@penvhq/cli 0.9.5 → 0.11.0

package/dist/index.js

@@ -1,10 +1,20 @@
+import {
+  detectPackageManager,
+  engineVersion,
+  installWithPackageManager,
+  noCommand,
+  planInstall,
+  renderInstallPlan,
+  startChild
+} from "./chunk-JJY4RLDJ.js";
+
 // src/index.ts
 import { setKeychain } from "@penvhq/core";
 import { runMain as cittyRunMain, defineCommand as defineCommand22 } from "citty";
 
 // src/commands/artifact.ts
 import { mkdirSync, writeFileSync } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, relative, resolve as resolve3 } from "path";
+import { dirname as dirname3, isAbsolute, relative, resolve as resolve3 } from "path";
 import {
   ARTIFACT_FORMAT,
   candidatesFor as candidatesFor2,
@@ -12,7 +22,7 @@ import {
   formatValueFile as formatValueFile2,
   isSecret as isSecret2,
   keySourceIdentifier,
-  PenvError as PenvError9,
+  PenvError as PenvError7,
   parameterId as parameterId3,
   serializeArtifact,
   variableName as variableName3
@@ -20,313 +30,9 @@ import {
 import { assertDeliverableNames, declaredRefs as declaredRefs2 } from "@penvhq/runtime";
 import { defineCommand as defineCommand4 } from "citty";
 
-// src/install.ts
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { join as join2 } from "path";
-import { PenvError as PenvError2 } from "@penvhq/core";
-
-// src/child.ts
-import { spawn } from "child_process";
-import { existsSync, statSync } from "fs";
-import { delimiter, isAbsolute, join, win32 } from "path";
-import { PenvError } from "@penvhq/core";
-var FORWARDED = ["SIGINT", "SIGTERM", "SIGHUP", "SIGBREAK"];
-var startChild = (invocation) => {
-  const [executable, ...args] = invocation.command;
-  if (executable === void 0) {
-    throw noCommand();
-  }
-  const target = resolveTarget(executable, args, invocation.env);
-  const child = spawn(target.file, target.args, {
-    cwd: invocation.cwd,
-    env: invocation.env,
-    stdio: "inherit",
-    ...target.verbatim ? { windowsVerbatimArguments: true } : {}
-  });
-  const forward = /* @__PURE__ */ new Map();
-  for (const signal of FORWARDED) {
-    const handler = () => {
-      child.kill(signal);
-    };
-    forward.set(signal, handler);
-    process.on(signal, handler);
-  }
-  const release = () => {
-    for (const [signal, handler] of forward) {
-      process.off(signal, handler);
-    }
-  };
-  const ended = new Promise((resolve9, reject) => {
-    child.on("error", (cause) => {
-      release();
-      reject(cannotStart(executable, cause, invocation.purpose));
-    });
-    child.on("exit", (code, signal) => {
-      release();
-      resolve9({ exitCode: code ?? 1, signal });
-    });
-  });
-  return {
-    ended,
-    kill(signal) {
-      child.kill(signal);
-    }
-  };
-};
-function noCommand() {
-  return new PenvError(
-    "RUN_NO_COMMAND",
-    "`penv run` was given no command to start",
-    "Put the command after `--`, e.g. `penv run -- pnpm dev`."
-  );
-}
-function cannotStart(executable, cause, purpose) {
-  const detail = cause instanceof Error ? cause.message : String(cause);
-  if (purpose !== void 0) {
-    return new PenvError(
-      "PENV_COMMAND_NOT_STARTED",
-      `penv could not start \`${executable}\` to ${purpose}: ${detail}`,
-      `Check that \`${executable}\` runs on its own \u2014 penv starts it the way your shell does, so it has to be on PATH. Nothing was changed.`
-    );
-  }
-  return new PenvError(
-    "RUN_COMMAND_NOT_STARTED",
-    `\`${executable}\` could not be started: ${detail}`,
-    `Check the command after \`--\` runs on its own \u2014 \`${executable}\` has to be on PATH, exactly as it is spelled here.`
-  );
-}
-function resolveTarget(executable, args, env) {
-  if (process.platform !== "win32") {
-    return { file: executable, args, verbatim: false };
-  }
-  const resolved = findExecutable(executable, env);
-  if (resolved === void 0 || !/\.(cmd|bat)$/i.test(resolved)) {
-    return { file: resolved ?? executable, args, verbatim: false };
-  }
-  return {
-    file: env.ComSpec ?? "cmd.exe",
-    args: ["/d", "/s", "/c", `"${cmdCommandLine(resolved, args)}"`],
-    verbatim: true
-  };
-}
-var SHIM = /(?:^|\\)node_modules\\\.bin\\[^\\]+\.cmd$/i;
-function cmdCommandLine(resolved, args) {
-  const command = win32.normalize(resolved);
-  const shim = SHIM.test(command);
-  return [escapeCommand(command), ...args.map((argument) => escapeArgument(argument, shim))].join(
-    " "
-  );
-}
-function extensions(env, platform) {
-  if (platform !== "win32") {
-    return [""];
-  }
-  const declared = env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD";
-  return [...declared.split(";").filter((extension) => extension.length > 0), ""];
-}
-function findExecutable(executable, env, platform = process.platform) {
-  const candidates = extensions(env, platform);
-  const isFile = (path2) => existsSync(path2) && statSync(path2).isFile();
-  if (executable.includes("/") || executable.includes("\\") || isAbsolute(executable)) {
-    return candidates.map((extension) => executable + extension).find(isFile);
-  }
-  const path = env.PATH ?? env.Path ?? "";
-  for (const directory of path.split(delimiter).filter((entry) => entry.length > 0)) {
-    const hit = candidates.map((extension) => join(directory, executable + extension)).find(isFile);
-    if (hit !== void 0) {
-      return hit;
-    }
-  }
-  return void 0;
-}
-var CMD_METACHARACTERS = /([()\][%!^"`<>&|;, *?])/g;
-function escapeCommand(command) {
-  return command.replace(CMD_METACHARACTERS, "^$1");
-}
-function escapeArgument(argument, doubleEscape) {
-  const quoted = `"${argument.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1")}"`;
-  const escaped = quoted.replace(CMD_METACHARACTERS, "^$1");
-  return doubleEscape ? escaped.replace(CMD_METACHARACTERS, "^$1") : escaped;
-}
-
-// src/install.ts
-var RUNTIME_PACKAGE = "@penvhq/penv";
-var SCHEMA_PACKAGE = "zod";
-var LOCKFILES = [
-  ["pnpm", "pnpm-lock.yaml"],
-  ["yarn", "yarn.lock"],
-  ["bun", "bun.lock"],
-  ["bun", "bun.lockb"],
-  ["npm", "package-lock.json"]
-];
-var ADD = {
-  pnpm: ["pnpm", "add", "--save-exact"],
-  npm: ["npm", "install", "--save-exact"],
-  yarn: ["yarn", "add", "--exact"],
-  bun: ["bun", "add", "--exact"]
-};
-function engineVersion() {
-  const version = ownManifest()?.version;
-  if (typeof version === "string" && version.length > 0) {
-    return version;
-  }
-  throw new PenvError2(
-    "ENGINE_VERSION_UNREADABLE",
-    "penv could not read its own version, so it cannot say which `@penvhq/penv` this project needs",
-    `Reinstall penv, then run \`penv init\` again.`
-  );
-}
-function schemaPackageVersion() {
-  const peers = ownManifest()?.peerDependencies;
-  const declared = peers !== null && typeof peers === "object" && !Array.isArray(peers) ? peers[SCHEMA_PACKAGE] : void 0;
-  const floor = typeof declared === "string" ? declared.replace(/^[\^~>=\s]+/, "").trim() : "";
-  if (floor.length > 0) {
-    return floor;
-  }
-  throw new PenvError2(
-    "ENGINE_PEER_UNREADABLE",
-    `penv could not read its own \`${SCHEMA_PACKAGE}\` peer range, so it cannot say which ${SCHEMA_PACKAGE} this project needs`,
-    `Reinstall penv, then run \`penv init\` again.`
-  );
-}
-function ownManifest() {
-  try {
-    const parsed = JSON.parse(
-      readFileSync(new URL("../package.json", import.meta.url), "utf8")
-    );
-    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function detectPackageManager(root) {
-  for (const [manager, lockfile] of LOCKFILES) {
-    if (existsSync2(join2(root, lockfile))) {
-      return manager;
-    }
-  }
-  return declaredManager(root) ?? "npm";
-}
-function declaredManager(root) {
-  const declared = manifestOf(root)?.packageManager;
-  if (typeof declared !== "string") {
-    return void 0;
-  }
-  const name = declared.split("@")[0];
-  return name === "pnpm" || name === "npm" || name === "yarn" || name === "bun" ? name : void 0;
-}
-function manifestOf(root) {
-  const file = join2(root, "package.json");
-  if (!existsSync2(file)) {
-    return void 0;
-  }
-  try {
-    const manifest = JSON.parse(readFileSync(file, "utf8"));
-    return manifest !== null && typeof manifest === "object" && !Array.isArray(manifest) ? manifest : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function declaredVersion(root, name) {
-  const manifest = manifestOf(root);
-  for (const field of ["dependencies", "devDependencies"]) {
-    const block = manifest?.[field];
-    if (block !== null && typeof block === "object" && !Array.isArray(block)) {
-      const version = block[name];
-      if (typeof version === "string") {
-        return version;
-      }
-    }
-  }
-  return void 0;
-}
-function planInstall(root, version = engineVersion()) {
-  const manager = detectPackageManager(root);
-  const lockfile = LOCKFILES.find(
-    ([name, file]) => name === manager && existsSync2(join2(root, file))
-  )?.[1];
-  const runtimeDeclared = declaredVersion(root, RUNTIME_PACKAGE);
-  const zodDeclared = declaredVersion(root, SCHEMA_PACKAGE);
-  const packages = [
-    {
-      name: RUNTIME_PACKAGE,
-      version,
-      ...runtimeDeclared === void 0 ? {} : { declared: runtimeDeclared },
-      satisfied: runtimeDeclared === version
-    },
-    {
-      name: SCHEMA_PACKAGE,
-      version: schemaPackageVersion(),
-      ...zodDeclared === void 0 ? {} : { declared: zodDeclared },
-      // Any declared zod counts: which zod a project uses is the project's
-      // decision, and penv is here to make sure there is one, not to move it.
-      satisfied: zodDeclared !== void 0
-    }
-  ];
-  const pending = packages.filter((entry) => !entry.satisfied);
-  const specs = (pending.length === 0 ? packages : pending).map(
-    (entry) => `${entry.name}@${entry.version}`
-  );
-  return {
-    root,
-    manager,
-    packages,
-    command: [...ADD[manager], ...specs],
-    ...lockfile === void 0 ? {} : { lockfile },
-    satisfied: pending.length === 0
-  };
-}
-function describe(entry) {
-  return `${entry.name} ${entry.version}`;
-}
-function renderInstallPlan(plan2) {
-  if (plan2.satisfied) {
-    return [
-      `package.json already has ${plan2.packages.map(describe).join(" and ")} \u2014 nothing to install.`
-    ];
-  }
-  const pending = plan2.packages.filter((entry) => !entry.satisfied);
-  const added = pending.filter((entry) => entry.declared === void 0);
-  const replaced = pending.filter((entry) => entry.declared !== void 0);
-  return [
-    "package.json",
-    ...added.length === 0 ? [] : [
-      '  + "dependencies": {',
-      ...added.map((entry) => `  +   "${entry.name}": "${entry.version}"`),
-      "  + }"
-    ],
-    ...replaced.flatMap((entry) => [
-      `  - "${entry.name}": "${entry.declared}"`,
-      `  + "${entry.name}": "${entry.version}"`
-    ]),
-    ...plan2.lockfile === void 0 ? [] : [plan2.lockfile, ...pending.map((entry) => `  + ${entry.name}@${entry.version}`)],
-    "",
-    `Run with: ${plan2.command.join(" ")}`
-  ];
-}
-var installWithPackageManager = async (plan2) => {
-  const child = startChild({
-    command: plan2.command,
-    env: process.env,
-    cwd: plan2.root,
-    purpose: `install ${plan2.packages.map(describe).join(" and ")}`
-  });
-  const ended = await child.ended;
-  if (ended.exitCode !== 0 || ended.signal !== null) {
-    throw installFailed(plan2);
-  }
-};
-function installFailed(plan2) {
-  return new PenvError2(
-    "INIT_INSTALL_FAILED",
-    `${plan2.command.join(" ")} did not finish, so penv migrated nothing`,
-    `Run \`${plan2.command.join(" ")}\` yourself, then start this command again. Your dotenv files are exactly where they were.`
-  );
-}
-
 // src/project.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { dirname, join as join3 } from "path";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join2 } from "path";
 import {
   assertMigrated,
   candidatesFor,
@@ -335,7 +41,7 @@ import {
   isReservedToken,
   loadConfig,
   openValue,
-  PenvError as PenvError5,
+  PenvError as PenvError3,
   parameterId,
   ReservedTokenError,
   recordsDir as recordsDir2,
@@ -348,7 +54,7 @@ import {
 import { FilesystemProvider } from "@penvhq/provider-filesystem";
 
 // src/env-flags.ts
-import { PenvError as PenvError3 } from "@penvhq/core";
+import { PenvError } from "@penvhq/core";
 var BASE_RESERVED = ["help", "version", "h", "v", "_", "--"];
 var COMMAND_FLAGS = [
   ...BASE_RESERVED,
@@ -381,14 +87,14 @@ function environmentFromShorthand(config, candidates, explicit) {
   const hits = candidates.filter((candidate) => config.environments.includes(candidate));
   const strangers = candidates.filter((candidate) => !config.environments.includes(candidate));
   if (strangers.length > 0) {
-    throw new PenvError3(
+    throw new PenvError(
       "UNKNOWN_FLAG",
       `${quoteList(strangers)} ${strangers.length === 1 ? "is not a flag" : "are not flags"} this command takes, and ${strangers.length === 1 ? "names" : "name"} no declared environment`,
       `Declared environments work as bare flags: ${quoteList(config.environments)}. Anything else needs \`--env <name>\`.`
     );
   }
   if (hits.length > 1) {
-    throw new PenvError3(
+    throw new PenvError(
       "ENVIRONMENT_FLAG_AMBIGUOUS",
       `${quoteList(hits)} name two environments at once, and a command acts on exactly one`,
       "Pass a single environment flag, or the canonical `--env <name>`."
@@ -396,7 +102,7 @@ function environmentFromShorthand(config, candidates, explicit) {
   }
   const hit = hits[0];
   if (hit !== void 0 && explicit !== void 0 && explicit !== hit) {
-    throw new PenvError3(
+    throw new PenvError(
       "ENVIRONMENT_FLAG_AMBIGUOUS",
       `\`--env ${explicit}\` and \`--${hit}\` name two environments at once`,
       "Drop one of them \u2014 `--env` is the canonical spelling."
@@ -406,17 +112,22 @@ function environmentFromShorthand(config, candidates, explicit) {
 }
 
 // src/registry.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 import { createRequire } from "module";
-import { resolve } from "path";
+import { join, resolve } from "path";
 import { pathToFileURL } from "url";
 import {
   holdsProjection,
   LOCAL_EXTENSIONS_PATH,
   localExtensionsFile,
+  MANIFEST_PATH,
   PENV_DIR,
-  PenvError as PenvError4,
+  PenvError as PenvError2,
+  packageDir,
+  packageEntry,
   parseLocalExtensions,
+  parseManifest,
+  penvHome,
   recordsDir
 } from "@penvhq/core";
 import { createFilesystemProvider } from "@penvhq/provider-filesystem";
@@ -461,23 +172,16 @@ async function createSourceProvider(type, context) {
   return loadPluginProvider(type, context);
 }
 async function loadPluginProvider(type, context) {
-  const resolved = resolvePlugin(type, context.root);
-  if (resolved === void 0) {
-    throw unknownProvider(type, context.environment);
-  }
+  const path = resolveExtension(type, context.root, context.environment);
   let mod;
   try {
-    mod = await importPlugin(resolved);
-  } catch {
-    throw new PenvError4(
-      "PROVIDER_PLUGIN_LOAD",
-      `The provider package \`${type}\` failed to load`,
-      "It resolved but threw while importing. Check it builds and its dependencies are installed."
-    );
+    mod = await importPlugin(path);
+  } catch (cause) {
+    throw providerLoadFailed(type, path, cause);
   }
   const factory = mod[PLUGIN_FACTORY_EXPORT];
   if (typeof factory !== "function") {
-    throw new PenvError4(
+    throw new PenvError2(
       "PROVIDER_PLUGIN_INVALID",
       `\`${type}\` does not export \`${PLUGIN_FACTORY_EXPORT}\``,
       `A penv provider package must export \`${PLUGIN_FACTORY_EXPORT}(context) => Provider\`.`
@@ -497,15 +201,47 @@ function assertProvidersRegistered(config, projectRoot, options) {
     if (ci && local.includes(provider.type)) {
       throw localExtensionInCi(provider.type, environment);
     }
-    if (resolvePlugin(provider.type, projectRoot) === void 0) {
-      throw unknownProvider(provider.type, environment);
+    resolveExtension(provider.type, projectRoot, environment, local);
+  }
+}
+function resolveExtension(type, projectRoot, environment, local = localExtensions(projectRoot)) {
+  const fromProject = resolvePlugin(type, projectRoot);
+  if (local.includes(type)) {
+    if (fromProject === void 0) {
+      throw localExtensionUnresolved(type, projectRoot, environment);
     }
+    return fromProject;
+  }
+  if (fromProject !== void 0) {
+    return fromProject;
+  }
+  const version = pinnedVersion(type, projectRoot);
+  if (version === void 0) {
+    throw unknownProvider(type, environment);
+  }
+  const stored = storedExtension(type, version);
+  if (stored === void 0) {
+    throw extensionNotInstalled(type, version, environment);
+  }
+  return stored;
+}
+function pinnedVersion(type, projectRoot) {
+  let manifest;
+  try {
+    manifest = parseManifest(readFileSync(join(projectRoot, ...MANIFEST_PATH.split("/")), "utf8"));
+  } catch {
+    return void 0;
   }
+  return manifest.extensions[type]?.version;
+}
+function storedExtension(type, version) {
+  const entry = packageEntry(packageDir(penvHome(process.env), "extensions", type, version));
+  return entry?.file;
 }
 function localExtensions(projectRoot) {
   let text;
   try {
-    text = readFileSync2(localExtensionsFile(projectRoot), "utf8");
+    text = readFileSync(localExtensionsFile(projectRoot), "utf8");
   } catch {
     return [];
   }
@@ -515,7 +251,7 @@ function isCi(value) {
   return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
 }
 function localExtensionInCi(type, environment) {
-  return new PenvError4(
+  return new PenvError2(
     "LOCAL_EXTENSION_IN_CI",
     `The provider \`${type}\` for environment ${environment} is a local extension, and this is CI`,
     `${LOCAL_EXTENSIONS_PATH} records it as a package this project develops, so nothing pins the bytes CI would run. Publish it and run \`penv add ${type}\` to pin a release.`
@@ -544,7 +280,7 @@ function assertSatisfiesContract(provider, specifier) {
   const contract = projection ? "the @penvhq/core ProjectionProvider contract its declared capabilities select" : "the @penvhq/core Provider contract that the filesystem provider defines";
   for (const method of methods) {
     if (typeof provider[method] !== "function") {
-      throw new PenvError4(
+      throw new PenvError2(
         "PROVIDER_PLUGIN_INVALID",
         `The provider from \`${specifier}\` is missing \`${method}()\``,
         `It must satisfy ${contract}.`
@@ -552,13 +288,37 @@ function assertSatisfiesContract(provider, specifier) {
     }
   }
 }
+function where(environment) {
+  return environment === void 0 ? "" : ` for environment ${environment}`;
+}
 function unknownProvider(type, environment) {
   const preinstalled = [...REGISTRY.keys()].map((name) => `\`${name}\``).join(", ");
-  const where = environment === void 0 ? "" : ` for environment ${environment}`;
-  return new PenvError4(
+  return new PenvError2(
     "UNKNOWN_PROVIDER",
-    `The provider \`${type}\`${where} in penv.config.ts is not installed in this project`,
-    `A provider's \`type\` is the package penv imports, so it has to resolve from this project: install it with \`npm i ${type}\`, or \u2014 if this repository is the one that builds it \u2014 run \`penv add --local ${type}\` once it is a dependency of the root. The CLI ships ${preinstalled} pre-installed.`
+    `The provider \`${type}\`${where(environment)} in penv.config.ts is nowhere penv looks for it`,
+    `Run \`penv add ${type}\` to pin a release, or \`penv add --local ${type}\` if this repository is the one that builds it. penv looks in ${LOCAL_EXTENSIONS_PATH}, this project's node_modules, and then $PENV_HOME at the version ${MANIFEST_PATH} pins. The CLI ships ${preinstalled} pre-installed.`
+  );
+}
+function extensionNotInstalled(type, version, environment) {
+  return new PenvError2(
+    "EXTENSION_NOT_INSTALLED",
+    `${MANIFEST_PATH} pins \`${type}\` ${version}${where(environment)}, and it is not installed in ${penvHome(process.env)}`,
+    "Run `penv install` \u2014 it downloads and verifies every version the manifest pins, extensions included."
+  );
+}
+function localExtensionUnresolved(type, projectRoot, environment) {
+  return new PenvError2(
+    "LOCAL_EXTENSION_UNRESOLVED",
+    `${LOCAL_EXTENSIONS_PATH} records \`${type}\`${where(environment)} as a package this project develops, and it does not resolve from ${projectRoot}`,
+    `Add it as a dependency of the root (a workspace link is one) and run \`pnpm install\`, or drop the name from ${LOCAL_EXTENSIONS_PATH} if this project no longer builds it.`
+  );
+}
+function providerLoadFailed(type, path, cause) {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new PenvError2(
+    "PROVIDER_PLUGIN_LOAD",
+    `The provider package \`${type}\` failed to load from ${path}: ${detail}`,
+    "penv imports that file exactly as it stands, with no transform, so it has to be built JavaScript with its dependencies installed."
   );
 }
 
@@ -578,7 +338,7 @@ function openProject(cwd) {
 }
 function localTree(project) {
   if (!(project.provider instanceof FilesystemProvider)) {
-    throw new PenvError5(
+    throw new PenvError3(
       "PROVIDER_NOT_LOCAL",
       `This command reads the local .penv tree synchronously, which the \`${project.provider.type}\` provider is not`,
       "Run this against a filesystem-backed project, or use a command that speaks the async provider contract."
@@ -587,11 +347,11 @@ function localTree(project) {
   return project.provider;
 }
 function selfContainedSchemaModule(root, schemaFile) {
-  const file = join3(root, ...schemaFile.split("/"));
-  if (!existsSync3(file)) {
+  const file = join2(root, ...schemaFile.split("/"));
+  if (!existsSync(file)) {
     return void 0;
   }
-  const source = readFileSync3(file, "utf8");
+  const source = readFileSync2(file, "utf8");
   return source.includes("PenvSchemaShape") || source.includes("z.object") ? schemaFile : void 0;
 }
 function schemaShapeFileOf(project) {
@@ -620,7 +380,7 @@ function refFromKey(key, config) {
   const segments = key.split(KEY_SEPARATOR).filter((segment) => segment.length > 0);
   const name = segments[segments.length - 1];
   if (name === void 0) {
-    throw new PenvError5(
+    throw new PenvError3(
       "PARAMETER_KEY",
       `\`${key}\` names no parameter`,
       "A key is `<namespace>/<name>` or `<namespace>.<name>`, e.g. `redis/password`."
@@ -639,13 +399,13 @@ function assertWritableKey(key) {
   const ref = refFromAccessPath(segments);
   if (ref !== void 0) {
     const suggestion = [...ref.namespace, ref.name].join("/");
-    throw new PenvError5(
+    throw new PenvError3(
       "PARAMETER_KEY_CASING",
       `\`${key}\` is not a canonical parameter name`,
       `Parameter files are lower-case and hyphenated. Did you mean \`${suggestion}\`? That is the file that backs the \`${key}\` key in your schema.`
     );
   }
-  throw new PenvError5(
+  throw new PenvError3(
     "PARAMETER_KEY_UNREACHABLE",
     `No value file can be named that reaches \`${key}\``,
     "Parameter files are lower-case and hyphenated, and this key maps to no such file \u2014 a run of capitals like `apiURL` cannot be reached (use `api-url`, which the schema reads as `apiUrl`). Run `penv validate` or `penv fill` to see the names penv expects."
@@ -693,7 +453,7 @@ function refsFrom(files) {
 }
 
 // src/ui.ts
-import { PenvError as PenvError6 } from "@penvhq/core";
+import { PenvError as PenvError4 } from "@penvhq/core";
 
 // src/style.ts
 function supportsColor(stream) {
@@ -826,7 +586,7 @@ function writeError(lines) {
   }
 }
 function reportError(error) {
-  if (error instanceof PenvError6) {
+  if (error instanceof PenvError4) {
     process.stderr.write(`${err.red(CROSS)} ${error.summary}
 `);
     if (error.remedy !== void 0) {
@@ -857,9 +617,9 @@ async function guard(run) {
 }
 
 // src/commands/run.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, watch } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, watch } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { basename, dirname as dirname2, join as join4, resolve as resolve2 } from "path";
+import { basename, dirname as dirname2, join as join3, resolve as resolve2 } from "path";
 import {
   ARTIFACT_BUILD_COMMAND,
   assertArtifactFor,
@@ -869,7 +629,7 @@ import {
   MissingMaterializationError,
   openSealed,
   own,
-  PenvError as PenvError8,
+  PenvError as PenvError6,
   parseArtifact,
   RECORDS_PATH,
   UndecryptableValueError,
@@ -1118,7 +878,7 @@ import {
   checkNameCollisions,
   jitiFor,
   NameCollisionError,
-  PenvError as PenvError7,
+  PenvError as PenvError5,
   ReservedTokenError as ReservedTokenError2,
   resolveAll,
   SCHEMA_HARVEST_ENV,
@@ -1467,7 +1227,7 @@ async function checkEnvironment(project, environment) {
   try {
     files = await project.provider.list();
   } catch (error) {
-    if (!(error instanceof PenvError7)) {
+    if (!(error instanceof PenvError5)) {
       throw error;
     }
     return {
@@ -1619,7 +1379,7 @@ function assertNotNested(host, inner) {
   if (outer === void 0) {
     return;
   }
-  throw new PenvError8(
+  throw new PenvError6(
     "RUN_NESTED",
     `\`${inner}\` is starting inside \`${outer}\`, and two penv environments cannot own one process`,
     `Drop one of the two wrappers \u2014 the inner one is in a package.json script \u2014 then run \`${outer}\` again.`
@@ -1629,7 +1389,7 @@ function assertSource(source, inner) {
   if (source === "project" || source === "snapshot") {
     return source;
   }
-  throw new PenvError8(
+  throw new PenvError6(
     "RUN_SOURCE_UNKNOWN",
     `\`--source ${source}\` names no source penv reads`,
     `A run reads ${SOURCES.map((name) => `\`${name}\``).join(" or ")}, and \`project\` is the default \u2014 so \`${inner}\` reads the local tree.`
@@ -1650,7 +1410,7 @@ async function assertNoPublicSecret(project, environment, refs, retry) {
     }
     const parameter = [...ref.namespace, ref.name].join("/");
     const prefix = prefixes.find((candidate) => variable.startsWith(candidate));
-    throw new PenvError8(
+    throw new PenvError6(
       "RUN_PUBLIC_SECRET",
       `The secret ${parameter} maps to ${variable}, which the \`${prefix}\` prefix publishes to the browser`,
       `Rename the parameter, or drop \`secret\` from its meta if it is not one \u2014 then \`${retry}\`.`
@@ -1659,7 +1419,7 @@ async function assertNoPublicSecret(project, environment, refs, retry) {
 }
 function invalidConfiguration(result2, inner) {
   const lines = result2.issues.map((issue) => `  ${issue.subject}: ${issue.message}`).join("\n");
-  return new PenvError8(
+  return new PenvError6(
     "RUN_INVALID_CONFIGURATION",
     `Configuration for environment ${result2.environment} is not valid, so nothing was started:
 ${lines}`,
@@ -1681,7 +1441,7 @@ function assertNoActiveDotenv(project) {
   if (first === void 0) {
     return;
   }
-  throw new PenvError8(
+  throw new PenvError6(
     "RUN_DOTENV_ACTIVE",
     `${first.name} is active configuration again, and your framework would read it beside penv's records`,
     `Adopt it with \`penv init\`, or delete ${first.name} \u2014 its values belong in ${RECORDS_PATH}/.`
@@ -1699,10 +1459,10 @@ function packageManifest(specifier, root) {
     return void 0;
   }
   for (; ; ) {
-    const file = join4(directory, "package.json");
-    if (existsSync4(file)) {
+    const file = join3(directory, "package.json");
+    if (existsSync2(file)) {
       try {
-        const parsed = JSON.parse(readFileSync4(file, "utf8"));
+        const parsed = JSON.parse(readFileSync3(file, "utf8"));
         if (isPlainObject(parsed) && parsed.name === specifier) {
           return parsed;
         }
@@ -1729,7 +1489,7 @@ function declaredCredentials(config, root) {
       continue;
     }
     if (!Array.isArray(credentials) || credentials.some((name) => typeof name !== "string" || !VARIABLE.test(name))) {
-      throw new PenvError8(
+      throw new PenvError6(
         "PROVIDER_CREDENTIALS_INVALID",
         `\`${provider.type}\` declares \`penv.credentials\`, and it is not a list of variable names`,
         `Its package.json should read \`"penv": { "credentials": ["ACME_TOKEN"] }\` \u2014 penv strips exactly what an extension declares, so it will not guess at a declaration it cannot read.`
@@ -1765,7 +1525,7 @@ async function prepare(project, environment, host, inner) {
 function snapshotPath(host) {
   const path = host[SNAPSHOT_VARIABLE]?.trim();
   if (path === void 0 || path.length === 0) {
-    throw new PenvError8(
+    throw new PenvError6(
       "RUN_SNAPSHOT_UNSET",
       `\`--source snapshot\` reads the sealed artifact ${SNAPSHOT_VARIABLE} names, and ${SNAPSHOT_VARIABLE} is not set`,
       `Build one with \`${ARTIFACT_BUILD_COMMAND}\` and point ${SNAPSHOT_VARIABLE} at it.`
@@ -1775,9 +1535,9 @@ function snapshotPath(host) {
 }
 function readSnapshot(path) {
   try {
-    return readFileSync4(path, "utf8");
+    return readFileSync3(path, "utf8");
   } catch {
-    throw new PenvError8(
+    throw new PenvError6(
       "RUN_SNAPSHOT_MISSING",
       `${SNAPSHOT_VARIABLE} names ${path}, and penv cannot read a sealed artifact there`,
       `Point ${SNAPSHOT_VARIABLE} at the artifact your release mounted \u2014 \`${ARTIFACT_BUILD_COMMAND}\` writes one.`
@@ -1854,7 +1614,7 @@ function watchProject(project, onChange) {
     timer = setTimeout(onChange, DEBOUNCE_MS);
   };
   const add = (target, recursive, only) => {
-    if (!existsSync4(target)) {
+    if (!existsSync2(target)) {
       return;
     }
     try {
@@ -1893,7 +1653,7 @@ async function runRun(options) {
   }
   if (source === "snapshot") {
     if (options.watch === true) {
-      throw new PenvError8(
+      throw new PenvError6(
         "RUN_SNAPSHOT_WATCH",
         "`--watch` re-syncs the project tree, and a run from a sealed artifact has no tree to watch",
         "Drop `--watch` \u2014 an artifact is built once and read unchanged. Watch the project instead: `penv run --watch -- <command>`."
@@ -2037,7 +1797,7 @@ function buildCommand(environment, out2) {
 function targetOf(options) {
   const environment = options.environment?.trim();
   if (environment === void 0 || environment.length === 0) {
-    throw new PenvError9(
+    throw new PenvError7(
       "ARTIFACT_ENV_REQUIRED",
       "`penv artifact build` names the environment it builds for, and `--env` was not given",
       `Name it: \`${buildCommand(void 0, options.out)}\`. An artifact carries one environment, and penv will not pick which.`
@@ -2048,13 +1808,13 @@ function targetOf(options) {
 function outputOf(options, environment) {
   const out2 = options.out?.trim();
   if (out2 === void 0 || out2.length === 0) {
-    throw new PenvError9(
+    throw new PenvError7(
       "ARTIFACT_OUT_REQUIRED",
       "`penv artifact build` writes where it is told, and `--out` was not given",
       `Name the path: \`${buildCommand(environment, void 0)}\`. The artifact belongs outside the repository, so there is no default worth having.`
     );
   }
-  return isAbsolute2(out2) ? out2 : resolve3(options.cwd, out2);
+  return isAbsolute(out2) ? out2 : resolve3(options.cwd, out2);
 }
 async function winnerOf(project, ref, environment) {
   for (const file of candidatesFor2(ref, environment, true)) {
@@ -2066,7 +1826,7 @@ async function winnerOf(project, ref, environment) {
   return void 0;
 }
 function plaintextSecret(parameter, location, environment) {
-  return new PenvError9(
+  return new PenvError7(
     "ARTIFACT_PLAINTEXT_SECRET",
     `${parameter} is a secret for environment ${environment}, and its value comes from ${location}, which is not sealed`,
     `Seal it with \`penv encrypt ${parameter} --env ${environment}\` \u2014 an artifact carries ciphertext or nothing.`
@@ -2080,7 +1840,7 @@ async function runArtifactBuild(options) {
   const { schema, issues } = await loadSchema(project, environment);
   if (schema === void 0) {
     const lines = issues.map((issue) => `  ${issue.subject}: ${issue.message}`).join("\n");
-    throw new PenvError9(
+    throw new PenvError7(
       "ARTIFACT_NO_SCHEMA",
       `The schema did not load, so penv cannot tell what this artifact should deliver:
 ${lines}`,
@@ -2132,7 +1892,7 @@ ${lines}`,
     values: present,
     sealed,
     absent: refs.length - present,
-    insideRepo: inside !== "" && !inside.startsWith("..") && !isAbsolute2(inside)
+    insideRepo: inside !== "" && !inside.startsWith("..") && !isAbsolute(inside)
   };
 }
 function displayPath(cwd, file) {
@@ -2193,25 +1953,25 @@ import { defineCommand as defineCommand5 } from "citty";
 
 // src/cutover.ts
 import {
-  existsSync as existsSync5,
+  existsSync as existsSync3,
   mkdirSync as mkdirSync2,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync4,
   renameSync,
   rmSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname4, join as join5, resolve as resolve4 } from "path";
+import { dirname as dirname4, join as join4, resolve as resolve4 } from "path";
 import {
   CUTOVER_PATH,
   findConfigFile,
-  PenvError as PenvError10,
+  PenvError as PenvError8,
   ROLLBACK_DOTENV_PATH,
   ROLLBACK_PATH
 } from "@penvhq/core";
 var CUTOVER_FORMAT = 1;
 function fileFor(root, relativePosix) {
-  return join5(root, ...relativePosix.split("/"));
+  return join4(root, ...relativePosix.split("/"));
 }
 function bundleDir(root) {
   return fileFor(root, ROLLBACK_DOTENV_PATH);
@@ -2235,12 +1995,12 @@ function bundleUnresolved(root) {
 }
 function readCutover(root) {
   const file = cutoverFile(root);
-  if (!existsSync5(file)) {
+  if (!existsSync3(file)) {
     return void 0;
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(file, "utf8"));
+    parsed = JSON.parse(readFileSync4(file, "utf8"));
   } catch {
     throw unreadable("it is not JSON");
   }
@@ -2266,7 +2026,7 @@ function readCutover(root) {
   };
 }
 function unreadable(what) {
-  return new PenvError10(
+  return new PenvError8(
     "CUTOVER_UNREADABLE",
     `${CUTOVER_PATH} records the last dotenv cutover, and ${what}`,
     `Run \`penv cleanup\` to drop that record and the rollback bundle it names.`
@@ -2298,7 +2058,7 @@ function bundleDotenvFiles(root, files, environments, now = /* @__PURE__ */ new
   const bundle = bundleDir(root);
   mkdirSync2(bundle, { recursive: true });
   for (const name of files) {
-    renameSync(join5(root, name), join5(bundle, name));
+    renameSync(join4(root, name), join4(bundle, name));
   }
   return cutover;
 }
@@ -2307,7 +2067,7 @@ function runUndo(options) {
   const cutover = readCutover(root);
   const bundled = bundledFiles(root);
   if (cutover === void 0 && bundled.length === 0) {
-    throw new PenvError10(
+    throw new PenvError8(
       "INIT_UNDO_NOTHING",
       "There is no dotenv cutover to undo in this project",
       "Run `penv init` to adopt your dotenv files; undo puts them back afterwards."
@@ -2317,11 +2077,11 @@ function runUndo(options) {
   const names = [...recorded, ...bundled.filter((name) => !recorded.includes(name))];
   const bundle = bundleDir(root);
   const held = new Set(bundled);
-  const occupied2 = names.filter((name) => held.has(name) && existsSync5(join5(root, name)));
+  const occupied2 = names.filter((name) => held.has(name) && existsSync3(join4(root, name)));
   if (occupied2.length > 0) {
     const listed = occupied2.join(", ");
     const many = occupied2.length > 1;
-    throw new PenvError10(
+    throw new PenvError8(
       "INIT_UNDO_OCCUPIED",
       `${listed} ${many ? "exist" : "exists"} again, and restoring what penv moved aside would write over ${many ? "them" : "it"}`,
       `Move ${listed} out of the way, or run \`penv cleanup\` to keep ${many ? "them" : "it"} and drop the bundle. Nothing was restored.`
@@ -2332,9 +2092,9 @@ function runUndo(options) {
   const missing = [];
   for (const name of names) {
     if (held.has(name)) {
-      renameSync(join5(bundle, name), join5(root, name));
+      renameSync(join4(bundle, name), join4(root, name));
       restored.push(name);
-    } else if (existsSync5(join5(root, name))) {
+    } else if (existsSync3(join4(root, name))) {
       alreadyBack.push(name);
     } else {
       missing.push(name);
@@ -2346,7 +2106,7 @@ function runUndo(options) {
 function runCleanup(options) {
   const root = cutoverRoot(options.cwd);
   const held = bundledFiles(root);
-  const cleaned = held.length > 0 || existsSync5(cutoverFile(root)) || existsSync5(fileFor(root, ROLLBACK_PATH));
+  const cleaned = held.length > 0 || existsSync3(cutoverFile(root)) || existsSync3(fileFor(root, ROLLBACK_PATH));
   removeBundle(root);
   return { root, removed: held, cleaned };
 }
@@ -2387,8 +2147,8 @@ var cleanupCommand = defineCommand5({
 });
 
 // src/commands/doctor.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { join as join6, relative as relative2 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync5, statSync } from "fs";
+import { join as join5, relative as relative2 } from "path";
 import {
   ARTIFACT_BUILD_COMMAND as ARTIFACT_BUILD_COMMAND2,
   accessPath as accessPath3,
@@ -2414,7 +2174,7 @@ import { defineCommand as defineCommand7 } from "citty";
 import {
   checkNameCollisions as checkNameCollisions2,
   holdsProjection as holdsProjection3,
-  PenvError as PenvError11,
+  PenvError as PenvError9,
   recordPath,
   requireValue,
   variableName as variableName4
@@ -2482,7 +2242,7 @@ async function destinationFor(project, environment, options) {
   const declared = project.config.providers[environment];
   const location = declared?.location;
   if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
-    throw new PenvError11(
+    throw new PenvError9(
       "NO_DESTINATION",
       `Environment ${environment}'s provider is the local records tree itself, so penv has nowhere to push`,
       `Declare a provider for it in penv.config.ts \u2014 e.g. \`${environment}: { type: "@penvhq/provider-github", location: "owner/repo" }\` \u2014 or push somewhere once with \`penv push --env ${environment} --destination <package> --location <place>\`.`
@@ -2509,7 +2269,7 @@ function plan(resolutions, config, environment, allowDecrypt) {
     let encrypted = false;
     if (winner.file.encrypted) {
       if (!allowDecrypt) {
-        throw new PenvError11(
+        throw new PenvError9(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${recordPath(winner.location)}, and a push sends plaintext for the destination to re-seal`,
           "Re-run with `--allow-decrypt` to decrypt it locally and push it, or push an environment whose values are plaintext. penv's encryption stops at the projection; the destination seals it under its own key."
@@ -2562,7 +2322,7 @@ async function ensureTargetApproved(provider, environment, options) {
     return false;
   }
   if (provider.ensureTarget === void 0) {
-    throw new PenvError11(
+    throw new PenvError9(
       "MISSING_TARGET",
       `The destination has no environment \`${environment}\` to receive this push, and this provider cannot create one`,
       `Create the environment on the destination side, then run \`penv push --env ${environment}\` again.`
@@ -2572,7 +2332,7 @@ async function ensureTargetApproved(provider, environment, options) {
     `The destination has no environment \`${environment}\`. Create it?`
   );
   if (!approved) {
-    throw new PenvError11(
+    throw new PenvError9(
       "MISSING_TARGET",
       `The destination has no environment \`${environment}\` to receive this push`,
       `Re-run with \`--yes\` to create it, answer \`y\` at the prompt, or create it on the destination side yourself.`
@@ -3342,7 +3102,7 @@ function scannableFiles(directory, out2) {
     return;
   }
   for (const entry of entries) {
-    const path = join6(directory, entry.name);
+    const path = join5(directory, entry.name);
     if (entry.isDirectory()) {
       if (!UNSCANNED_DIRS.has(entry.name)) {
         scannableFiles(path, out2);
@@ -3384,10 +3144,10 @@ function artifactFindings(project) {
   for (const file of files) {
     let text;
     try {
-      if (statSync2(file).size > ARTIFACT_SCAN_LIMIT) {
+      if (statSync(file).size > ARTIFACT_SCAN_LIMIT) {
         continue;
       }
-      text = readFileSync6(file, "utf8");
+      text = readFileSync5(file, "utf8");
     } catch {
       continue;
     }
@@ -3736,7 +3496,7 @@ import {
   formatValueFile as formatValueFile5,
   isSecret as isSecret5,
   openValue as openValue3,
-  PenvError as PenvError13,
+  PenvError as PenvError11,
   parameterId as parameterId5,
   recordPath as recordPath3,
   sealValue as sealValue2
@@ -3747,7 +3507,7 @@ import { defineCommand as defineCommand9 } from "citty";
 import {
   formatValueFile as formatValueFile4,
   isSecret as isSecret4,
-  PenvError as PenvError12,
+  PenvError as PenvError10,
   parameterId as parameterId4,
   recordPath as recordPath2,
   sealValue
@@ -3771,7 +3531,7 @@ function targetScope(project, options, key) {
     return scopeFrom(options);
   }
   if (environment.trim().length === 0) {
-    throw new PenvError12(
+    throw new PenvError10(
       "ENVIRONMENT_FLAG_EMPTY",
       `\`--env\` for parameter ${key} names no environment`,
       `Pass a declared environment \u2014 ${project.config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
@@ -3784,7 +3544,7 @@ function policyEnvironment(project, options) {
 }
 function sealFor(project, file, value, parameter, environment) {
   if (environment === void 0) {
-    throw new PenvError12(
+    throw new PenvError10(
       "SECRET_SCOPE_AMBIGUOUS",
       `Parameter ${parameter} is a secret, and ${recordPath2(formatValueFile4(file))} names no environment`,
       "Keys are declared per environment in the `keys` block of penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
@@ -3886,7 +3646,7 @@ function twins(project, key, options) {
 }
 function environmentFor(project, options, verb) {
   if (options.environment === void 0) {
-    throw new PenvError13(
+    throw new PenvError11(
       "SECRET_SCOPE_AMBIGUOUS",
       `\`penv ${verb}\` names no environment, and keys are declared per environment`,
       "Pass `--env <environment>`. penv cannot tell which environment's key applies to a file that names none, and will not pick one for you."
@@ -3905,7 +3665,7 @@ async function runEncrypt(options) {
   const value = await readOne(project, plain);
   if (value === void 0) {
     const already = await readOne(project, sealed);
-    throw new PenvError13(
+    throw new PenvError11(
       "PARAMETER_ABSENT",
       already === void 0 ? `Parameter ${parameter} has no value file at ${recordPath3(formatValueFile5(plain))}` : `Parameter ${parameter} is already encrypted at ${recordPath3(formatValueFile5(sealed))}`,
       already === void 0 ? `Write it first with \`penv set ${options.key} --env ${environment}\`, which seals it automatically when the parameter's meta declares it a secret.` : "Nothing to do."
@@ -3926,7 +3686,7 @@ async function runDecrypt(options) {
   const [plain, sealed] = twins(project, options.key, options);
   const parameter = parameterId5(plain);
   if (isSecret5(await project.provider.readMeta(plain), environment)) {
-    throw new PenvError13(
+    throw new PenvError11(
       "SECRET_DECRYPT_REFUSED",
       `Parameter ${parameter} is declared a secret for environment ${environment}, so penv will not write it in plaintext`,
       "A secret with a plaintext value file is a `penv doctor` failure. Drop `secret` from the parameter's meta if it is not one, or run `penv generate --allow-decrypt` if you need the plaintext value in a `.env` artifact."
@@ -3934,7 +3694,7 @@ async function runDecrypt(options) {
   }
   const stored = await readOne(project, sealed);
   if (stored === void 0) {
-    throw new PenvError13(
+    throw new PenvError11(
       "PARAMETER_ABSENT",
       `Parameter ${parameter} has no encrypted value file at ${recordPath3(formatValueFile5(sealed))}`,
       `Nothing to decrypt. \`penv get ${options.key} --env ${environment} --explain\` shows every file penv looked at.`
@@ -3957,7 +3717,7 @@ async function runDecrypt(options) {
     removed: formatValueFile5(sealed)
   };
 }
-var UndecryptableAt = class extends PenvError13 {
+var UndecryptableAt = class extends PenvError11 {
   constructor(parameter, environment, location, detail) {
     super(
       "VALUE_UNDECRYPTABLE",
@@ -4012,7 +3772,7 @@ var decryptCommand = defineCommand9({
 });
 
 // src/commands/fill.ts
-import { PenvError as PenvError14, recordPath as recordPath4, SCHEMA_SHAPE_FILE as SCHEMA_SHAPE_FILE2 } from "@penvhq/core";
+import { PenvError as PenvError12, recordPath as recordPath4, SCHEMA_SHAPE_FILE as SCHEMA_SHAPE_FILE2 } from "@penvhq/core";
 import { defineCommand as defineCommand10 } from "citty";
 var BLOCKING = /* @__PURE__ */ new Set(["config", "collision", "reserved"]);
 async function runFill(options) {
@@ -4027,7 +3787,7 @@ async function runFill(options) {
     const detail = blockers.map(
       (issue) => `  - ${issue.message}${issue.remedy === void 0 ? "" : ` (${issue.remedy})`}`
     ).join("\n");
-    throw new PenvError14(
+    throw new PenvError12(
       "FILL_BLOCKED",
       `penv fill cannot run: environment ${environment} has ${blockers.length} unresolved configuration ${blockers.length === 1 ? "issue" : "issues"}:
 ${detail}`,
@@ -4163,11 +3923,11 @@ var fillCommand = defineCommand10({
 
 // src/commands/generate.ts
 import { writeFileSync as writeFileSync3 } from "fs";
-import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve5 } from "path";
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve5 } from "path";
 import {
   checkNameCollisions as checkNameCollisions3,
   effectiveMeta as effectiveMeta2,
-  PenvError as PenvError15,
+  PenvError as PenvError13,
   recordPath as recordPath5,
   requireValue as requireValue2,
   serializeDotenv,
@@ -4192,7 +3952,7 @@ function entriesFor(project, environment, allowDecrypt) {
     const winner = resolution.winner;
     if (winner?.file.encrypted === true) {
       if (!allowDecrypt) {
-        throw new PenvError15(
+        throw new PenvError13(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${recordPath5(winner.location)}, and \`penv generate\` writes plaintext`,
           `Re-run with \`--allow-decrypt\` to write the decrypted value into the artifact, or generate for an environment whose values are plaintext. The artifact is gitignored; a committed plaintext secret is a \`penv doctor\` failure.`
@@ -4223,7 +3983,7 @@ function runGenerate(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment, options.envFlags);
   const { entries, decrypted } = entriesFor(project, environment, options.allowDecrypt === true);
-  const file = options.out === void 0 ? resolve5(project.root, DEFAULT_OUTPUT) : isAbsolute3(options.out) ? options.out : resolve5(options.cwd, options.out);
+  const file = options.out === void 0 ? resolve5(project.root, DEFAULT_OUTPUT) : isAbsolute2(options.out) ? options.out : resolve5(options.cwd, options.out);
   writeFileSync3(file, serializeDotenv(entries), "utf8");
   return { file, environment, entries: entries.length, decrypted };
 }
@@ -4276,7 +4036,7 @@ var generateCommand = defineCommand11({
 });
 
 // src/commands/get.ts
-import { PenvError as PenvError16, recordPath as recordPath6, requireValue as requireValue3, resolveParameter } from "@penvhq/core";
+import { PenvError as PenvError14, recordPath as recordPath6, requireValue as requireValue3, resolveParameter } from "@penvhq/core";
 import { defineCommand as defineCommand12 } from "citty";
 async function runGet(options) {
   const project = openProject(options.cwd);
@@ -4286,7 +4046,7 @@ async function runGet(options) {
   const resolution = await resolveParameter(ref, environment, project.provider, keys);
   const value = requireValue3(resolution, environment);
   if (value === void 0) {
-    throw new PenvError16(
+    throw new PenvError14(
       "PARAMETER_ABSENT",
       `Parameter ${resolution.parameter} resolves to no value for environment ${environment}`,
       `Set it with \`penv set ${options.key} --env ${environment}\`, or run \`penv get ${options.key} --env ${environment} --explain\` to see every file penv looked at.`
@@ -4362,15 +4122,15 @@ var getCommand = defineCommand12({
 });
 
 // src/commands/import.ts
-import { copyFileSync, existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
-import { basename as basename2, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve7 } from "path";
+import { copyFileSync, existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
+import { basename as basename2, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve7 } from "path";
 import {
   assertNever as assertNever2,
   FilenameGrammarError,
   findConfigFile as findConfigFile2,
   loadConfigFrom as loadConfigFrom2,
   lookupEnvironment,
-  PenvError as PenvError19,
+  PenvError as PenvError17,
   parseDotenv as parseDotenv2,
   schemaFileOf as schemaFileOf4,
   UnknownEnvironmentError
@@ -4381,7 +4141,7 @@ import { defineCommand as defineCommand14 } from "citty";
 import {
   checkNameCollisions as checkNameCollisions4,
   isReservedToken as isReservedToken3,
-  PenvError as PenvError17,
+  PenvError as PenvError15,
   ReservedTokenError as ReservedTokenError3,
   refFromVariable as refFromVariable2,
   roundTripsCleanly,
@@ -4391,15 +4151,15 @@ function assertImportable(ref, variable) {
   if (!ref.name.includes(".")) {
     return;
   }
-  throw new PenvError17(
+  throw new PenvError15(
     "IMPORT_UNPARSEABLE_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, whose \`.\` would be read as a scope`,
     `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
   );
 }
-function assertNotReserved(ref, variable, where, config) {
+function assertNotReserved(ref, variable, where2, config) {
   if (isReservedToken3(ref.name, config)) {
-    throw new ReservedTokenError3("parameter", variable, where);
+    throw new ReservedTokenError3("parameter", variable, where2);
   }
 }
 function assertRoundTrips(ref, variable, config) {
@@ -4410,18 +4170,18 @@ function assertRoundTrips(ref, variable, config) {
     return;
   }
   const generated = variableName7(ref, config);
-  throw new PenvError17(
+  throw new PenvError15(
     "IMPORT_LOSSY_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, which regenerates as ${generated}`,
     `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`override\` block of penv.config.ts \u2014 \`override: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
   );
 }
-function refsForEntries(entries, where, config) {
+function refsForEntries(entries, where2, config) {
   const refs = [];
   for (const entry of entries) {
     const ref = refFromVariable2(entry.key);
     assertImportable(ref, entry.key);
-    assertNotReserved(ref, entry.key, where, config);
+    assertNotReserved(ref, entry.key, where2, config);
     assertRoundTrips(ref, entry.key, config);
     refs.push(ref);
   }
@@ -4451,8 +4211,8 @@ function writeEntries(tree, entries, refs, scope) {
 }
 
 // src/detect.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
+import { join as join6 } from "path";
 import { DEFAULT_SCHEMA_FILE } from "@penvhq/core";
 var SIGNATURES = [
   { name: "Next.js", packages: ["next"], publicPrefixes: ["NEXT_PUBLIC_"] },
@@ -4469,7 +4229,7 @@ var SIGNATURES = [
 function exportsSchema(file) {
   let source;
   try {
-    source = readFileSync7(file, "utf8");
+    source = readFileSync6(file, "utf8");
   } catch {
     return false;
   }
@@ -4480,8 +4240,8 @@ function exportsSchema(file) {
   );
 }
 function occupied(cwd, relative5) {
-  const file = join7(cwd, ...relative5.split("/"));
-  return existsSync6(file) && !exportsSchema(file);
+  const file = join6(cwd, ...relative5.split("/"));
+  return existsSync4(file) && !exportsSchema(file);
 }
 function schemaFileFor(cwd) {
   const dir = srcPrefix(cwd);
@@ -4496,10 +4256,10 @@ function schemaFileFor(cwd) {
   return { file: DEFAULT_SCHEMA_FILE, displaced: preferred };
 }
 function srcPrefix(cwd) {
-  return existsSync6(join7(cwd, "src")) ? "src/" : "";
+  return existsSync4(join6(cwd, "src")) ? "src/" : "";
 }
 function dependenciesOf(cwd) {
-  const manifest = manifestOf2(cwd);
+  const manifest = manifestOf(cwd);
   if (manifest === void 0) {
     return void 0;
   }
@@ -4514,14 +4274,14 @@ function dependenciesOf(cwd) {
   }
   return names;
 }
-function manifestOf2(cwd) {
-  const file = join7(cwd, "package.json");
-  if (!existsSync6(file)) {
+function manifestOf(cwd) {
+  const file = join6(cwd, "package.json");
+  if (!existsSync4(file)) {
     return void 0;
   }
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync7(file, "utf8"));
+    manifest = JSON.parse(readFileSync6(file, "utf8"));
   } catch {
     return void 0;
   }
@@ -4537,7 +4297,7 @@ function detectFramework(cwd) {
       return detectedFrom(cwd, signature.name, signature.publicPrefixes);
     }
   }
-  if (existsSync6(join7(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
+  if (existsSync4(join6(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
     return detectedFrom(cwd, "Bun", []);
   }
   return void 0;
@@ -4557,7 +4317,7 @@ function detectAlias(cwd) {
   return hasImportsBlock(cwd) ? IMPORTS_ALIAS : DEFAULT_ALIAS;
 }
 function hasImportsBlock(cwd) {
-  const manifest = manifestOf2(cwd);
+  const manifest = manifestOf(cwd);
   const imports = manifest?.imports;
   return imports !== null && typeof imports === "object" && !Array.isArray(imports);
 }
@@ -4616,8 +4376,8 @@ function draftFieldsAcross(sources, environments) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname6, join as join9, resolve as resolve6 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 import {
   CUTOVER_PATH as CUTOVER_PATH3,
@@ -4625,7 +4385,7 @@ import {
   isLegalEnvironmentName as isLegalEnvironmentName2,
   loadConfigFrom,
   PENV_DIR as PENV_DIR2,
-  PenvError as PenvError18,
+  PenvError as PenvError16,
   parameterId as parameterId6,
   parseDotenv,
   RECORDS_PATH as RECORDS_PATH3,
@@ -4642,32 +4402,32 @@ import { defineCommand as defineCommand13 } from "citty";
 
 // src/scaffold-undo.ts
 import {
-  existsSync as existsSync7,
+  existsSync as existsSync5,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync7,
   rmdirSync,
-  statSync as statSync3,
+  statSync as statSync2,
   unlinkSync,
   writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { dirname as dirname5, join as join7 } from "path";
 function record(path, files, dirs) {
   let stats;
   try {
-    stats = statSync3(path);
+    stats = statSync2(path);
   } catch {
     return;
   }
   if (stats.isDirectory()) {
     dirs.add(path);
     for (const entry of readdirSync4(path)) {
-      record(join8(path, entry), files, dirs);
+      record(join7(path, entry), files, dirs);
     }
     return;
   }
   if (stats.isFile()) {
-    files.set(path, readFileSync8(path));
+    files.set(path, readFileSync7(path));
   }
 }
 function captureScaffold(root, paths) {
@@ -4675,7 +4435,7 @@ function captureScaffold(root, paths) {
   const dirs = /* @__PURE__ */ new Set();
   for (const path of paths) {
     for (let dir = dirname5(path); dir.startsWith(root) && dir !== root; dir = dirname5(dir)) {
-      if (existsSync7(dir)) {
+      if (existsSync5(dir)) {
         dirs.add(dir);
       }
     }
@@ -4698,7 +4458,7 @@ function restoreScaffold(undo) {
 function removeAdded(path, undo) {
   let stats;
   try {
-    stats = statSync3(path);
+    stats = statSync2(path);
   } catch {
     return;
   }
@@ -4712,7 +4472,7 @@ function removeAdded(path, undo) {
     return;
   }
   for (const entry of readdirSync4(path)) {
-    removeAdded(join8(path, entry), undo);
+    removeAdded(join7(path, entry), undo);
   }
   if (!undo.dirs.has(path) && readdirSync4(path).length === 0) {
     rmdirSync(path);
@@ -4906,7 +4666,7 @@ function suggestEnvironments(root) {
   return [...found].sort();
 }
 function emptyFlag(flag) {
-  return new PenvError18(
+  return new PenvError16(
     "INIT_FLAG_EMPTY",
     `\`--${flag}\` was given without a value`,
     flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${DEFAULT_SCHEMA_FILE2}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
@@ -4930,8 +4690,8 @@ function configOf(decisions) {
   return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
 }
 function declaredIn(root) {
-  const file = join9(root, CONFIG_FILE);
-  if (!existsSync8(file)) {
+  const file = join8(root, CONFIG_FILE);
+  if (!existsSync6(file)) {
     return void 0;
   }
   return loadConfigFrom(file);
@@ -4969,7 +4729,7 @@ function planInit(root, flags = {}) {
     throw emptyFlag("alias");
   }
   if (!ALIAS_NAME.test(alias)) {
-    throw new PenvError18(
+    throw new PenvError16(
       "INIT_ALIAS_INVALID",
       `\`${alias}\` is not an alias penv can write`,
       `An alias is \`@name\` \u2014 a tsconfig \`paths\` entry a bundler resolves \u2014 or \`#name\`, a package.json \`imports\` entry Node resolves itself. Those are the two things a module specifier can be that is not a package.`
@@ -5303,7 +5063,7 @@ ${objectIndent}${source.slice(close)}`;
 ${entryIndent}${member},${source.slice(open + 1)}`;
 }
 function shapeError(what, target, alias) {
-  return new PenvError18(
+  return new PenvError16(
     "TSCONFIG_SHAPE",
     `penv cannot add the \`${alias}\` path alias to tsconfig.json: ${what}`,
     `Add it by hand: \`{ "compilerOptions": { "paths": { "${alias}": ["${target}"] } } }\`.`
@@ -5374,15 +5134,15 @@ function renderTsconfig(target, alias) {
 }
 function ensurePenvDir(root) {
   const dir = resolve6(root, PENV_DIR2);
-  if (existsSync8(dir)) {
+  if (existsSync6(dir)) {
     return { target: "penv-dir", action: "kept", text: `Found ${PENV_DIR2}/` };
   }
   mkdirSync4(dir, { recursive: true });
   return { target: "penv-dir", action: "created", text: `Created ${PENV_DIR2}/` };
 }
 function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
-  const file = join9(root, SCHEMA_SHAPE_FILE3);
-  if (existsSync8(file)) {
+  const file = join8(root, SCHEMA_SHAPE_FILE3);
+  if (existsSync6(file)) {
     return {
       target: "schema",
       action: "kept",
@@ -5408,8 +5168,8 @@ function writeSchemaShapeFile(root, fields, draft, decisions = DEFAULT_DECISIONS
   };
 }
 function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
-  const file = join9(root, ...decisions.schemaFile.split("/"));
-  if (existsSync8(file)) {
+  const file = join8(root, ...decisions.schemaFile.split("/"));
+  if (existsSync6(file)) {
     return {
       target: "env",
       action: "kept",
@@ -5427,8 +5187,8 @@ function writeEnvFile(root, decisions = DEFAULT_DECISIONS) {
   };
 }
 function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
-  const file = join9(root, CONFIG_FILE);
-  if (existsSync8(file)) {
+  const file = join8(root, CONFIG_FILE);
+  if (existsSync6(file)) {
     return { target: "config", action: "kept", text: `Kept ${CONFIG_FILE}` };
   }
   writeFileSync5(file, renderConfigModule(decisions), "utf8");
@@ -5437,9 +5197,9 @@ function writeConfigFile(root, decisions = DEFAULT_DECISIONS) {
 function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
   const alias = decisions.alias;
   const imports = alias.startsWith(IMPORTS_PREFIX);
-  const file = join9(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
-  const where = imports ? PACKAGE_FILE : TSCONFIG_FILE;
-  if (!existsSync8(file)) {
+  const file = join8(root, imports ? PACKAGE_FILE : TSCONFIG_FILE);
+  const where2 = imports ? PACKAGE_FILE : TSCONFIG_FILE;
+  if (!existsSync6(file)) {
     if (imports) {
       return {
         target: "tsconfig",
@@ -5455,13 +5215,13 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
       text: `Created ${TSCONFIG_FILE} with the ${alias} path alias`
     };
   }
-  const source = readFileSync9(file, "utf8");
+  const source = readFileSync8(file, "utf8");
   const edit = imports ? insertImportsAlias(source, decisions.schemaFile, alias) : insertEnvAlias(source, decisions.schemaFile, alias);
   if (edit.conflict !== void 0) {
     return {
       target: "tsconfig",
       action: "conflicted",
-      text: `${where} already maps ${alias} to ${edit.conflict}`,
+      text: `${where2} already maps ${alias} to ${edit.conflict}`,
       note: `(left alone \u2014 \`import { env } from "${alias}"\` will not reach ${decisions.schemaFile})`
     };
   }
@@ -5469,20 +5229,20 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
     return {
       target: "tsconfig",
       action: "kept",
-      text: `Kept the ${alias} alias in ${where}`
+      text: `Kept the ${alias} alias in ${where2}`
     };
   }
   writeFileSync5(file, edit.source, "utf8");
   return {
     target: "tsconfig",
     action: "updated",
-    text: `Added ${alias} alias to ${where}`
+    text: `Added ${alias} alias to ${where2}`
   };
 }
 function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
-  const file = join9(root, ...STATE_GITIGNORE_PATH.split("/"));
+  const file = join8(root, ...STATE_GITIGNORE_PATH.split("/"));
   const wanted = renderStateGitignore(configOf(decisions));
-  const existing = existsSync8(file) ? readFileSync9(file, "utf8") : void 0;
+  const existing = existsSync6(file) ? readFileSync8(file, "utf8") : void 0;
   if (existing === wanted) {
     return { target: "gitignore", action: "kept", text: `Kept ${STATE_GITIGNORE_PATH}` };
   }
@@ -5503,12 +5263,12 @@ function outdatedRuntimeWarning(root) {
   return `Injection needs @penvhq/penv ${INJECT_MIN_VERSION}+ \u2014 this project has ${version}, whose \`load\` ignores \`{ inject: true }\`. Upgrade, or process.env stays empty.`;
 }
 function installedPenvVersion(root) {
-  const file = join9(root, "node_modules", "@penvhq", "penv", "package.json");
-  if (!existsSync8(file)) {
+  const file = join8(root, "node_modules", "@penvhq", "penv", "package.json");
+  if (!existsSync6(file)) {
     return void 0;
   }
   try {
-    const version = JSON.parse(readFileSync9(file, "utf8")).version;
+    const version = JSON.parse(readFileSync8(file, "utf8")).version;
     return typeof version === "string" ? version : void 0;
   } catch {
     return void 0;
@@ -5548,11 +5308,11 @@ function writeSeam(root, decisions = DEFAULT_DECISIONS, framework = detectFramew
     };
   }
   const alsoNote = writeAlso(root, seam.also);
-  const file = join9(root, ...seam.file.split("/"));
+  const file = join8(root, ...seam.file.split("/"));
   const baseNotes = [...seam.notes, ...alsoNote === void 0 ? [] : [alsoNote]];
   const notes = baseNotes.length === 0 ? "" : `
 ${baseNotes.map((n) => `  ${n}`).join("\n")}`;
-  if (existsSync8(file)) {
+  if (existsSync6(file)) {
     return {
       target: "seam",
       action: "info",
@@ -5573,8 +5333,8 @@ function writeAlso(root, also) {
   if (also === void 0) {
     return void 0;
   }
-  const file = join9(root, ...also.file.split("/"));
-  if (existsSync8(file)) {
+  const file = join8(root, ...also.file.split("/"));
+  if (existsSync6(file)) {
     return also.ifPresent;
   }
   mkdirSync4(dirname6(file), { recursive: true });
@@ -5604,7 +5364,7 @@ function scaffold(root, fields, draft, decisions = DEFAULT_DECISIONS, framework
   return seam === void 0 ? steps : [...steps, seam];
 }
 function scaffoldPaths(root, decisions = DEFAULT_DECISIONS, framework = detectFramework(root)?.name) {
-  const fileAt = (relative5) => join9(root, ...relative5.split("/"));
+  const fileAt = (relative5) => join8(root, ...relative5.split("/"));
   const seam = decisions.inject ? seamFor(framework, {
     alias: decisions.alias,
     srcDir: srcPrefix(root),
@@ -5645,7 +5405,7 @@ function planCutover(input) {
   assertBundleResolved(root);
   const selected = [...input.selected];
   if (selected.length === 0) {
-    throw new PenvError18(
+    throw new PenvError16(
       "INIT_NOTHING_SELECTED",
       "No dotenv file was selected, so there is nothing to migrate",
       "Run `penv init` again and choose the files penv should adopt."
@@ -5657,7 +5417,7 @@ function planCutover(input) {
   const environments = declared === void 0 ? chosen : declared.environments;
   for (const environment of chosen) {
     if (!environments.includes(environment)) {
-      throw new PenvError18(
+      throw new PenvError16(
         "INIT_ENVIRONMENT_UNDECLARED",
         `${CONFIG_FILE} declares ${describeList(environments)}, and adopting these files needs \`${environment}\` declared too`,
         `Add \`${environment}\` to \`environments\` in ${CONFIG_FILE}, with a provider for it, then run \`penv init\` again. Nothing was changed.`
@@ -5682,7 +5442,7 @@ function planCutover(input) {
   const diagnostics = [];
   let variables = 0;
   for (const file of selected) {
-    const parsed = parseDotenv(readFileSync9(join9(root, file.name), "utf8"));
+    const parsed = parseDotenv(readFileSync8(join8(root, file.name), "utf8"));
     const fileRefs = refsForEntries(parsed.entries, file.name, config);
     adopted.push({ file, entries: parsed.entries, refs: fileRefs, scope: scopeOf(file) });
     refs.push(...fileRefs);
@@ -5744,7 +5504,7 @@ function requireEnvironment(input) {
   if (environment.length > 0) {
     return environment;
   }
-  throw new PenvError18(
+  throw new PenvError16(
     "INIT_ENVIRONMENT_UNNAMED",
     "The selected files name no environment, and penv does not invent one",
     `Run \`penv init --env ${DEVELOPMENT}\` to say which environment these values are for.`
@@ -5756,7 +5516,7 @@ function assertCascadeComplete(root, selected, environments) {
   for (const environment of environments) {
     for (const name of cascadeFor(environment)) {
       if (present.has(name) && !taken.has(name)) {
-        throw new PenvError18(
+        throw new PenvError16(
           "INIT_CUTOVER_INCOMPLETE",
           `${name} is part of ${environment}'s cascade and was not selected, so your framework would keep reading it beside penv`,
           "Run `penv init` again and take every file penv listed for that environment. Nothing was changed."
@@ -5769,7 +5529,7 @@ function assertBundleResolved(root) {
   if (!bundleUnresolved(root)) {
     return;
   }
-  throw new PenvError18(
+  throw new PenvError16(
     "INIT_BUNDLE_UNRESOLVED",
     `The dotenv files from the last cutover are still in ${ROLLBACK_DOTENV_PATH3}/, and penv will not migrate a second time over them`,
     "Run `penv init undo` to put them back, or `penv cleanup` to drop them once you are happy with the migration."
@@ -5781,7 +5541,7 @@ function selectionForYes(plan2) {
     (file) => file.environment !== void 0 && file.environment !== DEVELOPMENT
   );
   if (shared !== void 0 && other !== void 0) {
-    throw new PenvError18(
+    throw new PenvError16(
       "INIT_YES_SHARED_FALLBACK",
       `${other.name} falls back to the shared ${shared.name} this cutover would move, so \`--yes\` will not decide what happens to ${other.environment ?? ""}`,
       "Run `penv init` without `--yes` and choose every file the cutover takes. Nothing was changed."
@@ -5827,7 +5587,7 @@ function issueLines(result2) {
 }
 var SCAFFOLD_ROLLED_BACK = "penv put the project back as it found it \u2014 your dotenv files and everything else are exactly where they were.";
 function invalidAfterImport(result2) {
-  return new PenvError18(
+  return new PenvError16(
     "INIT_CUTOVER_INVALID",
     `The imported values do not satisfy the draft schema for ${result2.environment}:
 ${issueLines(result2)}`,
@@ -5835,7 +5595,7 @@ ${issueLines(result2)}`,
   );
 }
 function draftNotLoaded(result2) {
-  return new PenvError18(
+  return new PenvError16(
     "INIT_DRAFT_NOT_LOADED",
     `penv could not load the schema it drafted for ${result2.environment}, so nothing was checked against it:
 ${issueLines(result2)}`,
@@ -5926,12 +5686,12 @@ function dailyCommand(root) {
   return `penv run -- ${detectPackageManager(root)} ${devScript(root)}`;
 }
 function devScript(root) {
-  const file = join9(root, PACKAGE_FILE);
-  if (!existsSync8(file)) {
+  const file = join8(root, PACKAGE_FILE);
+  if (!existsSync6(file)) {
     return "dev";
   }
   try {
-    const scripts = JSON.parse(readFileSync9(file, "utf8")).scripts;
+    const scripts = JSON.parse(readFileSync8(file, "utf8")).scripts;
     if (scripts !== null && typeof scripts === "object" && !Array.isArray(scripts)) {
       const named = Object.keys(scripts);
       return ["dev", "start"].find((script) => named.includes(script)) ?? named[0] ?? "dev";
@@ -5975,7 +5735,7 @@ async function promptForSelection(plan2, io) {
   for (const name of names) {
     const file = plan2.found.find((candidate) => candidate.name === name);
     if (file === void 0) {
-      throw new PenvError18(
+      throw new PenvError16(
         "INIT_SELECTION_UNKNOWN",
         `\`${name}\` is not one of the dotenv files penv found`,
         "Run `penv init` again and name the files exactly as they are listed, e.g. `.env.production`."
@@ -6138,7 +5898,7 @@ var initCommand = defineCommand13({
 });
 function runUndoAction(root, action) {
   if (action !== "undo") {
-    throw new PenvError18(
+    throw new PenvError16(
       "INIT_UNKNOWN_ACTION",
       `\`penv init ${action}\` is not something init does`,
       "Run `penv init undo` to put back the dotenv files of the last cutover."
@@ -6244,7 +6004,7 @@ function explicitEnvironment(options, source, config) {
   if (value.length > 0) {
     return value;
   }
-  throw new PenvError19(
+  throw new PenvError17(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
     `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
@@ -6254,7 +6014,7 @@ function assertEnvironmentAgrees(derived, explicit, source) {
   if (derived === void 0 || explicit === void 0 || derived === explicit) {
     return;
   }
-  throw new PenvError19(
+  throw new PenvError17(
     "IMPORT_ENV_CONFLICT",
     `The file ${source} is scoped to environment ${derived}, but \`--env ${explicit}\` names ${explicit}`,
     `Drop \`--env\` to import ${source} as ${derived}, pass \`--env ${derived}\` to say the same thing twice, or point \`penv import\` at the file that holds ${explicit}'s values. Nothing was imported.`
@@ -6299,15 +6059,15 @@ function configInEffect(cwd, environment) {
 }
 function importDotenv(options) {
   const cwd = resolve7(options.cwd);
-  const file = isAbsolute4(options.file) ? options.file : resolve7(cwd, options.file);
-  if (!existsSync9(file)) {
-    throw new PenvError19(
+  const file = isAbsolute3(options.file) ? options.file : resolve7(cwd, options.file);
+  if (!existsSync7(file)) {
+    throw new PenvError17(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = parseDotenv2(readFileSync10(file, "utf8"));
+  const parsed = parseDotenv2(readFileSync9(file, "utf8"));
   const { config, decisions } = configInEffect(cwd, environmentNamed(file, options.environment));
   const source = displayPath3(cwd, file);
   const named = scopeFromFilename(file, config);
@@ -6425,19 +6185,19 @@ var importCommand = defineCommand14({
 
 // src/commands/key.ts
 import { randomBytes } from "crypto";
-import { KEY_BYTES, KEYCHAIN_SERVICE, PenvError as PenvError21 } from "@penvhq/core";
+import { KEY_BYTES, KEYCHAIN_SERVICE, PenvError as PenvError19 } from "@penvhq/core";
 import { defineCommand as defineCommand15 } from "citty";
 
 // src/keychain.ts
 import { createRequire as createRequire3 } from "module";
-import { PenvError as PenvError20 } from "@penvhq/core";
+import { PenvError as PenvError18 } from "@penvhq/core";
 var KEYRING_MODULE = "@napi-rs/keyring";
 var nodeRequire = (id) => createRequire3(import.meta.url)(id);
 function firstLine2(cause) {
   return (cause instanceof Error ? cause.message : String(cause)).split("\n")[0] ?? "";
 }
 function keyringMissing(cause) {
-  return new PenvError20(
+  return new PenvError18(
     "KEYCHAIN_BINDING_MISSING",
     `penv could not load ${KEYRING_MODULE}, the native binding it reads your OS keychain through`,
     `This penv engine was installed as a plain tarball, which carries no native modules. Install penv with \`npm install -g @penvhq/launcher\`, or declare \`source: "env"\` for this environment and export its key. Original error: ${firstLine2(cause)}`
@@ -6479,7 +6239,7 @@ function runKeyCreate(options) {
   const environment = targetEnvironment(project, options.environment);
   const declared = project.config.keys?.[environment];
   if (declared === void 0) {
-    throw new PenvError21(
+    throw new PenvError19(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
       `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
@@ -6493,17 +6253,17 @@ function runKeyCreate(options) {
       try {
         existing = keychain.getPassword(KEYCHAIN_SERVICE, declared.id);
       } catch (cause) {
-        if (cause instanceof PenvError21) {
+        if (cause instanceof PenvError19) {
           throw cause;
         }
-        throw new PenvError21(
+        throw new PenvError19(
           "KEYCHAIN_UNAVAILABLE",
           `penv could not read your OS keychain to check for an existing key \`${declared.id}\``,
           `Unlock your keychain and run this again. Original error: ${cause instanceof Error ? cause.message : String(cause)}`
         );
       }
       if (existing !== null) {
-        throw new PenvError21(
+        throw new PenvError19(
           "KEY_EXISTS",
           `Environment ${environment} already has a key \`${declared.id}\` in your OS keychain`,
           "Replacing it would orphan every value already sealed under it \u2014 they could never be decrypted again. Re-run with `--force` only if you are certain nothing is sealed under the current key."
@@ -6658,21 +6418,21 @@ var listCommand = defineCommand16({
 
 // src/commands/migrate.ts
 import {
-  existsSync as existsSync10,
+  existsSync as existsSync8,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync10,
   renameSync as renameSync2,
   rmSync as rmSync2,
   writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
+import { dirname as dirname7, join as join9 } from "path";
 import { createInterface as createInterface3 } from "readline/promises";
 import {
   loadConfig as loadConfig2,
   oldLayoutEntries,
   PENV_DIR as PENV_DIR3,
-  PenvError as PenvError22,
+  PenvError as PenvError20,
   RECORDS_PATH as RECORDS_PATH5,
   recordsDir as recordsDir3,
   renderStateGitignore as renderStateGitignore2,
@@ -6687,17 +6447,17 @@ function planMigrate(cwd) {
   const tree = recordsDir3(root);
   const collisions = collidingEntries(entries, tree);
   if (collisions.length > 0) {
-    throw new PenvError22(
+    throw new PenvError20(
       "HALF_MIGRATED",
-      `${describe2(collisions)} in both \`${PENV_DIR3}/\` and \`${RECORDS_PATH5}/\`, and penv cannot tell which copy is current`,
+      `${describe(collisions)} in both \`${PENV_DIR3}/\` and \`${RECORDS_PATH5}/\`, and penv cannot tell which copy is current`,
       `Move what is left under \`${PENV_DIR3}/\` into \`${RECORDS_PATH5}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
     );
   }
   const creates = [];
-  if (entries.length > 0 && !existsSync10(tree)) {
+  if (entries.length > 0 && !existsSync8(tree)) {
     creates.push(`${RECORDS_PATH5}/`);
   }
-  if (readIfPresent(join10(root, ...STATE_GITIGNORE_PATH2.split("/"))) !== renderStateGitignore2(config)) {
+  if (readIfPresent(join9(root, ...STATE_GITIGNORE_PATH2.split("/"))) !== renderStateGitignore2(config)) {
     creates.push(STATE_GITIGNORE_PATH2);
   }
   return {
@@ -6707,11 +6467,11 @@ function planMigrate(cwd) {
       to: `${RECORDS_PATH5}/${entry}`
     })),
     creates,
-    removes: existsSync10(join10(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
+    removes: existsSync8(join9(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
   };
 }
 function readIfPresent(file) {
-  return existsSync10(file) ? readFileSync11(file, "utf8") : void 0;
+  return existsSync8(file) ? readFileSync10(file, "utf8") : void 0;
 }
 function collidingEntries(entries, tree) {
   let held;
@@ -6723,7 +6483,7 @@ function collidingEntries(entries, tree) {
   const taken = new Set(held.map((name) => name.toLowerCase()));
   return entries.filter((entry) => taken.has(entry.toLowerCase())).sort();
 }
-function describe2(names) {
+function describe(names) {
   return names.length === 1 ? `\`${names[0]}\` is` : `${names.map((name) => `\`${name}\``).join(", ")} are`;
 }
 function isNoop(plan2) {
@@ -6737,16 +6497,16 @@ function applyMigrate(plan2) {
   if (plan2.moves.length > 0) {
     mkdirSync5(recordsDir3(plan2.root), { recursive: true });
     for (const move of plan2.moves) {
-      renameSync2(join10(plan2.root, ...move.from.split("/")), join10(plan2.root, ...move.to.split("/")));
+      renameSync2(join9(plan2.root, ...move.from.split("/")), join9(plan2.root, ...move.to.split("/")));
     }
   }
   if (plan2.creates.includes(STATE_GITIGNORE_PATH2)) {
-    const ignore = join10(plan2.root, ...STATE_GITIGNORE_PATH2.split("/"));
+    const ignore = join9(plan2.root, ...STATE_GITIGNORE_PATH2.split("/"));
     mkdirSync5(dirname7(ignore), { recursive: true });
     writeFileSync6(ignore, renderStateGitignore2(config), "utf8");
   }
   for (const removed of plan2.removes) {
-    rmSync2(join10(plan2.root, ...removed.split("/")), { force: true });
+    rmSync2(join9(plan2.root, ...removed.split("/")), { force: true });
   }
   return { ...plan2, status: "migrated" };
 }
@@ -6828,7 +6588,7 @@ import {
   formatMetaFile,
   formatValueFile as formatValueFile6,
   openValue as openValue4,
-  PenvError as PenvError23,
+  PenvError as PenvError21,
   parameterId as parameterId7,
   recordPath as recordPath7,
   sealValue as sealValue3
@@ -6848,7 +6608,7 @@ async function planFile(project, source, target, parameter) {
   }
   const environment = environmentOf2(source);
   if (environment === void 0) {
-    throw new PenvError23(
+    throw new PenvError21(
       "SECRET_SCOPE_AMBIGUOUS",
       `${recordPath7(formatValueFile6(source))} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
       "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
@@ -6857,7 +6617,7 @@ async function planFile(project, source, target, parameter) {
   const keys = keySourceFor(project, environment);
   const opened = openValue4(source, stored, keys);
   if (opened.kind === "failed") {
-    throw new PenvError23(
+    throw new PenvError21(
       "VALUE_UNDECRYPTABLE",
       `${recordPath7(formatValueFile6(source))} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
       "A sealed value is bound to the file it lives in, so moving it means opening it and sealing it again. Make the key available and run this again. Nothing has been moved."
@@ -6880,7 +6640,7 @@ async function runMove(options) {
   assertWritableKey(options.to);
   const to = refFromKey(options.to, project.config);
   if (parameterId7(from) === parameterId7(to)) {
-    throw new PenvError23(
+    throw new PenvError21(
       "PARAMETER_UNCHANGED",
       `\`${options.from}\` and \`${options.to}\` are the same parameter`,
       "Name a different destination, e.g. `penv mv redis-password redis/password`."
@@ -6890,7 +6650,7 @@ async function runMove(options) {
   const sources = filesOf(all, from);
   const meta = await project.provider.readMeta(from);
   if (sources.length === 0 && meta === void 0) {
-    throw new PenvError23(
+    throw new PenvError21(
       "PARAMETER_ABSENT",
       `Parameter ${parameterId7(from)} has no value files and no meta, so there is nothing to move`,
       `\`penv list\` shows every parameter penv holds.`
@@ -6898,7 +6658,7 @@ async function runMove(options) {
   }
   const occupied2 = filesOf(all, to);
   if (occupied2.length > 0 || await project.provider.readMeta(to) !== void 0) {
-    throw new PenvError23(
+    throw new PenvError21(
       "PARAMETER_EXISTS",
       `Parameter ${parameterId7(to)} already exists, and penv will not merge two parameters into one`,
       `Remove or rename ${parameterId7(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
@@ -7057,7 +6817,7 @@ import {
   beginRotation,
   completeRotation,
   holdsRecords as holdsRecords2,
-  PenvError as PenvError24,
+  PenvError as PenvError22,
   retainsPrevious,
   rotationOf as rotationOf2
 } from "@penvhq/core";
@@ -7086,7 +6846,7 @@ async function writeRotatedValue(project, provider, ref, environment, value) {
 }
 function requireNewValue(value, phase, key) {
   if (value === void 0) {
-    throw new PenvError24(
+    throw new PenvError22(
       "ROTATION_NO_VALUE",
       `A ${phase} rotation of ${key} writes a new value, and none was given`,
       "Pass the new value as the argument \u2014 `penv rotate <key> <value>` \u2014 or pipe it in on stdin."
@@ -7096,7 +6856,7 @@ function requireNewValue(value, phase, key) {
 }
 function requireRetaining(provider, environment) {
   if (!retainsPrevious(provider)) {
-    throw new PenvError24(
+    throw new PenvError22(
       "ROTATION_NOT_RETAINING",
       `A dual-valid rotation needs the previous value to stay readable during the grace window, and the \`${provider.type}\` provider for environment ${environment} does not retain it`,
       "Point this environment at a provider that keeps prior versions (its `readPrevious` is what penv reads during the window), or, if a momentary overlap is not required, declare the parameter `atomic-cutover` in its meta and flip it in one step."
@@ -7110,7 +6870,7 @@ async function runRotate(options) {
   const ref = refFromKey(options.key, project.config);
   const source = await sourceProviderFor(project, environment);
   if (!holdsRecords2(source)) {
-    throw new PenvError24(
+    throw new PenvError22(
       "ROTATION_NOT_RECORDS",
       `Environment ${environment} is backed by \`${source.type}\`, which holds a resolved projection penv cannot rotate in place`,
       "Rotate the parameter in the environment that holds the records (the local tree, Vault, SSM), then `penv push` the result to this destination."
@@ -7121,7 +6881,7 @@ async function runRotate(options) {
   const before = await provider.readMeta(ref);
   const { mechanism } = rotationOf2(before, environment);
   if (mechanism === void 0) {
-    throw new PenvError24(
+    throw new PenvError22(
       "ROTATION_NO_MECHANISM",
       `Parameter ${options.key} declares no rotation mechanism for environment ${environment}, so penv does not know how to rotate it`,
       'Set `rotationMechanism` in the parameter\'s meta to `"dual-valid"` (a grace-window overlap) or `"atomic-cutover"` (a single flip), then run `penv rotate` again.'
@@ -7131,7 +6891,7 @@ async function runRotate(options) {
   const complete = options.complete === true;
   if (mechanism === "atomic-cutover") {
     if (begin || complete) {
-      throw new PenvError24(
+      throw new PenvError22(
         "ROTATION_MECHANISM_MISMATCH",
         `Parameter ${options.key} is atomic-cutover, which flips in one step, so \`--begin\`/\`--complete\` do not apply`,
         "Run `penv rotate <key> <value>` with no phase flag to flip it. `--begin`/`--complete` bracket a dual-valid grace window, which atomic-cutover has none of."
@@ -7145,7 +6905,7 @@ async function runRotate(options) {
   }
   const retaining = requireRetaining(provider, environment);
   if (begin === complete) {
-    throw new PenvError24(
+    throw new PenvError22(
       "ROTATION_PHASE_REQUIRED",
       `A dual-valid rotation of ${options.key} needs exactly one of \`--begin\` or \`--complete\``,
       "`--begin` writes the new value and opens the grace window; `--complete` closes it once every reader has moved to the new value. Run them in that order, one at a time."
@@ -7248,7 +7008,7 @@ var rotateCommand = defineCommand20({
 });
 
 // src/commands/watch.ts
-import { existsSync as existsSync11, watch as watch2 } from "fs";
+import { existsSync as existsSync9, watch as watch2 } from "fs";
 import { basename as basename3, dirname as dirname8, resolve as resolve8 } from "path";
 import { SCHEMA_SHAPE_FILE as SCHEMA_SHAPE_FILE4, schemaFileOf as schemaFileOf5, schemaInsideTree } from "@penvhq/core";
 import { defineCommand as defineCommand21 } from "citty";
@@ -7316,14 +7076,14 @@ function runWatch(options) {
         if (closed || recovery === void 0) {
           return;
         }
-        if (!existsSync11(parent)) {
+        if (!existsSync9(parent)) {
           stop2(recovery);
           return;
         }
         if (filename !== null && basename3(filename) !== name) {
           return;
         }
-        if (!existsSync11(target)) {
+        if (!existsSync9(target)) {
           return;
         }
         stop2(recovery);
@@ -7347,7 +7107,7 @@ function runWatch(options) {
       if (closed) {
         return;
       }
-      if (!existsSync11(target)) {
+      if (!existsSync9(target)) {
         if (watcher !== void 0) {
           stop2(watcher);
         }