@penvhq/cli 0.9.4 → 0.10.0

package/dist/index.js

@@ -325,8 +325,8 @@ function installFailed(plan2) {
 }
 
 // src/project.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { dirname, join as join4 } from "path";
 import {
   assertMigrated,
   candidatesFor,
@@ -406,10 +406,24 @@ function environmentFromShorthand(config, candidates, explicit) {
 }
 
 // src/registry.ts
+import { readFileSync as readFileSync2 } from "fs";
 import { createRequire } from "module";
-import { resolve } from "path";
+import { join as join3, resolve } from "path";
 import { pathToFileURL } from "url";
-import { holdsProjection, PENV_DIR, PenvError as PenvError4, recordsDir } from "@penvhq/core";
+import {
+  holdsProjection,
+  LOCAL_EXTENSIONS_PATH,
+  localExtensionsFile,
+  MANIFEST_PATH,
+  PENV_DIR,
+  PenvError as PenvError4,
+  packageDir,
+  packageEntry,
+  parseLocalExtensions,
+  parseManifest,
+  penvHome,
+  recordsDir
+} from "@penvhq/core";
 import { createFilesystemProvider } from "@penvhq/provider-filesystem";
 import { createMockProvider } from "@penvhq/provider-mock";
 var PLUGIN_FACTORY_EXPORT = "penvProviderFactory";
@@ -452,19 +466,12 @@ async function createSourceProvider(type, context) {
   return loadPluginProvider(type, context);
 }
 async function loadPluginProvider(type, context) {
-  const resolved = resolvePlugin(type, context.root);
-  if (resolved === void 0) {
-    throw unknownProvider(type, context.environment);
-  }
+  const path = resolveExtension(type, context.root, context.environment);
   let mod;
   try {
-    mod = await importPlugin(resolved);
-  } catch {
-    throw new PenvError4(
-      "PROVIDER_PLUGIN_LOAD",
-      `The provider package \`${type}\` failed to load`,
-      "It resolved but threw while importing. Check it builds and its dependencies are installed."
-    );
+    mod = await importPlugin(path);
+  } catch (cause) {
+    throw providerLoadFailed(type, path, cause);
   }
   const factory = mod[PLUGIN_FACTORY_EXPORT];
   if (typeof factory !== "function") {
@@ -478,15 +485,71 @@ async function loadPluginProvider(type, context) {
   assertSatisfiesContract(provider, type);
   return provider;
 }
-function assertProvidersRegistered(config, projectRoot) {
+function assertProvidersRegistered(config, projectRoot, options) {
+  const local = localExtensions(projectRoot);
+  const ci = options?.ci ?? isCi(process.env.CI);
   for (const [environment, provider] of Object.entries(config.providers)) {
     if (isProviderRegistered(provider.type)) {
       continue;
     }
-    if (resolvePlugin(provider.type, projectRoot) === void 0) {
-      throw unknownProvider(provider.type, environment);
+    if (ci && local.includes(provider.type)) {
+      throw localExtensionInCi(provider.type, environment);
     }
+    resolveExtension(provider.type, projectRoot, environment, local);
+  }
+}
+function resolveExtension(type, projectRoot, environment, local = localExtensions(projectRoot)) {
+  const fromProject = resolvePlugin(type, projectRoot);
+  if (local.includes(type)) {
+    if (fromProject === void 0) {
+      throw localExtensionUnresolved(type, projectRoot, environment);
+    }
+    return fromProject;
+  }
+  if (fromProject !== void 0) {
+    return fromProject;
+  }
+  const version = pinnedVersion(type, projectRoot);
+  if (version === void 0) {
+    throw unknownProvider(type, environment);
+  }
+  const stored = storedExtension(type, version);
+  if (stored === void 0) {
+    throw extensionNotInstalled(type, version, environment);
+  }
+  return stored;
+}
+function pinnedVersion(type, projectRoot) {
+  let manifest;
+  try {
+    manifest = parseManifest(readFileSync2(join3(projectRoot, ...MANIFEST_PATH.split("/")), "utf8"));
+  } catch {
+    return void 0;
+  }
+  return manifest.extensions[type]?.version;
+}
+function storedExtension(type, version) {
+  const entry = packageEntry(packageDir(penvHome(process.env), "extensions", type, version));
+  return entry?.file;
+}
+function localExtensions(projectRoot) {
+  let text;
+  try {
+    text = readFileSync2(localExtensionsFile(projectRoot), "utf8");
+  } catch {
+    return [];
   }
+  return parseLocalExtensions(text);
+}
+function isCi(value) {
+  return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+}
+function localExtensionInCi(type, environment) {
+  return new PenvError4(
+    "LOCAL_EXTENSION_IN_CI",
+    `The provider \`${type}\` for environment ${environment} is a local extension, and this is CI`,
+    `${LOCAL_EXTENSIONS_PATH} records it as a package this project develops, so nothing pins the bytes CI would run. Publish it and run \`penv add ${type}\` to pin a release.`
+  );
 }
 function resolvePlugin(specifier, fromDir) {
   try {
@@ -519,13 +582,37 @@ function assertSatisfiesContract(provider, specifier) {
     }
   }
 }
+function where(environment) {
+  return environment === void 0 ? "" : ` for environment ${environment}`;
+}
 function unknownProvider(type, environment) {
   const preinstalled = [...REGISTRY.keys()].map((name) => `\`${name}\``).join(", ");
-  const where = environment === void 0 ? "" : ` for environment ${environment}`;
   return new PenvError4(
     "UNKNOWN_PROVIDER",
-    `The provider \`${type}\`${where} in penv.config.ts is not installed in this project`,
-    `Install it with \`npm i ${type}\` \u2014 a provider's \`type\` is the package penv imports. The CLI ships ${preinstalled} pre-installed.`
+    `The provider \`${type}\`${where(environment)} in penv.config.ts is nowhere penv looks for it`,
+    `Run \`penv add ${type}\` to pin a release, or \`penv add --local ${type}\` if this repository is the one that builds it. penv looks in ${LOCAL_EXTENSIONS_PATH}, this project's node_modules, and then $PENV_HOME at the version ${MANIFEST_PATH} pins. The CLI ships ${preinstalled} pre-installed.`
+  );
+}
+function extensionNotInstalled(type, version, environment) {
+  return new PenvError4(
+    "EXTENSION_NOT_INSTALLED",
+    `${MANIFEST_PATH} pins \`${type}\` ${version}${where(environment)}, and it is not installed in ${penvHome(process.env)}`,
+    "Run `penv install` \u2014 it downloads and verifies every version the manifest pins, extensions included."
+  );
+}
+function localExtensionUnresolved(type, projectRoot, environment) {
+  return new PenvError4(
+    "LOCAL_EXTENSION_UNRESOLVED",
+    `${LOCAL_EXTENSIONS_PATH} records \`${type}\`${where(environment)} as a package this project develops, and it does not resolve from ${projectRoot}`,
+    `Add it as a dependency of the root (a workspace link is one) and run \`pnpm install\`, or drop the name from ${LOCAL_EXTENSIONS_PATH} if this project no longer builds it.`
+  );
+}
+function providerLoadFailed(type, path, cause) {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new PenvError4(
+    "PROVIDER_PLUGIN_LOAD",
+    `The provider package \`${type}\` failed to load from ${path}: ${detail}`,
+    "penv imports that file exactly as it stands, with no transform, so it has to be built JavaScript with its dependencies installed."
   );
 }
 
@@ -554,11 +641,11 @@ function localTree(project) {
   return project.provider;
 }
 function selfContainedSchemaModule(root, schemaFile) {
-  const file = join3(root, ...schemaFile.split("/"));
+  const file = join4(root, ...schemaFile.split("/"));
   if (!existsSync3(file)) {
     return void 0;
   }
-  const source = readFileSync2(file, "utf8");
+  const source = readFileSync3(file, "utf8");
   return source.includes("PenvSchemaShape") || source.includes("z.object") ? schemaFile : void 0;
 }
 function schemaShapeFileOf(project) {
@@ -794,10 +881,7 @@ function writeError(lines) {
 }
 function reportError(error) {
   if (error instanceof PenvError6) {
-    const suffix = error.remedy === void 0 ? void 0 : `
-  ${error.remedy}`;
-    const message = suffix !== void 0 && error.message.endsWith(suffix) ? error.message.slice(0, -suffix.length) : error.message;
-    process.stderr.write(`${err.red(CROSS)} ${message}
+    process.stderr.write(`${err.red(CROSS)} ${error.summary}
 `);
     if (error.remedy !== void 0) {
       process.stderr.write(`  ${err.cyan("\u2192")} ${error.remedy}
@@ -827,9 +911,9 @@ async function guard(run) {
 }
 
 // src/commands/run.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, watch } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, watch } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { basename, dirname as dirname2, join as join4, resolve as resolve2 } from "path";
+import { basename, dirname as dirname2, join as join5, resolve as resolve2 } from "path";
 import {
   ARTIFACT_BUILD_COMMAND,
   assertArtifactFor,
@@ -1669,10 +1753,10 @@ function packageManifest(specifier, root) {
     return void 0;
   }
   for (; ; ) {
-    const file = join4(directory, "package.json");
+    const file = join5(directory, "package.json");
     if (existsSync4(file)) {
       try {
-        const parsed = JSON.parse(readFileSync3(file, "utf8"));
+        const parsed = JSON.parse(readFileSync4(file, "utf8"));
         if (isPlainObject(parsed) && parsed.name === specifier) {
           return parsed;
         }
@@ -1745,7 +1829,7 @@ function snapshotPath(host) {
 }
 function readSnapshot(path) {
   try {
-    return readFileSync3(path, "utf8");
+    return readFileSync4(path, "utf8");
   } catch {
     throw new PenvError8(
       "RUN_SNAPSHOT_MISSING",
@@ -2166,12 +2250,12 @@ import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync2,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync,
   rmSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname4, join as join5, resolve as resolve4 } from "path";
+import { dirname as dirname4, join as join6, resolve as resolve4 } from "path";
 import {
   CUTOVER_PATH,
   findConfigFile,
@@ -2181,7 +2265,7 @@ import {
 } from "@penvhq/core";
 var CUTOVER_FORMAT = 1;
 function fileFor(root, relativePosix) {
-  return join5(root, ...relativePosix.split("/"));
+  return join6(root, ...relativePosix.split("/"));
 }
 function bundleDir(root) {
   return fileFor(root, ROLLBACK_DOTENV_PATH);
@@ -2210,7 +2294,7 @@ function readCutover(root) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(file, "utf8"));
+    parsed = JSON.parse(readFileSync5(file, "utf8"));
   } catch {
     throw unreadable("it is not JSON");
   }
@@ -2268,7 +2352,7 @@ function bundleDotenvFiles(root, files, environments, now = /* @__PURE__ */ new
   const bundle = bundleDir(root);
   mkdirSync2(bundle, { recursive: true });
   for (const name of files) {
-    renameSync(join5(root, name), join5(bundle, name));
+    renameSync(join6(root, name), join6(bundle, name));
   }
   return cutover;
 }
@@ -2287,7 +2371,7 @@ function runUndo(options) {
   const names = [...recorded, ...bundled.filter((name) => !recorded.includes(name))];
   const bundle = bundleDir(root);
   const held = new Set(bundled);
-  const occupied2 = names.filter((name) => held.has(name) && existsSync5(join5(root, name)));
+  const occupied2 = names.filter((name) => held.has(name) && existsSync5(join6(root, name)));
   if (occupied2.length > 0) {
     const listed = occupied2.join(", ");
     const many = occupied2.length > 1;
@@ -2302,9 +2386,9 @@ function runUndo(options) {
   const missing = [];
   for (const name of names) {
     if (held.has(name)) {
-      renameSync(join5(bundle, name), join5(root, name));
+      renameSync(join6(bundle, name), join6(root, name));
       restored.push(name);
-    } else if (existsSync5(join5(root, name))) {
+    } else if (existsSync5(join6(root, name))) {
       alreadyBack.push(name);
     } else {
       missing.push(name);
@@ -2357,8 +2441,8 @@ var cleanupCommand = defineCommand5({
 });
 
 // src/commands/doctor.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import { join as join6, relative as relative2 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import { join as join7, relative as relative2 } from "path";
 import {
   ARTIFACT_BUILD_COMMAND as ARTIFACT_BUILD_COMMAND2,
   accessPath as accessPath3,
@@ -2372,6 +2456,7 @@ import {
   isSecret as isSecret3,
   isStuck,
   openValue as openValue2,
+  RECORDS_PATH as RECORDS_PATH2,
   resolveAll as resolveAll2,
   rotationOf,
   tryParseDuration,
@@ -2827,6 +2912,7 @@ async function runDoctor(options) {
     findings.push(...unusedFindings(drift));
   }
   findings.push(...fallbackFindings(subjects, environment));
+  findings.push(...secrecyFindings(subjects, environment));
   findings.push(...plaintextSecretFindings(subjects, environment));
   findings.push(...publicSecretFindings(subjects, environment, project.config));
   findings.push(...encryptionFindings(subjects, environment));
@@ -2839,6 +2925,7 @@ async function runDoctor(options) {
   }
   findings.push(...await providerDriftFindings(project, environment, options.source));
   findings.push(...await projectionFindings(project, environment, options.projection));
+  findings.push(...localExtensionFindings(project));
   findings.push(...artifactFindings(project));
   findings.push({
     check: "provider",
@@ -2976,6 +3063,31 @@ function fallbackFindings(subjects, environment) {
     }
   ];
 }
+function secrecyFindings(subjects, environment) {
+  const undeclared = subjects.filter(
+    ({ meta }) => effectiveMeta(meta, environment).secret === void 0
+  );
+  if (undeclared.length === 0) {
+    return [
+      {
+        check: "secrecy-undeclared",
+        severity: "pass",
+        label: "Secrecy policy",
+        subject: subjects.length === 0 ? `no parameter resolves for ${environment}` : `every parameter declares whether it is secret for ${environment}`
+      }
+    ];
+  }
+  return [
+    {
+      check: "secrecy-undeclared",
+      severity: "unknown",
+      label: "Secrecy policy",
+      subject: `${undeclared.length} of ${subjects.length} declare neither way for ${environment}`,
+      detail: "penv was never told which of these values must be encrypted",
+      remedy: `declare \`"secret": true\` or \`"secret": false\` in a parameter's meta file, ${RECORDS_PATH2}/<name>.json`
+    }
+  ];
+}
 function plaintextSecretFindings(subjects, environment) {
   const secrets = subjects.filter(({ meta }) => isSecret3(meta, environment));
   const findings = [];
@@ -3284,7 +3396,7 @@ function scannableFiles(directory, out2) {
     return;
   }
   for (const entry of entries) {
-    const path = join6(directory, entry.name);
+    const path = join7(directory, entry.name);
     if (entry.isDirectory()) {
       if (!UNSCANNED_DIRS.has(entry.name)) {
         scannableFiles(path, out2);
@@ -3296,6 +3408,29 @@ function scannableFiles(directory, out2) {
     }
   }
 }
+function localExtensionFindings(project) {
+  const names = localExtensions(project.root);
+  if (names.length === 0) {
+    return [
+      {
+        check: "local-extension",
+        severity: "pass",
+        label: "Extensions",
+        subject: "every extension this project names is pinned"
+      }
+    ];
+  }
+  return [
+    {
+      check: "local-extension",
+      severity: "unknown",
+      label: "Extensions",
+      subject: names.join(", "),
+      detail: "resolved from this project's node_modules \u2014 no release, no pinned bytes",
+      remedy: `publish it and run \`penv add ${names[0]}\` when this stops being a development path`
+    }
+  ];
+}
 function artifactFindings(project) {
   const files = [];
   scannableFiles(project.root, files);
@@ -3306,7 +3441,7 @@ function artifactFindings(project) {
       if (statSync2(file).size > ARTIFACT_SCAN_LIMIT) {
         continue;
       }
-      text = readFileSync5(file, "utf8");
+      text = readFileSync6(file, "utf8");
     } catch {
       continue;
     }
@@ -4281,7 +4416,7 @@ var getCommand = defineCommand12({
 });
 
 // src/commands/import.ts
-import { copyFileSync, existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { copyFileSync, existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
 import { basename as basename2, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve7 } from "path";
 import {
   assertNever as assertNever2,
@@ -4316,9 +4451,9 @@ function assertImportable(ref, variable) {
     `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
   );
 }
-function assertNotReserved(ref, variable, where, config) {
+function assertNotReserved(ref, variable, where2, config) {
   if (isReservedToken3(ref.name, config)) {
-    throw new ReservedTokenError3("parameter", variable, where);
+    throw new ReservedTokenError3("parameter", variable, where2);
   }
 }
 function assertRoundTrips(ref, variable, config) {
@@ -4335,12 +4470,12 @@ function assertRoundTrips(ref, variable, config) {
     `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`override\` block of penv.config.ts \u2014 \`override: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
   );
 }
-function refsForEntries(entries, where, config) {
+function refsForEntries(entries, where2, config) {
   const refs = [];
   for (const entry of entries) {
     const ref = refFromVariable2(entry.key);
     assertImportable(ref, entry.key);
-    assertNotReserved(ref, entry.key, where, config);
+    assertNotReserved(ref, entry.key, where2, config);
     assertRoundTrips(ref, entry.key, config);
     refs.push(ref);
   }
@@ -4370,8 +4505,8 @@ function writeEntries(tree, entries, refs, scope) {
 }
 
 // src/detect.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 import { DEFAULT_SCHEMA_FILE } from "@penvhq/core";
 var SIGNATURES = [
   { name: "Next.js", packages: ["next"], publicPrefixes: ["NEXT_PUBLIC_"] },
@@ -4388,7 +4523,7 @@ var SIGNATURES = [
 function exportsSchema(file) {
   let source;
   try {
-    source = readFileSync6(file, "utf8");
+    source = readFileSync7(file, "utf8");
   } catch {
     return false;
   }
@@ -4399,7 +4534,7 @@ function exportsSchema(file) {
   );
 }
 function occupied(cwd, relative5) {
-  const file = join7(cwd, ...relative5.split("/"));
+  const file = join8(cwd, ...relative5.split("/"));
   return existsSync6(file) && !exportsSchema(file);
 }
 function schemaFileFor(cwd) {
@@ -4415,7 +4550,7 @@ function schemaFileFor(cwd) {
   return { file: DEFAULT_SCHEMA_FILE, displaced: preferred };
 }
 function srcPrefix(cwd) {
-  return existsSync6(join7(cwd, "src")) ? "src/" : "";
+  return existsSync6(join8(cwd, "src")) ? "src/" : "";
 }
 function dependenciesOf(cwd) {
   const manifest = manifestOf2(cwd);
@@ -4434,13 +4569,13 @@ function dependenciesOf(cwd) {
   return names;
 }
 function manifestOf2(cwd) {
-  const file = join7(cwd, "package.json");
+  const file = join8(cwd, "package.json");
   if (!existsSync6(file)) {
     return void 0;
   }
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync6(file, "utf8"));
+    manifest = JSON.parse(readFileSync7(file, "utf8"));
   } catch {
     return void 0;
   }
@@ -4456,7 +4591,7 @@ function detectFramework(cwd) {
       return detectedFrom(cwd, signature.name, signature.publicPrefixes);
     }
   }
-  if (existsSync6(join7(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
+  if (existsSync6(join8(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
     return detectedFrom(cwd, "Bun", []);
   }
   return void 0;
@@ -4535,8 +4670,8 @@ function draftFieldsAcross(sources, environments) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname6, join as join9, resolve as resolve6 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, join as join10, resolve as resolve6 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 import {
   CUTOVER_PATH as CUTOVER_PATH3,
@@ -4547,7 +4682,7 @@ import {
   PenvError as PenvError18,
   parameterId as parameterId6,
   parseDotenv,
-  RECORDS_PATH as RECORDS_PATH2,
+  RECORDS_PATH as RECORDS_PATH3,
   RESERVED_TOKENS as RESERVED_TOKENS2,
   ROLLBACK_DOTENV_PATH as ROLLBACK_DOTENV_PATH3,
   renderStateGitignore,
@@ -4564,13 +4699,13 @@ import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   rmdirSync,
   statSync as statSync3,
   unlinkSync,
   writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { dirname as dirname5, join as join9 } from "path";
 function record(path, files, dirs) {
   let stats;
   try {
@@ -4581,12 +4716,12 @@ function record(path, files, dirs) {
   if (stats.isDirectory()) {
     dirs.add(path);
     for (const entry of readdirSync4(path)) {
-      record(join8(path, entry), files, dirs);
+      record(join9(path, entry), files, dirs);
     }
     return;
   }
   if (stats.isFile()) {
-    files.set(path, readFileSync7(path));
+    files.set(path, readFileSync8(path));
   }
 }
 function captureScaffold(root, paths) {
@@ -4631,7 +4766,7 @@ function removeAdded(path, undo) {
     return;
   }
   for (const entry of readdirSync4(path)) {
-    removeAdded(join8(path, entry), undo);
+    removeAdded(join9(path, entry), undo);
   }
   if (!undo.dirs.has(path) && readdirSync4(path).length === 0) {
     rmdirSync(path);
@@ -4849,7 +4984,7 @@ function configOf(decisions) {
   return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
 }
 function declaredIn(root) {
-  const file = join9(root, CONFIG_FILE);
+  const file = join10(root, CONFIG_FILE);
   if (!existsSync8(file)) {
     return void 0;
   }
@@ -5300,7 +5435,7 @@ function ensurePenvDir(root) {
   return { target: "penv-dir", action: "created", text: `Created ${PENV_DIR2}/` };
 }
 function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
-  const file = join9(root, SCHEMA_SHAPE_FILE3);
+  const file = join10(root, SCHEMA_SHAPE_FILE3);
   if (existsSync8(file)) {
     return {
       target: "schema",
@@ -5327,7 +5462,7 @@ function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS
   };
 }
 function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
-  const file = join9(root, ...decisions.schemaFile.split("/"));
+  const file = join10(root, ...decisions.schemaFile.split("/"));
   if (existsSync8(file)) {
     return {
       target: "env",
@@ -5346,7 +5481,7 @@ function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
   };
 }
 function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
-  const file = join9(root, CONFIG_FILE);
+  const file = join10(root, CONFIG_FILE);
   if (existsSync8(file)) {
     return { target: "config", action: "kept", text: `Kept ${CONFIG_FILE}` };
   }
@@ -5356,8 +5491,8 @@ function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
 function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   const alias = decisions.alias;
   const imports = alias.startsWith(IMPORTS_PREFIX);
-  const file = join9(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
-  const where = imports ? PACKAGE_FILE : TSCONFIG_FILE;
+  const file = join10(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
+  const where2 = imports ? PACKAGE_FILE : TSCONFIG_FILE;
   if (!existsSync8(file)) {
     if (imports) {
       return {
@@ -5374,13 +5509,13 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
       text: `Created ${TSCONFIG_FILE} with the ${alias} path alias`
     };
   }
-  const source = readFileSync8(file, "utf8");
+  const source = readFileSync9(file, "utf8");
   const edit = imports ? insertImportsAlias(source, decisions.schemaFile, alias) : insertEnvAlias(source, decisions.schemaFile, alias);
   if (edit.conflict !== void 0) {
     return {
       target: "tsconfig",
       action: "conflicted",
-      text: `${where} already maps ${alias} to ${edit.conflict}`,
+      text: `${where2} already maps ${alias} to ${edit.conflict}`,
       note: `(left alone \u2014 \`import { env } from "${alias}"\` will not reach ${decisions.schemaFile})`
     };
   }
@@ -5388,20 +5523,20 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
     return {
       target: "tsconfig",
       action: "kept",
-      text: `Kept the ${alias} alias in ${where}`
+      text: `Kept the ${alias} alias in ${where2}`
     };
   }
   writeFileSync5(file, edit.source, "utf8");
   return {
     target: "tsconfig",
     action: "updated",
-    text: `Added ${alias} alias to ${where}`
+    text: `Added ${alias} alias to ${where2}`
   };
 }
 function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
-  const file = join9(root, ...STATE_GITIGNORE_PATH.split("/"));
+  const file = join10(root, ...STATE_GITIGNORE_PATH.split("/"));
   const wanted = renderStateGitignore(configOf(decisions));
-  const existing = existsSync8(file) ? readFileSync8(file, "utf8") : void 0;
+  const existing = existsSync8(file) ? readFileSync9(file, "utf8") : void 0;
   if (existing === wanted) {
     return { target: "gitignore", action: "kept", text: `Kept ${STATE_GITIGNORE_PATH}` };
   }
@@ -5422,12 +5557,12 @@ function outdatedRuntimeWarning(root) {
   return `Injection needs @penvhq/penv ${INJECT_MIN_VERSION}+ \u2014 this project has ${version}, whose \`load\` ignores \`{ inject: true }\`. Upgrade, or process.env stays empty.`;
 }
 function installedPenvVersion(root) {
-  const file = join9(root, "node_modules", "@penvhq", "penv", "package.json");
+  const file = join10(root, "node_modules", "@penvhq", "penv", "package.json");
   if (!existsSync8(file)) {
     return void 0;
   }
   try {
-    const version = JSON.parse(readFileSync8(file, "utf8")).version;
+    const version = JSON.parse(readFileSync9(file, "utf8")).version;
     return typeof version === "string" ? version : void 0;
   } catch {
     return void 0;
@@ -5467,7 +5602,7 @@ function writeSeam(root, decisions = DEFAULT_DECISIONS, framework = detectFramew
     };
   }
   const alsoNote = writeAlso(root, seam.also);
-  const file = join9(root, ...seam.file.split("/"));
+  const file = join10(root, ...seam.file.split("/"));
   const baseNotes = [...seam.notes, ...alsoNote === void 0 ? [] : [alsoNote]];
   const notes = baseNotes.length === 0 ? "" : `
 ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
@@ -5492,7 +5627,7 @@ function writeAlso(root, also) {
   if (also === void 0) {
     return void 0;
   }
-  const file = join9(root, ...also.file.split("/"));
+  const file = join10(root, ...also.file.split("/"));
   if (existsSync8(file)) {
     return also.ifPresent;
   }
@@ -5523,7 +5658,7 @@ function scaffold(root, fields, draft, decisions = DEFAULT_DECISIONS, framework
   return seam === void 0 ? steps : [...steps, seam];
 }
 function scaffoldPaths(root, decisions = DEFAULT_DECISIONS, framework = detectFramework(root)?.name) {
-  const fileAt = (relative5) => join9(root, ...relative5.split("/"));
+  const fileAt = (relative5) => join10(root, ...relative5.split("/"));
   const seam = decisions.inject ? seamFor(framework, {
     alias: decisions.alias,
     srcDir: srcPrefix(root),
@@ -5601,7 +5736,7 @@ function planCutover(input) {
   const diagnostics = [];
   let variables = 0;
   for (const file of selected) {
-    const parsed = parseDotenv(readFileSync8(join9(root, file.name), "utf8"));
+    const parsed = parseDotenv(readFileSync9(join10(root, file.name), "utf8"));
     const fileRefs = refsForEntries(parsed.entries, file.name, config);
     adopted.push({ file, entries: parsed.entries, refs: fileRefs, scope: scopeOf(file) });
     refs.push(...fileRefs);
@@ -5789,7 +5924,7 @@ function renderCutoverPlan(plan2) {
   ]);
   rows.push([
     `  ${out.dim("values")}`,
-    `${RECORDS_PATH2}/`,
+    `${RECORDS_PATH3}/`,
     out.dim(`\u2190 from ${plan2.variables} variables`)
   ]);
   rows.push([
@@ -5825,7 +5960,7 @@ function renderCutover(result2) {
     {
       glyph: CHECK,
       text: `Imported ${plan2.fields.length} parameters`,
-      note: `into ${RECORDS_PATH2}/`
+      note: `into ${RECORDS_PATH3}/`
     },
     { glyph: CHECK, text: `Validated ${result2.validated.join(", ")}` },
     {
@@ -5845,12 +5980,12 @@ function dailyCommand(root) {
   return `penv run -- ${detectPackageManager(root)} ${devScript(root)}`;
 }
 function devScript(root) {
-  const file = join9(root, PACKAGE_FILE);
+  const file = join10(root, PACKAGE_FILE);
   if (!existsSync8(file)) {
     return "dev";
   }
   try {
-    const scripts = JSON.parse(readFileSync8(file, "utf8")).scripts;
+    const scripts = JSON.parse(readFileSync9(file, "utf8")).scripts;
     if (scripts !== null && typeof scripts === "object" && !Array.isArray(scripts)) {
       const named = Object.keys(scripts);
       return ["dev", "start"].find((script) => named.includes(script)) ?? named[0] ?? "dev";
@@ -6084,7 +6219,7 @@ function runUndoAction(root, action) {
     ]),
     "",
     result2.missing.length === 0 ? `${out.green(CHECK)} ${out.bold("Undone.")} Your dotenv files are back exactly as they were, and ${CUTOVER_PATH3} is gone.` : `${out.yellow(WARN)} ${out.bold("Undone as far as penv could.")} Everything still in the bundle is back, and ${CUTOVER_PATH3} is gone.`,
-    `penv's records are still in ${RECORDS_PATH2}/ \u2014 nothing penv scaffolded is yours to lose.`
+    `penv's records are still in ${RECORDS_PATH3}/ \u2014 nothing penv scaffolded is yours to lose.`
   ]);
 }
 
@@ -6226,7 +6361,7 @@ function importDotenv(options) {
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = parseDotenv2(readFileSync9(file, "utf8"));
+  const parsed = parseDotenv2(readFileSync10(file, "utf8"));
   const { config, decisions } = configInEffect(cwd, environmentNamed(file, options.environment));
   const source = displayPath3(cwd, file);
   const named = scopeFromFilename(file, config);
@@ -6497,7 +6632,7 @@ var keyCommand = defineCommand15({
 });
 
 // src/commands/list.ts
-import { assertNever as assertNever3, RECORDS_PATH as RECORDS_PATH3, resolveAll as resolveAll3, variableName as variableName8 } from "@penvhq/core";
+import { assertNever as assertNever3, RECORDS_PATH as RECORDS_PATH4, resolveAll as resolveAll3, variableName as variableName8 } from "@penvhq/core";
 import { defineCommand as defineCommand16 } from "citty";
 function scopeLabel2(scope) {
   switch (scope.kind) {
@@ -6541,7 +6676,7 @@ function paintScope(entry) {
 function renderList(result2) {
   if (result2.parameters.length === 0) {
     return [
-      `No parameters in ${RECORDS_PATH3}/ for environment ${result2.environment}.`,
+      `No parameters in ${RECORDS_PATH4}/ for environment ${result2.environment}.`,
       tip(`penv set <key> --env ${result2.environment}`)
     ];
   }
@@ -6580,19 +6715,19 @@ import {
   existsSync as existsSync10,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync as renameSync2,
   rmSync as rmSync2,
   writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
+import { dirname as dirname7, join as join11 } from "path";
 import { createInterface as createInterface3 } from "readline/promises";
 import {
   loadConfig as loadConfig2,
   oldLayoutEntries,
   PENV_DIR as PENV_DIR3,
   PenvError as PenvError22,
-  RECORDS_PATH as RECORDS_PATH4,
+  RECORDS_PATH as RECORDS_PATH5,
   recordsDir as recordsDir3,
   renderStateGitignore as renderStateGitignore2,
   STATE_GITIGNORE_PATH as STATE_GITIGNORE_PATH2
@@ -6608,29 +6743,29 @@ function planMigrate(cwd) {
   if (collisions.length > 0) {
     throw new PenvError22(
       "HALF_MIGRATED",
-      `${describe2(collisions)} in both \`${PENV_DIR3}/\` and \`${RECORDS_PATH4}/\`, and penv cannot tell which copy is current`,
-      `Move what is left under \`${PENV_DIR3}/\` into \`${RECORDS_PATH4}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
+      `${describe2(collisions)} in both \`${PENV_DIR3}/\` and \`${RECORDS_PATH5}/\`, and penv cannot tell which copy is current`,
+      `Move what is left under \`${PENV_DIR3}/\` into \`${RECORDS_PATH5}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
     );
   }
   const creates = [];
   if (entries.length > 0 && !existsSync10(tree)) {
-    creates.push(`${RECORDS_PATH4}/`);
+    creates.push(`${RECORDS_PATH5}/`);
   }
-  if (readIfPresent(join10(root, ...STATE_GITIGNORE_PATH2.split("/"))) !== renderStateGitignore2(config)) {
+  if (readIfPresent(join11(root, ...STATE_GITIGNORE_PATH2.split("/"))) !== renderStateGitignore2(config)) {
     creates.push(STATE_GITIGNORE_PATH2);
   }
   return {
     root,
     moves: entries.map((entry) => ({
       from: `${PENV_DIR3}/${entry}`,
-      to: `${RECORDS_PATH4}/${entry}`
+      to: `${RECORDS_PATH5}/${entry}`
     })),
     creates,
-    removes: existsSync10(join10(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
+    removes: existsSync10(join11(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
   };
 }
 function readIfPresent(file) {
-  return existsSync10(file) ? readFileSync10(file, "utf8") : void 0;
+  return existsSync10(file) ? readFileSync11(file, "utf8") : void 0;
 }
 function collidingEntries(entries, tree) {
   let held;
@@ -6656,16 +6791,16 @@ function applyMigrate(plan2) {
   if (plan2.moves.length > 0) {
     mkdirSync5(recordsDir3(plan2.root), { recursive: true });
     for (const move of plan2.moves) {
-      renameSync2(join10(plan2.root, ...move.from.split("/")), join10(plan2.root, ...move.to.split("/")));
+      renameSync2(join11(plan2.root, ...move.from.split("/")), join11(plan2.root, ...move.to.split("/")));
     }
   }
   if (plan2.creates.includes(STATE_GITIGNORE_PATH2)) {
-    const ignore = join10(plan2.root, ...STATE_GITIGNORE_PATH2.split("/"));
+    const ignore = join11(plan2.root, ...STATE_GITIGNORE_PATH2.split("/"));
     mkdirSync5(dirname7(ignore), { recursive: true });
     writeFileSync6(ignore, renderStateGitignore2(config), "utf8");
   }
   for (const removed of plan2.removes) {
-    rmSync2(join10(plan2.root, ...removed.split("/")), { force: true });
+    rmSync2(join11(plan2.root, ...removed.split("/")), { force: true });
   }
   return { ...plan2, status: "migrated" };
 }
@@ -6678,7 +6813,7 @@ function runMigrate(options) {
 }
 function renderMigrate(result2) {
   if (result2.status === "current") {
-    return [`${out.green(CHECK)} Already on ${RECORDS_PATH4}/ \u2014 nothing to migrate.`];
+    return [`${out.green(CHECK)} Already on ${RECORDS_PATH5}/ \u2014 nothing to migrate.`];
   }
   const done = result2.status === "migrated";
   const glyph = done ? CHECK : "\u2192";
@@ -6719,7 +6854,7 @@ async function approveOnTty() {
 var migrateCommand = defineCommand17({
   meta: {
     name: "migrate",
-    description: `Move a project written under an earlier layout to ${RECORDS_PATH4}/`
+    description: `Move a project written under an earlier layout to ${RECORDS_PATH5}/`
   },
   args: {
     yes: { type: "boolean", description: "Apply the previewed move without asking" }