@wrkspace-co/env 0.1.0

package/dist/chunk-32DQKIYR.js

@@ -0,0 +1,4474 @@
+// src/plugin.ts
+import { Command } from "commander";
+
+// src/audit-command.ts
+import { access as access4, readFile as readFile4 } from "fs/promises";
+import path4 from "path";
+
+// src/dotenv.ts
+function detectNewline(content) {
+  const match = content.match(/\r\n|\n/);
+  if (!match) {
+    return "\n";
+  }
+  return match[0] === "\r\n" ? "\r\n" : "\n";
+}
+function decodeDoubleQuoted(input) {
+  return input.replace(/\\([nrt"\\])/g, (_fullMatch, token) => {
+    switch (token) {
+      case "n":
+        return "\n";
+      case "r":
+        return "\r";
+      case "t":
+        return "	";
+      case '"':
+        return '"';
+      case "\\":
+        return "\\";
+      default:
+        return token;
+    }
+  });
+}
+function encodeDoubleQuoted(input) {
+  return input.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/"/g, '\\"');
+}
+function parseInlineComment(input) {
+  const trimmedStart = input.trimStart();
+  if (!trimmedStart.startsWith("#")) {
+    return void 0;
+  }
+  return trimmedStart;
+}
+function parseUnquotedValue(input) {
+  let splitIndex = input.length;
+  for (let i = 0; i < input.length; i += 1) {
+    if (input[i] !== "#") {
+      continue;
+    }
+    if (i === 0 || /\s/.test(input[i - 1])) {
+      splitIndex = i;
+      break;
+    }
+  }
+  const rawValue = input.slice(0, splitIndex).trimEnd();
+  const remainder = input.slice(splitIndex);
+  return {
+    value: rawValue.replace(/\\n/g, "\n"),
+    quote: "none",
+    inlineComment: parseInlineComment(remainder)
+  };
+}
+function parseQuotedValue(input, quote) {
+  const escaped = quote === '"';
+  let cursor = 1;
+  let isEscaping = false;
+  while (cursor < input.length) {
+    const current = input[cursor];
+    if (escaped && !isEscaping && current === "\\") {
+      isEscaping = true;
+      cursor += 1;
+      continue;
+    }
+    if (!isEscaping && current === quote) {
+      break;
+    }
+    isEscaping = false;
+    cursor += 1;
+  }
+  if (cursor >= input.length || input[cursor] !== quote) {
+    return {
+      value: input,
+      quote: "none"
+    };
+  }
+  const innerValue = input.slice(1, cursor);
+  const remainder = input.slice(cursor + 1);
+  return {
+    value: quote === '"' ? decodeDoubleQuoted(innerValue) : innerValue,
+    quote: quote === '"' ? "double" : "single",
+    inlineComment: parseInlineComment(remainder)
+  };
+}
+function parseValueSegment(rawValueSegment) {
+  const trimmed = rawValueSegment.trimStart();
+  if (trimmed.startsWith('"')) {
+    return parseQuotedValue(trimmed, '"');
+  }
+  if (trimmed.startsWith("'")) {
+    return parseQuotedValue(trimmed, "'");
+  }
+  return parseUnquotedValue(trimmed);
+}
+function parseDotenv(content) {
+  const newline = detectNewline(content);
+  const hasTrailingNewline = content.endsWith(newline);
+  const rawLines = content.length > 0 ? content.split(/\r?\n/) : [];
+  if (hasTrailingNewline) {
+    rawLines.pop();
+  }
+  const lines = rawLines.map((rawLine) => {
+    const trimmed = rawLine.trim();
+    if (trimmed.length === 0) {
+      return {
+        type: "blank",
+        raw: rawLine
+      };
+    }
+    if (trimmed.startsWith("#")) {
+      return {
+        type: "comment",
+        raw: rawLine
+      };
+    }
+    const pairMatch = rawLine.match(/^\s*(export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/);
+    if (!pairMatch) {
+      return {
+        type: "unknown",
+        raw: rawLine
+      };
+    }
+    const exported = Boolean(pairMatch[1]);
+    const key = pairMatch[2];
+    const parsed = parseValueSegment(pairMatch[3] ?? "");
+    return {
+      type: "pair",
+      raw: rawLine,
+      key,
+      value: parsed.value,
+      quote: parsed.quote,
+      exported,
+      inlineComment: parsed.inlineComment
+    };
+  });
+  return {
+    lines,
+    newline,
+    hasTrailingNewline
+  };
+}
+function canUseUnquoted(value) {
+  return /^[A-Za-z0-9_./:@+-]*$/.test(value);
+}
+function formatDotenvValue(value, preferredQuote = "none") {
+  if (value.length === 0) {
+    return "";
+  }
+  if (preferredQuote === "single" && !value.includes("'") && !value.includes("\n")) {
+    return `'${value}'`;
+  }
+  if (preferredQuote === "double") {
+    return `"${encodeDoubleQuoted(value)}"`;
+  }
+  if (preferredQuote === "none" && canUseUnquoted(value)) {
+    return value;
+  }
+  return `"${encodeDoubleQuoted(value)}"`;
+}
+function writeDotenv(document, options = {}) {
+  const updates = options.updates ?? {};
+  const seenKeys = /* @__PURE__ */ new Set();
+  const renderedLines = [];
+  for (const line of document.lines) {
+    if (line.type !== "pair") {
+      renderedLines.push(line.raw);
+      continue;
+    }
+    if (!Object.hasOwn(updates, line.key)) {
+      renderedLines.push(line.raw);
+      continue;
+    }
+    seenKeys.add(line.key);
+    const updatedValue = updates[line.key] ?? "";
+    const renderedValue = formatDotenvValue(updatedValue, line.quote);
+    const commentSuffix = line.inlineComment ? ` ${line.inlineComment}` : "";
+    const exportPrefix = line.exported ? "export " : "";
+    renderedLines.push(`${exportPrefix}${line.key}=${renderedValue}${commentSuffix}`);
+  }
+  let pendingKeys = Object.keys(updates).filter((key) => !seenKeys.has(key));
+  if (options.sortNewKeys !== false) {
+    pendingKeys = pendingKeys.sort();
+  }
+  if (pendingKeys.length > 0 && renderedLines.length > 0 && renderedLines.at(-1) !== "") {
+    renderedLines.push("");
+  }
+  for (const key of pendingKeys) {
+    const value = updates[key] ?? "";
+    renderedLines.push(`${key}=${formatDotenvValue(value)}`);
+  }
+  let output = renderedLines.join(document.newline);
+  if (document.hasTrailingNewline || pendingKeys.length > 0) {
+    output += document.newline;
+  }
+  return output;
+}
+function dotenvToObject(document) {
+  const output = {};
+  for (const line of document.lines) {
+    if (line.type === "pair") {
+      output[line.key] = line.value;
+    }
+  }
+  return output;
+}
+
+// src/env.ts
+var TARGETS = ["dev", "preview", "prod"];
+function normalizeTargets(requiredIn) {
+  if (!requiredIn || requiredIn.length === 0) {
+    return TARGETS;
+  }
+  const uniqueTargets = Array.from(new Set(requiredIn));
+  for (const target of uniqueTargets) {
+    if (!TARGETS.includes(target)) {
+      throw new Error(`Unknown env target "${target}". Expected one of: ${TARGETS.join(", ")}.`);
+    }
+  }
+  return uniqueTargets;
+}
+function createBaseDefinition(kind, config = {}) {
+  return {
+    kind,
+    scope: config.scope ?? "server",
+    requiredIn: normalizeTargets(config.requiredIn),
+    description: config.description,
+    example: config.example,
+    sensitive: config.sensitive,
+    owner: config.owner,
+    rotationDays: config.rotationDays,
+    deprecated: config.deprecated ? { ...config.deprecated } : void 0,
+    provider: config.provider ? { ...config.provider } : void 0,
+    tags: config.tags ? [...config.tags] : void 0,
+    defaultValue: config.defaultValue
+  };
+}
+function string(config = {}) {
+  return createBaseDefinition("string", config);
+}
+function url(config = {}) {
+  return createBaseDefinition("url", config);
+}
+function number(config = {}) {
+  return createBaseDefinition("number", config);
+}
+function boolean(config = {}) {
+  return createBaseDefinition("boolean", config);
+}
+function enumBuilder(values, config = {}) {
+  return {
+    ...createBaseDefinition("enum", config),
+    values: [...values]
+  };
+}
+function json(config = {}) {
+  return createBaseDefinition("json", config);
+}
+var builders = {
+  string,
+  url,
+  number,
+  boolean,
+  enum: enumBuilder,
+  json
+};
+function defineSchema(schema) {
+  return schema;
+}
+var prefixPolicies = {
+  nextjs: {
+    name: "nextjs",
+    publicPrefixes: ["NEXT_PUBLIC_"]
+  },
+  vite: {
+    name: "vite",
+    publicPrefixes: ["VITE_"]
+  }
+};
+function parseVariableValue(definition, rawValue) {
+  switch (definition.kind) {
+    case "string":
+      return rawValue;
+    case "url": {
+      return new URL(rawValue);
+    }
+    case "number": {
+      if (rawValue.trim().length === 0) {
+        throw new Error("must be a finite number");
+      }
+      const parsed = Number(rawValue);
+      if (!Number.isFinite(parsed)) {
+        throw new Error("must be a finite number");
+      }
+      return parsed;
+    }
+    case "boolean": {
+      const normalized = rawValue.trim().toLowerCase();
+      if (["true", "1", "yes", "on"].includes(normalized)) {
+        return true;
+      }
+      if (["false", "0", "no", "off"].includes(normalized)) {
+        return false;
+      }
+      throw new Error('must be a boolean ("true" or "false")');
+    }
+    case "enum": {
+      if (!definition.values.includes(rawValue)) {
+        throw new Error(`must be one of: ${definition.values.join(", ")}`);
+      }
+      return rawValue;
+    }
+    case "json": {
+      return JSON.parse(rawValue);
+    }
+    default:
+      throw new Error(`Unsupported variable kind "${String(definition.kind)}".`);
+  }
+}
+function parseRemoveAfter(removeAfter) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(removeAfter)) {
+    return /* @__PURE__ */ new Date(`${removeAfter}T23:59:59.999Z`);
+  }
+  const parsed = new Date(removeAfter);
+  if (Number.isNaN(parsed.getTime())) {
+    return void 0;
+  }
+  return parsed;
+}
+function hasPublicPrefix(key, prefixes) {
+  return prefixes.some((prefix) => key.startsWith(prefix));
+}
+function isUnsetRawValue(rawValue) {
+  return rawValue === void 0 || rawValue.trim().length === 0;
+}
+function createScopeIssue(key, target, scope, strict, code, message, fix) {
+  return {
+    key,
+    target,
+    scope,
+    code,
+    message,
+    fix,
+    severity: strict ? "error" : "warning"
+  };
+}
+function formatIssue(issue) {
+  if (!issue.fix) {
+    return `- ${issue.key}: ${issue.message}`;
+  }
+  return `- ${issue.key}: ${issue.message} Fix: ${issue.fix}`;
+}
+function formatValidationIssues(issues) {
+  if (issues.length === 0) {
+    return "Environment validation failed.";
+  }
+  const grouped = /* @__PURE__ */ new Map();
+  for (const issue of issues) {
+    const groupKey = `${issue.target}|${issue.scope}`;
+    const current = grouped.get(groupKey);
+    if (current) {
+      current.push(issue);
+    } else {
+      grouped.set(groupKey, [issue]);
+    }
+  }
+  const lines = ["Environment validation failed:"];
+  for (const [groupKey, groupIssues] of grouped) {
+    const [target, scope] = groupKey.split("|");
+    lines.push("");
+    lines.push(`[target=${target} scope=${scope}]`);
+    for (const issue of groupIssues) {
+      lines.push(formatIssue(issue));
+    }
+  }
+  lines.push("");
+  lines.push("Fix steps:");
+  lines.push("1) Add missing required values for the selected target environment.");
+  lines.push("2) Align variable names with your prefix policy and variable scope.");
+  return lines.join("\n");
+}
+var EnvValidationError = class extends Error {
+  issues;
+  constructor(issues) {
+    super(formatValidationIssues(issues));
+    this.name = "EnvValidationError";
+    this.issues = [...issues];
+  }
+};
+function createEnv(schema, options) {
+  const strict = options.strict ?? true;
+  const throwOnError = options.throwOnError ?? true;
+  const envValues = options.values ?? process.env;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const issues = [];
+  const values = {};
+  const rawValues = { ...envValues };
+  const prefixes = options.prefixPolicy?.publicPrefixes ?? [];
+  const warnedDeprecatedKeys = /* @__PURE__ */ new Set();
+  for (const [key, definition] of Object.entries(schema)) {
+    const deprecated = definition.deprecated;
+    const deprecatedRawValue = envValues[String(key)];
+    if (!deprecated || isUnsetRawValue(deprecatedRawValue)) {
+      continue;
+    }
+    const replacementKey = deprecated.replacedBy;
+    const hasReplacementKey = Boolean(replacementKey && replacementKey in schema);
+    const replacementRawValue = replacementKey ? rawValues[replacementKey] : void 0;
+    if (hasReplacementKey && replacementKey && isUnsetRawValue(replacementRawValue)) {
+      rawValues[replacementKey] = deprecatedRawValue;
+    }
+    const parsedDeadline = deprecated.removeAfter ? parseRemoveAfter(deprecated.removeAfter) : void 0;
+    const isExpired = parsedDeadline ? now.getTime() > parsedDeadline.getTime() : false;
+    if (isExpired) {
+      issues.push({
+        key: String(key),
+        target: options.target,
+        scope: definition.scope,
+        severity: strict ? "error" : "warning",
+        code: "DEPRECATED_EXPIRED",
+        message: `Deprecated key is past removeAfter (${deprecated.removeAfter}).`,
+        fix: replacementKey ? `Stop using "${String(key)}" and set "${replacementKey}" instead.` : `Remove "${String(key)}" from your environment.`
+      });
+      continue;
+    }
+    if (!strict && !warnedDeprecatedKeys.has(String(key))) {
+      issues.push({
+        key: String(key),
+        target: options.target,
+        scope: definition.scope,
+        severity: "warning",
+        code: "DEPRECATED_KEY_USED",
+        message: replacementKey ? `Deprecated key is used. Prefer "${replacementKey}".` : "Deprecated key is used.",
+        fix: replacementKey ? `Rename "${String(key)}" to "${replacementKey}".` : `Remove "${String(key)}" from your environment when possible.`
+      });
+      warnedDeprecatedKeys.add(String(key));
+    }
+  }
+  for (const [key, definition] of Object.entries(schema)) {
+    const scope = definition.scope;
+    const prefixed = hasPublicPrefix(String(key), prefixes);
+    if (prefixes.length > 0) {
+      if (scope === "client" && !prefixed) {
+        issues.push(
+          createScopeIssue(
+            String(key),
+            options.target,
+            scope,
+            strict,
+            "PREFIX_CLIENT_MISMATCH",
+            `Client variable must use one of prefixes: ${prefixes.join(", ")}.`,
+            `Rename "${String(key)}" with an approved public prefix or mark it as scope: "server".`
+          )
+        );
+      } else if (scope === "server" && prefixed) {
+        issues.push(
+          createScopeIssue(
+            String(key),
+            options.target,
+            scope,
+            strict,
+            "PREFIX_SERVER_PUBLIC",
+            `Server variable is using a public prefix (${prefixes.join(", ")}).`,
+            `Rename "${String(key)}" to remove a public prefix or mark it as scope: "client".`
+          )
+        );
+      }
+    }
+    if (options.prefixPolicy?.validate) {
+      const additionalIssues = options.prefixPolicy.validate({
+        key: String(key),
+        target: options.target,
+        scope,
+        hasPublicPrefix: prefixed,
+        publicPrefixes: prefixes,
+        strict
+      });
+      if (additionalIssues) {
+        for (const additionalIssue of additionalIssues) {
+          issues.push({
+            ...additionalIssue,
+            key: String(key),
+            scope,
+            target: options.target
+          });
+        }
+      }
+    }
+    const replacementKey = definition.deprecated?.replacedBy;
+    const isDeprecatedAlias = Boolean(replacementKey && replacementKey in schema);
+    const requiredForTarget = definition.requiredIn.includes(options.target) && !isDeprecatedAlias;
+    const rawValue = rawValues[String(key)];
+    if (isUnsetRawValue(rawValue)) {
+      if (definition.defaultValue !== void 0) {
+        values[key] = definition.defaultValue;
+        continue;
+      }
+      values[key] = void 0;
+      if (requiredForTarget) {
+        issues.push({
+          key: String(key),
+          target: options.target,
+          scope,
+          severity: "error",
+          code: "MISSING_REQUIRED",
+          message: `Missing required variable for target "${options.target}".`,
+          fix: `Set "${String(key)}" for ${options.target}.`
+        });
+      }
+      continue;
+    }
+    const presentRawValue = rawValue;
+    try {
+      values[key] = parseVariableValue(definition, presentRawValue);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : "invalid value";
+      issues.push({
+        key: String(key),
+        target: options.target,
+        scope,
+        severity: "error",
+        code: "INVALID_VALUE",
+        message: `Invalid value: ${reason}.`,
+        fix: `Update "${String(key)}" to match type "${definition.kind}".`
+      });
+      values[key] = void 0;
+    }
+  }
+  const warnings = issues.filter((issue) => issue.severity === "warning");
+  for (const warning of warnings) {
+    options.onWarning?.(warning);
+  }
+  const hasErrors = issues.some((issue) => issue.severity === "error");
+  function assert() {
+    if (hasErrors) {
+      throw new EnvValidationError(issues);
+    }
+  }
+  if (throwOnError) {
+    assert();
+  }
+  function get(key) {
+    const value = values[key];
+    if (value === void 0) {
+      throw new Error(
+        `Variable "${String(key)}" is undefined. Use optional("${String(
+          key
+        )}") if this key is optional for target "${options.target}".`
+      );
+    }
+    return value;
+  }
+  function optional(key) {
+    return values[key];
+  }
+  function pick(keys) {
+    const selected = {};
+    for (const key of keys) {
+      selected[key] = values[key];
+    }
+    return selected;
+  }
+  function all() {
+    return { ...values };
+  }
+  function meta(key) {
+    if (key !== void 0) {
+      return { ...schema[key] };
+    }
+    const allMetadata = {};
+    for (const [schemaKey, definition] of Object.entries(schema)) {
+      allMetadata[schemaKey] = { ...definition };
+    }
+    return allMetadata;
+  }
+  return {
+    get,
+    optional,
+    assert,
+    pick,
+    all,
+    meta
+  };
+}
+
+// src/drift.ts
+function sortIssues(issues) {
+  const severityOrder = {
+    error: 0,
+    warning: 1
+  };
+  return [...issues].sort((left, right) => {
+    return severityOrder[left.severity] - severityOrder[right.severity] || left.target.localeCompare(right.target) || left.scope.localeCompare(right.scope) || left.key.localeCompare(right.key) || left.code.localeCompare(right.code);
+  });
+}
+function collectUnknownIssues(schema, values, target, source) {
+  const schemaKeys = new Set(Object.keys(schema));
+  const issues = [];
+  for (const key of Object.keys(values)) {
+    if (schemaKeys.has(key)) {
+      continue;
+    }
+    issues.push({
+      key,
+      target,
+      scope: "server",
+      severity: "error",
+      code: "EXTRA_VARIABLE",
+      message: "Variable is present in snapshot but not defined in schema.",
+      fix: `Remove "${key}" from snapshot or add it to schema.`,
+      source
+    });
+  }
+  return issues;
+}
+function detectDrift(schema, options) {
+  const issues = [];
+  const runtime = createEnv(schema, {
+    target: options.target,
+    values: options.values,
+    strict: true,
+    throwOnError: false
+  });
+  try {
+    runtime.assert();
+  } catch (error) {
+    if (!(error instanceof EnvValidationError)) {
+      throw error;
+    }
+    issues.push(
+      ...error.issues.map((issue) => ({
+        ...issue,
+        source: options.source
+      }))
+    );
+  }
+  if (!options.allowUnknown) {
+    issues.push(
+      ...collectUnknownIssues(schema, options.values, options.target, options.source)
+    );
+  }
+  const sortedIssues = sortIssues(issues);
+  const errors = sortedIssues.filter((issue) => issue.severity === "error").length;
+  const warnings = sortedIssues.filter((issue) => issue.severity === "warning").length;
+  return {
+    target: options.target,
+    summary: {
+      total: sortedIssues.length,
+      errors,
+      warnings
+    },
+    issues: sortedIssues
+  };
+}
+
+// src/schema-loader.ts
+import { access as access3, readFile as readFile3 } from "fs/promises";
+import path3 from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+
+// src/migrations.ts
+import { createHash } from "crypto";
+import { access as access2, mkdir as mkdir2, readFile as readFile2, readdir, unlink, writeFile as writeFile2 } from "fs/promises";
+import path2 from "path";
+import { pathToFileURL } from "url";
+
+// src/generators.ts
+var DOC_TARGETS = ["dev", "preview", "prod"];
+var AIRLOCK_GENERATED_BY = "# Generated by airlock";
+var AIRLOCK_GENERATE = `${AIRLOCK_GENERATED_BY} generate`;
+function schemaEntries(schema) {
+  return Object.entries(schema);
+}
+function toEnvString(value, kind) {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (kind === "boolean" && typeof value === "boolean") {
+    return value ? "true" : "false";
+  }
+  if (kind === "number" && typeof value === "number") {
+    return `${value}`;
+  }
+  if (kind === "json") {
+    if (typeof value === "string") {
+      return value;
+    }
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+function placeholderForKey(key, definition) {
+  if (definition.sensitive) {
+    return "";
+  }
+  if (definition.defaultValue !== void 0) {
+    return toEnvString(definition.defaultValue, definition.kind);
+  }
+  switch (definition.kind) {
+    case "url":
+      return "https://example.com";
+    case "number":
+      return "0";
+    case "boolean":
+      return "false";
+    case "enum":
+      return definition.values[0] ?? "";
+    case "json":
+      return "{}";
+    case "string":
+    default:
+      return `example_${key.toLowerCase()}`;
+  }
+}
+function renderMetadataComment(key, definition) {
+  const description = definition.description ?? "No description";
+  const required = definition.requiredIn.join(",");
+  const sensitivity = definition.sensitive ? "yes" : "no";
+  return [
+    `# ${key}: ${description}`,
+    `# type=${definition.kind} scope=${definition.scope} requiredIn=${required} sensitive=${sensitivity}`
+  ];
+}
+function renderEnvExample(entries, app) {
+  const lines = [AIRLOCK_GENERATE];
+  if (app) {
+    lines.push(`# app=${app}`);
+  }
+  for (const [key, definition] of entries) {
+    lines.push("");
+    lines.push(...renderMetadataComment(key, definition));
+    lines.push(`${key}=${formatDotenvValue(placeholderForKey(key, definition))}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function renderEnvDefaults(entries, app) {
+  const lines = [AIRLOCK_GENERATE];
+  if (app) {
+    lines.push(`# app=${app}`);
+  }
+  lines.push("# Non-sensitive defaults only");
+  for (const [key, definition] of entries) {
+    if (definition.sensitive || definition.defaultValue === void 0) {
+      continue;
+    }
+    lines.push(`${key}=${formatDotenvValue(toEnvString(definition.defaultValue, definition.kind))}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function escapeMarkdownCell(value) {
+  if (value.length === 0) {
+    return "-";
+  }
+  return value.replace(/\|/g, "\\|");
+}
+function renderProviderMapping(definition) {
+  if (!definition.provider) {
+    return "";
+  }
+  return Object.entries(definition.provider).filter(([, providerKey]) => providerKey).map(([provider, providerKey]) => `${provider}=${providerKey}`).join(", ");
+}
+function renderDeprecated(definition) {
+  if (!definition.deprecated) {
+    return "";
+  }
+  const parts = [];
+  if (definition.deprecated.replacedBy) {
+    parts.push(`replacedBy=${definition.deprecated.replacedBy}`);
+  }
+  if (definition.deprecated.removeAfter) {
+    parts.push(`removeAfter=${definition.deprecated.removeAfter}`);
+  }
+  if (definition.deprecated.message) {
+    parts.push(definition.deprecated.message);
+  }
+  return parts.join("; ");
+}
+function renderDefaultValue(definition) {
+  if (definition.sensitive || definition.defaultValue === void 0) {
+    return "";
+  }
+  return toEnvString(definition.defaultValue, definition.kind);
+}
+function renderMarkdownTable(entries, options) {
+  const lines = [];
+  const columns = options.includeRequiredIn ? [
+    "Key",
+    "Type",
+    "Scope",
+    "Required In",
+    "Sensitive",
+    "Default",
+    "Description",
+    "Owner",
+    "Rotation Days",
+    "Provider",
+    "Deprecated",
+    "Tags"
+  ] : [
+    "Key",
+    "Type",
+    "Scope",
+    "Sensitive",
+    "Default",
+    "Description",
+    "Owner",
+    "Rotation Days",
+    "Provider",
+    "Deprecated",
+    "Tags"
+  ];
+  lines.push(`| ${columns.join(" | ")} |`);
+  lines.push(`| ${columns.map(() => "---").join(" | ")} |`);
+  for (const [key, definition] of entries) {
+    const tags = definition.tags?.join(", ") ?? "";
+    const commonCells = [
+      escapeMarkdownCell(key),
+      escapeMarkdownCell(definition.kind),
+      escapeMarkdownCell(definition.scope),
+      escapeMarkdownCell(definition.sensitive ? "yes" : "no"),
+      escapeMarkdownCell(renderDefaultValue(definition)),
+      escapeMarkdownCell(definition.description ?? ""),
+      escapeMarkdownCell(definition.owner ?? ""),
+      escapeMarkdownCell(definition.rotationDays === void 0 ? "" : `${definition.rotationDays}`),
+      escapeMarkdownCell(renderProviderMapping(definition)),
+      escapeMarkdownCell(renderDeprecated(definition)),
+      escapeMarkdownCell(tags)
+    ];
+    if (options.includeRequiredIn) {
+      const [keyCell, typeCell, scopeCell, sensitiveCell, ...restCells] = commonCells;
+      lines.push(
+        `| ${keyCell} | ${typeCell} | ${scopeCell} | ${escapeMarkdownCell(
+          definition.requiredIn.join(", ")
+        )} | ${sensitiveCell} | ${restCells.join(" | ")} |`
+      );
+      continue;
+    }
+    lines.push(`| ${commonCells.join(" | ")} |`);
+  }
+  return lines;
+}
+function renderEnvMarkdown(entries, app) {
+  const lines = ["# ENV", ""];
+  if (app) {
+    lines.push(`App: \`${escapeMarkdownCell(app)}\``);
+    lines.push("");
+  }
+  lines.push("## Catalog", "");
+  lines.push(...renderMarkdownTable(entries, { includeRequiredIn: true }));
+  lines.push("");
+  for (const target of DOC_TARGETS) {
+    const targetEntries = entries.filter(([, definition]) => definition.requiredIn.includes(target));
+    lines.push(`## Environment: ${target}`, "");
+    if (targetEntries.length === 0) {
+      lines.push("No variables are required in this environment.", "");
+      continue;
+    }
+    lines.push(...renderMarkdownTable(targetEntries, { includeRequiredIn: false }));
+    lines.push("");
+  }
+  return `${lines.join("\n")}
+`;
+}
+function renderAuditJson(entries, app) {
+  const sensitiveCount = entries.filter(([, definition]) => definition.sensitive).length;
+  const deprecatedCount = entries.filter(([, definition]) => Boolean(definition.deprecated)).length;
+  const defaultsCount = entries.filter(
+    ([, definition]) => definition.defaultValue !== void 0 && !definition.sensitive
+  ).length;
+  const payload = {
+    app: app ?? null,
+    totals: {
+      variables: entries.length,
+      sensitive: sensitiveCount,
+      deprecated: deprecatedCount,
+      defaults: defaultsCount
+    },
+    variables: entries.map(([key, definition]) => ({
+      key,
+      type: definition.kind,
+      scope: definition.scope,
+      requiredIn: [...definition.requiredIn],
+      sensitive: Boolean(definition.sensitive),
+      owner: definition.owner ?? null,
+      rotationDays: definition.rotationDays ?? null,
+      tags: definition.tags ?? [],
+      provider: definition.provider ?? {},
+      deprecated: definition.deprecated ?? null,
+      hasDefault: definition.defaultValue !== void 0
+    }))
+  };
+  return `${JSON.stringify(payload, null, 2)}
+`;
+}
+function renderEnvLocal(entries, app) {
+  const lines = [`${AIRLOCK_GENERATE} --write-local`];
+  if (app) {
+    lines.push(`# app=${app}`);
+  }
+  for (const [key, definition] of entries) {
+    const value = definition.sensitive ? "" : definition.defaultValue !== void 0 ? toEnvString(definition.defaultValue, definition.kind) : "";
+    lines.push(`${key}=${formatDotenvValue(value)}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function generateArtifacts(schema, options = {}) {
+  const entries = schemaEntries(schema);
+  return {
+    envExample: renderEnvExample(entries, options.app),
+    envDefaults: renderEnvDefaults(entries, options.app),
+    envMarkdown: renderEnvMarkdown(entries, options.app),
+    envAuditJson: renderAuditJson(entries, options.app),
+    envLocal: renderEnvLocal(entries, options.app)
+  };
+}
+function generateTargetEnvFile(schema, target, options = {}) {
+  const entries = schemaEntries(schema);
+  const lines = [`${AIRLOCK_GENERATE} --write-target-files`, `# target=${target}`];
+  if (options.app) {
+    lines.push(`# app=${options.app}`);
+  }
+  for (const [key, definition] of entries) {
+    if (!definition.requiredIn.includes(target)) {
+      continue;
+    }
+    const value = definition.sensitive ? "" : definition.defaultValue !== void 0 ? toEnvString(definition.defaultValue, definition.kind) : "";
+    lines.push(`${key}=${formatDotenvValue(value)}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+
+// src/workspace-layout.ts
+import { access, mkdir, readFile, writeFile } from "fs/promises";
+import path from "path";
+var WRKSPACE_ENV_DIR = "env";
+var DEFAULT_MIGRATIONS_DIR = `${WRKSPACE_ENV_DIR}/migrations`;
+var DEFAULT_MIGRATION_STATE_FILE = `${WRKSPACE_ENV_DIR}/migrations.state.json`;
+var DEFAULT_GENERATED_SCHEMA_FILE = `${WRKSPACE_ENV_DIR}/schema.generated.json`;
+var DEFAULT_ENV_DOC_FILE = `${WRKSPACE_ENV_DIR}/ENV.md`;
+var DEFAULT_ENV_AUDIT_FILE = `${WRKSPACE_ENV_DIR}/env.audit.json`;
+var DEFAULT_WRKSPACE_ENV_GITIGNORE_FILE = `${WRKSPACE_ENV_DIR}/.gitignore`;
+var DEFAULT_WRKSPACE_ENV_GITIGNORE_ENTRIES = [
+  "schema.generated.json",
+  "migrations.state.json",
+  "ENV.md",
+  "env.audit.json"
+];
+async function fileExists(filepath) {
+  try {
+    await access(filepath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalizeLine(line) {
+  return line.trim();
+}
+function uniqueNormalized(lines) {
+  return new Set(lines.map((line) => normalizeLine(line)).filter((line) => line.length > 0));
+}
+function resolveWrkspaceEnvDir(cwd) {
+  return path.resolve(cwd, WRKSPACE_ENV_DIR);
+}
+function toWrkspaceEnvIgnoreEntry(cwd, absolutePath) {
+  const wrkspaceDir = resolveWrkspaceEnvDir(cwd);
+  const relativePath = path.relative(wrkspaceDir, absolutePath);
+  if (relativePath.length === 0 || relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
+    return void 0;
+  }
+  return relativePath.split(path.sep).join("/");
+}
+async function ensureWrkspaceEnvGitignore(cwd, additionalEntries = []) {
+  const gitignorePath = path.resolve(cwd, DEFAULT_WRKSPACE_ENV_GITIGNORE_FILE);
+  const wrkspaceDir = path.dirname(gitignorePath);
+  await mkdir(wrkspaceDir, { recursive: true });
+  const existingLines = await fileExists(gitignorePath) ? (await readFile(gitignorePath, "utf8")).split(/\r?\n/) : ["# Generated by airlock"];
+  const requiredEntries = [
+    ...DEFAULT_WRKSPACE_ENV_GITIGNORE_ENTRIES,
+    ...additionalEntries.filter((entry) => entry.trim().length > 0)
+  ];
+  const seenLines = uniqueNormalized(existingLines);
+  const mergedLines = [...existingLines];
+  for (const entry of requiredEntries) {
+    if (seenLines.has(entry)) {
+      continue;
+    }
+    mergedLines.push(entry);
+    seenLines.add(entry);
+  }
+  const content = `${mergedLines.filter((line) => line.length > 0).join("\n")}
+`;
+  const existingContent = await fileExists(gitignorePath) ? await readFile(gitignorePath, "utf8") : "";
+  if (content !== existingContent) {
+    await writeFile(gitignorePath, content, "utf8");
+  }
+  return gitignorePath;
+}
+
+// src/migrations.ts
+var DEFAULT_MIGRATIONS_DIR2 = DEFAULT_MIGRATIONS_DIR;
+var DEFAULT_MIGRATION_STATE_FILE2 = DEFAULT_MIGRATION_STATE_FILE;
+var DEFAULT_GENERATED_SCHEMA_FILE2 = DEFAULT_GENERATED_SCHEMA_FILE;
+var DEFAULT_MIGRATION_TARGET_FILES = [
+  ".env.local",
+  ".env",
+  ".env.example",
+  ".env.defaults"
+];
+var ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var MIGRATION_FILE_PATTERN = /\.(?:mjs|cjs|js|mts|cts|ts)$/;
+async function pathExists(filepath) {
+  try {
+    await access2(filepath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function assertEnvKey(key) {
+  if (!ENV_KEY_PATTERN.test(key)) {
+    throw new Error(
+      `Invalid env key "${key}". Fix: use a key matching ${ENV_KEY_PATTERN.toString()}.`
+    );
+  }
+}
+function cloneSchemaDefinition(definition) {
+  const enumValues = definition.kind === "enum" && Array.isArray(definition.values) ? [...definition.values] : void 0;
+  return {
+    ...definition,
+    requiredIn: [...definition.requiredIn],
+    deprecated: definition.deprecated ? { ...definition.deprecated } : void 0,
+    provider: definition.provider ? { ...definition.provider } : void 0,
+    tags: definition.tags ? [...definition.tags] : void 0,
+    values: enumValues
+  };
+}
+function normalizeSchemaDefinition(key, definition) {
+  if (!definition || typeof definition !== "object" || Array.isArray(definition)) {
+    throw new Error(
+      `Invalid schema definition for "${key}". Fix: provide an object with at least a "kind" field.`
+    );
+  }
+  const normalized = cloneSchemaDefinition(definition);
+  const kind = normalized.kind;
+  if (!["string", "url", "number", "boolean", "enum", "json"].includes(kind)) {
+    throw new Error(
+      `Invalid schema kind "${String(kind)}" for "${key}". Fix: use one of string|url|number|boolean|enum|json.`
+    );
+  }
+  const scope = normalized.scope ?? "server";
+  if (scope !== "server" && scope !== "client") {
+    throw new Error(
+      `Invalid schema scope "${String(scope)}" for "${key}". Fix: use "server" or "client".`
+    );
+  }
+  normalized.scope = scope;
+  const requiredIn = normalized.requiredIn ?? ["dev", "preview", "prod"];
+  const uniqueTargets = Array.from(new Set(requiredIn));
+  for (const target of uniqueTargets) {
+    if (target !== "dev" && target !== "preview" && target !== "prod") {
+      throw new Error(
+        `Invalid requiredIn target "${String(target)}" for "${key}". Fix: use dev|preview|prod.`
+      );
+    }
+  }
+  normalized.requiredIn = uniqueTargets;
+  if (kind === "enum") {
+    const enumValues = normalized.values;
+    if (!Array.isArray(enumValues) || enumValues.length === 0) {
+      throw new Error(
+        `Invalid enum schema for "${key}". Fix: provide a non-empty values array.`
+      );
+    }
+    if (enumValues.some((value) => typeof value !== "string")) {
+      throw new Error(`Invalid enum schema for "${key}". Fix: all enum values must be strings.`);
+    }
+    normalized.values = [...enumValues];
+  }
+  return normalized;
+}
+function normalizePrefixPolicy(policy) {
+  if (!policy) {
+    return void 0;
+  }
+  if (policy === "nextjs") {
+    return prefixPolicies.nextjs;
+  }
+  if (policy === "vite") {
+    return prefixPolicies.vite;
+  }
+  if (!Array.isArray(policy.publicPrefixes)) {
+    throw new Error(
+      'Invalid prefix policy. Fix: provide "nextjs", "vite", or a PrefixPolicy with publicPrefixes.'
+    );
+  }
+  if (policy.publicPrefixes.some((prefix) => typeof prefix !== "string")) {
+    throw new Error(
+      'Invalid prefix policy. Fix: provide "nextjs", "vite", or a PrefixPolicy with publicPrefixes.'
+    );
+  }
+  return {
+    ...policy,
+    publicPrefixes: [...policy.publicPrefixes]
+  };
+}
+function serializePrefixPolicy(policy) {
+  if (!policy) {
+    return void 0;
+  }
+  if (policy === prefixPolicies.nextjs || policy.name === "nextjs") {
+    return "nextjs";
+  }
+  if (policy === prefixPolicies.vite || policy.name === "vite") {
+    return "vite";
+  }
+  return {
+    name: policy.name,
+    publicPrefixes: [...policy.publicPrefixes]
+  };
+}
+function deserializePrefixPolicy(value) {
+  if (!value) {
+    return void 0;
+  }
+  if (value === "nextjs") {
+    return prefixPolicies.nextjs;
+  }
+  if (value === "vite") {
+    return prefixPolicies.vite;
+  }
+  if (!Array.isArray(value.publicPrefixes) || value.publicPrefixes.some((prefix) => typeof prefix !== "string")) {
+    throw new Error(
+      "Invalid generated schema file prefix policy. Fix: delete the generated schema file and rebuild it from migrations."
+    );
+  }
+  return {
+    name: value.name,
+    publicPrefixes: [...value.publicPrefixes]
+  };
+}
+function toEnvString2(value, kind) {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (kind === "boolean" && typeof value === "boolean") {
+    return value ? "true" : "false";
+  }
+  if (kind === "number" && typeof value === "number") {
+    return `${value}`;
+  }
+  if (kind === "json") {
+    if (typeof value === "string") {
+      return value;
+    }
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+function defaultEnvValueForDefinition(definition) {
+  if (definition.sensitive) {
+    return "";
+  }
+  if (definition.defaultValue === void 0) {
+    return "";
+  }
+  return toEnvString2(definition.defaultValue, definition.kind);
+}
+function normalizeTargets2(targets) {
+  if (!targets || targets.length === 0) {
+    return [...DEFAULT_MIGRATION_TARGET_FILES];
+  }
+  const unique = Array.from(new Set(targets));
+  for (const target of unique) {
+    if (!DEFAULT_MIGRATION_TARGET_FILES.includes(target)) {
+      throw new Error(
+        `Unsupported migration target "${target}". Fix: use one of ${DEFAULT_MIGRATION_TARGET_FILES.join(
+          ", "
+        )}.`
+      );
+    }
+  }
+  return unique;
+}
+function findPairIndexes(document, key) {
+  const indexes = [];
+  for (let index = 0; index < document.lines.length; index += 1) {
+    const line = document.lines[index];
+    if (line.type === "pair" && line.key === key) {
+      indexes.push(index);
+    }
+  }
+  return indexes;
+}
+function findLastPairIndex(document, key) {
+  for (let index = document.lines.length - 1; index >= 0; index -= 1) {
+    const line = document.lines[index];
+    if (line.type === "pair" && line.key === key) {
+      return index;
+    }
+  }
+  return -1;
+}
+function renderPairLine(line) {
+  const value = formatDotenvValue(line.value, line.quote);
+  const exportPrefix = line.exported ? "export " : "";
+  const inlineComment = line.inlineComment ? ` ${line.inlineComment}` : "";
+  return `${exportPrefix}${line.key}=${value}${inlineComment}`;
+}
+function createPairLine(key, value) {
+  return {
+    type: "pair",
+    raw: `${key}=${formatDotenvValue(value)}`,
+    key,
+    value,
+    quote: "none",
+    exported: false
+  };
+}
+function normalizeCommentLines(comment) {
+  if (comment === void 0) {
+    return [];
+  }
+  const chunks = typeof comment === "string" ? comment.split(/\r?\n/) : [...comment];
+  const output = [];
+  for (const chunk of chunks) {
+    const trimmed = chunk.trim();
+    if (trimmed.length === 0) {
+      continue;
+    }
+    const normalized = trimmed.startsWith("#") ? trimmed : `# ${trimmed}`;
+    output.push({
+      type: "comment",
+      raw: normalized
+    });
+  }
+  return output;
+}
+function setCommentBlockForKey(document, key, comment) {
+  const index = findLastPairIndex(document, key);
+  if (index < 0) {
+    return;
+  }
+  let start = index;
+  while (start > 0 && document.lines[start - 1]?.type === "comment") {
+    start -= 1;
+  }
+  const newComments = normalizeCommentLines(comment);
+  document.lines.splice(start, index - start, ...newComments);
+}
+function upsertValue(document, key, value, options) {
+  const existingIndex = findLastPairIndex(document, key);
+  if (existingIndex >= 0) {
+    if (options.overwrite) {
+      const existingLine = document.lines[existingIndex];
+      if (existingLine.type === "pair") {
+        existingLine.value = value;
+        existingLine.raw = renderPairLine(existingLine);
+      }
+    }
+    if (options.comment !== void 0) {
+      setCommentBlockForKey(document, key, options.comment);
+    }
+    return;
+  }
+  if (!options.createIfMissing) {
+    return;
+  }
+  const commentLines = normalizeCommentLines(options.comment);
+  document.lines.push(...commentLines, createPairLine(key, value));
+}
+function removeKey(document, key) {
+  for (let index = document.lines.length - 1; index >= 0; index -= 1) {
+    const line = document.lines[index];
+    if (line.type === "pair" && line.key === key) {
+      document.lines.splice(index, 1);
+    }
+  }
+}
+function renameKey(document, fromKey, toKey, options) {
+  if (fromKey === toKey) {
+    if (options.comment !== void 0) {
+      setCommentBlockForKey(document, toKey, options.comment);
+    }
+    return;
+  }
+  const fromIndexes = findPairIndexes(document, fromKey);
+  if (fromIndexes.length === 0) {
+    return;
+  }
+  const toIndex = findLastPairIndex(document, toKey);
+  if (toIndex >= 0) {
+    if (!options.overwrite) {
+      return;
+    }
+    const sourceLine = document.lines[fromIndexes[fromIndexes.length - 1]];
+    const targetLine = document.lines[toIndex];
+    if (sourceLine.type === "pair" && targetLine.type === "pair") {
+      targetLine.value = sourceLine.value;
+      targetLine.raw = renderPairLine(targetLine);
+    }
+    removeKey(document, fromKey);
+    if (options.comment !== void 0) {
+      setCommentBlockForKey(document, toKey, options.comment);
+    }
+    return;
+  }
+  for (const index of fromIndexes) {
+    const line = document.lines[index];
+    if (line.type !== "pair") {
+      continue;
+    }
+    line.key = toKey;
+    line.raw = renderPairLine(line);
+  }
+  if (options.comment !== void 0) {
+    setCommentBlockForKey(document, toKey, options.comment);
+  }
+}
+function renderDocument(document) {
+  if (document.lines.length === 0) {
+    return "";
+  }
+  let output = document.lines.map((line) => line.raw).join(document.newline);
+  if (document.hasTrailingNewline) {
+    output += document.newline;
+  }
+  return output;
+}
+function newDocumentForMissingFile() {
+  return {
+    lines: [],
+    newline: "\n",
+    hasTrailingNewline: true
+  };
+}
+async function loadEnvTargetDocuments(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const targets = normalizeTargets2(options.targets);
+  const output = /* @__PURE__ */ new Map();
+  for (const target of targets) {
+    const filePath = path2.resolve(cwd, target);
+    const exists2 = await pathExists(filePath);
+    if (!exists2) {
+      output.set(target, {
+        target,
+        filePath,
+        document: newDocumentForMissingFile(),
+        source: ""
+      });
+      continue;
+    }
+    const source = await readFile2(filePath, "utf8");
+    output.set(target, {
+      target,
+      filePath,
+      document: parseDotenv(source),
+      source
+    });
+  }
+  return output;
+}
+function createNoopTargetDocuments() {
+  const documents = /* @__PURE__ */ new Map();
+  for (const target of DEFAULT_MIGRATION_TARGET_FILES) {
+    documents.set(target, {
+      target,
+      filePath: target,
+      source: "",
+      document: newDocumentForMissingFile()
+    });
+  }
+  return documents;
+}
+function hasKeyInTargetDocuments(documents, target, key) {
+  const document = documents.get(target)?.document;
+  if (!document) {
+    return false;
+  }
+  return findLastPairIndex(document, key) >= 0;
+}
+var finalizeFluentDefinitionsSymbol = /* @__PURE__ */ Symbol("@wrkspace-co/env/finalizeFluentDefinitions");
+function createInitialFluentDefinition(kind) {
+  const base = {
+    kind,
+    scope: "server",
+    requiredIn: ["dev", "preview", "prod"]
+  };
+  if (kind === "enum") {
+    return {
+      ...base,
+      kind: "enum",
+      values: []
+    };
+  }
+  return base;
+}
+function normalizeRequiredInInput(requiredIn) {
+  if (Array.isArray(requiredIn)) {
+    return [...requiredIn];
+  }
+  return [requiredIn];
+}
+function finalizeFluentDefinitions(context) {
+  const maybeContext = context;
+  if (typeof maybeContext[finalizeFluentDefinitionsSymbol] === "function") {
+    maybeContext[finalizeFluentDefinitionsSymbol]();
+  }
+}
+function createEnvMigrationContext(documents, operationLog = [], schemaState) {
+  const variableChains = [];
+  let context;
+  const resolveTargets = (options) => normalizeTargets2(options?.targets);
+  const forTargetFiles = (targetFiles) => targetFiles.map((target) => {
+    const targetDocument = documents.get(target);
+    if (!targetDocument) {
+      throw new Error(`Missing in-memory target "${target}".`);
+    }
+    return targetDocument;
+  });
+  const setSchemaDefinition = (key, definition) => {
+    const normalizedDefinition = normalizeSchemaDefinition(key, definition);
+    if (schemaState) {
+      schemaState.schema[key] = normalizedDefinition;
+    }
+    return normalizedDefinition;
+  };
+  const removeSchemaDefinition = (key) => {
+    if (!schemaState) {
+      return;
+    }
+    delete schemaState.schema[key];
+  };
+  const renameSchemaDefinition = (fromKey, toKey, options) => {
+    if (!schemaState || fromKey === toKey) {
+      return;
+    }
+    if (!(fromKey in schemaState.schema)) {
+      return;
+    }
+    if (toKey in schemaState.schema && !options?.overwrite) {
+      return;
+    }
+    const current = schemaState.schema[fromKey];
+    schemaState.schema[toKey] = normalizeSchemaDefinition(toKey, current);
+    delete schemaState.schema[fromKey];
+  };
+  const upsertKeyInTargets = (key, value, options) => {
+    const targetFiles = resolveTargets(options);
+    for (const targetDocument of forTargetFiles(targetFiles)) {
+      upsertValue(targetDocument.document, key, value, {
+        overwrite: options?.overwrite !== false,
+        createIfMissing: options?.createIfMissing !== false,
+        comment: options?.comment
+      });
+    }
+    return targetFiles;
+  };
+  const removeKeyInTargets = (key, options) => {
+    const targetFiles = resolveTargets(options);
+    for (const targetDocument of forTargetFiles(targetFiles)) {
+      removeKey(targetDocument.document, key);
+    }
+    return targetFiles;
+  };
+  const renameKeyInTargets = (fromKey, toKey, options) => {
+    const targetFiles = resolveTargets(options);
+    for (const targetDocument of forTargetFiles(targetFiles)) {
+      renameKey(targetDocument.document, fromKey, toKey, {
+        overwrite: Boolean(options?.overwrite),
+        comment: options?.comment
+      });
+    }
+    return targetFiles;
+  };
+  const applyUpdateVariable = (key, definition, value, options) => {
+    assertEnvKey(key);
+    const normalizedDefinition = setSchemaDefinition(key, definition);
+    const targetFiles = upsertKeyInTargets(
+      key,
+      value ?? defaultEnvValueForDefinition(normalizedDefinition),
+      options
+    );
+    operationLog.push({
+      kind: "updateVariable",
+      key,
+      targets: targetFiles
+    });
+  };
+  const applyRemoveVariable = (key, options) => {
+    assertEnvKey(key);
+    removeSchemaDefinition(key);
+    const targetFiles = removeKeyInTargets(key, options);
+    operationLog.push({
+      kind: "removeVariable",
+      key,
+      targets: targetFiles
+    });
+  };
+  const applyRenameVariable = (fromKey, toKey, options) => {
+    assertEnvKey(fromKey);
+    assertEnvKey(toKey);
+    renameSchemaDefinition(fromKey, toKey, options);
+    const targetFiles = renameKeyInTargets(fromKey, toKey, options);
+    operationLog.push({
+      kind: "renameVariable",
+      fromKey,
+      toKey,
+      targets: targetFiles
+    });
+  };
+  const existingSchemaDefinitionForKey = (key) => {
+    if (!schemaState) {
+      return void 0;
+    }
+    const existing = schemaState.schema[key];
+    if (!existing) {
+      return void 0;
+    }
+    return cloneSchemaDefinition(existing);
+  };
+  const ensureChainDefinition = (state, methodName) => {
+    const definition = state.definition ?? existingSchemaDefinitionForKey(state.key);
+    if (!definition) {
+      throw new Error(
+        `Cannot call .${methodName}(...) for "${state.key}" before setting its kind. Fix: call .kind(...), .define(...), or start with ctx.string(...)/ctx.url(...)/ctx.number(...)/ctx.boolean(...)/ctx.enum(...)/ctx.json(...).`
+      );
+    }
+    state.definition = definition;
+    return definition;
+  };
+  const markPendingUpdate = (state) => {
+    state.pendingUpdate = true;
+  };
+  const flushChain = (state) => {
+    if (!state.pendingUpdate) {
+      return;
+    }
+    if (!state.definition) {
+      throw new Error(
+        `Incomplete fluent schema definition for "${state.key}". Fix: call .kind(...) or .define(...) before applying variable metadata/value.`
+      );
+    }
+    if (state.definition.kind === "enum" && state.definition.values.length === 0) {
+      throw new Error(
+        `Incomplete fluent schema definition for "${state.key}". Fix: enum keys require .values(...).`
+      );
+    }
+    applyUpdateVariable(
+      state.key,
+      state.definition,
+      state.explicitValue ?? defaultEnvValueForDefinition(state.definition),
+      state.options
+    );
+    state.pendingUpdate = false;
+  };
+  const mergeRenameOptions = (state, options) => {
+    const merged = {};
+    if (options?.targets !== void 0) {
+      merged.targets = options.targets;
+    } else if (state.options.targets !== void 0) {
+      merged.targets = state.options.targets;
+    }
+    if (options?.overwrite !== void 0) {
+      merged.overwrite = options.overwrite;
+    } else if (state.options.overwrite !== void 0) {
+      merged.overwrite = state.options.overwrite;
+    }
+    if (options?.comment !== void 0) {
+      merged.comment = options.comment;
+    } else if (state.options.comment !== void 0) {
+      merged.comment = state.options.comment;
+    }
+    if (merged.targets === void 0 && merged.overwrite === void 0 && merged.comment === void 0) {
+      return void 0;
+    }
+    return merged;
+  };
+  const mergeRemoveOptions = (state, options) => {
+    const merged = {};
+    if (options?.targets !== void 0) {
+      merged.targets = options.targets;
+    } else if (state.options.targets !== void 0) {
+      merged.targets = state.options.targets;
+    }
+    if (merged.targets === void 0) {
+      return void 0;
+    }
+    return merged;
+  };
+  const createVariableChain = (key, initialKind) => {
+    assertEnvKey(key);
+    const existingDefinition = existingSchemaDefinitionForKey(key);
+    const state = {
+      key,
+      definition: initialKind ? createInitialFluentDefinition(initialKind) : existingDefinition,
+      options: {},
+      pendingUpdate: Boolean(initialKind)
+    };
+    variableChains.push(state);
+    const chain = {
+      kind(kind) {
+        state.definition = createInitialFluentDefinition(kind);
+        markPendingUpdate(state);
+        return chain;
+      },
+      define(definition) {
+        state.definition = normalizeSchemaDefinition(state.key, definition);
+        markPendingUpdate(state);
+        return chain;
+      },
+      string() {
+        return chain.kind("string");
+      },
+      url() {
+        return chain.kind("url");
+      },
+      number() {
+        return chain.kind("number");
+      },
+      boolean() {
+        return chain.kind("boolean");
+      },
+      enum() {
+        return chain.kind("enum");
+      },
+      json() {
+        return chain.kind("json");
+      },
+      scope(scope) {
+        const definition = ensureChainDefinition(state, "scope");
+        state.definition = {
+          ...definition,
+          scope
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      requiredIn(requiredIn) {
+        const definition = ensureChainDefinition(state, "requiredIn");
+        state.definition = {
+          ...definition,
+          requiredIn: normalizeRequiredInInput(requiredIn)
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      defaultValue(value) {
+        const definition = ensureChainDefinition(state, "defaultValue");
+        state.definition = {
+          ...definition,
+          defaultValue: value
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      sensitive(value = true) {
+        const definition = ensureChainDefinition(state, "sensitive");
+        state.definition = {
+          ...definition,
+          sensitive: value
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      values(values) {
+        const definition = ensureChainDefinition(state, "values");
+        if (definition.kind !== "enum") {
+          throw new Error(
+            `Cannot call .values(...) for "${state.key}" because it is "${definition.kind}". Fix: use .enum() or ctx.enum("${state.key}") before .values(...).`
+          );
+        }
+        const normalizedValues = Array.isArray(values) ? [...values] : [values];
+        state.definition = {
+          ...definition,
+          values: normalizedValues
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      description(value) {
+        const definition = ensureChainDefinition(state, "description");
+        state.definition = {
+          ...definition,
+          description: value
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      example(value) {
+        const definition = ensureChainDefinition(state, "example");
+        state.definition = {
+          ...definition,
+          example: value
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      owner(value) {
+        const definition = ensureChainDefinition(state, "owner");
+        state.definition = {
+          ...definition,
+          owner: value
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      rotationDays(value) {
+        const definition = ensureChainDefinition(state, "rotationDays");
+        state.definition = {
+          ...definition,
+          rotationDays: value
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      deprecated(value) {
+        const definition = ensureChainDefinition(state, "deprecated");
+        state.definition = {
+          ...definition,
+          deprecated: value ? { ...value } : void 0
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      deprecate(replacedBy, removeAfter, message) {
+        return chain.deprecated({
+          replacedBy,
+          removeAfter,
+          message
+        });
+      },
+      provider(value) {
+        const definition = ensureChainDefinition(state, "provider");
+        state.definition = {
+          ...definition,
+          provider: value ? { ...value } : void 0
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      providerAlias(provider, key2) {
+        const definition = ensureChainDefinition(state, "providerAlias");
+        const nextProvider = {
+          ...definition.provider ?? {}
+        };
+        if (key2 === void 0) {
+          delete nextProvider[provider];
+        } else {
+          nextProvider[provider] = key2;
+        }
+        state.definition = {
+          ...definition,
+          provider: Object.keys(nextProvider).length > 0 ? nextProvider : void 0
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      tags(values) {
+        const definition = ensureChainDefinition(state, "tags");
+        const normalized = values === void 0 ? void 0 : Array.isArray(values) ? [...values] : [values];
+        state.definition = {
+          ...definition,
+          tags: normalized
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      tag(value) {
+        const definition = ensureChainDefinition(state, "tag");
+        const nextTags = new Set(definition.tags ?? []);
+        nextTags.add(value);
+        state.definition = {
+          ...definition,
+          tags: [...nextTags]
+        };
+        markPendingUpdate(state);
+        return chain;
+      },
+      value(value) {
+        ensureChainDefinition(state, "value");
+        state.explicitValue = value;
+        markPendingUpdate(state);
+        return chain;
+      },
+      targets(targets) {
+        state.options.targets = normalizeTargets2(
+          Array.isArray(targets) ? targets : [targets]
+        );
+        return chain;
+      },
+      overwrite(value = true) {
+        state.options.overwrite = value;
+        return chain;
+      },
+      createIfMissing(value = true) {
+        state.options.createIfMissing = value;
+        return chain;
+      },
+      comment(comment) {
+        state.options.comment = comment;
+        return chain;
+      },
+      rename(toKey, options) {
+        flushChain(state);
+        const fromKey = state.key;
+        const mergedOptions = mergeRenameOptions(state, options);
+        applyRenameVariable(fromKey, toKey, mergedOptions);
+        state.key = toKey;
+        return chain;
+      },
+      remove(options) {
+        flushChain(state);
+        const mergedOptions = mergeRemoveOptions(state, options);
+        applyRemoveVariable(state.key, mergedOptions);
+        state.definition = void 0;
+        state.explicitValue = void 0;
+        state.pendingUpdate = false;
+        return chain;
+      }
+    };
+    return chain;
+  };
+  context = {
+    key(key) {
+      return createVariableChain(key);
+    },
+    string(key) {
+      return createVariableChain(key, "string");
+    },
+    url(key) {
+      return createVariableChain(key, "url");
+    },
+    number(key) {
+      return createVariableChain(key, "number");
+    },
+    boolean(key) {
+      return createVariableChain(key, "boolean");
+    },
+    enum(key) {
+      return createVariableChain(key, "enum");
+    },
+    json(key) {
+      return createVariableChain(key, "json");
+    },
+    setPrefixPolicy(policy) {
+      operationLog.push({
+        kind: "setPrefixPolicy",
+        targets: [...DEFAULT_MIGRATION_TARGET_FILES]
+      });
+      if (!schemaState) {
+        return;
+      }
+      schemaState.prefixPolicy = normalizePrefixPolicy(policy);
+    },
+    [finalizeFluentDefinitionsSymbol]() {
+      for (const state of variableChains) {
+        flushChain(state);
+      }
+    }
+  };
+  return context;
+}
+async function writeEnvTargetDocuments(documents) {
+  const changedFiles = [];
+  const sorted = [...documents.values()].sort((left, right) => left.filePath.localeCompare(right.filePath));
+  for (const targetDocument of sorted) {
+    const rendered = renderDocument(targetDocument.document);
+    if (rendered === targetDocument.source) {
+      continue;
+    }
+    await mkdir2(path2.dirname(targetDocument.filePath), { recursive: true });
+    await writeFile2(targetDocument.filePath, rendered, "utf8");
+    targetDocument.source = rendered;
+    changedFiles.push(targetDocument.target);
+  }
+  return changedFiles;
+}
+function resolveMigrationsDir(cwd, migrationsDir) {
+  return path2.resolve(cwd, migrationsDir ?? DEFAULT_MIGRATIONS_DIR2);
+}
+function resolveStatePath(cwd, stateFile) {
+  return path2.resolve(cwd, stateFile ?? DEFAULT_MIGRATION_STATE_FILE2);
+}
+function resolveGeneratedSchemaPath(cwd, generatedSchemaFile) {
+  return path2.resolve(cwd, generatedSchemaFile ?? DEFAULT_GENERATED_SCHEMA_FILE2);
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+async function loadMigrationState(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const statePath = resolveStatePath(cwd, options.stateFile);
+  if (!await pathExists(statePath)) {
+    return {
+      statePath,
+      state: {
+        version: 1,
+        applied: []
+      }
+    };
+  }
+  const raw = await readFile2(statePath, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `Invalid migration state file at "${statePath}". Fix: ensure it contains valid JSON.`
+    );
+  }
+  if (!isRecord(parsed)) {
+    throw new Error(
+      `Invalid migration state file at "${statePath}". Fix: expected an object with an "applied" array.`
+    );
+  }
+  if (!Array.isArray(parsed.applied)) {
+    throw new Error(
+      `Invalid migration state file at "${statePath}". Fix: "applied" must be an array.`
+    );
+  }
+  const applied = [];
+  for (const item of parsed.applied) {
+    if (!isRecord(item)) {
+      throw new Error(
+        `Invalid migration state file at "${statePath}". Fix: each applied entry must be an object.`
+      );
+    }
+    const id = item.id;
+    const appliedAt = item.appliedAt;
+    const checksum = item.checksum;
+    if (typeof id !== "string" || id.length === 0) {
+      throw new Error(
+        `Invalid migration state file at "${statePath}". Fix: each applied entry must include a non-empty "id".`
+      );
+    }
+    if (typeof appliedAt !== "string" || appliedAt.length === 0) {
+      throw new Error(
+        `Invalid migration state file at "${statePath}". Fix: each applied entry must include "appliedAt".`
+      );
+    }
+    if (typeof checksum !== "string" || checksum.length === 0) {
+      throw new Error(
+        `Invalid migration state file at "${statePath}". Fix: each applied entry must include "checksum".`
+      );
+    }
+    applied.push({
+      id,
+      appliedAt,
+      checksum
+    });
+  }
+  return {
+    statePath,
+    state: {
+      version: 1,
+      applied
+    }
+  };
+}
+async function saveMigrationState(cwd, statePath, state) {
+  await mkdir2(path2.dirname(statePath), { recursive: true });
+  const ignoreEntry = toWrkspaceEnvIgnoreEntry(cwd, statePath);
+  await ensureWrkspaceEnvGitignore(cwd, ignoreEntry ? [ignoreEntry] : []);
+  await writeFile2(statePath, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+}
+async function loadPersistedGeneratedSchema(schemaPath) {
+  if (!await pathExists(schemaPath)) {
+    return void 0;
+  }
+  const raw = await readFile2(schemaPath, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `Invalid generated schema file at "${schemaPath}". Fix: delete it and re-run migrations, or write valid JSON.`
+    );
+  }
+  if (!isRecord(parsed)) {
+    throw new Error(
+      `Invalid generated schema file at "${schemaPath}". Fix: expected an object with schema metadata.`
+    );
+  }
+  const version = parsed.version;
+  const mode = parsed.mode;
+  const schema = parsed.schema;
+  const appliedMigrationIds = parsed.appliedMigrationIds;
+  if (version !== 1 || mode !== "migration-first") {
+    throw new Error(
+      `Unsupported generated schema version at "${schemaPath}". Fix: delete it and rebuild from migrations.`
+    );
+  }
+  if (!Array.isArray(appliedMigrationIds) || appliedMigrationIds.some((item) => typeof item !== "string")) {
+    throw new Error(
+      `Invalid generated schema file at "${schemaPath}". Fix: "appliedMigrationIds" must be a string array.`
+    );
+  }
+  if (!isRecord(schema)) {
+    throw new Error(
+      `Invalid generated schema file at "${schemaPath}". Fix: "schema" must be an object map.`
+    );
+  }
+  const normalizedSchema = {};
+  for (const [key, definition] of Object.entries(schema)) {
+    normalizedSchema[key] = normalizeSchemaDefinition(key, definition);
+  }
+  const parsedPrefixPolicy = parsed.prefixPolicy;
+  return {
+    version: 1,
+    mode: "migration-first",
+    appliedMigrationIds: [...appliedMigrationIds],
+    schema: normalizedSchema,
+    prefixPolicy: parsedPrefixPolicy
+  };
+}
+async function savePersistedGeneratedSchema(cwd, schemaPath, state, appliedMigrationIds) {
+  const payload = {
+    version: 1,
+    mode: "migration-first",
+    appliedMigrationIds: [...appliedMigrationIds],
+    schema: Object.fromEntries(
+      Object.entries(state.schema).map(([key, definition]) => [key, cloneSchemaDefinition(definition)])
+    ),
+    prefixPolicy: serializePrefixPolicy(state.prefixPolicy)
+  };
+  await mkdir2(path2.dirname(schemaPath), { recursive: true });
+  const ignoreEntry = toWrkspaceEnvIgnoreEntry(cwd, schemaPath);
+  await ensureWrkspaceEnvGitignore(cwd, ignoreEntry ? [ignoreEntry] : []);
+  await writeFile2(schemaPath, `${JSON.stringify(payload, null, 2)}
+`, "utf8");
+}
+async function writeEnvDocsFromSchema(cwd, schema) {
+  const artifacts = generateArtifacts(schema);
+  const envDocPath = path2.resolve(cwd, DEFAULT_ENV_DOC_FILE);
+  const envAuditPath = path2.resolve(cwd, DEFAULT_ENV_AUDIT_FILE);
+  await Promise.all([
+    mkdir2(path2.dirname(envDocPath), { recursive: true }),
+    mkdir2(path2.dirname(envAuditPath), { recursive: true })
+  ]);
+  await ensureWrkspaceEnvGitignore(cwd, [
+    toWrkspaceEnvIgnoreEntry(cwd, envDocPath) ?? "",
+    toWrkspaceEnvIgnoreEntry(cwd, envAuditPath) ?? ""
+  ]);
+  await Promise.all([
+    writeFile2(envDocPath, artifacts.envMarkdown, "utf8"),
+    writeFile2(envAuditPath, artifacts.envAuditJson, "utf8")
+  ]);
+}
+function createEmptyInMemorySchemaState() {
+  return {
+    schema: {}
+  };
+}
+function createInMemorySchemaStateFromPersisted(persisted) {
+  if (!persisted) {
+    return createEmptyInMemorySchemaState();
+  }
+  return {
+    schema: Object.fromEntries(
+      Object.entries(persisted.schema).map(([key, definition]) => [
+        key,
+        normalizeSchemaDefinition(key, definition)
+      ])
+    ),
+    prefixPolicy: deserializePrefixPolicy(persisted.prefixPolicy)
+  };
+}
+function computeChecksum(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+var cachedTypeScriptModule;
+function resolveTypeScriptModule(source) {
+  if (!isRecord(source)) {
+    return void 0;
+  }
+  const transpileModule = source.transpileModule;
+  const moduleKind = source.ModuleKind;
+  const scriptTarget = source.ScriptTarget;
+  if (typeof transpileModule !== "function" || !isRecord(moduleKind) || typeof moduleKind.ESNext !== "number" || !isRecord(scriptTarget) || typeof scriptTarget.ES2022 !== "number") {
+    return void 0;
+  }
+  return {
+    transpileModule,
+    ModuleKind: {
+      ESNext: moduleKind.ESNext
+    },
+    ScriptTarget: {
+      ES2022: scriptTarget.ES2022
+    }
+  };
+}
+async function loadTypeScriptModule() {
+  if (!cachedTypeScriptModule) {
+    cachedTypeScriptModule = (async () => {
+      let imported;
+      try {
+        imported = await import("typescript");
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `Cannot load "typescript" required for .ts env migrations. Fix: install it in your app (pnpm add -D typescript) or use .mjs migrations. Error: ${reason}`
+        );
+      }
+      const direct = resolveTypeScriptModule(imported);
+      if (direct) {
+        return direct;
+      }
+      const fallbackDefault = isRecord(imported) ? resolveTypeScriptModule(imported.default) : void 0;
+      if (fallbackDefault) {
+        return fallbackDefault;
+      }
+      throw new Error(
+        'Loaded "typescript" but module shape is unsupported. Fix: use a current TypeScript version that exports transpileModule/ModuleKind/ScriptTarget.'
+      );
+    })();
+  }
+  return await cachedTypeScriptModule;
+}
+async function importModuleFromFile(filePath) {
+  const extension = path2.extname(filePath).toLowerCase();
+  if (extension === ".ts" || extension === ".mts" || extension === ".cts") {
+    const source = await readFile2(filePath, "utf8");
+    const typescript = await loadTypeScriptModule();
+    const transpiled = typescript.transpileModule(source, {
+      fileName: filePath,
+      compilerOptions: {
+        target: typescript.ScriptTarget.ES2022,
+        module: typescript.ModuleKind.ESNext
+      }
+    }).outputText;
+    const transientFilePath = path2.join(
+      path2.dirname(filePath),
+      `.__wrkspace_env_migration_${path2.basename(filePath)}_${process.pid}_${Date.now()}.mjs`
+    );
+    await writeFile2(transientFilePath, transpiled, "utf8");
+    try {
+      return await import(`${pathToFileURL(transientFilePath).href}?v=${Date.now()}`);
+    } finally {
+      await unlink(transientFilePath).catch(() => void 0);
+    }
+  }
+  return await import(`${pathToFileURL(filePath).href}?v=${Date.now()}`);
+}
+function normalizeMigrationExports(imported) {
+  const output = {};
+  if (isRecord(imported)) {
+    Object.assign(output, imported);
+    const defaultExport = imported.default;
+    if (isRecord(defaultExport)) {
+      Object.assign(output, defaultExport);
+    }
+  }
+  return output;
+}
+async function loadMigrationFromFile(filePath) {
+  const source = await readFile2(filePath, "utf8");
+  const checksum = computeChecksum(source);
+  const imported = await importModuleFromFile(filePath);
+  const normalized = normalizeMigrationExports(imported);
+  const exportedId = normalized.id;
+  const derivedId = path2.basename(filePath, path2.extname(filePath));
+  const up = normalized.up;
+  const down = normalized.down;
+  if (exportedId !== void 0 && (typeof exportedId !== "string" || exportedId.trim().length === 0)) {
+    throw new Error(
+      `Invalid migration "${filePath}". Fix: if you export "id", it must be a non-empty string matching the filename stem "${derivedId}".`
+    );
+  }
+  if (typeof exportedId === "string" && exportedId !== derivedId) {
+    throw new Error(
+      `Invalid migration "${filePath}". Fix: migration id is derived from filename ("${derivedId}"). Remove exported id or rename it to match.`
+    );
+  }
+  if (typeof up !== "function") {
+    throw new Error(
+      `Invalid migration "${filePath}". Fix: export an "up(ctx)" function.`
+    );
+  }
+  if (typeof down !== "function") {
+    throw new Error(
+      `Invalid migration "${filePath}". Fix: export a "down(ctx)" function.`
+    );
+  }
+  return {
+    id: derivedId,
+    up,
+    down,
+    filePath,
+    checksum
+  };
+}
+async function discoverMigrations(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const migrationsDir = resolveMigrationsDir(cwd, options.migrationsDir);
+  if (!await pathExists(migrationsDir)) {
+    return {
+      migrationsDir,
+      migrations: []
+    };
+  }
+  const directoryEntries = await readdir(migrationsDir, {
+    withFileTypes: true
+  });
+  const migrationPaths = directoryEntries.filter((entry) => entry.isFile()).map((entry) => entry.name).filter((filename) => MIGRATION_FILE_PATTERN.test(filename) && !filename.endsWith(".d.ts")).sort((left, right) => left.localeCompare(right)).map((filename) => path2.resolve(migrationsDir, filename));
+  const migrations = [];
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const migrationPath of migrationPaths) {
+    const migration = await loadMigrationFromFile(migrationPath);
+    if (seenIds.has(migration.id)) {
+      throw new Error(
+        `Duplicate migration id "${migration.id}" in "${migrationsDir}". Fix: ensure migration filenames produce unique ids.`
+      );
+    }
+    seenIds.add(migration.id);
+    migrations.push(migration);
+  }
+  migrations.sort((left, right) => left.id.localeCompare(right.id) || left.filePath.localeCompare(right.filePath));
+  return {
+    migrationsDir,
+    migrations
+  };
+}
+function migrationStatusFromRuntime(migrationsDir, statePath, migrations, state) {
+  const stateById = /* @__PURE__ */ new Map();
+  for (const applied of state.applied) {
+    stateById.set(applied.id, applied);
+  }
+  const migrationById = /* @__PURE__ */ new Map();
+  for (const migration of migrations) {
+    migrationById.set(migration.id, migration);
+  }
+  const entries = [];
+  for (const migration of migrations) {
+    const applied = stateById.get(migration.id);
+    if (!applied) {
+      entries.push({
+        id: migration.id,
+        status: "pending",
+        filePath: migration.filePath,
+        checksum: migration.checksum
+      });
+      continue;
+    }
+    const changed = applied.checksum !== migration.checksum;
+    entries.push({
+      id: migration.id,
+      status: changed ? "changed" : "applied",
+      filePath: migration.filePath,
+      appliedAt: applied.appliedAt,
+      checksum: applied.checksum,
+      currentChecksum: migration.checksum
+    });
+  }
+  for (const applied of state.applied) {
+    if (migrationById.has(applied.id)) {
+      continue;
+    }
+    entries.push({
+      id: applied.id,
+      status: "missing",
+      appliedAt: applied.appliedAt,
+      checksum: applied.checksum
+    });
+  }
+  const summary = {
+    total: entries.length,
+    applied: entries.filter((entry) => entry.status === "applied").length,
+    pending: entries.filter((entry) => entry.status === "pending").length,
+    changed: entries.filter((entry) => entry.status === "changed").length,
+    missing: entries.filter((entry) => entry.status === "missing").length
+  };
+  return {
+    migrationsDir,
+    statePath,
+    entries,
+    summary
+  };
+}
+async function getMigrationStatus(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const [{ migrationsDir, migrations }, { statePath, state }] = await Promise.all([
+    discoverMigrations({
+      cwd,
+      migrationsDir: options.migrationsDir
+    }),
+    loadMigrationState({
+      cwd,
+      stateFile: options.stateFile
+    })
+  ]);
+  return migrationStatusFromRuntime(migrationsDir, statePath, migrations, state);
+}
+async function rebuildGeneratedSchemaFromState(options) {
+  const migrationById = new Map(options.migrations.map((migration) => [migration.id, migration]));
+  const schemaState = createEmptyInMemorySchemaState();
+  for (const applied of options.state.applied) {
+    const migration = migrationById.get(applied.id);
+    if (!migration) {
+      throw new Error(
+        `Cannot rebuild generated schema because migration "${applied.id}" is missing. Fix: restore migration files and rerun.`
+      );
+    }
+    const context = createEnvMigrationContext(createNoopTargetDocuments(), [], schemaState);
+    try {
+      await migration.up(context);
+      finalizeFluentDefinitions(context);
+    } catch (error) {
+      throw formatMigrationExecutionError(migration, "up", error);
+    }
+  }
+  const appliedMigrationIds = options.state.applied.map((entry) => entry.id);
+  await savePersistedGeneratedSchema(
+    options.cwd,
+    options.generatedSchemaPath,
+    schemaState,
+    appliedMigrationIds
+  );
+  return {
+    schemaPath: options.generatedSchemaPath,
+    schema: schemaState.schema,
+    prefixPolicy: schemaState.prefixPolicy,
+    appliedMigrationIds
+  };
+}
+async function loadOrBuildMigrationSchema(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const generatedSchemaPath = resolveGeneratedSchemaPath(cwd, options.generatedSchemaFile);
+  const [{ migrationsDir, migrations }, { statePath, state }, persistedSchema] = await Promise.all([
+    discoverMigrations({
+      cwd,
+      migrationsDir: options.migrationsDir
+    }),
+    loadMigrationState({
+      cwd,
+      stateFile: options.stateFile
+    }),
+    loadPersistedGeneratedSchema(generatedSchemaPath)
+  ]);
+  const status = migrationStatusFromRuntime(migrationsDir, statePath, migrations, state);
+  assertMigrationIntegrity(status);
+  if (state.applied.length === 0 && !persistedSchema) {
+    if (options.allowEmpty) {
+      const emptyState = createEmptyInMemorySchemaState();
+      await savePersistedGeneratedSchema(cwd, generatedSchemaPath, emptyState, []);
+      return {
+        schemaPath: generatedSchemaPath,
+        schema: {},
+        appliedMigrationIds: []
+      };
+    }
+    throw new Error(
+      `No schema file found and no applied migrations to derive one in "${cwd}". Fix: apply migrations that define schema (for example via ctx.url(...)/ctx.string(...)) or provide --schema <path>.`
+    );
+  }
+  const appliedMigrationIds = state.applied.map((entry) => entry.id);
+  if (!options.forceRebuild && persistedSchema && persistedSchema.appliedMigrationIds.length === appliedMigrationIds.length && persistedSchema.appliedMigrationIds.every((id, index) => id === appliedMigrationIds[index])) {
+    const normalized = createInMemorySchemaStateFromPersisted(persistedSchema);
+    return {
+      schemaPath: generatedSchemaPath,
+      schema: normalized.schema,
+      prefixPolicy: normalized.prefixPolicy,
+      appliedMigrationIds
+    };
+  }
+  return await rebuildGeneratedSchemaFromState({
+    cwd,
+    generatedSchemaPath,
+    migrations,
+    state
+  });
+}
+function formatMigrationExecutionError(migration, direction, error) {
+  const reason = error instanceof Error ? error.message : String(error);
+  return new Error(
+    `Migration "${migration.id}" failed during ${direction}() at "${migration.filePath}". Fix: check migration logic and retry. Error: ${reason}`
+  );
+}
+function assertMigrationIntegrity(status) {
+  if (status.summary.changed === 0 && status.summary.missing === 0) {
+    return;
+  }
+  const changedIds = status.entries.filter((entry) => entry.status === "changed").map((entry) => entry.id);
+  const missingIds = status.entries.filter((entry) => entry.status === "missing").map((entry) => entry.id);
+  const details = [];
+  if (changedIds.length > 0) {
+    details.push(`changed: ${changedIds.join(", ")}`);
+  }
+  if (missingIds.length > 0) {
+    details.push(`missing: ${missingIds.join(", ")}`);
+  }
+  throw new Error(
+    `Migration integrity check failed (${details.join(" | ")}). Fix: restore migration files/checksums to match ${status.statePath}.`
+  );
+}
+function formatIsoTimestamp(date) {
+  return date.toISOString();
+}
+function formatMigrationIdTimestamp(date) {
+  const year = date.getUTCFullYear();
+  const month = `${date.getUTCMonth() + 1}`.padStart(2, "0");
+  const day = `${date.getUTCDate()}`.padStart(2, "0");
+  const hour = `${date.getUTCHours()}`.padStart(2, "0");
+  const minute = `${date.getUTCMinutes()}`.padStart(2, "0");
+  const second = `${date.getUTCSeconds()}`.padStart(2, "0");
+  return `${year}${month}${day}${hour}${minute}${second}`;
+}
+function slugify(input) {
+  const slug = input.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug.length > 0 ? slug : "migration";
+}
+function renderDefaultMigrationTemplate(id) {
+  const _migrationId = id;
+  return [
+    'import type { EnvMigrationContext } from "@wrkspace-co/env";',
+    "",
+    `// Migration id is derived from this filename: ${_migrationId}.ts`,
+    "",
+    "export async function up(ctx: EnvMigrationContext) {",
+    "  // Fluent schema + env definition:",
+    '  // ctx.url("DATABASE_URL").scope("server").requiredIn("prod");',
+    '  // ctx.enum("LOG_LEVEL").values(["debug", "info", "warn", "error"]).defaultValue("info");',
+    "}",
+    "",
+    "export async function down(ctx: EnvMigrationContext) {",
+    '  // ctx.key("DATABASE_URL").remove();',
+    '  // ctx.key("LOG_LEVEL").remove();',
+    "}",
+    ""
+  ].join("\n");
+}
+async function createMigrationFile(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const migrationsDir = resolveMigrationsDir(cwd, options.migrationsDir);
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const id = `${formatMigrationIdTimestamp(now)}_${slugify(options.name)}`;
+  const filename = `${id}.ts`;
+  const filePath = path2.resolve(migrationsDir, filename);
+  await mkdir2(migrationsDir, { recursive: true });
+  if (await pathExists(filePath)) {
+    throw new Error(
+      `Migration file already exists at "${filePath}". Fix: choose a different migration name or timestamp.`
+    );
+  }
+  const content = options.template ? options.template(id) : renderDefaultMigrationTemplate(id);
+  await writeFile2(filePath, content, "utf8");
+  return {
+    id,
+    filePath,
+    migrationsDir
+  };
+}
+async function applyPendingMigrations(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const generatedSchemaPath = resolveGeneratedSchemaPath(cwd, options.generatedSchemaFile);
+  const [{ migrationsDir, migrations }, { statePath, state }] = await Promise.all([
+    discoverMigrations({
+      cwd,
+      migrationsDir: options.migrationsDir
+    }),
+    loadMigrationState({
+      cwd,
+      stateFile: options.stateFile
+    })
+  ]);
+  const status = migrationStatusFromRuntime(migrationsDir, statePath, migrations, state);
+  assertMigrationIntegrity(status);
+  const appliedIds = new Set(state.applied.map((item) => item.id));
+  const pending = migrations.filter((migration) => !appliedIds.has(migration.id));
+  if (pending.length === 0) {
+    const derivedSchema2 = await loadOrBuildMigrationSchema({
+      cwd,
+      migrationsDir: options.migrationsDir,
+      stateFile: options.stateFile,
+      generatedSchemaFile: options.generatedSchemaFile,
+      allowEmpty: true
+    });
+    await writeEnvDocsFromSchema(cwd, derivedSchema2.schema);
+    return {
+      migrationsDir,
+      statePath,
+      applied: [],
+      changedFiles: [],
+      pendingCount: 0
+    };
+  }
+  const targetDocuments = await loadEnvTargetDocuments({ cwd });
+  const derivedSchema = await loadOrBuildMigrationSchema({
+    cwd,
+    migrationsDir: options.migrationsDir,
+    stateFile: options.stateFile,
+    generatedSchemaFile: options.generatedSchemaFile,
+    allowEmpty: true
+  });
+  const schemaState = {
+    schema: Object.fromEntries(
+      Object.entries(derivedSchema.schema).map(([key, definition]) => [
+        key,
+        normalizeSchemaDefinition(key, definition)
+      ])
+    ),
+    prefixPolicy: derivedSchema.prefixPolicy
+  };
+  const changedFiles = /* @__PURE__ */ new Set();
+  const applied = [];
+  for (const migration of pending) {
+    const context = createEnvMigrationContext(targetDocuments, [], schemaState);
+    try {
+      await migration.up(context);
+      finalizeFluentDefinitions(context);
+    } catch (error) {
+      throw formatMigrationExecutionError(migration, "up", error);
+    }
+    const changedFromMigration = await writeEnvTargetDocuments(targetDocuments);
+    for (const changedFile of changedFromMigration) {
+      changedFiles.add(changedFile);
+    }
+    state.applied.push({
+      id: migration.id,
+      appliedAt: formatIsoTimestamp(now),
+      checksum: migration.checksum
+    });
+    await Promise.all([
+      saveMigrationState(cwd, statePath, state),
+      savePersistedGeneratedSchema(
+        cwd,
+        generatedSchemaPath,
+        schemaState,
+        state.applied.map((entry) => entry.id)
+      )
+    ]);
+    applied.push(migration.id);
+  }
+  await writeEnvDocsFromSchema(cwd, schemaState.schema);
+  return {
+    migrationsDir,
+    statePath,
+    applied,
+    changedFiles: [...changedFiles].sort((left, right) => left.localeCompare(right)),
+    pendingCount: 0
+  };
+}
+async function rollbackMigrations(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const generatedSchemaPath = resolveGeneratedSchemaPath(cwd, options.generatedSchemaFile);
+  if (!Number.isInteger(options.steps) || options.steps <= 0) {
+    throw new Error(`Invalid rollback steps "${options.steps}". Fix: pass a positive integer.`);
+  }
+  const [{ migrationsDir, migrations }, { statePath, state }] = await Promise.all([
+    discoverMigrations({
+      cwd,
+      migrationsDir: options.migrationsDir
+    }),
+    loadMigrationState({
+      cwd,
+      stateFile: options.stateFile
+    })
+  ]);
+  const status = migrationStatusFromRuntime(migrationsDir, statePath, migrations, state);
+  assertMigrationIntegrity(status);
+  if (state.applied.length === 0) {
+    return {
+      migrationsDir,
+      statePath,
+      rolledBack: [],
+      changedFiles: [],
+      remainingApplied: 0
+    };
+  }
+  if (options.steps > state.applied.length) {
+    throw new Error(
+      `Cannot rollback ${options.steps} step(s): only ${state.applied.length} migration(s) are applied. Fix: lower --steps.`
+    );
+  }
+  const migrationById = /* @__PURE__ */ new Map();
+  for (const migration of migrations) {
+    migrationById.set(migration.id, migration);
+  }
+  const selected = state.applied.slice(-options.steps).reverse();
+  const targetDocuments = await loadEnvTargetDocuments({ cwd });
+  const derivedSchema = await loadOrBuildMigrationSchema({
+    cwd,
+    migrationsDir: options.migrationsDir,
+    stateFile: options.stateFile,
+    generatedSchemaFile: options.generatedSchemaFile,
+    allowEmpty: true
+  });
+  const schemaState = {
+    schema: Object.fromEntries(
+      Object.entries(derivedSchema.schema).map(([key, definition]) => [
+        key,
+        normalizeSchemaDefinition(key, definition)
+      ])
+    ),
+    prefixPolicy: derivedSchema.prefixPolicy
+  };
+  const changedFiles = /* @__PURE__ */ new Set();
+  const rolledBack = [];
+  for (const applied of selected) {
+    const migration = migrationById.get(applied.id);
+    if (!migration) {
+      throw new Error(
+        `Cannot rollback migration "${applied.id}" because its file is missing. Fix: restore the migration file in ${migrationsDir}.`
+      );
+    }
+    const context = createEnvMigrationContext(targetDocuments, [], schemaState);
+    try {
+      await migration.down(context);
+      finalizeFluentDefinitions(context);
+    } catch (error) {
+      throw formatMigrationExecutionError(migration, "down", error);
+    }
+    const changedFromMigration = await writeEnvTargetDocuments(targetDocuments);
+    for (const changedFile of changedFromMigration) {
+      changedFiles.add(changedFile);
+    }
+    state.applied = state.applied.filter((entry) => entry.id !== applied.id);
+    await Promise.all([
+      saveMigrationState(cwd, statePath, state),
+      savePersistedGeneratedSchema(
+        cwd,
+        generatedSchemaPath,
+        schemaState,
+        state.applied.map((entry) => entry.id)
+      )
+    ]);
+    rolledBack.push(applied.id);
+  }
+  await writeEnvDocsFromSchema(cwd, schemaState.schema);
+  return {
+    migrationsDir,
+    statePath,
+    rolledBack,
+    changedFiles: [...changedFiles].sort((left, right) => left.localeCompare(right)),
+    remainingApplied: state.applied.length
+  };
+}
+
+// src/schema-loader.ts
+var DEFAULT_SCHEMA_FILES = [
+  "env.schema.mjs",
+  "env.schema.js",
+  "env.schema.cjs",
+  "env.schema.json"
+];
+async function exists(filepath) {
+  try {
+    await access3(filepath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function resolveSchemaPath(schemaPath, cwd, options = {}) {
+  if (schemaPath) {
+    const resolved = path3.resolve(cwd, schemaPath);
+    if (!await exists(resolved)) {
+      throw new Error(
+        `Schema file not found at "${resolved}". Fix: provide a valid path via --schema <path>.`
+      );
+    }
+    return resolved;
+  }
+  try {
+    const derived = await loadOrBuildMigrationSchema({
+      cwd,
+      migrationsDir: options.migrationsDir,
+      stateFile: options.stateFile,
+      generatedSchemaFile: options.generatedSchemaFile,
+      forceRebuild: Boolean(options.forceRebuildMigrationSchema),
+      allowEmpty: false
+    });
+    return derived.schemaPath;
+  } catch (error) {
+    const generatedSchemaPath = path3.resolve(
+      cwd,
+      options.generatedSchemaFile ?? DEFAULT_GENERATED_SCHEMA_FILE2
+    );
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `Migration-first schema resolution failed in "${cwd}" for "${generatedSchemaPath}". Fix: run env migrations that define schema (for example via ctx.url(...)/ctx.string(...)), or pass --schema <path> for manual debug/view mode. Error: ${reason}`
+    );
+  }
+}
+function validateLoadedSchema(rawSchema, schemaPath) {
+  if (!rawSchema || typeof rawSchema !== "object" || Array.isArray(rawSchema)) {
+    throw new Error(
+      `Invalid schema export from "${schemaPath}". Fix: export an object map of env keys to variable definitions.`
+    );
+  }
+  const schema = rawSchema;
+  for (const [key, candidate] of Object.entries(schema)) {
+    if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+      throw new Error(
+        `Invalid schema definition for key "${key}" in "${schemaPath}". Fix: each key must map to an object definition.`
+      );
+    }
+    const definition = candidate;
+    if (typeof definition.kind !== "string") {
+      throw new Error(
+        `Invalid schema definition for key "${key}" in "${schemaPath}". Fix: include a "kind" field (string/url/number/boolean/enum/json).`
+      );
+    }
+  }
+  return schema;
+}
+function resolvePrefixPolicy(rawPolicy, schemaPath, fieldName = "prefixPolicy") {
+  if (!rawPolicy) {
+    return void 0;
+  }
+  if (typeof rawPolicy === "string") {
+    if (rawPolicy === "nextjs") {
+      return prefixPolicies.nextjs;
+    }
+    if (rawPolicy === "vite") {
+      return prefixPolicies.vite;
+    }
+    throw new Error(
+      `Unsupported ${fieldName} "${rawPolicy}" in "${schemaPath}". Fix: use "nextjs", "vite", or a PrefixPolicy object.`
+    );
+  }
+  if (typeof rawPolicy === "object" && !Array.isArray(rawPolicy)) {
+    const candidate = rawPolicy;
+    if (!Array.isArray(candidate.publicPrefixes)) {
+      throw new Error(
+        `Invalid ${fieldName} in "${schemaPath}". Fix: include publicPrefixes: string[].`
+      );
+    }
+    return rawPolicy;
+  }
+  throw new Error(
+    `Invalid ${fieldName} in "${schemaPath}". Fix: use "nextjs", "vite", or a PrefixPolicy object.`
+  );
+}
+function isRecord2(candidate) {
+  return Boolean(candidate) && typeof candidate === "object" && !Array.isArray(candidate);
+}
+function parseAppSchemaConfig(appName, rawAppConfig, schemaPath) {
+  if (!isRecord2(rawAppConfig)) {
+    throw new Error(
+      `Invalid app config for "${appName}" in "${schemaPath}". Fix: app configs must be objects.`
+    );
+  }
+  const hasContainerShape = ["schema", "overrides", "only", "prefixPolicy"].some(
+    (field) => Object.hasOwn(rawAppConfig, field)
+  );
+  const config = rawAppConfig;
+  const overridesCandidate = hasContainerShape ? config.schema ?? config.overrides ?? {} : rawAppConfig;
+  const overrides = validateLoadedSchema(overridesCandidate, schemaPath);
+  let only;
+  if (hasContainerShape && config.only !== void 0) {
+    if (!Array.isArray(config.only) || config.only.some((value) => typeof value !== "string")) {
+      throw new Error(
+        `Invalid apps.${appName}.only in "${schemaPath}". Fix: provide a string[] of schema keys.`
+      );
+    }
+    only = [...config.only];
+  }
+  const prefixPolicy = hasContainerShape ? resolvePrefixPolicy(config.prefixPolicy, schemaPath, `apps.${appName}.prefixPolicy`) : void 0;
+  return {
+    overrides,
+    only,
+    prefixPolicy
+  };
+}
+function parseApps(rawApps, schemaPath) {
+  if (rawApps === void 0) {
+    return {};
+  }
+  if (!isRecord2(rawApps)) {
+    throw new Error(
+      `Invalid apps config in "${schemaPath}". Fix: export apps as an object map keyed by app name.`
+    );
+  }
+  const parsed = {};
+  for (const [appName, appConfig] of Object.entries(rawApps)) {
+    parsed[appName] = parseAppSchemaConfig(appName, appConfig, schemaPath);
+  }
+  return parsed;
+}
+function selectSchemaForApp(baseSchema, appName, appConfig, schemaPath) {
+  const mergedSchema = {
+    ...baseSchema,
+    ...appConfig.overrides
+  };
+  if (!appConfig.only) {
+    return mergedSchema;
+  }
+  const subsetSchema = {};
+  for (const key of appConfig.only) {
+    if (!(key in mergedSchema)) {
+      throw new Error(
+        `Unknown key "${key}" in apps.${appName}.only for "${schemaPath}". Fix: add this key to base/schema overrides or remove it from only.`
+      );
+    }
+    subsetSchema[key] = mergedSchema[key];
+  }
+  return subsetSchema;
+}
+function normalizeLoadedSchema(rawSource, schemaPath, options) {
+  const source = isRecord2(rawSource) ? rawSource : {};
+  const baseCandidate = source.baseSchema ?? source.default ?? source.schema ?? rawSource;
+  const baseSchema = validateLoadedSchema(baseCandidate, schemaPath);
+  const globalPrefixPolicy = resolvePrefixPolicy(source.prefixPolicy, schemaPath, "prefixPolicy");
+  const apps = parseApps(source.apps ?? source.appSchemas, schemaPath);
+  if (!options.app) {
+    return {
+      schema: baseSchema,
+      prefixPolicy: globalPrefixPolicy,
+      schemaPath
+    };
+  }
+  const appConfig = apps[options.app];
+  if (!appConfig) {
+    const knownApps = Object.keys(apps);
+    const knownAppsText = knownApps.length > 0 ? knownApps.join(", ") : "none";
+    throw new Error(
+      `Unknown app "${options.app}" for "${schemaPath}". Fix: use one of: ${knownAppsText}.`
+    );
+  }
+  return {
+    schema: selectSchemaForApp(baseSchema, options.app, appConfig, schemaPath),
+    prefixPolicy: appConfig.prefixPolicy ?? globalPrefixPolicy,
+    schemaPath,
+    app: options.app
+  };
+}
+async function loadSchema(schemaPath, options = {}) {
+  if (schemaPath.endsWith(".json")) {
+    const jsonContent = await readFile3(schemaPath, "utf8");
+    return normalizeLoadedSchema(JSON.parse(jsonContent), schemaPath, options);
+  }
+  const imported = await import(pathToFileURL2(schemaPath).href);
+  return normalizeLoadedSchema(imported, schemaPath, options);
+}
+
+// src/audit-command.ts
+var TARGETS2 = ["dev", "preview", "prod"];
+var AUDIT_FILES_BY_TARGET = {
+  dev: [".env.defaults", ".env", ".env.dev", ".env.local", ".env.dev.local", ".env.vercel.dev"],
+  preview: [
+    ".env.defaults",
+    ".env",
+    ".env.preview",
+    ".env.local",
+    ".env.preview.local",
+    ".env.vercel.preview"
+  ],
+  prod: [".env.defaults", ".env", ".env.prod", ".env.local", ".env.prod.local", ".env.vercel.prod"]
+};
+async function fileExists2(filepath) {
+  try {
+    await access4(filepath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loadValuesForTarget(cwd, target, schema) {
+  const values = {};
+  const inspectedFiles = [];
+  for (const candidate of AUDIT_FILES_BY_TARGET[target]) {
+    const filepath = path4.resolve(cwd, candidate);
+    if (!await fileExists2(filepath)) {
+      continue;
+    }
+    const content = await readFile4(filepath, "utf8");
+    const parsed = parseDotenv(content);
+    Object.assign(values, dotenvToObject(parsed));
+    inspectedFiles.push(candidate);
+  }
+  for (const key of Object.keys(schema)) {
+    if (process.env[key] !== void 0) {
+      values[key] = process.env[key];
+    }
+  }
+  return { values, inspectedFiles };
+}
+function aggregateSummary(targets) {
+  return targets.reduce(
+    (accumulator, targetResult) => ({
+      total: accumulator.total + targetResult.summary.total,
+      errors: accumulator.errors + targetResult.summary.errors,
+      warnings: accumulator.warnings + targetResult.summary.warnings
+    }),
+    { total: 0, errors: 0, warnings: 0 }
+  );
+}
+function flattenIssues(targets) {
+  return targets.flatMap((targetResult) => targetResult.issues);
+}
+async function runAuditCommand(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const schemaPath = await resolveSchemaPath(options.schema, cwd);
+  const loaded = await loadSchema(schemaPath);
+  const targetResults = [];
+  for (const target of TARGETS2) {
+    const { values, inspectedFiles } = await loadValuesForTarget(cwd, target, loaded.schema);
+    const drift = detectDrift(loaded.schema, {
+      target,
+      values,
+      source: inspectedFiles.join(", ")
+    });
+    targetResults.push({
+      target,
+      inspectedFiles,
+      summary: drift.summary,
+      issues: drift.issues
+    });
+  }
+  const summary = aggregateSummary(targetResults);
+  const issues = flattenIssues(targetResults);
+  const result = {
+    ok: summary.errors === 0,
+    exitCode: summary.errors === 0 ? 0 : 1,
+    schemaPath,
+    summary,
+    targets: targetResults,
+    issues
+  };
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  if (options.json) {
+    stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+  } else if (result.ok) {
+    stdout.write("env audit passed. No drift detected across dev/preview/prod snapshots.\n");
+  } else {
+    stderr.write(`${formatValidationIssues(result.issues)}
+`);
+  }
+  return result;
+}
+
+// src/check-command.ts
+import { access as access5, readFile as readFile5 } from "fs/promises";
+import path5 from "path";
+var CHECK_ENV_FILES_BY_TARGET = {
+  dev: [".env.defaults", ".env", ".env.dev", ".env.local", ".env.dev.local"],
+  preview: [".env.defaults", ".env", ".env.preview", ".env.local", ".env.preview.local"],
+  prod: [".env.defaults", ".env", ".env.prod", ".env.local", ".env.prod.local"]
+};
+function assertTarget(target) {
+  if (target === "dev" || target === "preview" || target === "prod") {
+    return;
+  }
+  throw new Error(`Invalid target "${String(target)}". Expected one of: dev, preview, prod.`);
+}
+function sortIssues2(issues) {
+  const severityOrder = {
+    error: 0,
+    warning: 1
+  };
+  return [...issues].sort((left, right) => {
+    return severityOrder[left.severity] - severityOrder[right.severity] || left.target.localeCompare(right.target) || left.scope.localeCompare(right.scope) || left.key.localeCompare(right.key) || left.code.localeCompare(right.code);
+  });
+}
+function collectUnknownIssues2(schema, values, target) {
+  const schemaKeys = new Set(Object.keys(schema));
+  const issues = [];
+  for (const key of Object.keys(values)) {
+    if (schemaKeys.has(key)) {
+      continue;
+    }
+    issues.push({
+      key,
+      target,
+      scope: "server",
+      severity: "error",
+      code: "UNKNOWN_VARIABLE",
+      message: "Variable is not defined in schema and `--allow-unknown` was not set.",
+      fix: `Add "${key}" to your schema or re-run check with --allow-unknown.`
+    });
+  }
+  return issues;
+}
+async function fileExists3(filepath) {
+  try {
+    await access5(filepath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loadValuesFromFiles(cwd, target, schema) {
+  const merged = {};
+  const fileOrder = CHECK_ENV_FILES_BY_TARGET[target];
+  for (const filename of fileOrder) {
+    const absolutePath = path5.resolve(cwd, filename);
+    if (!await fileExists3(absolutePath)) {
+      continue;
+    }
+    const fileContent = await readFile5(absolutePath, "utf8");
+    const parsed = parseDotenv(fileContent);
+    Object.assign(merged, dotenvToObject(parsed));
+  }
+  for (const key of Object.keys(schema)) {
+    if (process.env[key] !== void 0) {
+      merged[key] = process.env[key];
+    }
+  }
+  return merged;
+}
+async function runCheckCommand(options) {
+  assertTarget(options.target);
+  const cwd = options.cwd ?? process.cwd();
+  const strict = options.strict ?? true;
+  const allowUnknown = options.allowUnknown ?? false;
+  const schemaPath = await resolveSchemaPath(options.schema, cwd);
+  const loaded = await loadSchema(schemaPath, { app: options.app });
+  const schema = loaded.schema;
+  const prefixPolicy = options.prefixPolicy ?? loaded.prefixPolicy;
+  const values = options.values ?? await loadValuesFromFiles(cwd, options.target, schema);
+  const issues = [];
+  const runtime = createEnv(schema, {
+    target: options.target,
+    values,
+    strict,
+    throwOnError: false,
+    prefixPolicy,
+    now: options.now
+  });
+  try {
+    runtime.assert();
+  } catch (error) {
+    if (!(error instanceof EnvValidationError)) {
+      throw error;
+    }
+    issues.push(...error.issues);
+  }
+  if (!allowUnknown) {
+    issues.push(...collectUnknownIssues2(schema, values, options.target));
+  }
+  const sortedIssues = sortIssues2(issues);
+  const errors = sortedIssues.filter((issue) => issue.severity === "error").length;
+  const warnings = sortedIssues.filter((issue) => issue.severity === "warning").length;
+  const ok = errors === 0;
+  const result = {
+    ok,
+    exitCode: ok ? 0 : 1,
+    target: options.target,
+    allowUnknown,
+    strict,
+    schemaPath,
+    summary: {
+      total: sortedIssues.length,
+      errors,
+      warnings
+    },
+    issues: sortedIssues
+  };
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  if (options.json) {
+    stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+  } else if (!result.ok) {
+    stderr.write(`${formatValidationIssues(sortedIssues)}
+`);
+  } else {
+    stdout.write(
+      `env check passed for target "${options.target}" with ${Object.keys(schema).length} schema variable(s).
+`
+    );
+  }
+  return result;
+}
+
+// src/deprecations-command.ts
+function parseRemoveAfter2(removeAfter) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(removeAfter)) {
+    return /* @__PURE__ */ new Date(`${removeAfter}T23:59:59.999Z`);
+  }
+  const parsed = new Date(removeAfter);
+  if (Number.isNaN(parsed.getTime())) {
+    return void 0;
+  }
+  return parsed;
+}
+function getStatus(removeAfter, now) {
+  if (!removeAfter) {
+    return "no-deadline";
+  }
+  const parsedDeadline = parseRemoveAfter2(removeAfter);
+  if (!parsedDeadline) {
+    return "no-deadline";
+  }
+  if (now.getTime() > parsedDeadline.getTime()) {
+    return "expired";
+  }
+  return "active";
+}
+function formatItem(item) {
+  const parts = [`- ${item.key}`, `scope=${item.scope}`, `status=${item.status}`];
+  if (item.replacedBy) {
+    parts.push(`replacedBy=${item.replacedBy}`);
+  }
+  if (item.removeAfter) {
+    parts.push(`removeAfter=${item.removeAfter}`);
+  }
+  if (item.message) {
+    parts.push(`message=${item.message}`);
+  }
+  return parts.join(" ");
+}
+async function runDeprecationsCommand(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const schemaPath = await resolveSchemaPath(options.schema, cwd);
+  const loaded = await loadSchema(schemaPath, { app: options.app });
+  const stdout = options.stdout ?? process.stdout;
+  const items = Object.entries(loaded.schema).filter(([, definition]) => Boolean(definition.deprecated)).map(([key, definition]) => ({
+    key,
+    scope: definition.scope,
+    replacedBy: definition.deprecated?.replacedBy,
+    removeAfter: definition.deprecated?.removeAfter,
+    message: definition.deprecated?.message,
+    status: getStatus(definition.deprecated?.removeAfter, now)
+  })).sort((left, right) => left.key.localeCompare(right.key));
+  const result = {
+    ok: true,
+    exitCode: 0,
+    schemaPath,
+    app: options.app,
+    count: items.length,
+    items
+  };
+  if (options.json) {
+    stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    return result;
+  }
+  if (items.length === 0) {
+    stdout.write("No deprecated variables found in schema.\n");
+    return result;
+  }
+  stdout.write("Deprecated variables:\n");
+  for (const item of items) {
+    stdout.write(`${formatItem(item)}
+`);
+  }
+  return result;
+}
+
+// src/export-command.ts
+import { access as access6, readFile as readFile6 } from "fs/promises";
+import path6 from "path";
+function yamlString(value) {
+  return JSON.stringify(value);
+}
+function includeEntryForFormat(format, definition) {
+  if (format === "github-actions") {
+    return true;
+  }
+  return definition.scope === "server";
+}
+function buildEntries(schema, format, options) {
+  return Object.entries(schema).sort(([left], [right]) => left.localeCompare(right)).filter(([, definition]) => includeEntryForFormat(format, definition)).map(([key, definition]) => ({
+    key,
+    scope: definition.scope,
+    sensitive: Boolean(definition.sensitive),
+    value: options.withValues ? options.sourceValues[key] ?? "" : ""
+  }));
+}
+function renderDockerCompose(entries) {
+  const lines = ['version: "3.9"', "services:", "  app:", "    environment:"];
+  if (entries.length === 0) {
+    lines.push("      {}");
+    return `${lines.join("\n")}
+`;
+  }
+  for (const entry of entries) {
+    lines.push(`      ${entry.key}: ${yamlString(entry.value)}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function renderK8s(entries) {
+  const configEntries = entries.filter((entry) => !entry.sensitive);
+  const secretEntries = entries.filter((entry) => entry.sensitive);
+  const lines = ["apiVersion: v1", "kind: ConfigMap", "metadata:", "  name: wrkspace-env-config"];
+  if (configEntries.length === 0) {
+    lines.push("data: {}");
+  } else {
+    lines.push("data:");
+    for (const entry of configEntries) {
+      lines.push(`  ${entry.key}: ${yamlString(entry.value)}`);
+    }
+  }
+  lines.push("---");
+  lines.push("apiVersion: v1");
+  lines.push("kind: Secret");
+  lines.push("metadata:");
+  lines.push("  name: wrkspace-env-secret");
+  lines.push("type: Opaque");
+  if (secretEntries.length === 0) {
+    lines.push("stringData: {}");
+  } else {
+    lines.push("stringData:");
+    for (const entry of secretEntries) {
+      lines.push(`  ${entry.key}: ${yamlString(entry.value)}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+function renderGithubActions(entries) {
+  const serverEntries = entries.filter((entry) => entry.scope === "server");
+  const clientEntries = entries.filter((entry) => entry.scope === "client");
+  const lines = ["env:"];
+  if (serverEntries.length === 0 && clientEntries.length === 0) {
+    lines.push("  {}");
+    return `${lines.join("\n")}
+`;
+  }
+  if (serverEntries.length > 0) {
+    lines.push("  # server");
+    for (const entry of serverEntries) {
+      lines.push(`  ${entry.key}: ${yamlString(entry.value)}`);
+    }
+  }
+  if (clientEntries.length > 0) {
+    lines.push("  # client");
+    for (const entry of clientEntries) {
+      lines.push(`  ${entry.key}: ${yamlString(entry.value)}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+function renderExport(schema, format, options) {
+  const entries = buildEntries(schema, format, options);
+  if (format === "docker-compose") {
+    return renderDockerCompose(entries);
+  }
+  if (format === "k8s") {
+    return renderK8s(entries);
+  }
+  return renderGithubActions(entries);
+}
+async function fileExists4(filepath) {
+  try {
+    await access6(filepath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readValuesFromFile(filepath) {
+  const content = await readFile6(filepath, "utf8");
+  const parsed = parseDotenv(content);
+  const values = dotenvToObject(parsed);
+  return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, value]));
+}
+async function runExportCommand(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  const withValues = Boolean(options.withValues);
+  const schemaPath = await resolveSchemaPath(options.schema, cwd);
+  const loaded = await loadSchema(schemaPath);
+  if (withValues && !options.from) {
+    stderr.write(
+      'Cannot export with values because "--from <file>" was not provided. Fix: pass both --with-values and --from <file>.\n'
+    );
+    return {
+      ok: false,
+      exitCode: 1,
+      format: options.format,
+      schemaPath
+    };
+  }
+  let sourcePath;
+  let sourceValues = {};
+  if (withValues && options.from) {
+    sourcePath = path6.resolve(cwd, options.from);
+    if (!await fileExists4(sourcePath)) {
+      stderr.write(
+        `Source file not found at "${sourcePath}". Fix: pass a valid --from <file> path.
+`
+      );
+      return {
+        ok: false,
+        exitCode: 1,
+        format: options.format,
+        schemaPath,
+        sourcePath
+      };
+    }
+    sourceValues = await readValuesFromFile(sourcePath);
+  }
+  const output = renderExport(loaded.schema, options.format, {
+    withValues,
+    sourceValues
+  });
+  stdout.write(output);
+  return {
+    ok: true,
+    exitCode: 0,
+    format: options.format,
+    schemaPath,
+    sourcePath,
+    output
+  };
+}
+
+// src/generate-command.ts
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import path7 from "path";
+async function runGenerateCommand(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const schemaPath = await resolveSchemaPath(options.schema, cwd);
+  const loaded = await loadSchema(schemaPath, { app: options.app });
+  const schema = loaded.schema;
+  const artifacts = generateArtifacts(schema, { app: options.app });
+  const filesToWrite = [
+    [".env.example", artifacts.envExample],
+    [".env.defaults", artifacts.envDefaults],
+    [DEFAULT_ENV_DOC_FILE, artifacts.envMarkdown],
+    [DEFAULT_ENV_AUDIT_FILE, artifacts.envAuditJson]
+  ];
+  if (options.writeLocal) {
+    filesToWrite.push([".env.local", artifacts.envLocal]);
+  }
+  if (options.writeTargetFiles) {
+    filesToWrite.push(
+      [".env.dev", generateTargetEnvFile(schema, "dev", { app: options.app })],
+      [".env.preview", generateTargetEnvFile(schema, "preview", { app: options.app })],
+      [".env.prod", generateTargetEnvFile(schema, "prod", { app: options.app })]
+    );
+  }
+  const autoGeneratedIgnoreEntries = filesToWrite.map(([relativePath]) => toWrkspaceEnvIgnoreEntry(cwd, path7.resolve(cwd, relativePath))).filter((entry) => Boolean(entry));
+  await ensureWrkspaceEnvGitignore(cwd, autoGeneratedIgnoreEntries);
+  for (const [relativePath, content] of filesToWrite) {
+    const absolutePath = path7.resolve(cwd, relativePath);
+    await mkdir3(path7.dirname(absolutePath), { recursive: true });
+    await writeFile3(absolutePath, content, "utf8");
+  }
+  const output = options.stdout ?? process.stdout;
+  output.write(`Generated ${filesToWrite.length} env artifact(s) from ${path7.basename(schemaPath)}.
+`);
+  return {
+    schemaPath,
+    writtenFiles: filesToWrite.map(([relativePath]) => relativePath),
+    artifacts
+  };
+}
+
+// src/migrate-command.ts
+function toErrorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function runMigrateMakeCommand(options) {
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  try {
+    const created = await createMigrationFile({
+      name: options.name,
+      cwd: options.cwd,
+      migrationsDir: options.migrationsDir,
+      now: options.now
+    });
+    stdout.write(`Created migration "${created.id}" at ${created.filePath}.
+`);
+    return {
+      ok: true,
+      exitCode: 0,
+      id: created.id,
+      filePath: created.filePath,
+      migrationsDir: created.migrationsDir
+    };
+  } catch (error) {
+    stderr.write(`${toErrorMessage(error)}
+`);
+    return {
+      ok: false,
+      exitCode: 1
+    };
+  }
+}
+async function runMigrateCommand(options = {}) {
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  try {
+    const result = await applyPendingMigrations({
+      cwd: options.cwd,
+      migrationsDir: options.migrationsDir,
+      stateFile: options.stateFile,
+      generatedSchemaFile: options.generatedSchemaFile,
+      now: options.now
+    });
+    if (result.applied.length === 0) {
+      stdout.write("No pending env migrations.\n");
+    } else {
+      stdout.write(`Applied ${result.applied.length} env migration(s): ${result.applied.join(", ")}.
+`);
+      if (result.changedFiles.length > 0) {
+        stdout.write(`Updated files: ${result.changedFiles.join(", ")}.
+`);
+      }
+      stdout.write(`State updated at ${result.statePath}.
+`);
+    }
+    return {
+      ok: true,
+      exitCode: 0,
+      migrationsDir: result.migrationsDir,
+      statePath: result.statePath,
+      applied: result.applied,
+      changedFiles: result.changedFiles
+    };
+  } catch (error) {
+    stderr.write(`${toErrorMessage(error)}
+`);
+    return {
+      ok: false,
+      exitCode: 1,
+      applied: [],
+      changedFiles: []
+    };
+  }
+}
+async function runMigrateStatusCommand(options = {}) {
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  try {
+    const status = await getMigrationStatus({
+      cwd: options.cwd,
+      migrationsDir: options.migrationsDir,
+      stateFile: options.stateFile
+    });
+    let schemaPath;
+    if (status.summary.changed === 0 && status.summary.missing === 0) {
+      const derivedSchema = await loadOrBuildMigrationSchema({
+        cwd: options.cwd,
+        migrationsDir: options.migrationsDir,
+        stateFile: options.stateFile,
+        generatedSchemaFile: options.generatedSchemaFile,
+        allowEmpty: true
+      });
+      schemaPath = derivedSchema.schemaPath;
+    }
+    const ok = status.summary.changed === 0 && status.summary.missing === 0;
+    const resultBase = {
+      ok,
+      exitCode: ok ? 0 : 1,
+      migrationsDir: status.migrationsDir,
+      statePath: status.statePath,
+      summary: status.summary,
+      entries: status.entries
+    };
+    const result = schemaPath ? { ...resultBase, schemaPath } : resultBase;
+    if (options.json) {
+      stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+      return result;
+    }
+    stdout.write(`Migrations dir: ${status.migrationsDir}
+`);
+    stdout.write(`State file: ${status.statePath}
+`);
+    if (result.schemaPath) {
+      stdout.write(`Schema file: ${result.schemaPath}
+`);
+    }
+    stdout.write(
+      `Summary: applied=${status.summary.applied} pending=${status.summary.pending} changed=${status.summary.changed} missing=${status.summary.missing}
+`
+    );
+    for (const entry of status.entries) {
+      const appliedAt = entry.appliedAt ? ` appliedAt=${entry.appliedAt}` : "";
+      stdout.write(`- [${entry.status}] ${entry.id}${appliedAt}
+`);
+    }
+    if (!ok) {
+      stderr.write(
+        "Migration integrity issues detected. Fix: resolve changed/missing migrations before apply or rollback.\n"
+      );
+    }
+    return result;
+  } catch (error) {
+    const errorMessage = toErrorMessage(error);
+    const failureResult = {
+      ok: false,
+      exitCode: 1,
+      migrationsDir: "",
+      statePath: "",
+      error: errorMessage,
+      summary: {
+        total: 0,
+        applied: 0,
+        pending: 0,
+        changed: 0,
+        missing: 0
+      },
+      entries: []
+    };
+    if (options.json) {
+      stdout.write(`${JSON.stringify(failureResult, null, 2)}
+`);
+      return failureResult;
+    }
+    stderr.write(`${errorMessage}
+`);
+    return failureResult;
+  }
+}
+async function runMigrateRollbackCommand(options) {
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  try {
+    const rolledBack = await rollbackMigrations({
+      steps: options.steps,
+      cwd: options.cwd,
+      migrationsDir: options.migrationsDir,
+      stateFile: options.stateFile,
+      generatedSchemaFile: options.generatedSchemaFile
+    });
+    if (rolledBack.rolledBack.length === 0) {
+      stdout.write("No applied env migrations to rollback.\n");
+    } else {
+      stdout.write(
+        `Rolled back ${rolledBack.rolledBack.length} env migration(s): ${rolledBack.rolledBack.join(", ")}.
+`
+      );
+      if (rolledBack.changedFiles.length > 0) {
+        stdout.write(`Updated files: ${rolledBack.changedFiles.join(", ")}.
+`);
+      }
+      stdout.write(`State updated at ${rolledBack.statePath}.
+`);
+    }
+    return {
+      ok: true,
+      exitCode: 0,
+      migrationsDir: rolledBack.migrationsDir,
+      statePath: rolledBack.statePath,
+      rolledBack: rolledBack.rolledBack,
+      changedFiles: rolledBack.changedFiles,
+      remainingApplied: rolledBack.remainingApplied
+    };
+  } catch (error) {
+    stderr.write(`${toErrorMessage(error)}
+`);
+    return {
+      ok: false,
+      exitCode: 1,
+      rolledBack: [],
+      changedFiles: []
+    };
+  }
+}
+async function runSchemaBuildCommand(options = {}) {
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  try {
+    const result = await loadOrBuildMigrationSchema({
+      cwd: options.cwd,
+      migrationsDir: options.migrationsDir,
+      stateFile: options.stateFile,
+      generatedSchemaFile: options.generatedSchemaFile,
+      forceRebuild: Boolean(options.force),
+      allowEmpty: true
+    });
+    stdout.write(
+      `Built migration-derived schema at ${result.schemaPath} from ${result.appliedMigrationIds.length} applied migration(s).
+`
+    );
+    return {
+      ok: true,
+      exitCode: 0,
+      schemaPath: result.schemaPath,
+      appliedMigrationIds: result.appliedMigrationIds
+    };
+  } catch (error) {
+    stderr.write(`${toErrorMessage(error)}
+`);
+    return {
+      ok: false,
+      exitCode: 1
+    };
+  }
+}
+
+// src/provider-command.ts
+import { spawn } from "child_process";
+import { access as access7, readFile as readFile7 } from "fs/promises";
+import path8 from "path";
+async function runExternalCommand(command, args, options = {}) {
+  return await new Promise((resolve) => {
+    const subprocess = spawn(command, [...args], {
+      cwd: options.cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let missingBinary = false;
+    subprocess.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    subprocess.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    subprocess.on("error", (error) => {
+      if (error.code === "ENOENT") {
+        missingBinary = true;
+        resolve({
+          exitCode: 127,
+          stdout,
+          stderr: `Command not found: ${command}`,
+          missingBinary: true
+        });
+        return;
+      }
+      resolve({
+        exitCode: 1,
+        stdout,
+        stderr: error.message,
+        missingBinary: false
+      });
+    });
+    subprocess.on("close", (code) => {
+      if (missingBinary) {
+        return;
+      }
+      resolve({
+        exitCode: code ?? 1,
+        stdout,
+        stderr,
+        missingBinary: false
+      });
+    });
+  });
+}
+function parseTarget(value) {
+  if (value === "dev" || value === "preview" || value === "prod") {
+    return value;
+  }
+  throw new Error(`Invalid target "${value}". Expected one of: dev, preview, prod.`);
+}
+async function pathExists2(filepath) {
+  try {
+    await access7(filepath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function mergeValuesFromSnapshot(snapshotContent) {
+  const parsed = parseDotenv(snapshotContent);
+  const values = dotenvToObject(parsed);
+  return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, value]));
+}
+function formatDiffIssues(issues) {
+  if (issues.length === 0) {
+    return "No schema drift detected.";
+  }
+  return formatValidationIssues(
+    issues.map((issue) => ({
+      key: issue.key,
+      target: issue.target,
+      scope: issue.scope,
+      severity: issue.severity,
+      code: issue.code,
+      message: issue.message,
+      fix: issue.fix
+    }))
+  );
+}
+var PROVIDER_INSTALL_GUIDE = {
+  vercel: "Install Vercel CLI: npm install -g vercel",
+  heroku: "Install Heroku CLI: https://devcenter.heroku.com/articles/heroku-cli"
+};
+async function runDoctorCommand(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const runner = options.runner ?? runExternalCommand;
+  const checks = [];
+  let schemaPath;
+  try {
+    schemaPath = await resolveSchemaPath(options.schema, cwd);
+    checks.push({
+      name: "schema",
+      ok: true,
+      message: `Schema found at ${schemaPath}.`
+    });
+  } catch (error) {
+    checks.push({
+      name: "schema",
+      ok: false,
+      message: error instanceof Error ? error.message : "Schema file not found.",
+      fix: "Add env.schema.mjs (or pass --schema <path>)."
+    });
+  }
+  for (const provider of ["vercel", "heroku"]) {
+    const result2 = await runner(provider, ["--version"], { cwd });
+    if (result2.missingBinary) {
+      checks.push({
+        name: `${provider}-cli`,
+        ok: false,
+        message: `${provider} CLI is not installed.`,
+        fix: PROVIDER_INSTALL_GUIDE[provider]
+      });
+      continue;
+    }
+    if (result2.exitCode !== 0) {
+      checks.push({
+        name: `${provider}-cli`,
+        ok: false,
+        message: `${provider} CLI returned non-zero exit code (${result2.exitCode}).`,
+        fix: `Run "${provider} --version" manually and fix local setup.`
+      });
+      continue;
+    }
+    checks.push({
+      name: `${provider}-cli`,
+      ok: true,
+      message: `${provider} CLI is available.`
+    });
+  }
+  const ok = checks.every((check) => check.ok);
+  const result = {
+    ok,
+    exitCode: ok ? 0 : 1,
+    schemaPath,
+    checks
+  };
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  if (ok) {
+    stdout.write("env doctor passed.\n");
+    return result;
+  }
+  stderr.write("env doctor found setup issues:\n");
+  for (const check of checks.filter((item) => !item.ok)) {
+    stderr.write(`- ${check.name}: ${check.message}
+`);
+    if (check.fix) {
+      stderr.write(`  Fix: ${check.fix}
+`);
+    }
+  }
+  return result;
+}
+async function runPullVercelCommand(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const runner = options.runner ?? runExternalCommand;
+  const outputPath = path8.resolve(cwd, `.env.vercel.${options.env}`);
+  const result = await runner("vercel", ["env", "pull", outputPath, options.env], { cwd });
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  if (result.missingBinary) {
+    stderr.write(
+      `vercel CLI is not installed. Fix: ${PROVIDER_INSTALL_GUIDE.vercel}.
+`
+    );
+    return { ok: false, exitCode: 1, outputPath };
+  }
+  if (result.exitCode !== 0) {
+    stderr.write(
+      `vercel env pull failed for target "${options.env}". ${result.stderr || "No stderr output."}
+`
+    );
+    return { ok: false, exitCode: 1, outputPath };
+  }
+  stdout.write(`Pulled Vercel env snapshot to ${outputPath}.
+`);
+  return { ok: true, exitCode: 0, outputPath };
+}
+function getSnapshotPath(options, cwd) {
+  if (options.snapshot) {
+    return path8.resolve(cwd, options.snapshot);
+  }
+  if (options.provider === "vercel") {
+    const envTarget = options.env;
+    if (!envTarget) {
+      throw new Error('Missing required option "--env <target>" for vercel diff.');
+    }
+    return path8.resolve(cwd, `.env.vercel.${envTarget}`);
+  }
+  const app = options.app;
+  if (!app) {
+    throw new Error('Missing required option "--app <name>" for heroku diff.');
+  }
+  return path8.resolve(cwd, `.env.heroku.${app}`);
+}
+function resolveDiffTarget(options) {
+  if (options.provider === "vercel") {
+    if (!options.env) {
+      throw new Error('Missing required option "--env <target>" for vercel diff.');
+    }
+    return parseTarget(options.env);
+  }
+  return options.target ?? "prod";
+}
+async function runDiffCommand(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const schemaPath = await resolveSchemaPath(options.schema, cwd);
+  const loaded = await loadSchema(schemaPath);
+  const target = resolveDiffTarget(options);
+  const snapshotPath = getSnapshotPath(options, cwd);
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  if (!await pathExists2(snapshotPath)) {
+    const message = `Snapshot file not found at "${snapshotPath}". Fix: pull provider env first, then retry diff.`;
+    if (options.json) {
+      stdout.write(
+        `${JSON.stringify(
+          {
+            provider: options.provider,
+            ok: false,
+            exitCode: 1,
+            schemaPath,
+            snapshotPath,
+            target,
+            summary: { total: 1, errors: 1, warnings: 0 },
+            issues: [
+              {
+                key: "__snapshot__",
+                target,
+                scope: "server",
+                severity: "error",
+                code: "SNAPSHOT_MISSING",
+                message,
+                fix: "Create the snapshot file and re-run diff.",
+                source: snapshotPath
+              }
+            ]
+          },
+          null,
+          2
+        )}
+`
+      );
+    } else {
+      stderr.write(`${message}
+`);
+    }
+    return {
+      provider: options.provider,
+      ok: false,
+      exitCode: 1,
+      schemaPath,
+      snapshotPath,
+      target,
+      summary: {
+        total: 1,
+        errors: 1,
+        warnings: 0
+      },
+      issues: [
+        {
+          key: "__snapshot__",
+          target,
+          scope: "server",
+          severity: "error",
+          code: "SNAPSHOT_MISSING",
+          message,
+          fix: "Create the snapshot file and re-run diff.",
+          source: snapshotPath
+        }
+      ]
+    };
+  }
+  const snapshotContent = await readFile7(snapshotPath, "utf8");
+  const snapshotValues = mergeValuesFromSnapshot(snapshotContent);
+  const drift = detectDrift(loaded.schema, {
+    target,
+    values: snapshotValues,
+    source: snapshotPath,
+    allowUnknown: options.allowUnknown ?? false
+  });
+  const ok = drift.summary.errors === 0;
+  const result = {
+    provider: options.provider,
+    ok,
+    exitCode: ok ? 0 : 1,
+    schemaPath,
+    snapshotPath,
+    target,
+    summary: drift.summary,
+    issues: drift.issues
+  };
+  if (options.json) {
+    stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+  } else if (ok) {
+    stdout.write(`No drift detected for ${options.provider} snapshot (${path8.basename(snapshotPath)}).
+`);
+  } else {
+    stderr.write(`${formatDiffIssues(result.issues)}
+`);
+  }
+  return result;
+}
+function isGeneratedPlaceholder(key, value) {
+  const normalized = value.trim();
+  if (normalized.length === 0) {
+    return true;
+  }
+  const lowercase = normalized.toLowerCase();
+  if (lowercase === `example_${key.toLowerCase()}`) {
+    return true;
+  }
+  return normalized === "https://example.com" || normalized === "{}" || lowercase.startsWith("example_");
+}
+async function runPushHerokuCommand(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const runner = options.runner ?? runExternalCommand;
+  const schemaPath = await resolveSchemaPath(options.schema, cwd);
+  const loaded = await loadSchema(schemaPath);
+  const inputFile = path8.resolve(cwd, options.from);
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  if (!await pathExists2(inputFile)) {
+    stderr.write(`Source file not found at "${inputFile}". Fix: pass a valid --from <file> path.
+`);
+    return { ok: false, exitCode: 1, pushedKeys: [], skippedKeys: [] };
+  }
+  const content = await readFile7(inputFile, "utf8");
+  const values = mergeValuesFromSnapshot(content);
+  const pushedEntries = [];
+  const skippedKeys = [];
+  for (const [key, value] of Object.entries(values)) {
+    if (!(key in loaded.schema)) {
+      skippedKeys.push(key);
+      continue;
+    }
+    if (value === void 0 || isGeneratedPlaceholder(key, value)) {
+      skippedKeys.push(key);
+      continue;
+    }
+    pushedEntries.push([key, value]);
+  }
+  if (pushedEntries.length === 0) {
+    stdout.write(
+      "No eligible variables to push. Only schema-approved non-placeholder values are pushed to Heroku.\n"
+    );
+    return { ok: true, exitCode: 0, pushedKeys: [], skippedKeys };
+  }
+  const assignmentArgs = pushedEntries.map(([key, value]) => `${key}=${value}`);
+  const result = await runner("heroku", ["config:set", ...assignmentArgs, "--app", options.app], { cwd });
+  if (result.missingBinary) {
+    stderr.write(
+      `heroku CLI is not installed. Fix: ${PROVIDER_INSTALL_GUIDE.heroku}.
+`
+    );
+    return { ok: false, exitCode: 1, pushedKeys: [], skippedKeys };
+  }
+  if (result.exitCode !== 0) {
+    stderr.write(
+      `heroku config:set failed for app "${options.app}". ${result.stderr || "No stderr output."}
+`
+    );
+    return { ok: false, exitCode: 1, pushedKeys: [], skippedKeys };
+  }
+  stdout.write(
+    `Pushed ${pushedEntries.length} variable(s) to Heroku app "${options.app}" for target "${options.target}".
+`
+  );
+  return {
+    ok: true,
+    exitCode: 0,
+    pushedKeys: pushedEntries.map(([key]) => key),
+    skippedKeys
+  };
+}
+
+// src/reconcile-command.ts
+function toErrorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function envValueFromDefault(definition) {
+  if (definition.sensitive) {
+    return "";
+  }
+  if (definition.defaultValue === void 0 || definition.defaultValue === null) {
+    return "";
+  }
+  if (definition.kind === "number" && typeof definition.defaultValue === "number") {
+    return `${definition.defaultValue}`;
+  }
+  if (definition.kind === "boolean" && typeof definition.defaultValue === "boolean") {
+    return definition.defaultValue ? "true" : "false";
+  }
+  if (definition.kind === "json") {
+    if (typeof definition.defaultValue === "string") {
+      return definition.defaultValue;
+    }
+    return JSON.stringify(definition.defaultValue);
+  }
+  return String(definition.defaultValue);
+}
+function renderTargets(targets) {
+  return `[${targets.map((target) => JSON.stringify(target)).join(", ")}]`;
+}
+function renderDefinition(definition) {
+  const sanitizedDefinition = definition.sensitive && definition.defaultValue !== void 0 ? {
+    ...definition,
+    defaultValue: void 0
+  } : definition;
+  return JSON.stringify(sanitizedDefinition, null, 2).split("\n");
+}
+function renderReconcileMigrationTemplate(id, additions) {
+  const lines = [
+    'import type { EnvMigrationContext } from "@wrkspace-co/env";',
+    "",
+    `// Migration id is derived from this filename: ${id}.ts`,
+    "",
+    "export async function up(ctx: EnvMigrationContext) {"
+  ];
+  for (const addition of additions) {
+    const hasAllTargets = addition.targets.length === DEFAULT_MIGRATION_TARGET_FILES.length;
+    lines.push(`  ctx.key(${JSON.stringify(addition.key)})`);
+    lines.push("    .define(");
+    const definitionLines = renderDefinition(addition.definition);
+    for (let index = 0; index < definitionLines.length; index += 1) {
+      lines.push(`      ${definitionLines[index]}`);
+    }
+    lines.push("    )");
+    lines.push(`    .value(${JSON.stringify(addition.value)})`);
+    if (!hasAllTargets) {
+      lines.push(`    .targets(${renderTargets(addition.targets)})`);
+    }
+    lines.push("    .overwrite(false)");
+    lines.push("    .createIfMissing(true);");
+  }
+  lines.push("}");
+  lines.push("");
+  lines.push("export async function down(ctx: EnvMigrationContext) {");
+  for (const addition of additions) {
+    const hasAllTargets = addition.targets.length === DEFAULT_MIGRATION_TARGET_FILES.length;
+    if (hasAllTargets) {
+      lines.push(`  ctx.key(${JSON.stringify(addition.key)}).remove();`);
+    } else {
+      lines.push(
+        `  ctx.key(${JSON.stringify(addition.key)}).targets(${renderTargets(addition.targets)}).remove();`
+      );
+    }
+  }
+  lines.push("}");
+  lines.push("");
+  return lines.join("\n");
+}
+async function runReconcileCommand(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  try {
+    const schemaPath = await resolveSchemaPath(options.schema, cwd);
+    const loaded = await loadSchema(schemaPath, { app: options.app });
+    const documents = await loadEnvTargetDocuments({ cwd });
+    const context = createEnvMigrationContext(documents);
+    const additions = [];
+    for (const [key, definition] of Object.entries(loaded.schema)) {
+      const missingTargets = DEFAULT_MIGRATION_TARGET_FILES.filter(
+        (target) => !hasKeyInTargetDocuments(documents, target, key)
+      );
+      if (missingTargets.length === 0) {
+        continue;
+      }
+      const value = envValueFromDefault(definition);
+      const chain = context.key(key).define(definition).value(value).overwrite(false).createIfMissing(true);
+      if (missingTargets.length !== DEFAULT_MIGRATION_TARGET_FILES.length) {
+        chain.targets(missingTargets);
+      }
+      additions.push({
+        key,
+        definition,
+        value,
+        targets: missingTargets
+      });
+    }
+    finalizeFluentDefinitions(context);
+    const changedFiles = await writeEnvTargetDocuments(documents);
+    let migrationId;
+    let migrationPath;
+    if (options.writeMigration && additions.length > 0) {
+      const created = await createMigrationFile({
+        name: "reconcile",
+        cwd,
+        migrationsDir: options.migrationsDir,
+        now: options.now,
+        template: (id) => renderReconcileMigrationTemplate(id, additions)
+      });
+      migrationId = created.id;
+      migrationPath = created.filePath;
+    }
+    if (additions.length === 0) {
+      stdout.write("env reconcile: all schema keys already exist in target env files.\n");
+    } else {
+      stdout.write(
+        `env reconcile added ${additions.length} schema key(s) across ${changedFiles.length} file(s).
+`
+      );
+      stdout.write(`Updated files: ${changedFiles.join(", ")}.
+`);
+      if (migrationPath) {
+        stdout.write(`Created reconcile migration "${migrationId}" at ${migrationPath}.
+`);
+      }
+    }
+    return {
+      ok: true,
+      exitCode: 0,
+      schemaPath,
+      changedFiles,
+      added: additions,
+      migrationId,
+      migrationPath
+    };
+  } catch (error) {
+    stderr.write(`${toErrorMessage2(error)}
+`);
+    return {
+      ok: false,
+      exitCode: 1,
+      changedFiles: [],
+      added: []
+    };
+  }
+}
+
+// src/plugin.ts
+function parseTarget2(value) {
+  if (value === "dev" || value === "preview" || value === "prod") {
+    return value;
+  }
+  throw new Error(`Invalid --target "${value}". Expected one of: dev, preview, prod.`);
+}
+function parsePositiveInteger(value) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`Invalid positive integer "${value}".`);
+  }
+  return parsed;
+}
+async function handleGenerateCommand(options) {
+  await runGenerateCommand({
+    writeLocal: Boolean(options.writeLocal),
+    writeTargetFiles: Boolean(options.writeTargetFiles),
+    schema: options.schema,
+    app: options.app
+  });
+}
+async function handleCheckCommand(options) {
+  const result = await runCheckCommand({
+    target: options.target,
+    app: options.app,
+    allowUnknown: Boolean(options.allowUnknown),
+    json: Boolean(options.json),
+    schema: options.schema
+  });
+  return result.exitCode;
+}
+async function handleDeprecationsCommand(options) {
+  const result = await runDeprecationsCommand({
+    schema: options.schema,
+    app: options.app,
+    json: Boolean(options.json)
+  });
+  return result.exitCode;
+}
+async function handleDoctorCommand(options) {
+  const result = await runDoctorCommand({
+    schema: options.schema
+  });
+  return result.exitCode;
+}
+async function handleAuditCommand(options) {
+  const result = await runAuditCommand({
+    schema: options.schema,
+    json: Boolean(options.json)
+  });
+  return result.exitCode;
+}
+async function handlePullVercelCommand(options) {
+  const result = await runPullVercelCommand({
+    env: options.env
+  });
+  return result.exitCode;
+}
+async function handleDiffVercelCommand(options) {
+  const result = await runDiffCommand({
+    provider: "vercel",
+    env: options.env,
+    schema: options.schema,
+    json: Boolean(options.json),
+    allowUnknown: Boolean(options.allowUnknown)
+  });
+  return result.exitCode;
+}
+async function handleDiffHerokuCommand(options) {
+  const result = await runDiffCommand({
+    provider: "heroku",
+    app: options.app,
+    schema: options.schema,
+    json: Boolean(options.json),
+    allowUnknown: Boolean(options.allowUnknown)
+  });
+  return result.exitCode;
+}
+async function handlePushHerokuCommand(options) {
+  const result = await runPushHerokuCommand({
+    app: options.app,
+    target: options.target,
+    from: options.from,
+    schema: options.schema
+  });
+  return result.exitCode;
+}
+async function handleExportDockerComposeCommand(options) {
+  const result = await runExportCommand({
+    format: "docker-compose",
+    schema: options.schema,
+    withValues: Boolean(options.withValues),
+    from: options.from
+  });
+  return result.exitCode;
+}
+async function handleExportK8sCommand(options) {
+  const result = await runExportCommand({
+    format: "k8s",
+    schema: options.schema,
+    withValues: Boolean(options.withValues),
+    from: options.from
+  });
+  return result.exitCode;
+}
+async function handleExportGithubActionsCommand(options) {
+  const result = await runExportCommand({
+    format: "github-actions",
+    schema: options.schema,
+    withValues: Boolean(options.withValues),
+    from: options.from
+  });
+  return result.exitCode;
+}
+async function handleMigrateMakeCommand(name, options) {
+  const result = await runMigrateMakeCommand({
+    name,
+    migrationsDir: options.dir
+  });
+  return result.exitCode;
+}
+async function handleMigrateCommand(options) {
+  const result = await runMigrateCommand({
+    migrationsDir: options.dir,
+    stateFile: options.state,
+    generatedSchemaFile: options.schemaFile
+  });
+  return result.exitCode;
+}
+async function handleMigrateStatusCommand(options) {
+  const result = await runMigrateStatusCommand({
+    migrationsDir: options.dir,
+    stateFile: options.state,
+    generatedSchemaFile: options.schemaFile,
+    json: Boolean(options.json)
+  });
+  return result.exitCode;
+}
+async function handleMigrateRollbackCommand(options) {
+  const result = await runMigrateRollbackCommand({
+    steps: options.steps,
+    migrationsDir: options.dir,
+    stateFile: options.state,
+    generatedSchemaFile: options.schemaFile
+  });
+  return result.exitCode;
+}
+async function handleSchemaBuildCommand(options) {
+  const result = await runSchemaBuildCommand({
+    migrationsDir: options.dir,
+    stateFile: options.state,
+    generatedSchemaFile: options.schemaFile,
+    force: Boolean(options.force)
+  });
+  return result.exitCode;
+}
+async function handleReconcileCommand(options) {
+  const result = await runReconcileCommand({
+    schema: options.schema,
+    app: options.app,
+    writeMigration: Boolean(options.writeMigration),
+    migrationsDir: options.dir
+  });
+  return result.exitCode;
+}
+function applyExitCode(exitCode) {
+  if (exitCode !== 0) {
+    process.exitCode = exitCode;
+  }
+}
+function registerAirlockCommands(command) {
+  command.command("doctor").description("Check schema and provider CLI setup").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handleDoctorCommand(options));
+  });
+  command.command("check").description("Validate environment variables against schema and policy").requiredOption("--target <target>", "Target environment (dev|preview|prod)", parseTarget2).option("--app <name>", "Optional app name for composed schema selection").option("--allow-unknown", "Allow variables not defined in schema").option("--json", "Print stable JSON output").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handleCheckCommand(options));
+  });
+  command.command("generate").description("Generate schema-driven env artifacts").option("--write-local", "Write .env.local with empty values for sensitive vars").option(
+    "--write-target-files",
+    "Write .env.dev, .env.preview, and .env.prod with target-required keys"
+  ).option("--schema <path>", "Path to schema module").option("--app <name>", "Optional app name for composed schema selection").action(async (options) => {
+    await handleGenerateCommand(options);
+  });
+  command.command("deprecations").description("Report deprecated environment keys and removal deadlines").option("--json", "Print stable JSON output").option("--schema <path>", "Path to schema module").option("--app <name>", "Optional app name for composed schema selection").action(async (options) => {
+    applyExitCode(await handleDeprecationsCommand(options));
+  });
+  command.command("audit").description("Detect schema drift in local env snapshots").option("--json", "Print stable JSON output").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handleAuditCommand(options));
+  });
+  const pullCommand = command.command("pull").description("Pull environment snapshots from provider CLIs");
+  pullCommand.command("vercel").description("Pull env snapshot from Vercel").requiredOption("--env <target>", "Target environment (dev|preview|prod)", parseTarget2).action(async (options) => {
+    applyExitCode(await handlePullVercelCommand(options));
+  });
+  const diffCommand = command.command("diff").description("Diff provider snapshots against schema expectations");
+  diffCommand.command("vercel").description("Diff a Vercel snapshot against schema").requiredOption("--env <target>", "Target environment (dev|preview|prod)", parseTarget2).option("--json", "Print stable JSON output").option("--allow-unknown", "Ignore unknown keys in snapshot").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handleDiffVercelCommand(options));
+  });
+  diffCommand.command("heroku").description("Diff a Heroku snapshot against schema").requiredOption("--app <name>", "Heroku app name").option("--json", "Print stable JSON output").option("--allow-unknown", "Ignore unknown keys in snapshot").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handleDiffHerokuCommand(options));
+  });
+  const pushCommand = command.command("push").description("Push env values to provider CLIs with safety filters");
+  pushCommand.command("heroku").description("Push schema-approved values to Heroku").requiredOption("--app <name>", "Heroku app name").requiredOption("--target <target>", "Target environment (dev|preview|prod)", parseTarget2).requiredOption("--from <file>", "Source dotenv file to read values from").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handlePushHerokuCommand(options));
+  });
+  const exportCommand = command.command("export").description("Export env schema to deployment formats with safe defaults");
+  exportCommand.command("docker-compose").description("Export docker-compose environment block").option("--with-values", "Include values from --from file").option("--from <file>", "Source dotenv file (required with --with-values)").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handleExportDockerComposeCommand(options));
+  });
+  exportCommand.command("k8s").description("Export Kubernetes ConfigMap and Secret manifests").option("--with-values", "Include values from --from file").option("--from <file>", "Source dotenv file (required with --with-values)").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handleExportK8sCommand(options));
+  });
+  exportCommand.command("github-actions").description("Export GitHub Actions env block").option("--with-values", "Include values from --from file").option("--from <file>", "Source dotenv file (required with --with-values)").option("--schema <path>", "Path to schema module").action(async (options) => {
+    applyExitCode(await handleExportGithubActionsCommand(options));
+  });
+  command.command("migrate:make").description("Create a new env migration file").argument("<name>", "Migration name").option("--dir <path>", "Migration directory (default: env/migrations)").action(async (name, options) => {
+    applyExitCode(await handleMigrateMakeCommand(name, options));
+  });
+  command.command("migrate").description("Apply pending env migrations").option("--dir <path>", "Migration directory (default: env/migrations)").option("--state <path>", "Migration state file (default: env/migrations.state.json)").option(
+    "--schema-file <path>",
+    "Generated schema file (default: env/schema.generated.json)"
+  ).action(async (options) => {
+    applyExitCode(await handleMigrateCommand(options));
+  });
+  command.command("migrate:status").description("Show env migration status").option("--json", "Print stable JSON output").option("--dir <path>", "Migration directory (default: env/migrations)").option("--state <path>", "Migration state file (default: env/migrations.state.json)").option(
+    "--schema-file <path>",
+    "Generated schema file (default: env/schema.generated.json)"
+  ).action(async (options) => {
+    applyExitCode(await handleMigrateStatusCommand(options));
+  });
+  command.command("migrate:rollback").description("Rollback applied env migrations").requiredOption("--steps <count>", "Number of steps to rollback", parsePositiveInteger).option("--dir <path>", "Migration directory (default: env/migrations)").option("--state <path>", "Migration state file (default: env/migrations.state.json)").option(
+    "--schema-file <path>",
+    "Generated schema file (default: env/schema.generated.json)"
+  ).action(async (options) => {
+    applyExitCode(await handleMigrateRollbackCommand(options));
+  });
+  command.command("schema:build").description("Build migration-derived schema file").option("--dir <path>", "Migration directory (default: env/migrations)").option("--state <path>", "Migration state file (default: env/migrations.state.json)").option(
+    "--schema-file <path>",
+    "Generated schema file (default: env/schema.generated.json)"
+  ).option("--force", "Force a full schema rebuild from applied migrations").action(async (options) => {
+    applyExitCode(await handleSchemaBuildCommand(options));
+  });
+  command.command("reconcile").description("Ensure env files include schema keys with minimal edits").option("--schema <path>", "Path to schema module").option("--app <name>", "Optional app name for composed schema selection").option("--write-migration", "Create a migration file with reconcile changes").option("--dir <path>", "Migration directory used by --write-migration").action(async (options) => {
+    applyExitCode(await handleReconcileCommand(options));
+  });
+}
+function createAirlockProgram() {
+  const program = new Command().name("airlock").description("Airlock environment commands");
+  registerAirlockCommands(program);
+  return program;
+}
+function register(program) {
+  const envCommand = program.command("env").description("Airlock environment commands");
+  registerAirlockCommands(envCommand);
+}
+var plugin = { register };
+var plugin_default = plugin;
+
+export {
+  parseDotenv,
+  formatDotenvValue,
+  writeDotenv,
+  dotenvToObject,
+  string,
+  url,
+  number,
+  boolean,
+  enumBuilder,
+  json,
+  builders,
+  defineSchema,
+  prefixPolicies,
+  formatValidationIssues,
+  EnvValidationError,
+  createEnv,
+  detectDrift,
+  generateArtifacts,
+  generateTargetEnvFile,
+  DEFAULT_MIGRATIONS_DIR2 as DEFAULT_MIGRATIONS_DIR,
+  DEFAULT_MIGRATION_STATE_FILE2 as DEFAULT_MIGRATION_STATE_FILE,
+  DEFAULT_GENERATED_SCHEMA_FILE2 as DEFAULT_GENERATED_SCHEMA_FILE,
+  DEFAULT_MIGRATION_TARGET_FILES,
+  loadEnvTargetDocuments,
+  hasKeyInTargetDocuments,
+  finalizeFluentDefinitions,
+  createEnvMigrationContext,
+  writeEnvTargetDocuments,
+  loadMigrationState,
+  saveMigrationState,
+  discoverMigrations,
+  getMigrationStatus,
+  loadOrBuildMigrationSchema,
+  createMigrationFile,
+  applyPendingMigrations,
+  rollbackMigrations,
+  DEFAULT_SCHEMA_FILES,
+  resolveSchemaPath,
+  loadSchema,
+  runAuditCommand,
+  runCheckCommand,
+  runDeprecationsCommand,
+  renderExport,
+  runExportCommand,
+  runGenerateCommand,
+  runMigrateMakeCommand,
+  runMigrateCommand,
+  runMigrateStatusCommand,
+  runMigrateRollbackCommand,
+  runSchemaBuildCommand,
+  runExternalCommand,
+  runDoctorCommand,
+  runPullVercelCommand,
+  runDiffCommand,
+  runPushHerokuCommand,
+  runReconcileCommand,
+  handleGenerateCommand,
+  handleCheckCommand,
+  handleDeprecationsCommand,
+  handleDoctorCommand,
+  handleAuditCommand,
+  handlePullVercelCommand,
+  handleDiffVercelCommand,
+  handleDiffHerokuCommand,
+  handlePushHerokuCommand,
+  handleExportDockerComposeCommand,
+  handleExportK8sCommand,
+  handleExportGithubActionsCommand,
+  handleMigrateMakeCommand,
+  handleMigrateCommand,
+  handleMigrateStatusCommand,
+  handleMigrateRollbackCommand,
+  handleSchemaBuildCommand,
+  handleReconcileCommand,
+  createAirlockProgram,
+  register,
+  plugin_default
+};
+//# sourceMappingURL=chunk-32DQKIYR.js.map