@kici-dev/compiler 0.1.26 → 0.2.0

package/dist/commands/secrets-list.d.ts

@@ -5,8 +5,8 @@ export interface SecretsListOptions {
 /**
  * List test-available secret contexts through the Platform.
  *
- * Calls GET /api/v1/orgs/:orgId/environments?includeSecrets=true (relayed to
- * the org's orchestrator), filters to environments with
+ * Calls GET /api/v1/orgs/:orgId/contexts?includeSecrets=true (relayed to
+ * the org's orchestrator), filters to contexts with
  * allowLocalExecution=true, and displays a table of names, key names, and
  * flags. Values are never exposed -- only key names.
  */

package/dist/commands/secrets-list.js

@@ -6,17 +6,17 @@ import { toErrorMessage } from "@kici-dev/core";
 /**
 * List test-available secret contexts through the Platform.
 *
-* Calls GET /api/v1/orgs/:orgId/environments?includeSecrets=true (relayed to
-* the org's orchestrator), filters to environments with
+* Calls GET /api/v1/orgs/:orgId/contexts?includeSecrets=true (relayed to
+* the org's orchestrator), filters to contexts with
 * allowLocalExecution=true, and displays a table of names, key names, and
 * flags. Values are never exposed -- only key names.
 */
 async function secretsListCommand(_options = {}) {
 	try {
-		const contexts = (await (await DashboardClient.load()).listEnvironments(true)).filter((e) => e.allowLocalExecution);
+		const contexts = (await (await DashboardClient.load()).listContexts(true)).filter((e) => e.allowLocalExecution);
 		if (contexts.length === 0) {
 			console.log(pc.yellow("No test-available secret contexts found."));
-			console.log(pc.gray("Enable test runs (allowLocalExecution) on an environment to make its secrets available for test runs."));
+			console.log(pc.gray("Enable test runs (allowLocalExecution) on a context to make its secrets available for test runs."));
 			return true;
 		}
 		renderContextTable(contexts);

package/dist/commands/types.d.ts

@@ -5,11 +5,11 @@ export interface TypesOptions {
     quiet?: boolean;
 }
 /**
- * Generate TypeScript declarations for environment secrets.
+ * Generate TypeScript declarations for context secrets.
  *
- * Fetches environment metadata (with secret key names) through the Platform
+ * Fetches context metadata (with secret key names) through the Platform
  * and generates .kici/types/secrets.d.ts with module augmentation for
- * KnownSecretKeys and EnvironmentSecrets.
+ * KnownSecretKeys and ContextSecrets.
  *
  * @param options - Command options
  * @returns true on success, false on error

package/dist/commands/types.js

@@ -8,11 +8,11 @@ import fs from "node:fs/promises";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/commands/types.ts
 /**
-* Generate TypeScript declarations for environment secrets.
+* Generate TypeScript declarations for context secrets.
 *
-* Fetches environment metadata (with secret key names) through the Platform
+* Fetches context metadata (with secret key names) through the Platform
 * and generates .kici/types/secrets.d.ts with module augmentation for
-* KnownSecretKeys and EnvironmentSecrets.
+* KnownSecretKeys and ContextSecrets.
 *
 * @param options - Command options
 * @returns true on success, false on error
@@ -21,7 +21,7 @@ async function typesCommand(options = {}) {
 	try {
 		const config = await loadGlobalConfig();
 		const dtsContent = generateSecretsDts({
-			environments: (await DashboardClient.fromConfig(config).listEnvironments(true)).map((e) => ({
+			contexts: (await DashboardClient.fromConfig(config).listContexts(true)).map((e) => ({
 				name: e.name,
 				keys: e.secretKeys ?? []
 			})),

package/dist/commands/verify-attestation.d.ts

@@ -3,7 +3,9 @@ export interface VerifyAttestationOptions {
     bundle?: string;
     /**
      * Trusted issuer URL (online discovery) or a self-contained `{ issuer, jwks }`
-     * file. Optional — defaults to the hosted KiCI Platform's provenance issuer.
+     * file. Optional — defaults to the configured orchestrator, falling back to
+     * the hosted KiCI Platform's provenance issuer when no orchestrator is
+     * configured.
      */
     trustRoot?: string;
     /** Expected token audience (defaults to the KiCI provenance audience). */

package/dist/commands/verify-attestation.js

@@ -1,5 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { resolveTrustRoot } from "../provenance-trust-root.js";
+import { loadGlobalConfig } from "../remote/config.js";
 import "../remote/prod-defaults.js";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
@@ -16,10 +17,14 @@ import { verifyKiciBundle } from "@kici-dev/engine/provenance/verify";
 * `@kici-dev/engine`. The engine owns all crypto; this command is the thin Node
 * wrapper (fs / fetch / artifact digest / output).
 *
-* `--trust-root` is optional: when omitted it defaults to the hosted KiCI
-* Platform's provenance issuer, so the common case (verifying a bundle attested
-* on the hosted platform) needs no flag. Pass `--trust-root` to verify against a
-* different environment (e.g. staging) or an offline `{ issuer, jwks }` file.
+* `--trust-root` is optional: when omitted it defaults to the CONFIGURED
+* ORCHESTRATOR (its own `.well-known`), which now owns provenance signing — the
+* natural root of trust for a self-hosted customer. When no orchestrator is
+* configured it falls back to the hosted KiCI Platform's provenance issuer (for
+* historical Platform-signed bundles, which keep verifying forever). Pass
+* `--trust-root` to verify against a different environment or an offline
+* `{ issuer, jwks }` file (air-gap). The token `iss` is always pinned to the
+* trust root out-of-band — a bundle can never name its own trusted issuer.
 *
 * Returns a boolean (verified) so `cli.ts` can map it to an exit code (0/1).
 */
@@ -29,9 +34,14 @@ async function verifyAttestationCommand(artifact, options = {}) {
 			logger.error(pc.red("Error: --bundle <path|url> is required"));
 			return false;
 		}
-		const trustRoot = options.trustRoot ?? "https://api.kici.dev";
+		const configuredOrchestrator = (await loadGlobalConfig().catch(() => null))?.endpoint;
+		const trustRoot = options.trustRoot ?? configuredOrchestrator ?? "https://api.kici.dev";
 		const usingDefault = !options.trustRoot;
-		if (usingDefault) logger.info(pc.gray(`Using default trust root ${trustRoot} (pass --trust-root to override)`));
+		const usingConfiguredOrchestrator = usingDefault && !!configuredOrchestrator;
+		if (usingDefault) {
+			const which = usingConfiguredOrchestrator ? "configured orchestrator" : "hosted KiCI platform";
+			logger.info(pc.gray(`Using default trust root ${trustRoot} (${which}; pass --trust-root to override)`));
+		}
 		const bundle = JSON.parse(await readBundle(options.bundle));
 		let resolved;
 		try {
@@ -39,7 +49,8 @@ async function verifyAttestationCommand(artifact, options = {}) {
 		} catch (error) {
 			const msg = toErrorMessage(error);
 			if (usingDefault && /\b503\b/.test(msg)) {
-				logger.error(pc.red(`Error: build provenance is not enabled on the hosted KiCI platform yet (${trustRoot} returned 503). Pass --trust-root to verify against another environment (e.g. staging) or an offline { issuer, jwks } file.`));
+				const where = usingConfiguredOrchestrator ? `your configured orchestrator (${trustRoot})` : `the hosted KiCI platform (${trustRoot})`;
+				logger.error(pc.red(`Error: build provenance signing is not enabled on ${where} yet (returned 503). Pass --trust-root to verify against another environment or an offline { issuer, jwks } file.`));
 				return false;
 			}
 			throw error;

package/dist/errors/formatter.d.ts

@@ -1,5 +1,16 @@
-/** Error code string (e.g., 'E001', 'E102'). */
+/**
+ * Error code string. Thrown compile errors use `E<digits>` (e.g. 'E001', 'E102');
+ * advisory, render-only diagnostics use `W<digits>` (e.g. 'W101'). `isCompilerError`
+ * only matches the `E<digits>` family — warning codes are never thrown, only rendered.
+ */
 type ErrorCode = string;
+/** Diagnostic severity. Errors abort compilation; warnings are advisory (compile still succeeds). */
+export declare enum DiagnosticSeverity {
+    Error = "error",
+    Warning = "warning"
+}
+/** Warning code for the impure dynamic-value → init-job fallback. */
+export declare const PURITY_FALLBACK_CODE = "W101";
 /** Source location for error reporting */
 export interface SourceLocation {
     readonly file: string;
@@ -12,6 +23,7 @@ export interface CompilerError {
     readonly message: string;
     readonly location?: SourceLocation;
     readonly suggestion?: string;
+    readonly severity?: DiagnosticSeverity;
 }
 /**
  * Format error in GNU standard format: file:line:column: error [CODE]: message
@@ -25,6 +37,7 @@ export declare function formatError(error: CompilerError): string;
 export declare function compilerError(code: ErrorCode, message: string, options?: {
     location?: SourceLocation;
     suggestion?: string;
+    severity?: DiagnosticSeverity;
 }): CompilerError;
 /** Check if an error is a CompilerError (codes are E + digits, e.g. E001, E102) */
 export declare function isCompilerError(error: unknown): error is CompilerError;

package/dist/errors/formatter.js

@@ -1,6 +1,14 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 //#region src/errors/formatter.ts
+/** Diagnostic severity. Errors abort compilation; warnings are advisory (compile still succeeds). */
+let DiagnosticSeverity = /* @__PURE__ */ function(DiagnosticSeverity) {
+	DiagnosticSeverity["Error"] = "error";
+	DiagnosticSeverity["Warning"] = "warning";
+	return DiagnosticSeverity;
+}({});
+/** Warning code for the impure dynamic-value → init-job fallback. */
+const PURITY_FALLBACK_CODE = "W101";
 /**
 * Format error in GNU standard format: file:line:column: error [CODE]: message
 *
@@ -11,7 +19,8 @@ import pc from "picocolors";
 function formatError(error) {
 	const parts = [];
 	if (error.location) parts.push(pc.cyan(`${error.location.file}:${error.location.line}:${error.location.column}`));
-	parts.push(pc.red("error") + pc.gray(` [${error.code}]`) + ": " + error.message);
+	const label = error.severity === "warning" ? pc.yellow("warning") : pc.red("error");
+	parts.push(label + pc.gray(` [${error.code}]`) + ": " + error.message);
 	let output = parts.join(" ");
 	if (error.suggestion) output += "\n  " + pc.dim(`Suggestion: ${error.suggestion}`);
 	return output;
@@ -22,7 +31,8 @@ function compilerError(code, message, options) {
 		code,
 		message,
 		location: options?.location,
-		suggestion: options?.suggestion
+		suggestion: options?.suggestion,
+		severity: options?.severity
 	};
 }
 /** Check if an error is a CompilerError (codes are E + digits, e.g. E001, E102) */
@@ -30,6 +40,6 @@ function isCompilerError(error) {
 	return typeof error === "object" && error !== null && "code" in error && "message" in error && typeof error.code === "string" && /^E\d+$/.test(error.code);
 }
 //#endregion
-export { compilerError, formatError, isCompilerError };
+export { DiagnosticSeverity, PURITY_FALLBACK_CODE, compilerError, formatError, isCompilerError };
 
 //# sourceMappingURL=formatter.js.map

package/dist/errors/index.d.ts

@@ -1,5 +1,6 @@
-export { formatError, compilerError, isCompilerError } from './formatter.js';
+export { formatError, compilerError, isCompilerError, DiagnosticSeverity, PURITY_FALLBACK_CODE, } from './formatter.js';
 export type { SourceLocation, CompilerError } from './formatter.js';
 export { CapabilityGapError, formatCapabilityGapError } from './capability-gap.js';
 export type { CapabilityGapInfo } from './capability-gap.js';
+export { firstStepLocation, locationForJob, locationForWorkflow } from './source-location.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/errors/index.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
-import { compilerError, formatError, isCompilerError } from "./formatter.js";
+import { DiagnosticSeverity, PURITY_FALLBACK_CODE, compilerError, formatError, isCompilerError } from "./formatter.js";
 import { CapabilityGapError, formatCapabilityGapError } from "./capability-gap.js";
-export { CapabilityGapError, compilerError, formatCapabilityGapError, formatError, isCompilerError };
+import { firstStepLocation, locationForJob, locationForWorkflow } from "./source-location.js";
+export { CapabilityGapError, DiagnosticSeverity, PURITY_FALLBACK_CODE, compilerError, firstStepLocation, formatCapabilityGapError, formatError, isCompilerError, locationForJob, locationForWorkflow };

package/dist/errors/source-location.d.ts

@@ -0,0 +1,20 @@
+import type { Job } from '@kici-dev/sdk';
+import type { SourceLocation } from './formatter.js';
+/**
+ * First step (walking one level into parallel groups) that carries a captured
+ * `_sourceLocation`. `step()` records a precise V8 call-site; bare functions and
+ * parallel-group wrappers do not, so this returns the first real anchor found.
+ */
+export declare function firstStepLocation(job: Job): SourceLocation | undefined;
+/**
+ * Best available location for a job-scoped error: its first step's captured
+ * location when a step exists, else the workflow source file at line 1
+ * (`job()` itself captures no call-site).
+ */
+export declare function locationForJob(job: Job, workflowFile: string): SourceLocation;
+/**
+ * Location for a workflow-scoped error: `workflow()` captures no call-site, so
+ * the best anchor is the workflow's source file at line 1.
+ */
+export declare function locationForWorkflow(file: string): SourceLocation;
+//# sourceMappingURL=source-location.d.ts.map

package/dist/errors/source-location.js

@@ -0,0 +1,45 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/errors/source-location.ts
+/**
+* First step (walking one level into parallel groups) that carries a captured
+* `_sourceLocation`. `step()` records a precise V8 call-site; bare functions and
+* parallel-group wrappers do not, so this returns the first real anchor found.
+*/
+function firstStepLocation(job) {
+	for (const entry of job.steps ?? []) {
+		const stepLike = entry;
+		if (stepLike._sourceLocation) return stepLike._sourceLocation;
+		const group = entry;
+		if (Array.isArray(group.steps)) {
+			const inner = group.steps.find((c) => c._sourceLocation)?._sourceLocation;
+			if (inner) return inner;
+		}
+	}
+}
+/**
+* Best available location for a job-scoped error: its first step's captured
+* location when a step exists, else the workflow source file at line 1
+* (`job()` itself captures no call-site).
+*/
+function locationForJob(job, workflowFile) {
+	return firstStepLocation(job) ?? {
+		file: workflowFile,
+		line: 1,
+		column: 1
+	};
+}
+/**
+* Location for a workflow-scoped error: `workflow()` captures no call-site, so
+* the best anchor is the workflow's source file at line 1.
+*/
+function locationForWorkflow(file) {
+	return {
+		file,
+		line: 1,
+		column: 1
+	};
+}
+//#endregion
+export { firstStepLocation, locationForJob, locationForWorkflow };
+
+//# sourceMappingURL=source-location.js.map

package/dist/execution/executor.js

@@ -5,9 +5,33 @@ import { ensureTsLoaderHook } from "./ts-loader.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
 import { existsSync } from "node:fs";
-import fs from "node:fs/promises";
+import fs$1 from "node:fs/promises";
 //#region src/execution/executor.ts
 /**
+* Map a caught runtime error's stack to a `SourceLocation` in the entry file.
+* Scans for the first stack frame referencing `entryPoint` (ignoring the
+* `?t=` cache-buster and the `file://` scheme) and returns its line/column;
+* falls back to `entryPoint` at line 1 when no frame matches.
+*/
+function locateInEntry(stack, entryPoint) {
+	const fallback = {
+		file: entryPoint,
+		line: 1,
+		column: 1
+	};
+	if (!stack) return fallback;
+	const needle = entryPoint.split("?")[0];
+	for (const raw of stack.split("\n")) {
+		const m = raw.match(/(.+?):(\d+):(\d+)\)?$/);
+		if (m && m[1].includes(needle)) return {
+			file: entryPoint,
+			line: parseInt(m[2], 10),
+			column: parseInt(m[3], 10)
+		};
+	}
+	return fallback;
+}
+/**
 * Load a TypeScript workflow/config module by direct dynamic import.
 *
 * Relies on the `@kici-dev/core/ts-loader-hook` ESM loader hook, registered
@@ -23,7 +47,7 @@ import fs from "node:fs/promises";
 async function loadModule(entryPoint, errorContext) {
 	let hashBundleSource;
 	try {
-		hashBundleSource = await fs.readFile(entryPoint, "utf-8");
+		hashBundleSource = await fs$1.readFile(entryPoint, "utf-8");
 	} catch {}
 	try {
 		ensureTsLoaderHook();
@@ -34,11 +58,7 @@ async function loadModule(entryPoint, errorContext) {
 	} catch (err) {
 		const message = err.message ?? "Failed to load module";
 		throw compilerError("E003", `Failed to load ${errorContext.fileLabel} module: ${message}`, {
-			location: {
-				file: errorContext.filePath,
-				line: 1,
-				column: 1
-			},
+			location: locateInEntry(err.stack, errorContext.filePath),
 			suggestion: `Check for TypeScript or runtime errors in your ${errorContext.fileLabel}. Make sure you invoke the workflow via the kici CLI (the bin shim registers the oxc-transform loader hook that handles TS files).`
 		});
 	}
@@ -60,12 +80,12 @@ async function loadModule(entryPoint, errorContext) {
 async function executeConfig(configPath) {
 	const absolutePath = path.resolve(configPath);
 	try {
-		await fs.access(absolutePath);
+		await fs$1.access(absolutePath);
 	} catch {
 		throw compilerError("E001", `Config file not found: ${absolutePath}`, { suggestion: "Ensure workflow files exist in .kici/workflows/" });
 	}
 	try {
-		await fs.readFile(absolutePath, "utf-8");
+		await fs$1.readFile(absolutePath, "utf-8");
 	} catch {
 		throw compilerError("E001", `Failed to read config file: ${absolutePath}`, { suggestion: "Check file permissions" });
 	}
@@ -180,14 +200,14 @@ async function discoverWorkflows(kiciDir) {
 	const absoluteKiciDir = resolveKiciDir(kiciDir);
 	const workflowDir = path.join(absoluteKiciDir, "workflows");
 	try {
-		if (!(await fs.stat(workflowDir)).isDirectory()) throw compilerError("E001", `.kici/workflows/ is not a directory: ${workflowDir}`, { suggestion: "Run \"kici init\" to create the .kici/workflows/ directory" });
+		if (!(await fs$1.stat(workflowDir)).isDirectory()) throw compilerError("E001", `.kici/workflows/ is not a directory: ${workflowDir}`, { suggestion: "Run \"kici init\" to create the .kici/workflows/ directory" });
 	} catch (err) {
 		if (err.code === "ENOENT") throw compilerError("E001", `.kici/workflows/ directory not found: ${workflowDir}`, { suggestion: "Run \"kici init\" to create the .kici/workflows/ directory" });
 		throw err;
 	}
 	let files;
 	try {
-		files = (await fs.readdir(workflowDir, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => path.join(workflowDir, entry.name));
+		files = (await fs$1.readdir(workflowDir, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => path.join(workflowDir, entry.name));
 	} catch {
 		throw compilerError("E001", `Failed to read .kici/workflows/ directory: ${workflowDir}`, { suggestion: "Check directory permissions" });
 	}
@@ -213,7 +233,7 @@ async function discoverWorkflows(kiciDir) {
 */
 async function executeWorkflowFile(filePath) {
 	try {
-		await fs.access(filePath);
+		await fs$1.access(filePath);
 	} catch {
 		throw compilerError("E001", `Failed to read workflow file: ${filePath}`, { suggestion: "Check file permissions" });
 	}

package/dist/fixtures/defaults/index.js

@@ -86,7 +86,8 @@ const FIXTURES = {
 * @throws Error if event is unknown
 */
 function getDefaultFixture(event) {
-	const fixture = FIXTURES[event.toLowerCase().trim()];
+	const normalized = event.toLowerCase().trim();
+	const fixture = FIXTURES[normalized];
 	if (!fixture) {
 		const available = Object.keys(FIXTURES).filter((k, i, arr) => arr.indexOf(k) === i).join(", ");
 		throw new Error(`Unknown event type: ${event}\nAvailable events: ${available}`);

package/dist/generators/secrets-dts.d.ts

@@ -1,27 +1,27 @@
 /**
- * .d.ts generator for environment secret type augmentation.
+ * .d.ts generator for context secret type augmentation.
  *
  * Produces a TypeScript declaration file that augments @kici-dev/sdk's
- * KnownSecretKeys and EnvironmentSecrets interfaces, enabling compile-time
+ * KnownSecretKeys and ContextSecrets interfaces, enabling compile-time
  * autocomplete and type checking for `ctx.secrets.get()` and `ctx.secrets.expose()`
- * key names per environment.
+ * key names per context.
  */
-export interface EnvironmentMetadata {
+export interface ContextMetadata {
     name: string;
     keys: string[];
 }
 interface GenerateSecretsDtsOptions {
-    environments: EnvironmentMetadata[];
+    contexts: ContextMetadata[];
     endpoint: string;
     generatedAt: Date;
 }
 /**
- * Generate a .d.ts string from environment metadata.
+ * Generate a .d.ts string from context metadata.
  *
- * The output augments @kici-dev/sdk's KnownSecretKeys and EnvironmentSecrets
- * interfaces, enabling compile-time autocomplete for secret keys per environment.
+ * The output augments @kici-dev/sdk's KnownSecretKeys and ContextSecrets
+ * interfaces, enabling compile-time autocomplete for secret keys per context.
  *
- * @param options - Environment metadata, endpoint URL, and generation timestamp
+ * @param options - Context metadata, endpoint URL, and generation timestamp
  * @returns The .d.ts file content as a string
  */
 export declare function generateSecretsDts(options: GenerateSecretsDtsOptions): string;

package/dist/generators/secrets-dts.js

@@ -13,11 +13,11 @@ function formatProperty(name) {
 	return isValidIdentifier(name) ? name : `'${escapeQuotes(name)}'`;
 }
 /**
-* Build a map of key -> list of environment names that provide it.
+* Build a map of key -> list of context names that provide it.
 */
-function buildKeySourceMap(environments) {
+function buildKeySourceMap(contexts) {
 	const map = /* @__PURE__ */ new Map();
-	for (const env of environments) for (const key of env.keys) {
+	for (const env of contexts) for (const key of env.keys) {
 		const sources = map.get(key);
 		if (sources) sources.push(env.name);
 		else map.set(key, [env.name]);
@@ -25,16 +25,16 @@ function buildKeySourceMap(environments) {
 	return map;
 }
 /**
-* Generate a .d.ts string from environment metadata.
+* Generate a .d.ts string from context metadata.
 *
-* The output augments @kici-dev/sdk's KnownSecretKeys and EnvironmentSecrets
-* interfaces, enabling compile-time autocomplete for secret keys per environment.
+* The output augments @kici-dev/sdk's KnownSecretKeys and ContextSecrets
+* interfaces, enabling compile-time autocomplete for secret keys per context.
 *
-* @param options - Environment metadata, endpoint URL, and generation timestamp
+* @param options - Context metadata, endpoint URL, and generation timestamp
 * @returns The .d.ts file content as a string
 */
 function generateSecretsDts(options) {
-	const { environments, endpoint, generatedAt } = options;
+	const { contexts, endpoint, generatedAt } = options;
 	const lines = [];
 	lines.push("// @generated by kici types -- DO NOT EDIT");
 	lines.push(`// Source: ${endpoint}`);
@@ -42,16 +42,16 @@ function generateSecretsDts(options) {
 	lines.push("// Run `kici types` to refresh");
 	lines.push("");
 	lines.push("declare module '@kici-dev/sdk' {");
-	const keySourceMap = buildKeySourceMap(environments);
+	const keySourceMap = buildKeySourceMap(contexts);
 	lines.push("  interface KnownSecretKeys {");
 	for (const [key, sources] of keySourceMap) {
-		lines.push(`    /** From environment: ${sources.join(", ")} */`);
+		lines.push(`    /** From context: ${sources.join(", ")} */`);
 		lines.push(`    ${formatProperty(key)}: string;`);
 	}
 	lines.push("  }");
 	lines.push("");
-	lines.push("  interface EnvironmentSecrets {");
-	for (const env of environments) if (env.keys.length === 0) lines.push(`    ${formatProperty(env.name)}: never;`);
+	lines.push("  interface ContextSecrets {");
+	for (const env of contexts) if (env.keys.length === 0) lines.push(`    ${formatProperty(env.name)}: never;`);
 	else {
 		const keyUnion = env.keys.map((k) => `'${escapeQuotes(k)}'`).join(" | ");
 		lines.push(`    ${formatProperty(env.name)}: ${keyUnion};`);