morphix-env 0.9.0 → 0.10.0

package/dist/cli.js

@@ -831,8 +831,8 @@ var require_react_development = __commonJS({
       function lazyInitializer(payload) {
         if (-1 === payload._status) {
           var resolveDebugValue = null, rejectDebugValue = null, ioInfo = payload._ioInfo;
-          null != ioInfo && (ioInfo.start = ioInfo.end = performance.now(), ioInfo.value = new Promise(function(resolve7, reject) {
-            resolveDebugValue = resolve7;
+          null != ioInfo && (ioInfo.start = ioInfo.end = performance.now(), ioInfo.value = new Promise(function(resolve8, reject) {
+            resolveDebugValue = resolve8;
             rejectDebugValue = reject;
           }));
           ioInfo = payload._result;
@@ -948,21 +948,21 @@ var require_react_development = __commonJS({
         );
         actScopeDepth = prevActScopeDepth;
       }
-      function recursivelyFlushAsyncActWork(returnValue, resolve7, reject) {
+      function recursivelyFlushAsyncActWork(returnValue, resolve8, reject) {
         var queue = ReactSharedInternals.actQueue;
         if (null !== queue)
           if (0 !== queue.length)
             try {
               flushActQueue(queue);
               enqueueTask(function() {
-                return recursivelyFlushAsyncActWork(returnValue, resolve7, reject);
+                return recursivelyFlushAsyncActWork(returnValue, resolve8, reject);
               });
               return;
             } catch (error) {
               ReactSharedInternals.thrownErrors.push(error);
             }
           else ReactSharedInternals.actQueue = null;
-        0 < ReactSharedInternals.thrownErrors.length ? (queue = aggregateErrors(ReactSharedInternals.thrownErrors), ReactSharedInternals.thrownErrors.length = 0, reject(queue)) : resolve7(returnValue);
+        0 < ReactSharedInternals.thrownErrors.length ? (queue = aggregateErrors(ReactSharedInternals.thrownErrors), ReactSharedInternals.thrownErrors.length = 0, reject(queue)) : resolve8(returnValue);
       }
       function flushActQueue(queue) {
         if (!isFlushing) {
@@ -1150,7 +1150,7 @@ var require_react_development = __commonJS({
             ));
           });
           return {
-            then: function(resolve7, reject) {
+            then: function(resolve8, reject) {
               didAwaitActCall = true;
               thenable.then(
                 function(returnValue) {
@@ -1160,7 +1160,7 @@ var require_react_development = __commonJS({
                       flushActQueue(queue), enqueueTask(function() {
                         return recursivelyFlushAsyncActWork(
                           returnValue,
-                          resolve7,
+                          resolve8,
                           reject
                         );
                       });
@@ -1174,7 +1174,7 @@ var require_react_development = __commonJS({
                       ReactSharedInternals.thrownErrors.length = 0;
                       reject(_thrownError);
                     }
-                  } else resolve7(returnValue);
+                  } else resolve8(returnValue);
                 },
                 function(error) {
                   popActScope(prevActQueue, prevActScopeDepth);
@@ -1196,15 +1196,15 @@ var require_react_development = __commonJS({
         if (0 < ReactSharedInternals.thrownErrors.length)
           throw callback = aggregateErrors(ReactSharedInternals.thrownErrors), ReactSharedInternals.thrownErrors.length = 0, callback;
         return {
-          then: function(resolve7, reject) {
+          then: function(resolve8, reject) {
             didAwaitActCall = true;
             0 === prevActScopeDepth ? (ReactSharedInternals.actQueue = queue, enqueueTask(function() {
               return recursivelyFlushAsyncActWork(
                 returnValue$jscomp$0,
-                resolve7,
+                resolve8,
                 reject
               );
-            })) : resolve7(returnValue$jscomp$0);
+            })) : resolve8(returnValue$jscomp$0);
           }
         };
       };
@@ -12991,7 +12991,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       };
     }
     exports2.prerender = function(children, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var onHeaders = options ? options.onHeaders : void 0, onHeadersImpl;
         onHeaders && (onHeadersImpl = function(headersDescriptor) {
           onHeaders(new Headers(headersDescriptor));
@@ -13035,7 +13035,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               { highWaterMark: 0 }
             );
             stream2 = { postponed: getPostponedState(request), prelude: stream2 };
-            resolve7(stream2);
+            resolve8(stream2);
           },
           void 0,
           void 0,
@@ -13046,7 +13046,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       });
     };
     exports2.prerenderToNodeStream = function(children, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var resumableState = createResumableState(
           options ? options.identifierPrefix : void 0,
           options ? options.unstable_externalRuntimeSrc : void 0,
@@ -13078,7 +13078,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               postponed: getPostponedState(request),
               prelude: readable
             };
-            resolve7(readable);
+            resolve8(readable);
           },
           void 0,
           void 0,
@@ -13123,7 +13123,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       };
     };
     exports2.renderToReadableStream = function(children, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var onFatalError, onAllReady, allReady = new Promise(function(res, rej) {
           onAllReady = res;
           onFatalError = rej;
@@ -13173,7 +13173,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               { highWaterMark: 0 }
             );
             stream2.allReady = allReady;
-            resolve7(stream2);
+            resolve8(stream2);
           },
           function(error) {
             allReady.catch(function() {
@@ -13188,7 +13188,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       });
     };
     exports2.resume = function(children, postponedState, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var onFatalError, onAllReady, allReady = new Promise(function(res, rej) {
           onAllReady = res;
           onFatalError = rej;
@@ -13226,7 +13226,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               { highWaterMark: 0 }
             );
             stream2.allReady = allReady;
-            resolve7(stream2);
+            resolve8(stream2);
           },
           function(error) {
             allReady.catch(function() {
@@ -13240,7 +13240,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       });
     };
     exports2.resumeAndPrerender = function(children, postponedState, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var request = resumeAndPrerenderRequest(
           children,
           postponedState,
@@ -13272,7 +13272,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               { highWaterMark: 0 }
             );
             stream2 = { postponed: getPostponedState(request), prelude: stream2 };
-            resolve7(stream2);
+            resolve8(stream2);
           },
           void 0,
           void 0,
@@ -13283,7 +13283,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       });
     };
     exports2.resumeAndPrerenderToNodeStream = function(children, postponedState, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var request = resumeAndPrerenderRequest(
           children,
           postponedState,
@@ -13304,7 +13304,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               }
             }), writable = createFakeWritableFromReadable(readable);
             readable = { postponed: getPostponedState(request), prelude: readable };
-            resolve7(readable);
+            resolve8(readable);
           },
           void 0,
           void 0,
@@ -28776,7 +28776,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       ensureCorrectIsomorphicReactVersion();
       ensureCorrectIsomorphicReactVersion();
       exports2.prerender = function(children, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var onHeaders = options ? options.onHeaders : void 0, onHeadersImpl;
           onHeaders && (onHeadersImpl = function(headersDescriptor) {
             onHeaders(new Headers(headersDescriptor));
@@ -28825,7 +28825,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 postponed: getPostponedState(request),
                 prelude: stream2
               };
-              resolve7(stream2);
+              resolve8(stream2);
             },
             void 0,
             void 0,
@@ -28836,7 +28836,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         });
       };
       exports2.prerenderToNodeStream = function(children, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var resumableState = createResumableState(
             options ? options.identifierPrefix : void 0,
             options ? options.unstable_externalRuntimeSrc : void 0,
@@ -28868,7 +28868,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 postponed: getPostponedState(request),
                 prelude: readable
               };
-              resolve7(readable);
+              resolve8(readable);
             },
             void 0,
             void 0,
@@ -28913,7 +28913,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         };
       };
       exports2.renderToReadableStream = function(children, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var onFatalError, onAllReady, allReady = new Promise(function(res, rej) {
             onAllReady = res;
             onFatalError = rej;
@@ -28963,7 +28963,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 { highWaterMark: 0 }
               );
               stream2.allReady = allReady;
-              resolve7(stream2);
+              resolve8(stream2);
             },
             function(error) {
               allReady.catch(function() {
@@ -28978,7 +28978,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         });
       };
       exports2.resume = function(children, postponedState, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var onFatalError, onAllReady, allReady = new Promise(function(res, rej) {
             onAllReady = res;
             onFatalError = rej;
@@ -29016,7 +29016,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 { highWaterMark: 0 }
               );
               stream2.allReady = allReady;
-              resolve7(stream2);
+              resolve8(stream2);
             },
             function(error) {
               allReady.catch(function() {
@@ -29030,7 +29030,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         });
       };
       exports2.resumeAndPrerender = function(children, postponedState, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var request = resumeAndPrerenderRequest(
             children,
             postponedState,
@@ -29064,7 +29064,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 { highWaterMark: 0 }
               );
               stream2 = { postponed: getPostponedState(request), prelude: stream2 };
-              resolve7(stream2);
+              resolve8(stream2);
             },
             void 0,
             void 0,
@@ -29075,7 +29075,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         });
       };
       exports2.resumeAndPrerenderToNodeStream = function(children, postponedState, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var request = resumeAndPrerenderRequest(
             children,
             postponedState,
@@ -29099,7 +29099,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 postponed: getPostponedState(request),
                 prelude: readable
               };
-              resolve7(readable);
+              resolve8(readable);
             },
             void 0,
             void 0,
@@ -29482,9 +29482,9 @@ var require_jsx_runtime = __commonJS({
 
 // src/cli.ts
 var import_cross_spawn = __toESM(require("cross-spawn"));
-var import_fs10 = require("fs");
-var import_os7 = require("os");
-var import_path10 = require("path");
+var import_fs11 = require("fs");
+var import_os8 = require("os");
+var import_path11 = require("path");
 
 // src/audit.ts
 var import_fs = require("fs");
@@ -29603,12 +29603,6 @@ function validateConfig(config, label = CONFIG_FILE) {
   return errors;
 }
 
-// src/sources.ts
-var import_child_process2 = require("child_process");
-var import_fs5 = require("fs");
-var import_path5 = require("path");
-var import_dotenv3 = require("dotenv");
-
 // src/env.ts
 var import_fs3 = require("fs");
 var import_path3 = require("path");
@@ -29618,6 +29612,14 @@ function parseEnvFile(filePath) {
   if (!(0, import_fs3.existsSync)(absPath)) return {};
   return (0, import_dotenv.parse)((0, import_fs3.readFileSync)(absPath, "utf8"));
 }
+function isDotenvxEncrypted(filePath) {
+  try {
+    const content = (0, import_fs3.readFileSync)((0, import_path3.resolve)(filePath), "utf8");
+    return content.includes("DOTENV_PUBLIC_KEY") && /^[A-Za-z_][A-Za-z0-9_]*="?encrypted:/m.test(content);
+  } catch {
+    return false;
+  }
+}
 var PUBLIC_PREFIXES = ["NEXT_PUBLIC_", "VITE_", "EXPO_PUBLIC_"];
 function extractPublicVars(environment = process.env) {
   const vars = {};
@@ -29629,6 +29631,12 @@ function extractPublicVars(environment = process.env) {
   return vars;
 }
 
+// src/sources.ts
+var import_child_process2 = require("child_process");
+var import_fs5 = require("fs");
+var import_path5 = require("path");
+var import_dotenv3 = require("dotenv");
+
 // src/infisical.ts
 var import_sdk = require("@infisical/sdk");
 var import_child_process = require("child_process");
@@ -29739,7 +29747,7 @@ function assertSafeGlobalFile(file, context, entry) {
   if ((mode & 63) !== 0) {
     throw new SourceError(
       entry.name,
-      "local",
+      entry.source.provider,
       `[morphix-env] Global env file ${file} is readable by group or other users; set mode 0600 or pass --allow-insecure-global.`
     );
   }
@@ -29831,6 +29839,16 @@ function resolveDotenvx(entry, source, context) {
   if (existingFiles.length !== files.length) {
     throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" is missing a declared env file.`);
   }
+  if (entry.globalImplicit && !context.allowInsecureGlobal && process.platform !== "win32") {
+    const keysFile = (0, import_path5.join)((0, import_path5.dirname)(existingFiles[0]), ".env.keys");
+    if ((0, import_fs5.existsSync)(keysFile) && ((0, import_fs5.statSync)(keysFile).mode & 63) !== 0) {
+      throw new SourceError(
+        entry.name,
+        source.provider,
+        `[morphix-env] Global dotenvx keys file ${keysFile} is readable by group or other users; set mode 0600 or pass --allow-insecure-global.`
+      );
+    }
+  }
   const command = ensureCommand("dotenvx", entry.name, source.provider);
   const keys = [...new Set(existingFiles.flatMap((file) => Object.keys(parseEnvFile(file))))].filter((key) => !key.startsWith("DOTENV_PUBLIC_KEY"));
   if (!keys.length) return { name: entry.name, provider: source.provider, values: {}, availability: "loaded" };
@@ -29838,8 +29856,10 @@ function resolveDotenvx(entry, source, context) {
   let stage = "run";
   try {
     const output = (0, import_child_process2.execFileSync)(
+      // --overload aligns dotenvx with every other provider: composed file
+      // values win over same-named variables already in the parent env.
       command,
-      ["run", "-f", existingFiles.join(","), "--", process.execPath, "-e", helper, JSON.stringify(keys)],
+      ["run", "--overload", "-f", existingFiles.join(","), "--", process.execPath, "-e", helper, JSON.stringify(keys)],
       {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -29862,7 +29882,8 @@ function resolveDotenvx(entry, source, context) {
     return { name: entry.name, provider: source.provider, values, availability: "loaded" };
   } catch (error) {
     const category = typeof error?.code === "string" ? error.code : "failed";
-    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" could not decrypt or load (${stage}:${category}).`);
+    const sniffHint = entry.globalImplicit ? " The global file looks dotenvx-encrypted; if it is actually plaintext, remove the DOTENV_PUBLIC_KEY / encrypted: markers." : "";
+    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" could not decrypt or load (${stage}:${category}).${sniffHint}`);
   }
 }
 var keytarModule;
@@ -30049,9 +30070,10 @@ function resolveEntries(layers, options) {
     ...includeGlobal ? Object.entries(layers.global.config.profiles || {}) : [],
     ...Object.entries(layers.project.config.profiles || {})
   ]);
+  const globalEncrypted = isDotenvxEncrypted(layers.globalEnvFile);
   const globalDotenv = includeGlobal ? [{
     name: GLOBAL_DOTENV_SOURCE,
-    source: { provider: "local", files: [layers.globalEnvFile], optional: true },
+    source: globalEncrypted ? { provider: "dotenvx", files: [layers.globalEnvFile], optional: true } : { provider: "local", files: [layers.globalEnvFile], optional: true },
     baseDir: layers.global.baseDir,
     globalImplicit: true
   }] : [];
@@ -37101,14 +37123,14 @@ async function startEditorServer(encodedState) {
   });
   const closeTimer = setTimeout(() => server.close(), EDITOR_LIFETIME_MS);
   closeTimer.unref();
-  await new Promise((resolve7, reject) => {
+  await new Promise((resolve8, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       if (!address || typeof address === "string") return reject(new Error("Editor did not receive a loopback port"));
       process.stdout.write(`http://127.0.0.1:${address.port}${editorPath(state)}
 `);
-      resolve7();
+      resolve8();
     });
   });
 }
@@ -37129,7 +37151,7 @@ async function launchEditor(entryScript, composition, selectedSource) {
     detached: true,
     stdio: ["ignore", "pipe", "ignore"]
   });
-  const url = await new Promise((resolve7, reject) => {
+  const url = await new Promise((resolve8, reject) => {
     const timer = setTimeout(() => reject(new Error("[morphix-env] Timed out starting local editor.")), 5e3);
     child.once("error", () => {
       clearTimeout(timer);
@@ -37139,7 +37161,7 @@ async function launchEditor(entryScript, composition, selectedSource) {
       clearTimeout(timer);
       const url2 = chunk.toString("utf8").trim();
       child.stdout?.destroy();
-      resolve7(url2);
+      resolve8(url2);
     });
   });
   child.unref();
@@ -37154,6 +37176,267 @@ async function launchEditor(entryScript, composition, selectedSource) {
   return { url, opened };
 }
 
+// src/migrate.ts
+var import_child_process4 = require("child_process");
+var import_fs7 = require("fs");
+var import_os5 = require("os");
+var import_path7 = require("path");
+var import_dotenv4 = require("dotenv");
+function resolveUnitFile(rawFile, baseDir, homeDir) {
+  const expanded = expandHomePath(rawFile, homeDir);
+  return (0, import_path7.isAbsolute)(expanded) ? expanded : (0, import_path7.resolve)(baseDir, expanded);
+}
+function snapshotValues(unit) {
+  const values = {};
+  for (const file of unit.files) Object.assign(values, parseEnvFile(file));
+  return values;
+}
+function declaredUnits(loaded, scope, homeDir) {
+  const units = [];
+  for (const [name, source] of Object.entries(loaded.config.sources || {})) {
+    if (source.provider !== "local") continue;
+    const files = source.files.map((file) => resolveUnitFile(file, loaded.baseDir, homeDir)).filter(import_fs7.existsSync);
+    if (!files.length) continue;
+    const probe = {
+      name,
+      kind: "declared",
+      scope,
+      baseDir: loaded.baseDir,
+      configPath: loaded.path,
+      source,
+      files,
+      keyNames: []
+    };
+    units.push({ ...probe, keyNames: Object.keys(snapshotValues(probe)).sort() });
+  }
+  return units;
+}
+function discoverPlaintextUnits(layers, homeDir = (0, import_os5.homedir)()) {
+  const units = [];
+  if ((0, import_fs7.existsSync)(layers.globalEnvFile) && !isDotenvxEncrypted(layers.globalEnvFile)) {
+    const source = { provider: "local", files: [layers.globalEnvFile], optional: true };
+    const probe = {
+      name: GLOBAL_DOTENV_SOURCE,
+      kind: "global-implicit",
+      scope: null,
+      baseDir: (0, import_path7.dirname)(layers.globalEnvFile),
+      configPath: null,
+      source,
+      files: [layers.globalEnvFile],
+      keyNames: []
+    };
+    units.push({ ...probe, keyNames: Object.keys(snapshotValues(probe)).sort() });
+  }
+  units.push(...declaredUnits(layers.global, "global", homeDir));
+  units.push(...declaredUnits(layers.project, "project", homeDir));
+  return units;
+}
+function legacyPlaintextHints(layers, units, homeDir = (0, import_os5.homedir)()) {
+  const covered = new Set(units.flatMap((unit) => unit.files));
+  const legacyFiles = layers.project.config.envFiles || [".env.local"];
+  return legacyFiles.map((file) => resolveUnitFile(file, layers.project.baseDir, homeDir)).filter((file) => (0, import_fs7.existsSync)(file) && !covered.has(file) && !isDotenvxEncrypted(file));
+}
+function backupFile(file, stamp) {
+  const backup = `${file}.mx-env-backup-${stamp}`;
+  (0, import_fs7.copyFileSync)(file, backup);
+  (0, import_fs7.chmodSync)(backup, 384);
+  return backup;
+}
+var BACKUP_MARK = ".mx-env-backup-";
+function restoreBackups(backups) {
+  const failed = [];
+  for (const backup of backups) {
+    const original = backup.slice(0, backup.lastIndexOf(BACKUP_MARK));
+    try {
+      if (original && (0, import_fs7.existsSync)(backup)) (0, import_fs7.copyFileSync)(backup, original);
+    } catch {
+      if (original) failed.push(original);
+    }
+  }
+  return failed;
+}
+function withRestoreOutcome(message, failed, backups) {
+  if (failed.length) {
+    return `${message} RESTORE FAILED for: ${failed.join(", ")} \u2014 restore manually from the .mx-env-backup-* copies${backups.length ? ` (${backups.join(", ")})` : ""}.`;
+  }
+  return `${message} Plaintext and configuration were restored from backup${backups.length ? ` (${backups.join(", ")})` : ""}.`;
+}
+function equivalent(expected, actual) {
+  const expectedKeys = Object.keys(expected).sort();
+  const actualKeys = Object.keys(actual).sort();
+  if (expectedKeys.length !== actualKeys.length) return false;
+  return expectedKeys.every((key, index2) => key === actualKeys[index2] && expected[key] === actual[key]);
+}
+function existingDeclaredFiles(unit, homeDir) {
+  const existing = new Set(unit.files);
+  return unit.source.files.filter((file) => existing.has(resolveUnitFile(file, unit.baseDir, homeDir)));
+}
+function droppedDeclaredFiles(unit, homeDir) {
+  const existing = new Set(unit.files);
+  return unit.source.files.filter((file) => !existing.has(resolveUnitFile(file, unit.baseDir, homeDir)));
+}
+function rewriteDeclaredSource(unit, newSource, stamp, backups) {
+  const configPath = unit.configPath;
+  backups.push(backupFile(configPath, stamp));
+  const parsed = JSON.parse((0, import_fs7.readFileSync)(configPath, "utf8"));
+  parsed.sources[unit.name] = newSource;
+  (0, import_fs7.writeFileSync)(configPath, `${JSON.stringify(parsed, null, 2)}
+`);
+}
+function gitIgnoreWarnings(paths) {
+  const warnings = [];
+  for (const path of paths) {
+    try {
+      (0, import_child_process4.execFileSync)("git", ["rev-parse", "--is-inside-work-tree"], { cwd: (0, import_path7.dirname)(path), stdio: ["ignore", "ignore", "ignore"] });
+    } catch {
+      continue;
+    }
+    try {
+      (0, import_child_process4.execFileSync)("git", ["check-ignore", "-q", path], { cwd: (0, import_path7.dirname)(path), stdio: ["ignore", "ignore", "ignore"] });
+    } catch (error) {
+      if (error?.status === 1) {
+        warnings.push(`[morphix-env] WARNING: ${path} is inside a git repository and NOT git-ignored \u2014 this file holds the decryption key and must never be committed.`);
+      }
+    }
+  }
+  return warnings;
+}
+async function reloadViaKeychain(unit, newSource, homeDir) {
+  const entry = {
+    name: unit.name,
+    source: newSource,
+    baseDir: unit.baseDir,
+    globalImplicit: unit.kind === "global-implicit"
+  };
+  const loaded = await loadSource(entry, { homeDir, environment: { ...process.env } });
+  return loaded.values;
+}
+function decryptValues(command, files) {
+  const values = {};
+  for (const file of files) {
+    const output = (0, import_child_process4.execFileSync)(command, ["decrypt", "-f", file, "--stdout", "--no-native"], {
+      encoding: "utf8",
+      cwd: (0, import_path7.dirname)(file),
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const markerKeys = new Set(Object.keys(parseEnvFile(file)).filter((key) => key.startsWith("DOTENV_PUBLIC_KEY")));
+    for (const [key, value] of Object.entries((0, import_dotenv4.parse)(output))) {
+      if (!markerKeys.has(key)) values[key] = value;
+    }
+  }
+  return values;
+}
+async function migrateToDotenvx(unit, stamp, homeDir, backups) {
+  const snapshot = snapshotValues(unit);
+  for (const file of unit.files) backups.push(backupFile(file, stamp));
+  const candidateKeysFiles = [...new Set(unit.files.map((file) => (0, import_path7.join)((0, import_path7.dirname)(file), ".env.keys")))];
+  const preExistingKeys = new Set(candidateKeysFiles.filter(import_fs7.existsSync));
+  for (const keysFile of preExistingKeys) backups.push(backupFile(keysFile, stamp));
+  try {
+    let command;
+    try {
+      command = ensureCommand("dotenvx", unit.name, "dotenvx");
+    } catch {
+      throw new Error("the dotenvx CLI is required; install it (e.g. `npm i -g @dotenvx/dotenvx`) or migrate to another target.");
+    }
+    for (const file of unit.files) {
+      (0, import_child_process4.execFileSync)(command, ["encrypt", "-f", file, "--no-native"], { cwd: (0, import_path7.dirname)(file), stdio: ["ignore", "ignore", "ignore"] });
+      const keysFile = (0, import_path7.join)((0, import_path7.dirname)(file), ".env.keys");
+      if ((0, import_fs7.existsSync)(keysFile)) (0, import_fs7.chmodSync)(keysFile, 384);
+    }
+    const keysFiles = candidateKeysFiles.filter(import_fs7.existsSync);
+    const values = decryptValues(command, unit.files);
+    if (!equivalent(snapshot, values)) {
+      throw new Error("post-migration verification failed: decrypted values differ from the plaintext snapshot.");
+    }
+    const warnings = [];
+    if (unit.kind === "declared") {
+      const newSource = {
+        provider: "dotenvx",
+        files: existingDeclaredFiles(unit, homeDir),
+        ...unit.source.override ? { override: true } : {},
+        ...unit.source.optional ? { optional: true } : {}
+      };
+      rewriteDeclaredSource(unit, newSource, stamp, backups);
+      for (const dropped of droppedDeclaredFiles(unit, homeDir)) {
+        warnings.push(`[morphix-env] Warning: declared file "${dropped}" did not exist at migration time and was dropped from the rewritten source; re-add it to the config if it returns.`);
+      }
+    }
+    return { warnings: [...warnings, ...gitIgnoreWarnings(keysFiles)] };
+  } catch (error) {
+    const failed = restoreBackups(backups);
+    for (const keysFile of candidateKeysFiles) {
+      if (!preExistingKeys.has(keysFile) && (0, import_fs7.existsSync)(keysFile)) (0, import_fs7.rmSync)(keysFile);
+    }
+    const message = error instanceof Error ? error.message : "unknown failure";
+    throw new Error(withRestoreOutcome(message, failed, backups));
+  }
+}
+function snapshotCovered(expected, actual) {
+  return Object.keys(expected).every((key) => actual[key] === expected[key]);
+}
+async function migrateToKeychain(unit, service, stamp, homeDir, backups) {
+  if (process.platform !== "darwin") throw new Error("the os-keychain target is supported on macOS only; use --to dotenvx on this machine.");
+  const keytar = await loadKeytar();
+  if (!keytar) throw new Error('the os-keychain target needs the optional native module "keytar"; reinstall morphix-env or use --to dotenvx.');
+  const snapshot = snapshotValues(unit);
+  for (const file of unit.files) backups.push(backupFile(file, stamp));
+  const preExisting = new Map((await keytar.findCredentials(service)).map(({ account, password }) => [account, password]));
+  try {
+    for (const [key, value] of Object.entries(snapshot)) await keytar.setPassword(service, key, value);
+    const newSource = {
+      provider: "os-keychain",
+      service,
+      ...unit.source.override ? { override: true } : {}
+    };
+    const values = await reloadViaKeychain(unit, newSource, homeDir);
+    if (!snapshotCovered(snapshot, values)) {
+      throw new Error("post-migration verification failed: keychain values differ from the plaintext snapshot.");
+    }
+    const foreign = Object.keys(values).filter((key) => !(key in snapshot));
+    const warnings = foreign.length ? [`[morphix-env] Warning: keychain service "${service}" also holds ${foreign.length} unrelated account(s) (e.g. "${foreign[0]}"); verify the service is not shared unexpectedly.`] : [];
+    rewriteDeclaredSource(unit, newSource, stamp, backups);
+    for (const file of unit.files) (0, import_fs7.rmSync)(file);
+    return { warnings };
+  } catch (error) {
+    const failed = restoreBackups(backups);
+    for (const key of Object.keys(snapshot)) {
+      if (preExisting.has(key)) {
+        await keytar.setPassword(service, key, preExisting.get(key)).catch(() => {
+        });
+      } else {
+        await keytar.deletePassword(service, key).catch(() => {
+        });
+      }
+    }
+    const message = error instanceof Error ? error.message : "unknown failure";
+    throw new Error(withRestoreOutcome(message, failed, backups));
+  }
+}
+async function executeUnit(unit, target, options = {}, homeDir = (0, import_os5.homedir)()) {
+  if (unit.kind === "global-implicit" && target === "keychain") {
+    return {
+      unit,
+      status: "skipped",
+      backups: [],
+      warnings: [],
+      detail: "the global implicit file cannot migrate to os-keychain (its loading does not go through profiles); use --to dotenvx for it."
+    };
+  }
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const backups = [];
+  if (!unit.keyNames.length) {
+    return { unit, status: "skipped", backups: [], warnings: [], detail: "no keys in the file(s); nothing to migrate." };
+  }
+  try {
+    const { warnings } = target === "dotenvx" ? await migrateToDotenvx(unit, stamp, homeDir, backups) : await migrateToKeychain(unit, options.service || `mx-env:${unit.name}`, stamp, homeDir, backups);
+    return { unit, status: "migrated", backups, warnings, detail: "" };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "unknown failure";
+    return { unit, status: "failed", backups, warnings: [], detail: message };
+  }
+}
+
 // src/redaction.ts
 var StreamingRedactor = class {
   constructor(values) {
@@ -37294,14 +37577,14 @@ var ReferenceResolver = class {
 };
 
 // src/skill.ts
-var import_fs7 = require("fs");
-var import_os5 = require("os");
-var import_path7 = require("path");
+var import_fs8 = require("fs");
+var import_os6 = require("os");
+var import_path8 = require("path");
 var SKILL_TARGETS = ["global", "project", "trellis"];
 function resolveSkillPath(target) {
-  if (target === "project") return (0, import_path7.join)(process.cwd(), ".claude", "skills", "morphix-env", "SKILL.md");
-  if (target === "trellis") return (0, import_path7.join)((0, import_os5.homedir)(), ".trellis", "skills", "morphix-env", "SKILL.md");
-  return (0, import_path7.join)((0, import_os5.homedir)(), ".claude", "skills", "morphix-env", "SKILL.md");
+  if (target === "project") return (0, import_path8.join)(process.cwd(), ".claude", "skills", "morphix-env", "SKILL.md");
+  if (target === "trellis") return (0, import_path8.join)((0, import_os6.homedir)(), ".trellis", "skills", "morphix-env", "SKILL.md");
+  return (0, import_path8.join)((0, import_os6.homedir)(), ".claude", "skills", "morphix-env", "SKILL.md");
 }
 function targetHint(target) {
   if (target === "project") {
@@ -37320,17 +37603,17 @@ function printNextSteps() {
   4. mx-env doc                            generate this project's key-to-source workflow Skill`);
 }
 function cmdSkill(subcommand, options) {
-  const templatePath = (0, import_path7.join)(__dirname, "SKILL.md");
-  const template = (0, import_fs7.readFileSync)(templatePath, "utf8");
+  const templatePath = (0, import_path8.join)(__dirname, "SKILL.md");
+  const template = (0, import_fs8.readFileSync)(templatePath, "utf8");
   if (subcommand === "show") {
     console.log(`[morphix-env] Skill template: ${templatePath}`);
     for (const target2 of SKILL_TARGETS) {
       const path = resolveSkillPath(target2);
-      if (!(0, import_fs7.existsSync)(path)) {
+      if (!(0, import_fs8.existsSync)(path)) {
         console.log(`  ${target2}: not installed (${path})`);
         continue;
       }
-      const state = (0, import_fs7.readFileSync)(path, "utf8") === template ? "installed (matches this version)" : "installed (differs from this version)";
+      const state = (0, import_fs8.readFileSync)(path, "utf8") === template ? "installed (matches this version)" : "installed (differs from this version)";
       console.log(`  ${target2}: ${state} (${path})`);
     }
     return 0;
@@ -37345,8 +37628,8 @@ function cmdSkill(subcommand, options) {
     return 1;
   }
   const dest = resolveSkillPath(target);
-  if ((0, import_fs7.existsSync)(dest)) {
-    if ((0, import_fs7.readFileSync)(dest, "utf8") === template) {
+  if ((0, import_fs8.existsSync)(dest)) {
+    if ((0, import_fs8.readFileSync)(dest, "utf8") === template) {
       console.log(`[morphix-env] Skill already installed and up to date: ${dest}`);
       return 0;
     }
@@ -37355,8 +37638,8 @@ function cmdSkill(subcommand, options) {
       return 1;
     }
   }
-  (0, import_fs7.mkdirSync)((0, import_path7.dirname)(dest), { recursive: true });
-  (0, import_fs7.writeFileSync)(dest, template, { mode: 420 });
+  (0, import_fs8.mkdirSync)((0, import_path8.dirname)(dest), { recursive: true });
+  (0, import_fs8.writeFileSync)(dest, template, { mode: 420 });
   console.log(`[morphix-env] Installed skill: ${dest}`);
   console.log(`[morphix-env] ${targetHint(target)}`);
   printNextSteps();
@@ -37438,9 +37721,9 @@ async function startSecretServer(values) {
 }
 
 // src/shims.ts
-var import_fs8 = require("fs");
-var import_os6 = require("os");
-var import_path8 = require("path");
+var import_fs9 = require("fs");
+var import_os7 = require("os");
+var import_path9 = require("path");
 var SHIM_MARKER = "# mx-env shim \u2014 regenerated by `mx-env shell-init`; do not edit by hand.";
 var RESERVED_SHIM_NAMES = [
   "run",
@@ -37451,6 +37734,7 @@ var RESERVED_SHIM_NAMES = [
   "generate",
   "gen",
   "inspect",
+  "migrate",
   "audit",
   "edit",
   "doc",
@@ -37462,8 +37746,8 @@ var RESERVED_SHIM_NAMES = [
   "__mx_editor"
 ];
 var SHIM_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-function shimsDir(homeDir = (0, import_os6.homedir)()) {
-  return (0, import_path8.join)(homeDir, ".mx-env", "shims");
+function shimsDir(homeDir = (0, import_os7.homedir)()) {
+  return (0, import_path9.join)(homeDir, ".mx-env", "shims");
 }
 function validateShimList(list, label) {
   if (list === void 0 || list === null) return [];
@@ -37518,33 +37802,33 @@ MXENV_SHIM=1 exec mx-env run -- ${command} "$@"
 }
 function readIfExists(path) {
   try {
-    return (0, import_fs8.readFileSync)(path, "utf8");
+    return (0, import_fs9.readFileSync)(path, "utf8");
   } catch {
     return null;
   }
 }
-function writeShims(commands, homeDir = (0, import_os6.homedir)()) {
+function writeShims(commands, homeDir = (0, import_os7.homedir)()) {
   const dir = shimsDir(homeDir);
-  (0, import_fs8.mkdirSync)(dir, { recursive: true, mode: 448 });
+  (0, import_fs9.mkdirSync)(dir, { recursive: true, mode: 448 });
   const wanted = new Set(commands.map((command) => command.toLowerCase()));
   const written = [];
   const removed = [];
   const skipped = [];
-  for (const file of (0, import_fs8.readdirSync)(dir)) {
-    const path = (0, import_path8.join)(dir, file);
+  for (const file of (0, import_fs9.readdirSync)(dir)) {
+    const path = (0, import_path9.join)(dir, file);
     const content = readIfExists(path);
     if (content === null || !content.includes(SHIM_MARKER)) continue;
     if (!wanted.has(file.toLowerCase())) {
-      (0, import_fs8.rmSync)(path);
+      (0, import_fs9.rmSync)(path);
       removed.push(file);
     }
   }
   for (const command of commands) {
-    const path = (0, import_path8.join)(dir, command);
+    const path = (0, import_path9.join)(dir, command);
     const content = renderShimScript(command);
     let isSymlink = false;
     try {
-      isSymlink = (0, import_fs8.lstatSync)(path).isSymbolicLink();
+      isSymlink = (0, import_fs9.lstatSync)(path).isSymbolicLink();
     } catch {
     }
     const existing = isSymlink ? null : readIfExists(path);
@@ -37552,42 +37836,42 @@ function writeShims(commands, homeDir = (0, import_os6.homedir)()) {
       skipped.push(command);
       continue;
     }
-    if (isSymlink) (0, import_fs8.rmSync)(path);
+    if (isSymlink) (0, import_fs9.rmSync)(path);
     else if (existing === content) continue;
-    (0, import_fs8.writeFileSync)(path, content, { mode: 493 });
-    (0, import_fs8.chmodSync)(path, 493);
+    (0, import_fs9.writeFileSync)(path, content, { mode: 493 });
+    (0, import_fs9.chmodSync)(path, 493);
     written.push(command);
   }
   return { written, removed, skipped };
 }
-function removeAllShims(homeDir = (0, import_os6.homedir)()) {
+function removeAllShims(homeDir = (0, import_os7.homedir)()) {
   const dir = shimsDir(homeDir);
-  if (!(0, import_fs8.existsSync)(dir)) return [];
+  if (!(0, import_fs9.existsSync)(dir)) return [];
   const removed = [];
-  for (const file of (0, import_fs8.readdirSync)(dir)) {
-    const path = (0, import_path8.join)(dir, file);
+  for (const file of (0, import_fs9.readdirSync)(dir)) {
+    const path = (0, import_path9.join)(dir, file);
     const content = readIfExists(path);
     if (content !== null && content.includes(SHIM_MARKER)) {
-      (0, import_fs8.rmSync)(path);
+      (0, import_fs9.rmSync)(path);
       removed.push(file);
     }
   }
   return removed;
 }
-function detectHandmadeReservedShims(homeDir = (0, import_os6.homedir)()) {
+function detectHandmadeReservedShims(homeDir = (0, import_os7.homedir)()) {
   const dir = shimsDir(homeDir);
-  if (!(0, import_fs8.existsSync)(dir)) return [];
+  if (!(0, import_fs9.existsSync)(dir)) return [];
   const found = [];
-  for (const file of (0, import_fs8.readdirSync)(dir)) {
+  for (const file of (0, import_fs9.readdirSync)(dir)) {
     if (!RESERVED_SHIM_NAMES.includes(file.toLowerCase())) continue;
-    const content = readIfExists((0, import_path8.join)(dir, file));
+    const content = readIfExists((0, import_path9.join)(dir, file));
     if (content === null || !content.includes(SHIM_MARKER)) found.push(file);
   }
   return found;
 }
 var RC_BLOCK_BEGIN = "# >>> mx-env shims >>>";
 var RC_BLOCK_END = "# <<< mx-env shims <<<";
-function rcBlock(homeDir = (0, import_os6.homedir)()) {
+function rcBlock(homeDir = (0, import_os7.homedir)()) {
   const dir = shimsDir(homeDir);
   if (/["$`\\]/.test(dir)) {
     throw new Error("[morphix-env] Shims directory path contains characters that are unsafe in a shell rc line.");
@@ -37596,18 +37880,18 @@ function rcBlock(homeDir = (0, import_os6.homedir)()) {
 export PATH="${dir}:$PATH"
 ${RC_BLOCK_END}`;
 }
-function defaultRcPath(shell, homeDir = (0, import_os6.homedir)()) {
+function defaultRcPath(shell, homeDir = (0, import_os7.homedir)()) {
   const name = shell ? shell.split("/").pop() : "";
-  if (name === "zsh") return (0, import_path8.join)(homeDir, ".zshrc");
-  if (name === "bash") return (0, import_path8.join)(homeDir, ".bashrc");
+  if (name === "zsh") return (0, import_path9.join)(homeDir, ".zshrc");
+  if (name === "bash") return (0, import_path9.join)(homeDir, ".bashrc");
   return null;
 }
 function writeFileAtomic(path, content) {
   const tmp = `${path}.mx-env-${process.pid}.tmp`;
-  (0, import_fs8.writeFileSync)(tmp, content);
-  (0, import_fs8.renameSync)(tmp, path);
+  (0, import_fs9.writeFileSync)(tmp, content);
+  (0, import_fs9.renameSync)(tmp, path);
 }
-function upsertRcBlock(rcPath, homeDir = (0, import_os6.homedir)()) {
+function upsertRcBlock(rcPath, homeDir = (0, import_os7.homedir)()) {
   const existing = readIfExists(rcPath) ?? "";
   const block = rcBlock(homeDir);
   const pattern = new RegExp(`${escapeRegExp(RC_BLOCK_BEGIN)}[\\s\\S]*?${escapeRegExp(RC_BLOCK_END)}`, "g");
@@ -37634,32 +37918,32 @@ function removeRcBlock(rcPath) {
 function escapeRegExp(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function stripShimsFromPath(pathValue, homeDir = (0, import_os6.homedir)()) {
+function stripShimsFromPath(pathValue, homeDir = (0, import_os7.homedir)()) {
   if (!pathValue) return pathValue;
   const target = shimsDir(homeDir);
   let targetReal = target;
   try {
-    targetReal = (0, import_fs8.realpathSync)(target);
+    targetReal = (0, import_fs9.realpathSync)(target);
   } catch {
   }
   const equal = (a, b) => process.platform === "darwin" ? a.toLowerCase() === b.toLowerCase() : a === b;
-  const entries = pathValue.split(import_path8.delimiter).filter((entry) => {
+  const entries = pathValue.split(import_path9.delimiter).filter((entry) => {
     if (!entry) return true;
     const literal = entry.replace(/\/+$/, "");
     let resolved = literal;
     try {
-      resolved = (0, import_fs8.realpathSync)(literal);
+      resolved = (0, import_fs9.realpathSync)(literal);
     } catch {
     }
     return !equal(literal, target) && !equal(resolved, targetReal);
   });
-  return entries.join(import_path8.delimiter);
+  return entries.join(import_path9.delimiter);
 }
 function sanitizeBootEnv(env = process.env, homeDir) {
   const originalPath = env.PATH;
   const viaShim = env.MXENV_SHIM === "1";
   try {
-    const home = homeDir ?? (0, import_os6.homedir)();
+    const home = homeDir ?? (0, import_os7.homedir)();
     const stripped = stripShimsFromPath(originalPath, home);
     if (stripped !== originalPath) {
       if (stripped) env.PATH = stripped;
@@ -37670,18 +37954,18 @@ function sanitizeBootEnv(env = process.env, homeDir) {
   delete env.MXENV_SHIM;
   return { viaShim, originalPath };
 }
-function findShadowedCommands(commands, originalPath, homeDir = (0, import_os6.homedir)()) {
+function findShadowedCommands(commands, originalPath, homeDir = (0, import_os7.homedir)()) {
   if (!originalPath) return { absent: [...commands], shadowed: [] };
-  const dirs = originalPath.split(import_path8.delimiter).filter(Boolean);
+  const dirs = originalPath.split(import_path9.delimiter).filter(Boolean);
   const absent = [];
   const shadowed = [];
   for (const command of commands) {
-    const shimPath = (0, import_path8.join)(shimsDir(homeDir), command);
+    const shimPath = (0, import_path9.join)(shimsDir(homeDir), command);
     let resolvedTo = null;
     for (const dir of dirs) {
-      const candidate = (0, import_path8.join)(dir, command);
+      const candidate = (0, import_path9.join)(dir, command);
       try {
-        (0, import_fs8.accessSync)(candidate, import_fs8.constants.X_OK);
+        (0, import_fs9.accessSync)(candidate, import_fs9.constants.X_OK);
         resolvedTo = candidate;
         break;
       } catch {
@@ -37695,9 +37979,9 @@ function findShadowedCommands(commands, originalPath, homeDir = (0, import_os6.h
 }
 
 // src/template.ts
-var import_child_process4 = require("child_process");
-var import_fs9 = require("fs");
-var import_path9 = require("path");
+var import_child_process5 = require("child_process");
+var import_fs10 = require("fs");
+var import_path10 = require("path");
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -37744,20 +38028,20 @@ function renderTemplate(text, environment) {
   return { output, missing: [...missing] };
 }
 function writePrivateFile(path, content) {
-  const absolute = (0, import_path9.resolve)(path);
-  (0, import_fs9.mkdirSync)((0, import_path9.dirname)(absolute), { recursive: true, mode: 448 });
-  (0, import_fs9.writeFileSync)(absolute, content, { mode: 384 });
-  (0, import_fs9.chmodSync)(absolute, 384);
+  const absolute = (0, import_path10.resolve)(path);
+  (0, import_fs10.mkdirSync)((0, import_path10.dirname)(absolute), { recursive: true, mode: 448 });
+  (0, import_fs10.writeFileSync)(absolute, content, { mode: 384 });
+  (0, import_fs10.chmodSync)(absolute, 384);
 }
 function gitOutputStatus(path) {
-  const absolute = (0, import_path9.resolve)(path);
-  const cwd = (0, import_path9.dirname)(absolute);
-  const name = (0, import_path9.basename)(absolute);
-  const inside = (0, import_child_process4.spawnSync)("git", ["rev-parse", "--is-inside-work-tree"], { cwd, encoding: "utf8" });
+  const absolute = (0, import_path10.resolve)(path);
+  const cwd = (0, import_path10.dirname)(absolute);
+  const name = (0, import_path10.basename)(absolute);
+  const inside = (0, import_child_process5.spawnSync)("git", ["rev-parse", "--is-inside-work-tree"], { cwd, encoding: "utf8" });
   if (inside.status !== 0) return "outside-repo";
-  const tracked = (0, import_child_process4.spawnSync)("git", ["ls-files", "--error-unmatch", "--", name], { cwd, encoding: "utf8" });
+  const tracked = (0, import_child_process5.spawnSync)("git", ["ls-files", "--error-unmatch", "--", name], { cwd, encoding: "utf8" });
   if (tracked.status === 0) return "tracked";
-  const ignored = (0, import_child_process4.spawnSync)("git", ["check-ignore", "-q", "--", name], { cwd, encoding: "utf8" });
+  const ignored = (0, import_child_process5.spawnSync)("git", ["check-ignore", "-q", "--", name], { cwd, encoding: "utf8" });
   if (ignored.status === 0) return "ignored";
   if (ignored.status === 1) return "untracked";
   return "outside-repo";
@@ -37774,7 +38058,7 @@ function warnOutputGitRisk(path) {
 // package.json
 var package_default = {
   name: "morphix-env",
-  version: "0.9.0",
+  version: "0.10.0",
   description: "Secret composition CLI \u2014 Infisical, Doppler, macOS Keychain, dotenvx, and local files stay value owners; composes them into one value-safe child environment and ships a built-in Agent Skill (mx-env skill install).",
   author: "MorphixAI <dev@morphixai.com>",
   homepage: "https://github.com/Morphicai/morphix-env#readme",
@@ -37879,11 +38163,14 @@ function parseArgs(argv) {
     printEditorUrl: false,
     source: null,
     target: null,
+    to: null,
+    service: null,
     force: false,
     dryRun: false,
     serve: false,
     write: false,
     remove: false,
+    warnPlaintext: false,
     unknownFlags: []
   };
   let i = 2;
@@ -37921,6 +38208,10 @@ function parseArgs(argv) {
       args.printEditorUrl = true;
     } else if (arg === "--target") {
       if (argv[++i]) args.target = argv[i];
+    } else if (arg === "--to") {
+      if (argv[++i]) args.to = argv[i];
+    } else if (arg === "--service") {
+      if (argv[++i]) args.service = argv[i];
     } else if (arg === "--force") {
       args.force = true;
     } else if (arg === "--dry-run") {
@@ -37931,6 +38222,8 @@ function parseArgs(argv) {
       args.remove = true;
     } else if (arg === "--serve") {
       args.serve = true;
+    } else if (arg === "--warn-plaintext") {
+      args.warnPlaintext = true;
     } else if (args.command === "run") {
       args.subArgs = argv.slice(i);
       break;
@@ -37944,7 +38237,7 @@ function parseArgs(argv) {
   return args;
 }
 function configLayers() {
-  return loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os7.homedir)() });
+  return loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os8.homedir)() });
 }
 function composeOptions(args) {
   return {
@@ -37954,7 +38247,7 @@ function composeOptions(args) {
     envName: args.env,
     allowInsecureGlobal: args.allowInsecureGlobal,
     envFiles: args.envFiles,
-    homeDir: (0, import_os7.homedir)()
+    homeDir: (0, import_os8.homedir)()
   };
 }
 var bootInfo = { viaShim: false };
@@ -37975,8 +38268,19 @@ function resolveComposition(args) {
   warnInvalidShims(layers, !args.noGlobal);
   return composeEnvironment(layers, composeOptions(args));
 }
+var plaintextWarned = false;
+function warnPlaintextSources(composition, args) {
+  if (plaintextWarned) return;
+  if (!args.warnPlaintext && process.env.MXENV_WARN_PLAINTEXT !== "1") return;
+  plaintextWarned = true;
+  const loaded = composition.sourceStatuses.filter(
+    (source) => source.provider === "local" && source.availability === "loaded" && source.keyCount > 0
+  );
+  if (!loaded.length) return;
+  console.warn(`[morphix-env] Plaintext local source(s) in use: ${loaded.map((source) => source.name).join(", ")} \u2014 local plaintext files are dev-only; run \`mx-env migrate\` to move them into encrypted storage.`);
+}
 function generatedOptions(args) {
-  const config = loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os7.homedir)() }).project.config;
+  const config = loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os8.homedir)() }).project.config;
   return {
     outFile: args.outFile || config.generate?.out || "public/__env.js",
     filter: args.filter || config.generate?.filter || null
@@ -37985,12 +38289,12 @@ function generatedOptions(args) {
 function generateClientEnv(outFile, filter, environment) {
   let vars = extractPublicVars(environment);
   if (filter) vars = Object.fromEntries(Object.entries(vars).filter(([key]) => key.startsWith(filter)));
-  (0, import_fs10.mkdirSync)((0, import_path10.dirname)(outFile), { recursive: true });
-  (0, import_fs10.writeFileSync)(outFile, `window.__ENV=${JSON.stringify(vars)};`);
+  (0, import_fs11.mkdirSync)((0, import_path11.dirname)(outFile), { recursive: true });
+  (0, import_fs11.writeFileSync)(outFile, `window.__ENV=${JSON.stringify(vars)};`);
   console.log(`[morphix-env] Generated ${outFile} (${Object.keys(vars).length} client vars)`);
 }
 async function runChild(command, commandArgs, composition) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     if (composition.environment.PATH) {
       composition.environment.PATH = stripShimsFromPath(composition.environment.PATH) ?? composition.environment.PATH;
     }
@@ -38001,14 +38305,14 @@ async function runChild(command, commandArgs, composition) {
     child.stderr?.on("data", (chunk) => process.stderr.write(stderr.write(chunk)));
     child.on("error", () => {
       console.error(`[morphix-env] Failed to execute: ${command}`);
-      resolve7(1);
+      resolve8(1);
     });
     child.on("close", (code) => {
       const stdoutFinal = stdout.flush();
       const stderrFinal = stderr.flush();
       if (stdoutFinal) process.stdout.write(stdoutFinal);
       if (stderrFinal) process.stderr.write(stderrFinal);
-      resolve7(code ?? 1);
+      resolve8(code ?? 1);
     });
   });
 }
@@ -38074,6 +38378,7 @@ async function cmdRun(args) {
   }
   const startedAt = Date.now();
   const composition = await resolveComposition(args);
+  warnPlaintextSources(composition, args);
   if (args.verbose) {
     for (const source of composition.sourceStatuses) {
       console.log(`[morphix-env] ${source.name}: ${source.availability} (${source.keyCount} keys)`);
@@ -38087,7 +38392,7 @@ async function cmdRun(args) {
   await resolveEnvironmentReferences(composition, args);
   if (args.outFile || generatedOptions(args).outFile) {
     const { outFile, filter } = generatedOptions(args);
-    const configured = Boolean(args.outFile || loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os7.homedir)() }).project.config.generate);
+    const configured = Boolean(args.outFile || loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os8.homedir)() }).project.config.generate);
     if (configured) generateClientEnv(outFile, filter, composition.environment);
   }
   const [command, ...commandArgs] = args.subArgs;
@@ -38144,6 +38449,7 @@ async function cmdFetch(args) {
 }
 async function cmdGenerate(args) {
   const composition = await resolveComposition(args);
+  warnPlaintextSources(composition, args);
   await resolveEnvironmentReferences(composition, args);
   const { outFile, filter } = generatedOptions(args);
   generateClientEnv(outFile, filter, composition.environment);
@@ -38156,7 +38462,8 @@ async function cmdInspect(args) {
   const composition = await resolveComposition(args);
   console.log(`profile: ${composition.profileName}`);
   for (const source of composition.sourceStatuses) {
-    console.log(`source: ${source.name} (${source.provider}) \u2014 ${source.availability}, ${source.keyCount} keys`);
+    const plaintextMark = source.provider === "local" ? " [plaintext, dev-only]" : "";
+    console.log(`source: ${source.name} (${source.provider}) \u2014 ${source.availability}, ${source.keyCount} keys${plaintextMark}`);
   }
   for (const [key, provenance] of Object.entries(composition.provenance).sort(([a], [b]) => a.localeCompare(b))) {
     if (!args.filter || key.startsWith(args.filter)) {
@@ -38169,6 +38476,7 @@ async function cmdInspect(args) {
 async function cmdExport(args) {
   const startedAt = Date.now();
   const composition = await resolveComposition(args);
+  warnPlaintextSources(composition, args);
   const keys = Object.keys(composition.provenance).sort();
   if (args.dryRun) {
     for (const key of keys) console.log(key);
@@ -38192,12 +38500,13 @@ async function cmdRender(args) {
     console.error("[morphix-env] Usage: mx-env render <template-file> <output-file> [options]");
     return 1;
   }
-  if (!(0, import_fs10.existsSync)(templatePath)) {
+  if (!(0, import_fs11.existsSync)(templatePath)) {
     console.error(`[morphix-env] Template not found: ${templatePath}`);
     return 1;
   }
-  const template = (0, import_fs10.readFileSync)(templatePath, "utf8");
+  const template = (0, import_fs11.readFileSync)(templatePath, "utf8");
   const composition = await resolveComposition(args);
+  warnPlaintextSources(composition, args);
   const names = findTemplateVariables(template);
   const missing = names.filter((name) => composition.environment[name] === void 0 || composition.environment[name] === null);
   if (missing.length) console.warn(`[morphix-env] Missing variables: ${missing.join(", ")} (left unresolved)`);
@@ -38221,11 +38530,11 @@ async function cmdInject(args) {
     console.error("[morphix-env] Usage: mx-env inject <template-file> <output-file> [options]");
     return 1;
   }
-  if (!(0, import_fs10.existsSync)(templatePath)) {
+  if (!(0, import_fs11.existsSync)(templatePath)) {
     console.error(`[morphix-env] Template not found: ${templatePath}`);
     return 1;
   }
-  const template = (0, import_fs10.readFileSync)(templatePath, "utf8");
+  const template = (0, import_fs11.readFileSync)(templatePath, "utf8");
   const layers = configLayers();
   warnInvalidShims(layers, !args.noGlobal);
   const resolver = new ReferenceResolver(layers, composeOptions(args));
@@ -38261,7 +38570,7 @@ async function cmdEdit(args) {
   }
   const composition = await resolveComposition(args);
   if (args.source && !composition.sourceEntries.some((entry) => entry.name === args.source)) {
-    const layers = loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os7.homedir)() });
+    const layers = loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os8.homedir)() });
     const declared = layers.project.config.sources?.[args.source] ? { source: layers.project.config.sources[args.source], baseDir: layers.project.baseDir } : !args.noGlobal && layers.global.config.sources?.[args.source] ? { source: layers.global.config.sources[args.source], baseDir: layers.global.baseDir } : null;
     if (!declared) {
       console.error(`[morphix-env] Unknown source "${args.source}".`);
@@ -38279,7 +38588,7 @@ async function cmdEdit(args) {
 }
 async function cmdDoc(args) {
   const composition = await resolveComposition(args);
-  const outFile = args.outFile || (0, import_path10.join)(process.cwd(), ".agents", "skills", "morphix-env", "SKILL.md");
+  const outFile = args.outFile || (0, import_path11.join)(process.cwd(), ".agents", "skills", "morphix-env", "SKILL.md");
   const keyRows = Object.entries(composition.provenance).sort(([a], [b]) => a.localeCompare(b)).map(([key, provenance]) => `| \`${key}\` | ${provenance.source} (${provenance.provider}) |`).join("\n") || "| _No resolved keys_ | \u2014 |";
   const skill = `---
 name: morphix-env
@@ -38313,8 +38622,8 @@ ${keyRows}
 
 Secret values and value prefixes do not belong in this Skill, command output, audit records, or conversation context.
 `;
-  (0, import_fs10.mkdirSync)((0, import_path10.dirname)(outFile), { recursive: true });
-  (0, import_fs10.writeFileSync)(outFile, skill, { mode: 384 });
+  (0, import_fs11.mkdirSync)((0, import_path11.dirname)(outFile), { recursive: true });
+  (0, import_fs11.writeFileSync)(outFile, skill, { mode: 384 });
   console.log(`[morphix-env] Generated value-free workflow Skill: ${outFile}`);
   return 0;
 }
@@ -38341,7 +38650,7 @@ function cmdShellInit(args) {
 }
 function runShellInit(args) {
   const layers = configLayers();
-  const home = (0, import_os7.homedir)();
+  const home = (0, import_os8.homedir)();
   const rcPath = defaultRcPath(process.env.SHELL, home);
   if (args.remove) {
     const removed2 = removeAllShims(home);
@@ -38390,13 +38699,117 @@ Add the shims directory to PATH${rcPath ? ` (e.g. in ${rcPath})` : ""}:
 Or re-run with --write to let mx-env maintain a marked block in your rc file.`);
   return 0;
 }
+function printMigratePlan(units, hints, target) {
+  if (!units.length) {
+    console.log("[morphix-env] No plaintext units in scope; nothing to migrate.");
+  }
+  for (const unit of units) {
+    const where = unit.kind === "global-implicit" ? "global implicit" : `${unit.scope}, declared in ${unit.configPath}`;
+    console.log(`unit: ${unit.name} (${where})`);
+    for (const file of unit.files) console.log(`  file: ${file}`);
+    console.log(`  keys: ${unit.keyNames.join(", ") || "(none)"}`);
+    console.log(`  --to dotenvx:  encrypt file(s) in place${unit.kind === "declared" ? " + rewrite provider in config" : " (no config change; loading auto-detects encryption)"}`);
+    console.log(unit.kind === "global-implicit" ? "  --to keychain: not supported for the global implicit file" : "  --to keychain: move values to a keychain service, rewrite config, delete plaintext");
+  }
+  for (const hint of hints) {
+    console.log(`legacy plaintext (not auto-migrated): ${hint} \u2014 declare it as a source in mx-env.config.json to migrate it.`);
+  }
+  if (units.length && !target) {
+    console.log("\nPlan only. Re-run with --to dotenvx|keychain to execute; every unit gets a 0600 backup and a post-migration equivalence check before its config changes.");
+  }
+}
+async function cmdMigrate(args) {
+  if (args.unknownFlags.length) {
+    console.error(`[morphix-env] migrate: unrecognized flag(s): ${args.unknownFlags.join(", ")}`);
+    return 1;
+  }
+  if (args.to && args.to !== "dotenvx" && args.to !== "keychain") {
+    console.error('[morphix-env] migrate: --to must be "dotenvx" or "keychain".');
+    return 1;
+  }
+  if (args.service && args.to !== "keychain") {
+    console.error("[morphix-env] migrate: --service is only valid with --to keychain.");
+    return 1;
+  }
+  if (args.service && !args.source) {
+    console.error("[morphix-env] migrate: --service requires --source (one service per migrated source).");
+    return 1;
+  }
+  const layers = configLayers();
+  const home = (0, import_os8.homedir)();
+  const units = discoverPlaintextUnits(layers, home);
+  const hints = legacyPlaintextHints(layers, units, home);
+  const fileOwners = /* @__PURE__ */ new Map();
+  const collisions = [];
+  for (const unit of units) {
+    for (const file of unit.files) {
+      const owner = fileOwners.get(file);
+      if (owner && owner !== unit.name) {
+        collisions.push(`file ${file} is shared by units "${owner}" and "${unit.name}"`);
+      }
+      if (!owner) fileOwners.set(file, unit.name);
+    }
+  }
+  for (const collision of collisions) {
+    if (!args.to || args.dryRun) console.warn(`[morphix-env] Warning: ${collision}; split them into separate files (or sources) before migrating.`);
+    else {
+      console.error(`[morphix-env] migrate: ${collision}; split them into separate files (or sources) before migrating.`);
+      return 1;
+    }
+  }
+  const selected = args.source ? units.filter((unit) => unit.name === args.source) : units;
+  if (args.source && !selected.length) {
+    console.error(`[morphix-env] migrate: no plaintext unit named "${args.source}" in scope (already migrated or unknown).`);
+    return 1;
+  }
+  if (!args.to || args.dryRun) {
+    printMigratePlan(selected, hints, args.to);
+    return 0;
+  }
+  if (!selected.length) {
+    console.log("[morphix-env] No plaintext units in scope; nothing to migrate.");
+    return 0;
+  }
+  const target = args.to;
+  const startedAt = Date.now();
+  const outcomes = [];
+  for (const unit of selected) {
+    const outcome = await executeUnit(unit, target, { service: args.service || void 0 }, home);
+    outcomes.push(outcome);
+    if (outcome.status === "migrated") {
+      console.log(`[morphix-env] Migrated ${unit.name} -> ${target} (${unit.keyNames.length} keys).`);
+      for (const warning of outcome.warnings) console.warn(warning);
+      for (const backup of outcome.backups) console.log(`[morphix-env] Backup (0600): ${backup}`);
+    } else if (outcome.status === "skipped") {
+      console.warn(`[morphix-env] Skipped ${unit.name}: ${outcome.detail}`);
+    } else {
+      console.error(`[morphix-env] Failed ${unit.name}: ${outcome.detail}`);
+      for (const backup of outcome.backups) console.error(`[morphix-env] Backup retained (0600): ${backup} \u2014 delete it by hand once verified.`);
+    }
+  }
+  const failed = outcomes.filter((outcome) => outcome.status === "failed");
+  const exitCode = failed.length ? 1 : 0;
+  writeAudit({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    profile: "migrate",
+    sources: selected.map((unit) => unit.name),
+    keys: [...new Set(selected.flatMap((unit) => unit.keyNames))].sort(),
+    outcome: failed.length ? "failure" : "success",
+    exitCode,
+    durationMs: Date.now() - startedAt
+  });
+  if (outcomes.some((outcome) => outcome.backups.length)) {
+    console.log("[morphix-env] Backups are 0600 copies of the original plaintext \u2014 delete them once your workflows are verified.");
+  }
+  return exitCode;
+}
 function cmdAudit(args) {
-  const file = (0, import_path10.join)((0, import_os7.homedir)(), ".mx-env", "audit", `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
-  if (!(0, import_fs10.existsSync)(file)) {
+  const file = (0, import_path11.join)((0, import_os8.homedir)(), ".mx-env", "audit", `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
+  if (!(0, import_fs11.existsSync)(file)) {
     console.log("[morphix-env] No audit events for today.");
     return 0;
   }
-  const lines = (0, import_fs10.readFileSync)(file, "utf8").trim().split("\n").filter(Boolean);
+  const lines = (0, import_fs11.readFileSync)(file, "utf8").trim().split("\n").filter(Boolean);
   const selected = args.subArgs[0] === "tail" ? lines.slice(-20) : lines;
   for (const line of selected) console.log(line);
   return 0;
@@ -38413,6 +38826,7 @@ Usage:
   mx-env inject <template> <output>       Resolve mx-env:// references into a file (mode 0600)
   mx-env generate [options]               Generate public __env.js
   mx-env inspect [options]                Print key names, sources, and status only
+  mx-env migrate [--to dotenvx|keychain]  Move plaintext local sources into encrypted storage
   mx-env doc [options]                    Generate a value-free project Skill
   mx-env audit [tail]                     Read value-free local audit events
   mx-env edit --profile <name>            Open the one-shot visual editor
@@ -38433,8 +38847,12 @@ Options:
   --no-infisical           Do not load Infisical sources
   --no-global              Ignore ~/.mx-env/.env and ~/.mx-env/config.json
   --allow-insecure-global  Allow a global .env with permissive file mode
+  --warn-plaintext         Warn once on stderr when plaintext local sources supply keys
   --print-editor-url       Explicitly print the one-time local editor URL
   --target <scope>         Skill install target: global, project, or trellis
+  --to <provider>          migrate destination: dotenvx or keychain (omit for a read-only plan)
+  --source <name>          edit/migrate: select a single source
+  --service <name>         migrate --to keychain: keychain service override (requires --source)
   --force                  Overwrite an installed skill that differs from this version
   -v, --verbose            Print source status and key counts only
   --help, -h               Show this help
@@ -38460,6 +38878,8 @@ async function main() {
       return cmdGenerate(args);
     case "inspect":
       return cmdInspect(args);
+    case "migrate":
+      return cmdMigrate(args);
     case "audit":
       return cmdAudit(args);
     case "edit":