {
+    if (!(0, import_node_fs6.existsSync)(target)) {
       return;
     }
     try {
-      const watcher = (0, import_node_fs5.watch)(target, { recursive }, (_event, filename) => {
+      const watcher = (0, import_node_fs6.watch)(target, { recursive }, (_event, filename) => {
         if (only !== void 0 && (filename === null || (0, import_node_path6.basename)(filename) !== only)) {
           return;
         }
@@ -52526,8 +52986,8 @@ ${lines}`,
     keySource: keySourceIdentifier(project.config, environment),
     values
   };
-  (0, import_node_fs6.mkdirSync)((0, import_node_path7.dirname)(file2), { recursive: true });
-  (0, import_node_fs6.writeFileSync)(file2, serializeArtifact(artifact), "utf8");
+  (0, import_node_fs7.mkdirSync)((0, import_node_path7.dirname)(file2), { recursive: true });
+  (0, import_node_fs7.writeFileSync)(file2, serializeArtifact(artifact), "utf8");
   const inside = (0, import_node_path7.relative)(project.root, file2);
   return {
     file: file2,
@@ -52597,7 +53057,7 @@ init_cjs_shims();
 
 // src/cutover.ts
 init_cjs_shims();
-var import_node_fs7 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_path8 = require("path");
 var CUTOVER_FORMAT = 1;
 function fileFor(root, relativePosix) {
@@ -52615,7 +53075,7 @@ function cutoverRoot(cwd) {
 }
 function bundledFiles(root) {
   try {
-    return (0, import_node_fs7.readdirSync)(bundleDir(root)).sort();
+    return (0, import_node_fs8.readdirSync)(bundleDir(root)).sort();
   } catch {
     return [];
   }
@@ -52625,12 +53085,12 @@ function bundleUnresolved(root) {
 }
 function readCutover(root) {
   const file2 = cutoverFile(root);
-  if (!(0, import_node_fs7.existsSync)(file2)) {
+  if (!(0, import_node_fs8.existsSync)(file2)) {
     return void 0;
   }
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs7.readFileSync)(file2, "utf8"));
+    parsed = JSON.parse((0, import_node_fs8.readFileSync)(file2, "utf8"));
   } catch {
     throw unreadable("it is not JSON");
   }
@@ -52683,12 +53143,12 @@ function bundleDotenvFiles(root, files, environments, now = /* @__PURE__ */ new
     environments: [...environments]
   };
   const file2 = cutoverFile(root);
-  (0, import_node_fs7.mkdirSync)((0, import_node_path8.dirname)(file2), { recursive: true });
-  (0, import_node_fs7.writeFileSync)(file2, serializeCutover(cutover), "utf8");
+  (0, import_node_fs8.mkdirSync)((0, import_node_path8.dirname)(file2), { recursive: true });
+  (0, import_node_fs8.writeFileSync)(file2, serializeCutover(cutover), "utf8");
   const bundle = bundleDir(root);
-  (0, import_node_fs7.mkdirSync)(bundle, { recursive: true });
+  (0, import_node_fs8.mkdirSync)(bundle, { recursive: true });
   for (const name of files) {
-    (0, import_node_fs7.renameSync)((0, import_node_path8.join)(root, name), (0, import_node_path8.join)(bundle, name));
+    (0, import_node_fs8.renameSync)((0, import_node_path8.join)(root, name), (0, import_node_path8.join)(bundle, name));
   }
   return cutover;
 }
@@ -52707,7 +53167,7 @@ function runUndo(options) {
   const names = [...recorded, ...bundled.filter((name) => !recorded.includes(name))];
   const bundle = bundleDir(root);
   const held = new Set(bundled);
-  const occupied2 = names.filter((name) => held.has(name) && (0, import_node_fs7.existsSync)((0, import_node_path8.join)(root, name)));
+  const occupied2 = names.filter((name) => held.has(name) && (0, import_node_fs8.existsSync)((0, import_node_path8.join)(root, name)));
   if (occupied2.length > 0) {
     const listed = occupied2.join(", ");
     const many = occupied2.length > 1;
@@ -52722,9 +53182,9 @@ function runUndo(options) {
   const missing = [];
   for (const name of names) {
     if (held.has(name)) {
-      (0, import_node_fs7.renameSync)((0, import_node_path8.join)(bundle, name), (0, import_node_path8.join)(root, name));
+      (0, import_node_fs8.renameSync)((0, import_node_path8.join)(bundle, name), (0, import_node_path8.join)(root, name));
       restored.push(name);
-    } else if ((0, import_node_fs7.existsSync)((0, import_node_path8.join)(root, name))) {
+    } else if ((0, import_node_fs8.existsSync)((0, import_node_path8.join)(root, name))) {
       alreadyBack.push(name);
     } else {
       missing.push(name);
@@ -52736,13 +53196,13 @@ function runUndo(options) {
 function runCleanup(options) {
   const root = cutoverRoot(options.cwd);
   const held = bundledFiles(root);
-  const cleaned = held.length > 0 || (0, import_node_fs7.existsSync)(cutoverFile(root)) || (0, import_node_fs7.existsSync)(fileFor(root, ROLLBACK_PATH));
+  const cleaned = held.length > 0 || (0, import_node_fs8.existsSync)(cutoverFile(root)) || (0, import_node_fs8.existsSync)(fileFor(root, ROLLBACK_PATH));
   removeBundle(root);
   return { root, removed: held, cleaned };
 }
 function removeBundle(root) {
-  (0, import_node_fs7.rmSync)(fileFor(root, ROLLBACK_PATH), { recursive: true, force: true });
-  (0, import_node_fs7.rmSync)(cutoverFile(root), { force: true });
+  (0, import_node_fs8.rmSync)(fileFor(root, ROLLBACK_PATH), { recursive: true, force: true });
+  (0, import_node_fs8.rmSync)(cutoverFile(root), { force: true });
 }
 
 // src/commands/cleanup.ts
@@ -52778,7 +53238,7 @@ var cleanupCommand = defineCommand({
 
 // src/commands/doctor.ts
 init_cjs_shims();
-var import_node_fs8 = require("fs");
+var import_node_fs9 = require("fs");
 var import_node_path9 = require("path");
 
 // src/commands/push.ts
@@ -52817,8 +53277,8 @@ function lineReader(input = process.stdin, output = process.stdout) {
       }
       rl.setPrompt(question);
       rl.prompt();
-      return new Promise((resolve12) => {
-        waiting.push(resolve12);
+      return new Promise((resolve13) => {
+        waiting.push(resolve13);
       });
     },
     close() {
@@ -53222,6 +53682,7 @@ async function runDoctor(options) {
     findings.push(...unusedFindings(drift));
   }
   findings.push(...fallbackFindings(subjects, environment));
+  findings.push(...secrecyFindings(subjects, environment));
   findings.push(...plaintextSecretFindings(subjects, environment));
   findings.push(...publicSecretFindings(subjects, environment, project.config));
   findings.push(...encryptionFindings(subjects, environment));
@@ -53234,6 +53695,7 @@ async function runDoctor(options) {
   }
   findings.push(...await providerDriftFindings(project, environment, options.source));
   findings.push(...await projectionFindings(project, environment, options.projection));
+  findings.push(...localExtensionFindings(project));
   findings.push(...artifactFindings(project));
   findings.push({
     check: "provider",
@@ -53371,6 +53833,31 @@ function fallbackFindings(subjects, environment) {
     }
   ];
 }
+function secrecyFindings(subjects, environment) {
+  const undeclared = subjects.filter(
+    ({ meta: meta3 }) => effectiveMeta(meta3, environment).secret === void 0
+  );
+  if (undeclared.length === 0) {
+    return [
+      {
+        check: "secrecy-undeclared",
+        severity: "pass",
+        label: "Secrecy policy",
+        subject: subjects.length === 0 ? `no parameter resolves for ${environment}` : `every parameter declares whether it is secret for ${environment}`
+      }
+    ];
+  }
+  return [
+    {
+      check: "secrecy-undeclared",
+      severity: "unknown",
+      label: "Secrecy policy",
+      subject: `${undeclared.length} of ${subjects.length} declare neither way for ${environment}`,
+      detail: "penv was never told which of these values must be encrypted",
+      remedy: `declare \`"secret": true\` or \`"secret": false\` in a parameter's meta file, ${RECORDS_PATH2}/<name>.json`
+    }
+  ];
+}
 function plaintextSecretFindings(subjects, environment) {
   const secrets = subjects.filter(({ meta: meta3 }) => isSecret(meta3, environment));
   const findings = [];
@@ -53674,7 +54161,7 @@ function looksLikeArtifact(text) {
 function scannableFiles(directory, out2) {
   let entries;
   try {
-    entries = (0, import_node_fs8.readdirSync)(directory, { withFileTypes: true });
+    entries = (0, import_node_fs9.readdirSync)(directory, { withFileTypes: true });
   } catch {
     return;
   }
@@ -53691,6 +54178,29 @@ function scannableFiles(directory, out2) {
     }
   }
 }
+function localExtensionFindings(project) {
+  const names = localExtensions(project.root);
+  if (names.length === 0) {
+    return [
+      {
+        check: "local-extension",
+        severity: "pass",
+        label: "Extensions",
+        subject: "every extension this project names is pinned"
+      }
+    ];
+  }
+  return [
+    {
+      check: "local-extension",
+      severity: "unknown",
+      label: "Extensions",
+      subject: names.join(", "),
+      detail: "resolved from this project's node_modules \u2014 no release, no pinned bytes",
+      remedy: `publish it and run \`penv add ${names[0]}\` when this stops being a development path`
+    }
+  ];
+}
 function artifactFindings(project) {
   const files = [];
   scannableFiles(project.root, files);
@@ -53698,10 +54208,10 @@ function artifactFindings(project) {
   for (const file2 of files) {
     let text;
     try {
-      if ((0, import_node_fs8.statSync)(file2).size > ARTIFACT_SCAN_LIMIT) {
+      if ((0, import_node_fs9.statSync)(file2).size > ARTIFACT_SCAN_LIMIT) {
         continue;
       }
-      text = (0, import_node_fs8.readFileSync)(file2, "utf8");
+      text = (0, import_node_fs9.readFileSync)(file2, "utf8");
     } catch {
       continue;
     }
@@ -54459,7 +54969,7 @@ var fillCommand = defineCommand({
 
 // src/commands/generate.ts
 init_cjs_shims();
-var import_node_fs9 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_path10 = require("path");
 var DEFAULT_OUTPUT = ".env";
 function entriesFor(project, environment, allowDecrypt) {
@@ -54506,7 +55016,7 @@ function runGenerate(options) {
   const environment = targetEnvironment(project, options.environment, options.envFlags);
   const { entries, decrypted } = entriesFor(project, environment, options.allowDecrypt === true);
   const file2 = options.out === void 0 ? (0, import_node_path10.resolve)(project.root, DEFAULT_OUTPUT) : (0, import_node_path10.isAbsolute)(options.out) ? options.out : (0, import_node_path10.resolve)(options.cwd, options.out);
-  (0, import_node_fs9.writeFileSync)(file2, serializeDotenv(entries), "utf8");
+  (0, import_node_fs10.writeFileSync)(file2, serializeDotenv(entries), "utf8");
   return { file: file2, environment, entries: entries.length, decrypted };
 }
 function displayPath2(cwd, file2) {
@@ -54644,7 +55154,7 @@ var getCommand = defineCommand({
 
 // src/commands/import.ts
 init_cjs_shims();
-var import_node_fs13 = require("fs");
+var import_node_fs14 = require("fs");
 var import_node_path14 = require("path");
 
 // src/adopt.ts
@@ -54659,9 +55169,9 @@ function assertImportable(ref, variable) {
     `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
   );
 }
-function assertNotReserved(ref, variable, where, config2) {
+function assertNotReserved(ref, variable, where2, config2) {
   if (isReservedToken(ref.name, config2)) {
-    throw new ReservedTokenError("parameter", variable, where);
+    throw new ReservedTokenError("parameter", variable, where2);
   }
 }
 function assertRoundTrips(ref, variable, config2) {
@@ -54678,12 +55188,12 @@ function assertRoundTrips(ref, variable, config2) {
     `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`override\` block of penv.config.ts \u2014 \`override: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
   );
 }
-function refsForEntries(entries, where, config2) {
+function refsForEntries(entries, where2, config2) {
   const refs = [];
   for (const entry of entries) {
     const ref = refFromVariable(entry.key);
     assertImportable(ref, entry.key);
-    assertNotReserved(ref, entry.key, where, config2);
+    assertNotReserved(ref, entry.key, where2, config2);
     assertRoundTrips(ref, entry.key, config2);
     refs.push(ref);
   }
@@ -54714,7 +55224,7 @@ function writeEntries(tree, entries, refs, scope) {
 
 // src/detect.ts
 init_cjs_shims();
-var import_node_fs10 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_path11 = require("path");
 var SIGNATURES = [
   { name: "Next.js", packages: ["next"], publicPrefixes: ["NEXT_PUBLIC_"] },
@@ -54731,7 +55241,7 @@ var SIGNATURES = [
 function exportsSchema(file2) {
   let source;
   try {
-    source = (0, import_node_fs10.readFileSync)(file2, "utf8");
+    source = (0, import_node_fs11.readFileSync)(file2, "utf8");
   } catch {
     return false;
   }
@@ -54743,7 +55253,7 @@ function exportsSchema(file2) {
 }
 function occupied(cwd, relative5) {
   const file2 = (0, import_node_path11.join)(cwd, ...relative5.split("/"));
-  return (0, import_node_fs10.existsSync)(file2) && !exportsSchema(file2);
+  return (0, import_node_fs11.existsSync)(file2) && !exportsSchema(file2);
 }
 function schemaFileFor(cwd) {
   const dir = srcPrefix(cwd);
@@ -54758,7 +55268,7 @@ function schemaFileFor(cwd) {
   return { file: DEFAULT_SCHEMA_FILE, displaced: preferred };
 }
 function srcPrefix(cwd) {
-  return (0, import_node_fs10.existsSync)((0, import_node_path11.join)(cwd, "src")) ? "src/" : "";
+  return (0, import_node_fs11.existsSync)((0, import_node_path11.join)(cwd, "src")) ? "src/" : "";
 }
 function dependenciesOf(cwd) {
   const manifest = manifestOf2(cwd);
@@ -54778,12 +55288,12 @@ function dependenciesOf(cwd) {
 }
 function manifestOf2(cwd) {
   const file2 = (0, import_node_path11.join)(cwd, "package.json");
-  if (!(0, import_node_fs10.existsSync)(file2)) {
+  if (!(0, import_node_fs11.existsSync)(file2)) {
     return void 0;
   }
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs10.readFileSync)(file2, "utf8"));
+    manifest = JSON.parse((0, import_node_fs11.readFileSync)(file2, "utf8"));
   } catch {
     return void 0;
   }
@@ -54799,7 +55309,7 @@ function detectFramework(cwd) {
       return detectedFrom(cwd, signature.name, signature.publicPrefixes);
     }
   }
-  if ((0, import_node_fs10.existsSync)((0, import_node_path11.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
+  if ((0, import_node_fs11.existsSync)((0, import_node_path11.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
     return detectedFrom(cwd, "Bun", []);
   }
   return void 0;
@@ -54879,30 +55389,30 @@ function draftFieldsAcross(sources, environments) {
 
 // src/commands/init.ts
 init_cjs_shims();
-var import_node_fs12 = require("fs");
+var import_node_fs13 = require("fs");
 var import_node_path13 = require("path");
 var import_promises = require("readline/promises");
 
 // src/scaffold-undo.ts
 init_cjs_shims();
-var import_node_fs11 = require("fs");
+var import_node_fs12 = require("fs");
 var import_node_path12 = require("path");
 function record2(path, files, dirs) {
   let stats;
   try {
-    stats = (0, import_node_fs11.statSync)(path);
+    stats = (0, import_node_fs12.statSync)(path);
   } catch {
     return;
   }
   if (stats.isDirectory()) {
     dirs.add(path);
-    for (const entry of (0, import_node_fs11.readdirSync)(path)) {
+    for (const entry of (0, import_node_fs12.readdirSync)(path)) {
       record2((0, import_node_path12.join)(path, entry), files, dirs);
     }
     return;
   }
   if (stats.isFile()) {
-    files.set(path, (0, import_node_fs11.readFileSync)(path));
+    files.set(path, (0, import_node_fs12.readFileSync)(path));
   }
 }
 function captureScaffold(root, paths) {
@@ -54910,7 +55420,7 @@ function captureScaffold(root, paths) {
   const dirs = /* @__PURE__ */ new Set();
   for (const path of paths) {
     for (let dir = (0, import_node_path12.dirname)(path); dir.startsWith(root) && dir !== root; dir = (0, import_node_path12.dirname)(dir)) {
-      if ((0, import_node_fs11.existsSync)(dir)) {
+      if ((0, import_node_fs12.existsSync)(dir)) {
         dirs.add(dir);
       }
     }
@@ -54926,31 +55436,31 @@ function restoreScaffold(undo) {
     pruneAncestors(path, undo);
   }
   for (const [file2, contents] of undo.files) {
-    (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(file2), { recursive: true });
-    (0, import_node_fs11.writeFileSync)(file2, contents);
+    (0, import_node_fs12.mkdirSync)((0, import_node_path12.dirname)(file2), { recursive: true });
+    (0, import_node_fs12.writeFileSync)(file2, contents);
   }
 }
 function removeAdded(path, undo) {
   let stats;
   try {
-    stats = (0, import_node_fs11.statSync)(path);
+    stats = (0, import_node_fs12.statSync)(path);
   } catch {
     return;
   }
   if (stats.isFile()) {
     if (!undo.files.has(path)) {
-      (0, import_node_fs11.unlinkSync)(path);
+      (0, import_node_fs12.unlinkSync)(path);
     }
     return;
   }
   if (!stats.isDirectory()) {
     return;
   }
-  for (const entry of (0, import_node_fs11.readdirSync)(path)) {
+  for (const entry of (0, import_node_fs12.readdirSync)(path)) {
     removeAdded((0, import_node_path12.join)(path, entry), undo);
   }
-  if (!undo.dirs.has(path) && (0, import_node_fs11.readdirSync)(path).length === 0) {
-    (0, import_node_fs11.rmdirSync)(path);
+  if (!undo.dirs.has(path) && (0, import_node_fs12.readdirSync)(path).length === 0) {
+    (0, import_node_fs12.rmdirSync)(path);
   }
 }
 function pruneAncestors(path, undo) {
@@ -54959,7 +55469,7 @@ function pruneAncestors(path, undo) {
       return;
     }
     try {
-      (0, import_node_fs11.rmdirSync)(dir);
+      (0, import_node_fs12.rmdirSync)(dir);
     } catch {
       return;
     }
@@ -55122,7 +55632,7 @@ var NOT_ENVIRONMENTS2 = [...RESERVED_TOKENS, "example", "sample", "template"];
 function suggestEnvironments(root) {
   let entries;
   try {
-    entries = (0, import_node_fs12.readdirSync)(root);
+    entries = (0, import_node_fs13.readdirSync)(root);
   } catch {
     return [];
   }
@@ -55167,7 +55677,7 @@ function configOf(decisions) {
 }
 function declaredIn(root) {
   const file2 = (0, import_node_path13.join)(root, CONFIG_FILE);
-  if (!(0, import_node_fs12.existsSync)(file2)) {
+  if (!(0, import_node_fs13.existsSync)(file2)) {
     return void 0;
   }
   return loadConfigFrom(file2);
@@ -55610,15 +56120,15 @@ function renderTsconfig(target, alias) {
 }
 function ensurePenvDir(root) {
   const dir = (0, import_node_path13.resolve)(root, PENV_DIR);
-  if ((0, import_node_fs12.existsSync)(dir)) {
+  if ((0, import_node_fs13.existsSync)(dir)) {
     return { target: "penv-dir", action: "kept", text: `Found ${PENV_DIR}/` };
   }
-  (0, import_node_fs12.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
   return { target: "penv-dir", action: "created", text: `Created ${PENV_DIR}/` };
 }
 function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
   const file2 = (0, import_node_path13.join)(root, SCHEMA_SHAPE_FILE);
-  if ((0, import_node_fs12.existsSync)(file2)) {
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return {
       target: "schema",
       action: "kept",
@@ -55635,7 +56145,7 @@ function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS
       note: `(the shape lives there, from before the ${SCHEMA_SHAPE_FILE} split \u2014 penv did not add a second one. To adopt the split: move the \`z.object\` (and any \`declare module\` block) into ${SCHEMA_SHAPE_FILE}, leaving ${oldLayout} importing \`schema\` from it and calling \`load\`.)`
     };
   }
-  (0, import_node_fs12.writeFileSync)(file2, renderSchemaShapeModule(fields, draft), "utf8");
+  (0, import_node_fs13.writeFileSync)(file2, renderSchemaShapeModule(fields, draft), "utf8");
   return {
     target: "schema",
     action: "created",
@@ -55645,7 +56155,7 @@ function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS
 }
 function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
   const file2 = (0, import_node_path13.join)(root, ...decisions.schemaFile.split("/"));
-  if ((0, import_node_fs12.existsSync)(file2)) {
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return {
       target: "env",
       action: "kept",
@@ -55653,8 +56163,8 @@ function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
       note: "(yours \u2014 penv never regenerates it)"
     };
   }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(file2, renderEnvModule(decisions.schemaFile, decisions.inject), "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file2, renderEnvModule(decisions.schemaFile, decisions.inject), "utf8");
   return {
     target: "env",
     action: "created",
@@ -55664,18 +56174,18 @@ function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
 }
 function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
   const file2 = (0, import_node_path13.join)(root, CONFIG_FILE);
-  if ((0, import_node_fs12.existsSync)(file2)) {
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return { target: "config", action: "kept", text: `Kept ${CONFIG_FILE}` };
   }
-  (0, import_node_fs12.writeFileSync)(file2, renderConfigModule(decisions), "utf8");
+  (0, import_node_fs13.writeFileSync)(file2, renderConfigModule(decisions), "utf8");
   return { target: "config", action: "created", text: `Generated ${CONFIG_FILE}` };
 }
 function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   const alias = decisions.alias;
   const imports = alias.startsWith(IMPORTS_PREFIX);
   const file2 = (0, import_node_path13.join)(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
-  const where = imports ? PACKAGE_FILE : TSCONFIG_FILE;
-  if (!(0, import_node_fs12.existsSync)(file2)) {
+  const where2 = imports ? PACKAGE_FILE : TSCONFIG_FILE;
+  if (!(0, import_node_fs13.existsSync)(file2)) {
     if (imports) {
       return {
         target: "tsconfig",
@@ -55684,20 +56194,20 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
         note: `(run \`npm init\` first, or use \`--alias @env\` to alias through ${TSCONFIG_FILE})`
       };
     }
-    (0, import_node_fs12.writeFileSync)(file2, renderTsconfig(decisions.schemaFile, alias), "utf8");
+    (0, import_node_fs13.writeFileSync)(file2, renderTsconfig(decisions.schemaFile, alias), "utf8");
     return {
       target: "tsconfig",
       action: "created",
       text: `Created ${TSCONFIG_FILE} with the ${alias} path alias`
     };
   }
-  const source = (0, import_node_fs12.readFileSync)(file2, "utf8");
+  const source = (0, import_node_fs13.readFileSync)(file2, "utf8");
   const edit = imports ? insertImportsAlias(source, decisions.schemaFile, alias) : insertEnvAlias(source, decisions.schemaFile, alias);
   if (edit.conflict !== void 0) {
     return {
       target: "tsconfig",
       action: "conflicted",
-      text: `${where} already maps ${alias} to ${edit.conflict}`,
+      text: `${where2} already maps ${alias} to ${edit.conflict}`,
       note: `(left alone \u2014 \`import { env } from "${alias}"\` will not reach ${decisions.schemaFile})`
     };
   }
@@ -55705,25 +56215,25 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
     return {
       target: "tsconfig",
       action: "kept",
-      text: `Kept the ${alias} alias in ${where}`
+      text: `Kept the ${alias} alias in ${where2}`
     };
   }
-  (0, import_node_fs12.writeFileSync)(file2, edit.source, "utf8");
+  (0, import_node_fs13.writeFileSync)(file2, edit.source, "utf8");
   return {
     target: "tsconfig",
     action: "updated",
-    text: `Added ${alias} alias to ${where}`
+    text: `Added ${alias} alias to ${where2}`
   };
 }
 function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
   const file2 = (0, import_node_path13.join)(root, ...STATE_GITIGNORE_PATH.split("/"));
   const wanted = renderStateGitignore(configOf(decisions));
-  const existing = (0, import_node_fs12.existsSync)(file2) ? (0, import_node_fs12.readFileSync)(file2, "utf8") : void 0;
+  const existing = (0, import_node_fs13.existsSync)(file2) ? (0, import_node_fs13.readFileSync)(file2, "utf8") : void 0;
   if (existing === wanted) {
     return { target: "gitignore", action: "kept", text: `Kept ${STATE_GITIGNORE_PATH}` };
   }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(file2, wanted, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file2, wanted, "utf8");
   return {
     target: "gitignore",
     action: existing === void 0 ? "created" : "updated",
@@ -55740,11 +56250,11 @@ function outdatedRuntimeWarning(root) {
 }
 function installedPenvVersion(root) {
   const file2 = (0, import_node_path13.join)(root, "node_modules", "@penvhq", "penv", "package.json");
-  if (!(0, import_node_fs12.existsSync)(file2)) {
+  if (!(0, import_node_fs13.existsSync)(file2)) {
     return void 0;
   }
   try {
-    const version2 = JSON.parse((0, import_node_fs12.readFileSync)(file2, "utf8")).version;
+    const version2 = JSON.parse((0, import_node_fs13.readFileSync)(file2, "utf8")).version;
     return typeof version2 === "string" ? version2 : void 0;
   } catch {
     return void 0;
@@ -55788,7 +56298,7 @@ function writeSeam(root, decisions = DEFAULT_DECISIONS, framework = detectFramew
   const baseNotes = [...seam.notes, ...alsoNote === void 0 ? [] : [alsoNote]];
   const notes = baseNotes.length === 0 ? "" : `
 ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
-  if ((0, import_node_fs12.existsSync)(file2)) {
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return {
       target: "seam",
       action: "info",
@@ -55796,8 +56306,8 @@ ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
       note: withWarning(`${seam.ifPresent}${notes}`, outdated)
     };
   }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(file2, seam.content, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file2, seam.content, "utf8");
   return {
     target: "seam",
     action: outdated === void 0 ? "created" : "info",
@@ -55810,11 +56320,11 @@ function writeAlso(root, also) {
     return void 0;
   }
   const file2 = (0, import_node_path13.join)(root, ...also.file.split("/"));
-  if ((0, import_node_fs12.existsSync)(file2)) {
+  if ((0, import_node_fs13.existsSync)(file2)) {
     return also.ifPresent;
   }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(file2, also.content, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file2), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file2, also.content, "utf8");
   return `Wrote ${also.file} to register it.`;
 }
 function withWarning(note, warning) {
@@ -55918,7 +56428,7 @@ function planCutover(input) {
   const diagnostics = [];
   let variables = 0;
   for (const file2 of selected) {
-    const parsed = parseDotenv((0, import_node_fs12.readFileSync)((0, import_node_path13.join)(root, file2.name), "utf8"));
+    const parsed = parseDotenv((0, import_node_fs13.readFileSync)((0, import_node_path13.join)(root, file2.name), "utf8"));
     const fileRefs = refsForEntries(parsed.entries, file2.name, config2);
     adopted.push({ file: file2, entries: parsed.entries, refs: fileRefs, scope: scopeOf(file2) });
     refs.push(...fileRefs);
@@ -56163,11 +56673,11 @@ function dailyCommand(root) {
 }
 function devScript(root) {
   const file2 = (0, import_node_path13.join)(root, PACKAGE_FILE);
-  if (!(0, import_node_fs12.existsSync)(file2)) {
+  if (!(0, import_node_fs13.existsSync)(file2)) {
     return "dev";
   }
   try {
-    const scripts = JSON.parse((0, import_node_fs12.readFileSync)(file2, "utf8")).scripts;
+    const scripts = JSON.parse((0, import_node_fs13.readFileSync)(file2, "utf8")).scripts;
     if (scripts !== null && typeof scripts === "object" && !Array.isArray(scripts)) {
       const named = Object.keys(scripts);
       return ["dev", "start"].find((script) => named.includes(script)) ?? named[0] ?? "dev";
@@ -56536,14 +57046,14 @@ function configInEffect(cwd, environment) {
 function importDotenv(options) {
   const cwd = (0, import_node_path14.resolve)(options.cwd);
   const file2 = (0, import_node_path14.isAbsolute)(options.file) ? options.file : (0, import_node_path14.resolve)(cwd, options.file);
-  if (!(0, import_node_fs13.existsSync)(file2)) {
+  if (!(0, import_node_fs14.existsSync)(file2)) {
     throw new PenvError(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file2} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = parseDotenv((0, import_node_fs13.readFileSync)(file2, "utf8"));
+  const parsed = parseDotenv((0, import_node_fs14.readFileSync)(file2, "utf8"));
   const { config: config2, decisions } = configInEffect(cwd, environmentNamed(file2, options.environment));
   const source = displayPath3(cwd, file2);
   const named = scopeFromFilename(file2, config2);
@@ -56559,7 +57069,7 @@ function importDotenv(options) {
   const tree = localTree(project);
   writeEntries(tree, parsed.entries, refs, scope);
   const backup = `${file2}${BACKUP_SUFFIX}`;
-  (0, import_node_fs13.copyFileSync)(file2, backup);
+  (0, import_node_fs14.copyFileSync)(file2, backup);
   return {
     root: project.root,
     file: file2,
@@ -56892,7 +57402,7 @@ var listCommand = defineCommand({
 
 // src/commands/migrate.ts
 init_cjs_shims();
-var import_node_fs14 = require("fs");
+var import_node_fs15 = require("fs");
 var import_node_path15 = require("path");
 var import_promises2 = require("readline/promises");
 var OLD_GITIGNORE = `${PENV_DIR}/.gitignore`;
@@ -56910,7 +57420,7 @@ function planMigrate(cwd) {
     );
   }
   const creates = [];
-  if (entries.length > 0 && !(0, import_node_fs14.existsSync)(tree)) {
+  if (entries.length > 0 && !(0, import_node_fs15.existsSync)(tree)) {
     creates.push(`${RECORDS_PATH2}/`);
   }
   if (readIfPresent((0, import_node_path15.join)(root, ...STATE_GITIGNORE_PATH.split("/"))) !== renderStateGitignore(config2)) {
@@ -56923,16 +57433,16 @@ function planMigrate(cwd) {
       to: `${RECORDS_PATH2}/${entry}`
     })),
     creates,
-    removes: (0, import_node_fs14.existsSync)((0, import_node_path15.join)(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
+    removes: (0, import_node_fs15.existsSync)((0, import_node_path15.join)(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
   };
 }
 function readIfPresent(file2) {
-  return (0, import_node_fs14.existsSync)(file2) ? (0, import_node_fs14.readFileSync)(file2, "utf8") : void 0;
+  return (0, import_node_fs15.existsSync)(file2) ? (0, import_node_fs15.readFileSync)(file2, "utf8") : void 0;
 }
 function collidingEntries(entries, tree) {
   let held;
   try {
-    held = (0, import_node_fs14.readdirSync)(tree);
+    held = (0, import_node_fs15.readdirSync)(tree);
   } catch {
     return [];
   }
@@ -56951,18 +57461,18 @@ function applyMigrate(plan2) {
   }
   const { config: config2 } = loadConfig(plan2.root);
   if (plan2.moves.length > 0) {
-    (0, import_node_fs14.mkdirSync)(recordsDir(plan2.root), { recursive: true });
+    (0, import_node_fs15.mkdirSync)(recordsDir(plan2.root), { recursive: true });
     for (const move of plan2.moves) {
-      (0, import_node_fs14.renameSync)((0, import_node_path15.join)(plan2.root, ...move.from.split("/")), (0, import_node_path15.join)(plan2.root, ...move.to.split("/")));
+      (0, import_node_fs15.renameSync)((0, import_node_path15.join)(plan2.root, ...move.from.split("/")), (0, import_node_path15.join)(plan2.root, ...move.to.split("/")));
     }
   }
   if (plan2.creates.includes(STATE_GITIGNORE_PATH)) {
     const ignore = (0, import_node_path15.join)(plan2.root, ...STATE_GITIGNORE_PATH.split("/"));
-    (0, import_node_fs14.mkdirSync)((0, import_node_path15.dirname)(ignore), { recursive: true });
-    (0, import_node_fs14.writeFileSync)(ignore, renderStateGitignore(config2), "utf8");
+    (0, import_node_fs15.mkdirSync)((0, import_node_path15.dirname)(ignore), { recursive: true });
+    (0, import_node_fs15.writeFileSync)(ignore, renderStateGitignore(config2), "utf8");
   }
   for (const removed of plan2.removes) {
-    (0, import_node_fs14.rmSync)((0, import_node_path15.join)(plan2.root, ...removed.split("/")), { force: true });
+    (0, import_node_fs15.rmSync)((0, import_node_path15.join)(plan2.root, ...removed.split("/")), { force: true });
   }
   return { ...plan2, status: "migrated" };
 }
@@ -57439,7 +57949,7 @@ var rotateCommand = defineCommand({
 
 // src/commands/watch.ts
 init_cjs_shims();
-var import_node_fs15 = require("fs");
+var import_node_fs16 = require("fs");
 var import_node_path16 = require("path");
 var DEBOUNCE_MS2 = 100;
 function runWatch(options) {
@@ -57501,18 +58011,18 @@ function runWatch(options) {
     const name = (0, import_node_path16.basename)(target);
     let recovery;
     try {
-      recovery = (0, import_node_fs15.watch)(parent, { recursive: false }, (_event, filename) => {
+      recovery = (0, import_node_fs16.watch)(parent, { recursive: false }, (_event, filename) => {
         if (closed || recovery === void 0) {
           return;
         }
-        if (!(0, import_node_fs15.existsSync)(parent)) {
+        if (!(0, import_node_fs16.existsSync)(parent)) {
           stop2(recovery);
           return;
         }
         if (filename !== null && (0, import_node_path16.basename)(filename) !== name) {
           return;
         }
-        if (!(0, import_node_fs15.existsSync)(target)) {
+        if (!(0, import_node_fs16.existsSync)(target)) {
           return;
         }
         stop2(recovery);
@@ -57532,11 +58042,11 @@ function runWatch(options) {
   }
   function addWatcher(target, recursive, only) {
     let watcher;
-    const listen = (useRecursive) => (0, import_node_fs15.watch)(target, { recursive: useRecursive }, (_event, filename) => {
+    const listen = (useRecursive) => (0, import_node_fs16.watch)(target, { recursive: useRecursive }, (_event, filename) => {
       if (closed) {
         return;
       }
-      if (!(0, import_node_fs15.existsSync)(target)) {
+      if (!(0, import_node_fs16.existsSync)(target)) {
         if (watcher !== void 0) {
           stop2(watcher);
         }
@@ -57646,10 +58156,10 @@ var watchCommand = defineCommand({
         }
       });
       write([`Watching .penv/ and penv.config.ts. ${out.dim("Ctrl-C to stop.")}`]);
-      await new Promise((resolve12) => {
+      await new Promise((resolve13) => {
         process.once("SIGINT", () => {
           handle.close();
-          resolve12();
+          resolve13();
         });
       });
     });