@penvhq/cli 0.9.4 → 0.9.5

package/dist/index.cjs

@@ -69,7 +69,7 @@ var import_core35 = require("@penvhq/core");
 var import_citty22 = require("citty");
 
 // src/commands/artifact.ts
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_node_path7 = require("path");
 var import_core12 = require("@penvhq/core");
 var import_runtime2 = require("@penvhq/runtime");
@@ -381,7 +381,7 @@ function installFailed(plan2) {
 }
 
 // src/project.ts
-var import_node_fs3 = require("fs");
+var import_node_fs4 = require("fs");
 var import_node_path4 = require("path");
 var import_core5 = require("@penvhq/core");
 var import_provider_filesystem2 = require("@penvhq/provider-filesystem");
@@ -445,6 +445,7 @@ function environmentFromShorthand(config, candidates, explicit) {
 }
 
 // src/registry.ts
+var import_node_fs3 = require("fs");
 var import_node_module = require("module");
 var import_node_path3 = require("path");
 var import_node_url = require("url");
@@ -517,16 +518,40 @@ async function loadPluginProvider(type, context) {
   assertSatisfiesContract(provider, type);
   return provider;
 }
-function assertProvidersRegistered(config, projectRoot) {
+function assertProvidersRegistered(config, projectRoot, options) {
+  const local = localExtensions(projectRoot);
+  const ci = options?.ci ?? isCi(process.env.CI);
   for (const [environment, provider] of Object.entries(config.providers)) {
     if (isProviderRegistered(provider.type)) {
       continue;
     }
+    if (ci && local.includes(provider.type)) {
+      throw localExtensionInCi(provider.type, environment);
+    }
     if (resolvePlugin(provider.type, projectRoot) === void 0) {
       throw unknownProvider(provider.type, environment);
     }
   }
 }
+function localExtensions(projectRoot) {
+  let text;
+  try {
+    text = (0, import_node_fs3.readFileSync)((0, import_core4.localExtensionsFile)(projectRoot), "utf8");
+  } catch {
+    return [];
+  }
+  return (0, import_core4.parseLocalExtensions)(text);
+}
+function isCi(value) {
+  return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+}
+function localExtensionInCi(type, environment) {
+  return new import_core4.PenvError(
+    "LOCAL_EXTENSION_IN_CI",
+    `The provider \`${type}\` for environment ${environment} is a local extension, and this is CI`,
+    `${import_core4.LOCAL_EXTENSIONS_PATH} records it as a package this project develops, so nothing pins the bytes CI would run. Publish it and run \`penv add ${type}\` to pin a release.`
+  );
+}
 function resolvePlugin(specifier, fromDir) {
   try {
     const require2 = (0, import_node_module.createRequire)((0, import_node_path3.resolve)(fromDir, "noop.js"));
@@ -564,7 +589,7 @@ function unknownProvider(type, environment) {
   return new import_core4.PenvError(
     "UNKNOWN_PROVIDER",
     `The provider \`${type}\`${where} in penv.config.ts is not installed in this project`,
-    `Install it with \`npm i ${type}\` \u2014 a provider's \`type\` is the package penv imports. The CLI ships ${preinstalled} pre-installed.`
+    `A provider's \`type\` is the package penv imports, so it has to resolve from this project: install it with \`npm i ${type}\`, or \u2014 if this repository is the one that builds it \u2014 run \`penv add --local ${type}\` once it is a dependency of the root. The CLI ships ${preinstalled} pre-installed.`
   );
 }
 
@@ -594,10 +619,10 @@ function localTree(project) {
 }
 function selfContainedSchemaModule(root, schemaFile) {
   const file = (0, import_node_path4.join)(root, ...schemaFile.split("/"));
-  if (!(0, import_node_fs3.existsSync)(file)) {
+  if (!(0, import_node_fs4.existsSync)(file)) {
     return void 0;
   }
-  const source = (0, import_node_fs3.readFileSync)(file, "utf8");
+  const source = (0, import_node_fs4.readFileSync)(file, "utf8");
   return source.includes("PenvSchemaShape") || source.includes("z.object") ? schemaFile : void 0;
 }
 function schemaShapeFileOf(project) {
@@ -833,10 +858,7 @@ function writeError(lines) {
 }
 function reportError(error) {
   if (error instanceof import_core6.PenvError) {
-    const suffix = error.remedy === void 0 ? void 0 : `
-  ${error.remedy}`;
-    const message = suffix !== void 0 && error.message.endsWith(suffix) ? error.message.slice(0, -suffix.length) : error.message;
-    process.stderr.write(`${err.red(CROSS)} ${message}
+    process.stderr.write(`${err.red(CROSS)} ${error.summary}
 `);
     if (error.remedy !== void 0) {
       process.stderr.write(`  ${err.cyan("\u2192")} ${error.remedy}
@@ -866,7 +888,7 @@ async function guard(run) {
 }
 
 // src/commands/run.ts
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_module2 = require("module");
 var import_node_path6 = require("path");
 var import_core11 = require("@penvhq/core");
@@ -874,7 +896,7 @@ var import_runtime = require("@penvhq/runtime");
 var import_citty3 = require("citty");
 
 // src/dotenv-files.ts
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var import_core7 = require("@penvhq/core");
 var SHARED = ".env";
 var LOCAL = "local";
@@ -934,7 +956,7 @@ function order(file) {
 function discoverDotenvFiles(root) {
   let entries;
   try {
-    entries = (0, import_node_fs4.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+    entries = (0, import_node_fs5.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
   } catch {
     return [];
   }
@@ -1671,9 +1693,9 @@ function packageManifest(specifier, root) {
   }
   for (; ; ) {
     const file = (0, import_node_path6.join)(directory, "package.json");
-    if ((0, import_node_fs5.existsSync)(file)) {
+    if ((0, import_node_fs6.existsSync)(file)) {
       try {
-        const parsed = JSON.parse((0, import_node_fs5.readFileSync)(file, "utf8"));
+        const parsed = JSON.parse((0, import_node_fs6.readFileSync)(file, "utf8"));
         if (isPlainObject(parsed) && parsed.name === specifier) {
           return parsed;
         }
@@ -1746,7 +1768,7 @@ function snapshotPath(host) {
 }
 function readSnapshot(path) {
   try {
-    return (0, import_node_fs5.readFileSync)(path, "utf8");
+    return (0, import_node_fs6.readFileSync)(path, "utf8");
   } catch {
     throw new import_core11.PenvError(
       "RUN_SNAPSHOT_MISSING",
@@ -1825,11 +1847,11 @@ function watchProject(project, onChange) {
     timer = setTimeout(onChange, DEBOUNCE_MS);
   };
   const add = (target, recursive, only) => {
-    if (!(0, import_node_fs5.existsSync)(target)) {
+    if (!(0, import_node_fs6.existsSync)(target)) {
       return;
     }
     try {
-      const watcher = (0, import_node_fs5.watch)(target, { recursive }, (_event, filename) => {
+      const watcher = (0, import_node_fs6.watch)(target, { recursive }, (_event, filename) => {
         if (only !== void 0 && (filename === null || (0, import_node_path6.basename)(filename) !== only)) {
           return;
         }
@@ -2092,8 +2114,8 @@ ${lines}`,
     keySource: (0, import_core12.keySourceIdentifier)(project.config, environment),
     values
   };
-  (0, import_node_fs6.mkdirSync)((0, import_node_path7.dirname)(file), { recursive: true });
-  (0, import_node_fs6.writeFileSync)(file, (0, import_core12.serializeArtifact)(artifact), "utf8");
+  (0, import_node_fs7.mkdirSync)((0, import_node_path7.dirname)(file), { recursive: true });
+  (0, import_node_fs7.writeFileSync)(file, (0, import_core12.serializeArtifact)(artifact), "utf8");
   const inside = (0, import_node_path7.relative)(project.root, file);
   return {
     file,
@@ -2163,7 +2185,7 @@ var import_core14 = require("@penvhq/core");
 var import_citty5 = require("citty");
 
 // src/cutover.ts
-var import_node_fs7 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_path8 = require("path");
 var import_core13 = require("@penvhq/core");
 var CUTOVER_FORMAT = 1;
@@ -2182,7 +2204,7 @@ function cutoverRoot(cwd) {
 }
 function bundledFiles(root) {
   try {
-    return (0, import_node_fs7.readdirSync)(bundleDir(root)).sort();
+    return (0, import_node_fs8.readdirSync)(bundleDir(root)).sort();
   } catch {
     return [];
   }
@@ -2192,12 +2214,12 @@ function bundleUnresolved(root) {
 }
 function readCutover(root) {
   const file = cutoverFile(root);
-  if (!(0, import_node_fs7.existsSync)(file)) {
+  if (!(0, import_node_fs8.existsSync)(file)) {
     return void 0;
   }
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs7.readFileSync)(file, "utf8"));
+    parsed = JSON.parse((0, import_node_fs8.readFileSync)(file, "utf8"));
   } catch {
     throw unreadable("it is not JSON");
   }
@@ -2250,12 +2272,12 @@ function bundleDotenvFiles(root, files, environments, now = /* @__PURE__ */ new
     environments: [...environments]
   };
   const file = cutoverFile(root);
-  (0, import_node_fs7.mkdirSync)((0, import_node_path8.dirname)(file), { recursive: true });
-  (0, import_node_fs7.writeFileSync)(file, serializeCutover(cutover), "utf8");
+  (0, import_node_fs8.mkdirSync)((0, import_node_path8.dirname)(file), { recursive: true });
+  (0, import_node_fs8.writeFileSync)(file, serializeCutover(cutover), "utf8");
   const bundle = bundleDir(root);
-  (0, import_node_fs7.mkdirSync)(bundle, { recursive: true });
+  (0, import_node_fs8.mkdirSync)(bundle, { recursive: true });
   for (const name of files) {
-    (0, import_node_fs7.renameSync)((0, import_node_path8.join)(root, name), (0, import_node_path8.join)(bundle, name));
+    (0, import_node_fs8.renameSync)((0, import_node_path8.join)(root, name), (0, import_node_path8.join)(bundle, name));
   }
   return cutover;
 }
@@ -2274,7 +2296,7 @@ function runUndo(options) {
   const names = [...recorded, ...bundled.filter((name) => !recorded.includes(name))];
   const bundle = bundleDir(root);
   const held = new Set(bundled);
-  const occupied2 = names.filter((name) => held.has(name) && (0, import_node_fs7.existsSync)((0, import_node_path8.join)(root, name)));
+  const occupied2 = names.filter((name) => held.has(name) && (0, import_node_fs8.existsSync)((0, import_node_path8.join)(root, name)));
   if (occupied2.length > 0) {
     const listed = occupied2.join(", ");
     const many = occupied2.length > 1;
@@ -2289,9 +2311,9 @@ function runUndo(options) {
   const missing = [];
   for (const name of names) {
     if (held.has(name)) {
-      (0, import_node_fs7.renameSync)((0, import_node_path8.join)(bundle, name), (0, import_node_path8.join)(root, name));
+      (0, import_node_fs8.renameSync)((0, import_node_path8.join)(bundle, name), (0, import_node_path8.join)(root, name));
       restored.push(name);
-    } else if ((0, import_node_fs7.existsSync)((0, import_node_path8.join)(root, name))) {
+    } else if ((0, import_node_fs8.existsSync)((0, import_node_path8.join)(root, name))) {
       alreadyBack.push(name);
     } else {
       missing.push(name);
@@ -2303,13 +2325,13 @@ function runUndo(options) {
 function runCleanup(options) {
   const root = cutoverRoot(options.cwd);
   const held = bundledFiles(root);
-  const cleaned = held.length > 0 || (0, import_node_fs7.existsSync)(cutoverFile(root)) || (0, import_node_fs7.existsSync)(fileFor(root, import_core13.ROLLBACK_PATH));
+  const cleaned = held.length > 0 || (0, import_node_fs8.existsSync)(cutoverFile(root)) || (0, import_node_fs8.existsSync)(fileFor(root, import_core13.ROLLBACK_PATH));
   removeBundle(root);
   return { root, removed: held, cleaned };
 }
 function removeBundle(root) {
-  (0, import_node_fs7.rmSync)(fileFor(root, import_core13.ROLLBACK_PATH), { recursive: true, force: true });
-  (0, import_node_fs7.rmSync)(cutoverFile(root), { force: true });
+  (0, import_node_fs8.rmSync)(fileFor(root, import_core13.ROLLBACK_PATH), { recursive: true, force: true });
+  (0, import_node_fs8.rmSync)(cutoverFile(root), { force: true });
 }
 
 // src/commands/cleanup.ts
@@ -2344,7 +2366,7 @@ var cleanupCommand = (0, import_citty5.defineCommand)({
 });
 
 // src/commands/doctor.ts
-var import_node_fs8 = require("fs");
+var import_node_fs9 = require("fs");
 var import_node_path9 = require("path");
 var import_core16 = require("@penvhq/core");
 var import_citty7 = require("citty");
@@ -2790,6 +2812,7 @@ async function runDoctor(options) {
     findings.push(...unusedFindings(drift));
   }
   findings.push(...fallbackFindings(subjects, environment));
+  findings.push(...secrecyFindings(subjects, environment));
   findings.push(...plaintextSecretFindings(subjects, environment));
   findings.push(...publicSecretFindings(subjects, environment, project.config));
   findings.push(...encryptionFindings(subjects, environment));
@@ -2802,6 +2825,7 @@ async function runDoctor(options) {
   }
   findings.push(...await providerDriftFindings(project, environment, options.source));
   findings.push(...await projectionFindings(project, environment, options.projection));
+  findings.push(...localExtensionFindings(project));
   findings.push(...artifactFindings(project));
   findings.push({
     check: "provider",
@@ -2939,6 +2963,31 @@ function fallbackFindings(subjects, environment) {
     }
   ];
 }
+function secrecyFindings(subjects, environment) {
+  const undeclared = subjects.filter(
+    ({ meta }) => (0, import_core16.effectiveMeta)(meta, environment).secret === void 0
+  );
+  if (undeclared.length === 0) {
+    return [
+      {
+        check: "secrecy-undeclared",
+        severity: "pass",
+        label: "Secrecy policy",
+        subject: subjects.length === 0 ? `no parameter resolves for ${environment}` : `every parameter declares whether it is secret for ${environment}`
+      }
+    ];
+  }
+  return [
+    {
+      check: "secrecy-undeclared",
+      severity: "unknown",
+      label: "Secrecy policy",
+      subject: `${undeclared.length} of ${subjects.length} declare neither way for ${environment}`,
+      detail: "penv was never told which of these values must be encrypted",
+      remedy: `declare \`"secret": true\` or \`"secret": false\` in a parameter's meta file, ${import_core16.RECORDS_PATH}/<name>.json`
+    }
+  ];
+}
 function plaintextSecretFindings(subjects, environment) {
   const secrets = subjects.filter(({ meta }) => (0, import_core16.isSecret)(meta, environment));
   const findings = [];
@@ -3242,7 +3291,7 @@ function looksLikeArtifact(text) {
 function scannableFiles(directory, out2) {
   let entries;
   try {
-    entries = (0, import_node_fs8.readdirSync)(directory, { withFileTypes: true });
+    entries = (0, import_node_fs9.readdirSync)(directory, { withFileTypes: true });
   } catch {
     return;
   }
@@ -3259,6 +3308,29 @@ function scannableFiles(directory, out2) {
     }
   }
 }
+function localExtensionFindings(project) {
+  const names = localExtensions(project.root);
+  if (names.length === 0) {
+    return [
+      {
+        check: "local-extension",
+        severity: "pass",
+        label: "Extensions",
+        subject: "every extension this project names is pinned"
+      }
+    ];
+  }
+  return [
+    {
+      check: "local-extension",
+      severity: "unknown",
+      label: "Extensions",
+      subject: names.join(", "),
+      detail: "resolved from this project's node_modules \u2014 no release, no pinned bytes",
+      remedy: `publish it and run \`penv add ${names[0]}\` when this stops being a development path`
+    }
+  ];
+}
 function artifactFindings(project) {
   const files = [];
   scannableFiles(project.root, files);
@@ -3266,10 +3338,10 @@ function artifactFindings(project) {
   for (const file of files) {
     let text;
     try {
-      if ((0, import_node_fs8.statSync)(file).size > ARTIFACT_SCAN_LIMIT) {
+      if ((0, import_node_fs9.statSync)(file).size > ARTIFACT_SCAN_LIMIT) {
         continue;
       }
-      text = (0, import_node_fs8.readFileSync)(file, "utf8");
+      text = (0, import_node_fs9.readFileSync)(file, "utf8");
     } catch {
       continue;
     }
@@ -4029,7 +4101,7 @@ var fillCommand = (0, import_citty10.defineCommand)({
 });
 
 // src/commands/generate.ts
-var import_node_fs9 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_path10 = require("path");
 var import_core20 = require("@penvhq/core");
 var import_citty11 = require("citty");
@@ -4083,7 +4155,7 @@ function runGenerate(options) {
   const environment = targetEnvironment(project, options.environment, options.envFlags);
   const { entries, decrypted } = entriesFor(project, environment, options.allowDecrypt === true);
   const file = options.out === void 0 ? (0, import_node_path10.resolve)(project.root, DEFAULT_OUTPUT) : (0, import_node_path10.isAbsolute)(options.out) ? options.out : (0, import_node_path10.resolve)(options.cwd, options.out);
-  (0, import_node_fs9.writeFileSync)(file, (0, import_core20.serializeDotenv)(entries), "utf8");
+  (0, import_node_fs10.writeFileSync)(file, (0, import_core20.serializeDotenv)(entries), "utf8");
   return { file, environment, entries: entries.length, decrypted };
 }
 function displayPath2(cwd, file) {
@@ -4221,7 +4293,7 @@ var getCommand = (0, import_citty12.defineCommand)({
 });
 
 // src/commands/import.ts
-var import_node_fs13 = require("fs");
+var import_node_fs14 = require("fs");
 var import_node_path14 = require("path");
 var import_core26 = require("@penvhq/core");
 var import_citty14 = require("citty");
@@ -4292,7 +4364,7 @@ function writeEntries(tree, entries, refs, scope) {
 }
 
 // src/detect.ts
-var import_node_fs10 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_path11 = require("path");
 var import_core23 = require("@penvhq/core");
 var SIGNATURES = [
@@ -4310,7 +4382,7 @@ var SIGNATURES = [
 function exportsSchema(file) {
   let source;
   try {
-    source = (0, import_node_fs10.readFileSync)(file, "utf8");
+    source = (0, import_node_fs11.readFileSync)(file, "utf8");
   } catch {
     return false;
   }
@@ -4322,7 +4394,7 @@ function exportsSchema(file) {
 }
 function occupied(cwd, relative5) {
   const file = (0, import_node_path11.join)(cwd, ...relative5.split("/"));
-  return (0, import_node_fs10.existsSync)(file) && !exportsSchema(file);
+  return (0, import_node_fs11.existsSync)(file) && !exportsSchema(file);
 }
 function schemaFileFor(cwd) {
   const dir = srcPrefix(cwd);
@@ -4337,7 +4409,7 @@ function schemaFileFor(cwd) {
   return { file: import_core23.DEFAULT_SCHEMA_FILE, displaced: preferred };
 }
 function srcPrefix(cwd) {
-  return (0, import_node_fs10.existsSync)((0, import_node_path11.join)(cwd, "src")) ? "src/" : "";
+  return (0, import_node_fs11.existsSync)((0, import_node_path11.join)(cwd, "src")) ? "src/" : "";
 }
 function dependenciesOf(cwd) {
   const manifest = manifestOf2(cwd);
@@ -4357,12 +4429,12 @@ function dependenciesOf(cwd) {
 }
 function manifestOf2(cwd) {
   const file = (0, import_node_path11.join)(cwd, "package.json");
-  if (!(0, import_node_fs10.existsSync)(file)) {
+  if (!(0, import_node_fs11.existsSync)(file)) {
     return void 0;
   }
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs10.readFileSync)(file, "utf8"));
+    manifest = JSON.parse((0, import_node_fs11.readFileSync)(file, "utf8"));
   } catch {
     return void 0;
   }
@@ -4378,7 +4450,7 @@ function detectFramework(cwd) {
       return detectedFrom(cwd, signature.name, signature.publicPrefixes);
     }
   }
-  if ((0, import_node_fs10.existsSync)((0, import_node_path11.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
+  if ((0, import_node_fs11.existsSync)((0, import_node_path11.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
     return detectedFrom(cwd, "Bun", []);
   }
   return void 0;
@@ -4457,31 +4529,31 @@ function draftFieldsAcross(sources, environments) {
 }
 
 // src/commands/init.ts
-var import_node_fs12 = require("fs");
+var import_node_fs13 = require("fs");
 var import_node_path13 = require("path");
 var import_promises = require("readline/promises");
 var import_core25 = require("@penvhq/core");
 var import_citty13 = require("citty");
 
 // src/scaffold-undo.ts
-var import_node_fs11 = require("fs");
+var import_node_fs12 = require("fs");
 var import_node_path12 = require("path");
 function record(path, files, dirs) {
   let stats;
   try {
-    stats = (0, import_node_fs11.statSync)(path);
+    stats = (0, import_node_fs12.statSync)(path);
   } catch {
     return;
   }
   if (stats.isDirectory()) {
     dirs.add(path);
-    for (const entry of (0, import_node_fs11.readdirSync)(path)) {
+    for (const entry of (0, import_node_fs12.readdirSync)(path)) {
       record((0, import_node_path12.join)(path, entry), files, dirs);
     }
     return;
   }
   if (stats.isFile()) {
-    files.set(path, (0, import_node_fs11.readFileSync)(path));
+    files.set(path, (0, import_node_fs12.readFileSync)(path));
   }
 }
 function captureScaffold(root, paths) {
@@ -4489,7 +4561,7 @@ function captureScaffold(root, paths) {
   const dirs = /* @__PURE__ */ new Set();
   for (const path of paths) {
     for (let dir = (0, import_node_path12.dirname)(path); dir.startsWith(root) && dir !== root; dir = (0, import_node_path12.dirname)(dir)) {
-      if ((0, import_node_fs11.existsSync)(dir)) {
+      if ((0, import_node_fs12.existsSync)(dir)) {
         dirs.add(dir);
       }
     }
@@ -4505,31 +4577,31 @@ function restoreScaffold(undo) {
     pruneAncestors(path, undo);
   }
   for (const [file, contents] of undo.files) {
-    (0, import_node_fs11.mkdirSync)((0, import_node_path12.dirname)(file), { recursive: true });
-    (0, import_node_fs11.writeFileSync)(file, contents);
+    (0, import_node_fs12.mkdirSync)((0, import_node_path12.dirname)(file), { recursive: true });
+    (0, import_node_fs12.writeFileSync)(file, contents);
   }
 }
 function removeAdded(path, undo) {
   let stats;
   try {
-    stats = (0, import_node_fs11.statSync)(path);
+    stats = (0, import_node_fs12.statSync)(path);
   } catch {
     return;
   }
   if (stats.isFile()) {
     if (!undo.files.has(path)) {
-      (0, import_node_fs11.unlinkSync)(path);
+      (0, import_node_fs12.unlinkSync)(path);
     }
     return;
   }
   if (!stats.isDirectory()) {
     return;
   }
-  for (const entry of (0, import_node_fs11.readdirSync)(path)) {
+  for (const entry of (0, import_node_fs12.readdirSync)(path)) {
     removeAdded((0, import_node_path12.join)(path, entry), undo);
   }
-  if (!undo.dirs.has(path) && (0, import_node_fs11.readdirSync)(path).length === 0) {
-    (0, import_node_fs11.rmdirSync)(path);
+  if (!undo.dirs.has(path) && (0, import_node_fs12.readdirSync)(path).length === 0) {
+    (0, import_node_fs12.rmdirSync)(path);
   }
 }
 function pruneAncestors(path, undo) {
@@ -4538,7 +4610,7 @@ function pruneAncestors(path, undo) {
       return;
     }
     try {
-      (0, import_node_fs11.rmdirSync)(dir);
+      (0, import_node_fs12.rmdirSync)(dir);
     } catch {
       return;
     }
@@ -4700,7 +4772,7 @@ var NOT_ENVIRONMENTS2 = [...import_core25.RESERVED_TOKENS, "example", "sample",
 function suggestEnvironments(root) {
   let entries;
   try {
-    entries = (0, import_node_fs12.readdirSync)(root);
+    entries = (0, import_node_fs13.readdirSync)(root);
   } catch {
     return [];
   }
@@ -4745,7 +4817,7 @@ function configOf(decisions) {
 }
 function declaredIn(root) {
   const file = (0, import_node_path13.join)(root, CONFIG_FILE);
-  if (!(0, import_node_fs12.existsSync)(file)) {
+  if (!(0, import_node_fs13.existsSync)(file)) {
     return void 0;
   }
   return (0, import_core25.loadConfigFrom)(file);
@@ -5188,15 +5260,15 @@ function renderTsconfig(target, alias) {
 }
 function ensurePenvDir(root) {
   const dir = (0, import_node_path13.resolve)(root, import_core25.PENV_DIR);
-  if ((0, import_node_fs12.existsSync)(dir)) {
+  if ((0, import_node_fs13.existsSync)(dir)) {
     return { target: "penv-dir", action: "kept", text: `Found ${import_core25.PENV_DIR}/` };
   }
-  (0, import_node_fs12.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
   return { target: "penv-dir", action: "created", text: `Created ${import_core25.PENV_DIR}/` };
 }
 function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
   const file = (0, import_node_path13.join)(root, import_core25.SCHEMA_SHAPE_FILE);
-  if ((0, import_node_fs12.existsSync)(file)) {
+  if ((0, import_node_fs13.existsSync)(file)) {
     return {
       target: "schema",
       action: "kept",
@@ -5213,7 +5285,7 @@ function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS
       note: `(the shape lives there, from before the ${import_core25.SCHEMA_SHAPE_FILE} split \u2014 penv did not add a second one. To adopt the split: move the \`z.object\` (and any \`declare module\` block) into ${import_core25.SCHEMA_SHAPE_FILE}, leaving ${oldLayout} importing \`schema\` from it and calling \`load\`.)`
     };
   }
-  (0, import_node_fs12.writeFileSync)(file, renderSchemaShapeModule(fields, draft), "utf8");
+  (0, import_node_fs13.writeFileSync)(file, renderSchemaShapeModule(fields, draft), "utf8");
   return {
     target: "schema",
     action: "created",
@@ -5223,7 +5295,7 @@ function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS
 }
 function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
   const file = (0, import_node_path13.join)(root, ...decisions.schemaFile.split("/"));
-  if ((0, import_node_fs12.existsSync)(file)) {
+  if ((0, import_node_fs13.existsSync)(file)) {
     return {
       target: "env",
       action: "kept",
@@ -5231,8 +5303,8 @@ function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
       note: "(yours \u2014 penv never regenerates it)"
     };
   }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(file, renderEnvModule(decisions.schemaFile, decisions.inject), "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file, renderEnvModule(decisions.schemaFile, decisions.inject), "utf8");
   return {
     target: "env",
     action: "created",
@@ -5242,10 +5314,10 @@ function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
 }
 function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
   const file = (0, import_node_path13.join)(root, CONFIG_FILE);
-  if ((0, import_node_fs12.existsSync)(file)) {
+  if ((0, import_node_fs13.existsSync)(file)) {
     return { target: "config", action: "kept", text: `Kept ${CONFIG_FILE}` };
   }
-  (0, import_node_fs12.writeFileSync)(file, renderConfigModule(decisions), "utf8");
+  (0, import_node_fs13.writeFileSync)(file, renderConfigModule(decisions), "utf8");
   return { target: "config", action: "created", text: `Generated ${CONFIG_FILE}` };
 }
 function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
@@ -5253,7 +5325,7 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   const imports = alias.startsWith(IMPORTS_PREFIX);
   const file = (0, import_node_path13.join)(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
   const where = imports ? PACKAGE_FILE : TSCONFIG_FILE;
-  if (!(0, import_node_fs12.existsSync)(file)) {
+  if (!(0, import_node_fs13.existsSync)(file)) {
     if (imports) {
       return {
         target: "tsconfig",
@@ -5262,14 +5334,14 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
         note: `(run \`npm init\` first, or use \`--alias @env\` to alias through ${TSCONFIG_FILE})`
       };
     }
-    (0, import_node_fs12.writeFileSync)(file, renderTsconfig(decisions.schemaFile, alias), "utf8");
+    (0, import_node_fs13.writeFileSync)(file, renderTsconfig(decisions.schemaFile, alias), "utf8");
     return {
       target: "tsconfig",
       action: "created",
       text: `Created ${TSCONFIG_FILE} with the ${alias} path alias`
     };
   }
-  const source = (0, import_node_fs12.readFileSync)(file, "utf8");
+  const source = (0, import_node_fs13.readFileSync)(file, "utf8");
   const edit = imports ? insertImportsAlias(source, decisions.schemaFile, alias) : insertEnvAlias(source, decisions.schemaFile, alias);
   if (edit.conflict !== void 0) {
     return {
@@ -5286,7 +5358,7 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
       text: `Kept the ${alias} alias in ${where}`
     };
   }
-  (0, import_node_fs12.writeFileSync)(file, edit.source, "utf8");
+  (0, import_node_fs13.writeFileSync)(file, edit.source, "utf8");
   return {
     target: "tsconfig",
     action: "updated",
@@ -5296,12 +5368,12 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
 function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
   const file = (0, import_node_path13.join)(root, ...import_core25.STATE_GITIGNORE_PATH.split("/"));
   const wanted = (0, import_core25.renderStateGitignore)(configOf(decisions));
-  const existing = (0, import_node_fs12.existsSync)(file) ? (0, import_node_fs12.readFileSync)(file, "utf8") : void 0;
+  const existing = (0, import_node_fs13.existsSync)(file) ? (0, import_node_fs13.readFileSync)(file, "utf8") : void 0;
   if (existing === wanted) {
     return { target: "gitignore", action: "kept", text: `Kept ${import_core25.STATE_GITIGNORE_PATH}` };
   }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(file, wanted, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file, wanted, "utf8");
   return {
     target: "gitignore",
     action: existing === void 0 ? "created" : "updated",
@@ -5318,11 +5390,11 @@ function outdatedRuntimeWarning(root) {
 }
 function installedPenvVersion(root) {
   const file = (0, import_node_path13.join)(root, "node_modules", "@penvhq", "penv", "package.json");
-  if (!(0, import_node_fs12.existsSync)(file)) {
+  if (!(0, import_node_fs13.existsSync)(file)) {
     return void 0;
   }
   try {
-    const version = JSON.parse((0, import_node_fs12.readFileSync)(file, "utf8")).version;
+    const version = JSON.parse((0, import_node_fs13.readFileSync)(file, "utf8")).version;
     return typeof version === "string" ? version : void 0;
   } catch {
     return void 0;
@@ -5366,7 +5438,7 @@ function writeSeam(root, decisions = DEFAULT_DECISIONS, framework = detectFramew
   const baseNotes = [...seam.notes, ...alsoNote === void 0 ? [] : [alsoNote]];
   const notes = baseNotes.length === 0 ? "" : `
 ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
-  if ((0, import_node_fs12.existsSync)(file)) {
+  if ((0, import_node_fs13.existsSync)(file)) {
     return {
       target: "seam",
       action: "info",
@@ -5374,8 +5446,8 @@ ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
       note: withWarning(`${seam.ifPresent}${notes}`, outdated)
     };
   }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(file, seam.content, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file, seam.content, "utf8");
   return {
     target: "seam",
     action: outdated === void 0 ? "created" : "info",
@@ -5388,11 +5460,11 @@ function writeAlso(root, also) {
     return void 0;
   }
   const file = (0, import_node_path13.join)(root, ...also.file.split("/"));
-  if ((0, import_node_fs12.existsSync)(file)) {
+  if ((0, import_node_fs13.existsSync)(file)) {
     return also.ifPresent;
   }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(file, also.content, "utf8");
+  (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(file, also.content, "utf8");
   return `Wrote ${also.file} to register it.`;
 }
 function withWarning(note, warning) {
@@ -5496,7 +5568,7 @@ function planCutover(input) {
   const diagnostics = [];
   let variables = 0;
   for (const file of selected) {
-    const parsed = (0, import_core25.parseDotenv)((0, import_node_fs12.readFileSync)((0, import_node_path13.join)(root, file.name), "utf8"));
+    const parsed = (0, import_core25.parseDotenv)((0, import_node_fs13.readFileSync)((0, import_node_path13.join)(root, file.name), "utf8"));
     const fileRefs = refsForEntries(parsed.entries, file.name, config);
     adopted.push({ file, entries: parsed.entries, refs: fileRefs, scope: scopeOf(file) });
     refs.push(...fileRefs);
@@ -5741,11 +5813,11 @@ function dailyCommand(root) {
 }
 function devScript(root) {
   const file = (0, import_node_path13.join)(root, PACKAGE_FILE);
-  if (!(0, import_node_fs12.existsSync)(file)) {
+  if (!(0, import_node_fs13.existsSync)(file)) {
     return "dev";
   }
   try {
-    const scripts = JSON.parse((0, import_node_fs12.readFileSync)(file, "utf8")).scripts;
+    const scripts = JSON.parse((0, import_node_fs13.readFileSync)(file, "utf8")).scripts;
     if (scripts !== null && typeof scripts === "object" && !Array.isArray(scripts)) {
       const named = Object.keys(scripts);
       return ["dev", "start"].find((script) => named.includes(script)) ?? named[0] ?? "dev";
@@ -6114,14 +6186,14 @@ function configInEffect(cwd, environment) {
 function importDotenv(options) {
   const cwd = (0, import_node_path14.resolve)(options.cwd);
   const file = (0, import_node_path14.isAbsolute)(options.file) ? options.file : (0, import_node_path14.resolve)(cwd, options.file);
-  if (!(0, import_node_fs13.existsSync)(file)) {
+  if (!(0, import_node_fs14.existsSync)(file)) {
     throw new import_core26.PenvError(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = (0, import_core26.parseDotenv)((0, import_node_fs13.readFileSync)(file, "utf8"));
+  const parsed = (0, import_core26.parseDotenv)((0, import_node_fs14.readFileSync)(file, "utf8"));
   const { config, decisions } = configInEffect(cwd, environmentNamed(file, options.environment));
   const source = displayPath3(cwd, file);
   const named = scopeFromFilename(file, config);
@@ -6137,7 +6209,7 @@ function importDotenv(options) {
   const tree = localTree(project);
   writeEntries(tree, parsed.entries, refs, scope);
   const backup = `${file}${BACKUP_SUFFIX}`;
-  (0, import_node_fs13.copyFileSync)(file, backup);
+  (0, import_node_fs14.copyFileSync)(file, backup);
   return {
     root: project.root,
     file,
@@ -6472,7 +6544,7 @@ var listCommand = (0, import_citty16.defineCommand)({
 });
 
 // src/commands/migrate.ts
-var import_node_fs14 = require("fs");
+var import_node_fs15 = require("fs");
 var import_node_path15 = require("path");
 var import_promises2 = require("readline/promises");
 var import_core30 = require("@penvhq/core");
@@ -6492,7 +6564,7 @@ function planMigrate(cwd) {
     );
   }
   const creates = [];
-  if (entries.length > 0 && !(0, import_node_fs14.existsSync)(tree)) {
+  if (entries.length > 0 && !(0, import_node_fs15.existsSync)(tree)) {
     creates.push(`${import_core30.RECORDS_PATH}/`);
   }
   if (readIfPresent((0, import_node_path15.join)(root, ...import_core30.STATE_GITIGNORE_PATH.split("/"))) !== (0, import_core30.renderStateGitignore)(config)) {
@@ -6505,16 +6577,16 @@ function planMigrate(cwd) {
       to: `${import_core30.RECORDS_PATH}/${entry}`
     })),
     creates,
-    removes: (0, import_node_fs14.existsSync)((0, import_node_path15.join)(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
+    removes: (0, import_node_fs15.existsSync)((0, import_node_path15.join)(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
   };
 }
 function readIfPresent(file) {
-  return (0, import_node_fs14.existsSync)(file) ? (0, import_node_fs14.readFileSync)(file, "utf8") : void 0;
+  return (0, import_node_fs15.existsSync)(file) ? (0, import_node_fs15.readFileSync)(file, "utf8") : void 0;
 }
 function collidingEntries(entries, tree) {
   let held;
   try {
-    held = (0, import_node_fs14.readdirSync)(tree);
+    held = (0, import_node_fs15.readdirSync)(tree);
   } catch {
     return [];
   }
@@ -6533,18 +6605,18 @@ function applyMigrate(plan2) {
   }
   const { config } = (0, import_core30.loadConfig)(plan2.root);
   if (plan2.moves.length > 0) {
-    (0, import_node_fs14.mkdirSync)((0, import_core30.recordsDir)(plan2.root), { recursive: true });
+    (0, import_node_fs15.mkdirSync)((0, import_core30.recordsDir)(plan2.root), { recursive: true });
     for (const move of plan2.moves) {
-      (0, import_node_fs14.renameSync)((0, import_node_path15.join)(plan2.root, ...move.from.split("/")), (0, import_node_path15.join)(plan2.root, ...move.to.split("/")));
+      (0, import_node_fs15.renameSync)((0, import_node_path15.join)(plan2.root, ...move.from.split("/")), (0, import_node_path15.join)(plan2.root, ...move.to.split("/")));
     }
   }
   if (plan2.creates.includes(import_core30.STATE_GITIGNORE_PATH)) {
     const ignore = (0, import_node_path15.join)(plan2.root, ...import_core30.STATE_GITIGNORE_PATH.split("/"));
-    (0, import_node_fs14.mkdirSync)((0, import_node_path15.dirname)(ignore), { recursive: true });
-    (0, import_node_fs14.writeFileSync)(ignore, (0, import_core30.renderStateGitignore)(config), "utf8");
+    (0, import_node_fs15.mkdirSync)((0, import_node_path15.dirname)(ignore), { recursive: true });
+    (0, import_node_fs15.writeFileSync)(ignore, (0, import_core30.renderStateGitignore)(config), "utf8");
   }
   for (const removed of plan2.removes) {
-    (0, import_node_fs14.rmSync)((0, import_node_path15.join)(plan2.root, ...removed.split("/")), { force: true });
+    (0, import_node_fs15.rmSync)((0, import_node_path15.join)(plan2.root, ...removed.split("/")), { force: true });
   }
   return { ...plan2, status: "migrated" };
 }
@@ -7030,7 +7102,7 @@ var rotateCommand = (0, import_citty20.defineCommand)({
 });
 
 // src/commands/watch.ts
-var import_node_fs15 = require("fs");
+var import_node_fs16 = require("fs");
 var import_node_path16 = require("path");
 var import_core34 = require("@penvhq/core");
 var import_citty21 = require("citty");
@@ -7094,18 +7166,18 @@ function runWatch(options) {
     const name = (0, import_node_path16.basename)(target);
     let recovery;
     try {
-      recovery = (0, import_node_fs15.watch)(parent, { recursive: false }, (_event, filename) => {
+      recovery = (0, import_node_fs16.watch)(parent, { recursive: false }, (_event, filename) => {
         if (closed || recovery === void 0) {
           return;
         }
-        if (!(0, import_node_fs15.existsSync)(parent)) {
+        if (!(0, import_node_fs16.existsSync)(parent)) {
           stop2(recovery);
           return;
         }
         if (filename !== null && (0, import_node_path16.basename)(filename) !== name) {
           return;
         }
-        if (!(0, import_node_fs15.existsSync)(target)) {
+        if (!(0, import_node_fs16.existsSync)(target)) {
           return;
         }
         stop2(recovery);
@@ -7125,11 +7197,11 @@ function runWatch(options) {
   }
   function addWatcher(target, recursive, only) {
     let watcher;
-    const listen = (useRecursive) => (0, import_node_fs15.watch)(target, { recursive: useRecursive }, (_event, filename) => {
+    const listen = (useRecursive) => (0, import_node_fs16.watch)(target, { recursive: useRecursive }, (_event, filename) => {
       if (closed) {
         return;
       }
-      if (!(0, import_node_fs15.existsSync)(target)) {
+      if (!(0, import_node_fs16.existsSync)(target)) {
         if (watcher !== void 0) {
           stop2(watcher);
         }