@penvhq/cli 0.13.0 → 0.15.0

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   planInstall,
   renderInstallPlan,
   startChild
-} from "./chunk-OBIHFXCK.js";
+} from "./chunk-4RR6UFVZ.js";
 
 // src/index.ts
 import { setKeychain } from "@penvhq/core";
@@ -37,6 +37,7 @@ import { dirname, join as join2 } from "path";
 import {
   assertMigrated,
   candidatesFor,
+  environmentEntry as environmentEntry2,
   formatValueFile,
   isCanonicalSegment,
   isReservedToken,
@@ -55,24 +56,12 @@ import {
 import { FilesystemProvider } from "@penvhq/provider-filesystem";
 
 // src/env-flags.ts
-import { PenvError } from "@penvhq/core";
+import { environmentNames, PenvError } from "@penvhq/core";
 var BASE_RESERVED = ["help", "version", "h", "v", "_", "--"];
-var COMMAND_FLAGS = [
-  ...BASE_RESERVED,
-  "env",
-  "out",
-  "allow-decrypt",
-  "destination",
-  "dest",
-  "d",
-  "location",
-  "l",
-  "yes",
-  "y"
-];
+var COMMAND_FLAGS = [...BASE_RESERVED, "env", "out", "allow-decrypt", "yes", "y"];
 function shadowedEnvironments(config) {
   const flags = new Set(COMMAND_FLAGS);
-  return config.environments.filter((environment) => flags.has(environment));
+  return environmentNames(config).filter((environment) => flags.has(environment));
 }
 function shorthandCandidates(args, declared) {
   const reserved = /* @__PURE__ */ new Set([...BASE_RESERVED, ...declared]);
@@ -85,13 +74,14 @@ function environmentFromShorthand(config, candidates, explicit) {
   if (candidates.length === 0) {
     return void 0;
   }
-  const hits = candidates.filter((candidate) => config.environments.includes(candidate));
-  const strangers = candidates.filter((candidate) => !config.environments.includes(candidate));
+  const declared = environmentNames(config);
+  const hits = candidates.filter((candidate) => declared.includes(candidate));
+  const strangers = candidates.filter((candidate) => !declared.includes(candidate));
   if (strangers.length > 0) {
     throw new PenvError(
       "UNKNOWN_FLAG",
       `${quoteList(strangers)} ${strangers.length === 1 ? "is not a flag" : "are not flags"} this command takes, and ${strangers.length === 1 ? "names" : "name"} no declared environment`,
-      `Declared environments work as bare flags: ${quoteList(config.environments)}. Anything else needs \`--env <name>\`.`
+      `Declared environments work as bare flags: ${quoteList(declared)}. Anything else needs \`--env <name>\`.`
     );
   }
   if (hits.length > 1) {
@@ -118,6 +108,8 @@ import { createRequire } from "module";
 import { join, resolve } from "path";
 import { pathToFileURL } from "url";
 import {
+  environmentEntry,
+  environmentNames as environmentNames2,
   holdsProjection,
   LOCAL_EXTENSIONS_PATH,
   localExtensionsFile,
@@ -129,6 +121,7 @@ import {
   parseLocalExtensions,
   parseManifest,
   penvHome,
+  providerMissing,
   recordsDir
 } from "@penvhq/core";
 import { createFilesystemProvider } from "@penvhq/provider-filesystem";
@@ -195,14 +188,18 @@ async function loadPluginProvider(type, context) {
 function assertProvidersRegistered(config, projectRoot, options) {
   const local = localExtensions(projectRoot);
   const ci = options?.ci ?? isCi(process.env.CI);
-  for (const [environment, provider] of Object.entries(config.providers)) {
-    if (isProviderRegistered(provider.type)) {
+  for (const environment of environmentNames2(config)) {
+    const provider = environmentEntry(config, environment)?.provider;
+    if (typeof provider !== "string" || provider.trim().length === 0) {
+      throw providerMissing(environment);
+    }
+    if (isProviderRegistered(provider)) {
       continue;
     }
-    if (ci && local.includes(provider.type)) {
-      throw localExtensionInCi(provider.type, environment);
+    if (ci && local.includes(provider)) {
+      throw localExtensionInCi(provider, environment);
     }
-    resolveExtension(provider.type, projectRoot, environment, local);
+    resolveExtension(provider, projectRoot, environment, local);
   }
 }
 function resolveExtension(type, projectRoot, environment, local = localExtensions(projectRoot)) {
@@ -360,11 +357,11 @@ function schemaShapeFileOf(project) {
   return selfContainedSchemaModule(project.root, schemaFile) ?? SCHEMA_SHAPE_FILE;
 }
 async function sourceProviderFor(project, environment) {
-  const providerConfig = project.config.providers[environment];
+  const providerConfig = environmentEntry2(project.config, environment);
   if (providerConfig === void 0) {
     return createProvider(LOCAL_TREE_TYPE, { root: project.root, config: project.config });
   }
-  return createSourceProvider(providerConfig.type, {
+  return createSourceProvider(providerConfig.provider, {
     root: project.root,
     config: project.config,
     providerConfig,
@@ -376,7 +373,7 @@ function targetEnvironment(project, explicit, shorthand) {
   return resolveEnvironment(project.config, explicit ?? fromFlags);
 }
 var KEY_SEPARATOR = /[./\\]/;
-var NO_ENVIRONMENTS = { environments: [], providers: {} };
+var NO_ENVIRONMENTS = { environments: {} };
 function refFromKey(key, config) {
   const segments = key.split(KEY_SEPARATOR).filter((segment) => segment.length > 0);
   const name = segments[segments.length - 1];
@@ -624,6 +621,8 @@ import { basename, dirname as dirname2, join as join3, resolve as resolve2 } fro
 import {
   ARTIFACT_BUILD_COMMAND,
   assertArtifactFor,
+  environmentEntry as environmentEntry3,
+  environmentNames as environmentNames4,
   isPublicVariable,
   isSecret,
   keySourceFrom,
@@ -648,7 +647,7 @@ import { defineCommand as defineCommand3 } from "citty";
 
 // src/dotenv-files.ts
 import { readdirSync } from "fs";
-import { isLegalEnvironmentName, RESERVED_TOKENS } from "@penvhq/core";
+import { environmentNames as environmentNames3, isLegalEnvironmentName, RESERVED_TOKENS } from "@penvhq/core";
 var SHARED = ".env";
 var LOCAL = "local";
 var NOT_ENVIRONMENTS = [
@@ -721,8 +720,9 @@ function discoverDotenvFiles(root) {
   return files.sort((a, b) => order(a) < order(b) ? -1 : order(a) > order(b) ? 1 : 0);
 }
 function activeDotenvFiles(root, config) {
+  const declared = environmentNames3(config);
   return discoverDotenvFiles(root).filter(
-    (file) => file.environment === void 0 || config.environments.includes(file.environment)
+    (file) => file.environment === void 0 || declared.includes(file.environment)
   );
 }
 function environmentsDeclaredBy(files) {
@@ -1480,11 +1480,12 @@ function packageManifest(specifier, root) {
 }
 function declaredCredentials(config, root) {
   const declared = {};
-  for (const provider of Object.values(config.providers)) {
-    if (own(declared, provider.type) !== void 0) {
+  for (const environment of environmentNames4(config)) {
+    const provider = environmentEntry3(config, environment)?.provider;
+    if (provider === void 0 || own(declared, provider) !== void 0) {
       continue;
     }
-    const penv = packageManifest(provider.type, root)?.penv;
+    const penv = packageManifest(provider, root)?.penv;
     const credentials = isPlainObject(penv) ? penv.credentials : void 0;
     if (credentials === void 0) {
       continue;
@@ -1492,11 +1493,11 @@ function declaredCredentials(config, root) {
     if (!Array.isArray(credentials) || credentials.some((name) => typeof name !== "string" || !VARIABLE.test(name))) {
       throw new PenvError5(
         "PROVIDER_CREDENTIALS_INVALID",
-        `\`${provider.type}\` declares \`penv.credentials\`, and it is not a list of variable names`,
+        `\`${provider}\` declares \`penv.credentials\`, and it is not a list of variable names`,
         `Its package.json should read \`"penv": { "credentials": ["ACME_TOKEN"] }\` \u2014 penv strips exactly what an extension declares, so it will not guess at a declaration it cannot read.`
       );
     }
-    declared[provider.type] = credentials;
+    declared[provider] = credentials;
   }
   return declared;
 }
@@ -2155,6 +2156,7 @@ import {
   accessPath as accessPath3,
   assertNever,
   effectiveMeta,
+  environmentEntry as environmentEntry5,
   formatValueFile as formatValueFile3,
   holdsProjection as holdsProjection4,
   holdsRecords,
@@ -2174,6 +2176,7 @@ import { defineCommand as defineCommand7 } from "citty";
 // src/commands/push.ts
 import {
   checkNameCollisions as checkNameCollisions2,
+  environmentEntry as environmentEntry4,
   holdsProjection as holdsProjection3,
   PenvError as PenvError8,
   recordPath,
@@ -2227,38 +2230,23 @@ function lineReader(input = process.stdin, output = process.stdout) {
 // src/commands/push.ts
 var LAST_PUSHED_KEY = "lastPushedAt";
 async function destinationFor(project, environment, options) {
-  if (options.destination !== void 0) {
-    const providerConfig = {
-      type: options.destination,
-      ...options.location === void 0 ? {} : { location: options.location }
-    };
-    const provider2 = options.provider ?? await createSourceProvider(options.destination, {
-      root: project.root,
-      config: project.config,
-      providerConfig,
-      environment
-    });
-    return { provider: provider2, location: options.location };
-  }
-  const declared = project.config.providers[environment];
-  const location = declared?.location;
-  if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
+  const declared = environmentEntry4(project.config, environment);
+  if (declared === void 0 || declared.provider === LOCAL_TREE_TYPE) {
     throw new PenvError8(
       "NO_DESTINATION",
       `Environment ${environment}'s provider is the local records tree itself, so penv has nowhere to push`,
-      `Declare a provider for it in penv.config.ts \u2014 e.g. \`${environment}: { type: "@penvhq/provider-github", location: "owner/repo" }\` \u2014 or push somewhere once with \`penv push --env ${environment} --destination <package> --location <place>\`.`
+      `Declare the backend that holds it in penv.config.ts \u2014 e.g. \`${environment}: { provider: "@penvhq/provider-github", repository: "owner/repo" }\` \u2014 and run this again. A push only ever goes where the config says this environment lives.`
     );
   }
   if (options.provider !== void 0) {
-    return { provider: options.provider, location };
+    return options.provider;
   }
-  const provider = await createSourceProvider(declared.type, {
+  return createSourceProvider(declared.provider, {
     root: project.root,
     config: project.config,
     providerConfig: declared,
     environment
   });
-  return { provider, location };
 }
 function plan(resolutions, config, environment, allowDecrypt) {
   const outbound = [];
@@ -2342,7 +2330,7 @@ async function ensureTargetApproved(provider, environment, options) {
   await provider.ensureTarget(environment);
   return true;
 }
-async function pushProjection(project, provider, environment, location, options) {
+async function pushProjection(project, provider, environment, options) {
   const tree = localTree(project);
   const keys = keySourceFor(project, environment);
   const resolutions = resolveAllSync(tree, environment, keys, true);
@@ -2373,7 +2361,6 @@ async function pushProjection(project, provider, environment, location, options)
     environment,
     destination: provider.type,
     mode: "projection",
-    location,
     pushed: outbound.length,
     meta: 0,
     repositorySecrets,
@@ -2389,7 +2376,7 @@ function crossesToRecords(file, environment) {
   }
   return scope.kind === "environment" && scope.environment === environment;
 }
-async function pushRecords(project, provider, environment, location) {
+async function pushRecords(project, provider, environment) {
   const tree = localTree(project);
   const files = tree.listSync().filter((file) => crossesToRecords(file, environment));
   let pushed = 0;
@@ -2415,7 +2402,6 @@ async function pushRecords(project, provider, environment, location) {
     environment,
     destination: provider.type,
     mode: "records",
-    location,
     pushed,
     meta,
     repositorySecrets: 0,
@@ -2427,11 +2413,11 @@ async function pushRecords(project, provider, environment, location) {
 async function runPush(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment, options.envFlags);
-  const { provider, location } = await destinationFor(project, environment, options);
+  const provider = await destinationFor(project, environment, options);
   if (holdsProjection3(provider)) {
-    return pushProjection(project, provider, environment, location, options);
+    return pushProjection(project, provider, environment, options);
   }
-  return pushRecords(project, provider, environment, location);
+  return pushRecords(project, provider, environment);
 }
 function renderPush(result2) {
   if (result2.pushed === 0 && result2.meta === 0) {
@@ -2443,7 +2429,7 @@ function renderPush(result2) {
       }
     ]);
   }
-  const target = `${result2.destination} for environment ${result2.environment}${result2.location === void 0 ? "" : ` (${result2.location})`}`;
+  const target = `${result2.destination} for environment ${result2.environment}`;
   if (result2.mode === "records") {
     return formatRows([
       {
@@ -2492,6 +2478,19 @@ function renderPush(result2) {
   }
   return formatRows(rows);
 }
+var REDIRECT_FLAGS = ["destination", "dest", "d", "location", "l"];
+function assertNoRedirect(args) {
+  const given = REDIRECT_FLAGS.filter((flag) => args[flag] !== void 0);
+  const named = given[0];
+  if (named === void 0) {
+    return;
+  }
+  throw new PenvError8(
+    "REMOVED_FLAG",
+    `\`--${named}\` is not a flag \`penv push\` takes`,
+    "A push only ever goes where the config says this environment lives. Declare the destination in `environments.<env>` \u2014 the provider package, addressed in that provider's own words \u2014 and push with `--env <name>`."
+  );
+}
 var pushCommand = defineCommand6({
   meta: {
     name: "push",
@@ -2503,16 +2502,6 @@ var pushCommand = defineCommand6({
       type: "boolean",
       description: "Decrypt sealed values locally and push them as plaintext for the destination to re-seal"
     },
-    destination: {
-      type: "string",
-      alias: ["dest", "d"],
-      description: "Push once to this provider package instead of the declared one"
-    },
-    location: {
-      type: "string",
-      alias: "l",
-      description: "The destination-side place, when --destination needs one"
-    },
     yes: {
       type: "boolean",
       alias: "y",
@@ -2521,25 +2510,13 @@ var pushCommand = defineCommand6({
   },
   run({ args }) {
     return guard(async () => {
+      assertNoRedirect(args);
       const result2 = await runPush({
         cwd: process.cwd(),
         ...args.env === void 0 ? {} : { environment: args.env },
         ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] },
-        ...args.destination === void 0 ? {} : { destination: args.destination },
-        ...args.location === void 0 ? {} : { location: args.location },
         ...args.yes === void 0 ? {} : { yes: args.yes },
-        envFlags: shorthandCandidates(args, [
-          "env",
-          "allow-decrypt",
-          "allowDecrypt",
-          "destination",
-          "dest",
-          "d",
-          "location",
-          "l",
-          "yes",
-          "y"
-        ])
+        envFlags: shorthandCandidates(args, ["env", "allow-decrypt", "allowDecrypt", "yes", "y"])
       });
       write(renderPush(result2));
     });
@@ -2638,7 +2615,7 @@ async function runDoctor(options) {
     check: "provider",
     severity: "pass",
     label: "Provider",
-    subject: project.config.providers[environment]?.type ?? project.provider.type
+    subject: environmentEntry5(project.config, environment)?.provider ?? project.provider.type
   });
   return {
     environment,
@@ -2908,8 +2885,8 @@ async function projectionFindings(project, environment, override) {
   if (override !== void 0) {
     projection = override;
   } else {
-    const declared = project.config.providers[environment];
-    if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
+    const declared = environmentEntry5(project.config, environment);
+    if (declared === void 0 || declared.provider === LOCAL_TREE_TYPE) {
       return [];
     }
     let source;
@@ -2921,7 +2898,7 @@ async function projectionFindings(project, environment, override) {
           check: "projection-unreachable",
           severity: "unknown",
           label: "Destination",
-          subject: `could not build the ${declared.type} provider for ${environment}`,
+          subject: `could not build the ${declared.provider} provider for ${environment}`,
           detail: errorDetail(error)
         }
       ];
@@ -3194,8 +3171,8 @@ function refPathOf(ref) {
   return [...ref.namespace, ref.name].join("/");
 }
 async function rotationSubjects(project, environment, local, override) {
-  const providerConfig = project.config.providers[environment];
-  if (override === void 0 && (providerConfig === void 0 || providerConfig.type === LOCAL_TREE_TYPE)) {
+  const providerConfig = environmentEntry5(project.config, environment);
+  if (override === void 0 && (providerConfig === void 0 || providerConfig.provider === LOCAL_TREE_TYPE)) {
     return { kind: "read", subjects: local };
   }
   const source = override ?? await sourceProviderFor(project, environment);
@@ -3217,7 +3194,7 @@ async function rotationSubjects(project, environment, local, override) {
         check: "rotation-overdue",
         severity: "unknown",
         label: "Rotation",
-        subject: `could not reach the ${providerConfig?.type ?? source.type} source of truth for ${environment}`,
+        subject: `could not reach the ${providerConfig?.provider ?? source.type} source of truth for ${environment}`,
         detail: errorDetail(error)
       }
     };
@@ -3338,8 +3315,8 @@ async function readRelevant(provider, environment) {
   return entries;
 }
 async function providerDriftFindings(project, environment, override) {
-  const providerConfig = project.config.providers[environment];
-  if (providerConfig === void 0 || providerConfig.type === LOCAL_TREE_TYPE) {
+  const providerConfig = environmentEntry5(project.config, environment);
+  if (providerConfig === void 0 || providerConfig.provider === LOCAL_TREE_TYPE) {
     return [
       {
         check: "provider-value-drift",
@@ -3364,7 +3341,7 @@ async function providerDriftFindings(project, environment, override) {
         check: "provider-value-drift",
         severity: "unknown",
         label: "Provider values",
-        subject: `could not reach the ${providerConfig.type} provider for ${environment}`,
+        subject: `could not reach the ${providerConfig.provider} provider for ${environment}`,
         detail: errorDetail(error)
       }
     ];
@@ -3383,7 +3360,7 @@ async function providerDriftFindings(project, environment, override) {
           severity: "unknown",
           label: "Provider value unreadable",
           subject: formatValueFile3(here.file),
-          detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.type} source of truth`
+          detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.provider} source of truth`
         });
         continue;
       }
@@ -3393,7 +3370,7 @@ async function providerDriftFindings(project, environment, override) {
           severity: "failure",
           label: "Provider value drift",
           subject: formatValueFile3(here.file),
-          detail: `the local tree and the ${providerConfig.type} source of truth hold different values`
+          detail: `the local tree and the ${providerConfig.provider} source of truth hold different values`
         });
       }
       continue;
@@ -3407,7 +3384,7 @@ async function providerDriftFindings(project, environment, override) {
       severity: "warning",
       label: here !== void 0 ? "Only in the local tree" : "Only in the source",
       subject: formatValueFile3(present.file),
-      detail: here !== void 0 ? `present locally, absent from the ${providerConfig.type} source of truth` : `present in the ${providerConfig.type} source of truth, absent from the local tree`
+      detail: here !== void 0 ? `present locally, absent from the ${providerConfig.provider} source of truth` : `present in the ${providerConfig.provider} source of truth, absent from the local tree`
     });
   }
   if (findings.length > 0) {
@@ -3418,7 +3395,7 @@ async function providerDriftFindings(project, environment, override) {
       check: "provider-value-drift",
       severity: "pass",
       label: "Provider values",
-      subject: `every value matches the ${providerConfig.type} source of truth for ${environment}`
+      subject: `every value matches the ${providerConfig.provider} source of truth for ${environment}`
     }
   ];
 }
@@ -3506,6 +3483,7 @@ import { defineCommand as defineCommand9 } from "citty";
 
 // src/commands/set.ts
 import {
+  environmentNames as environmentNames5,
   formatValueFile as formatValueFile4,
   isSecret as isSecret4,
   PenvError as PenvError9,
@@ -3535,7 +3513,7 @@ function targetScope(project, options, key) {
     throw new PenvError9(
       "ENVIRONMENT_FLAG_EMPTY",
       `\`--env\` for parameter ${key} names no environment`,
-      `Pass a declared environment \u2014 ${project.config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
+      `Pass a declared environment \u2014 ${environmentNames5(project.config).map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
     );
   }
   return scopeFrom({ ...options, environment: targetEnvironment(project, environment) });
@@ -3548,7 +3526,7 @@ function sealFor(project, file, value, parameter, environment) {
     throw new PenvError9(
       "SECRET_SCOPE_AMBIGUOUS",
       `Parameter ${parameter} is a secret, and ${recordPath2(formatValueFile4(file))} names no environment`,
-      "Keys are declared per environment in the `keys` block of penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
+      "A key is declared by its environment's `keySource` in penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
     );
   }
   return sealValue(file, value, keySourceFor(project, environment), parameter, environment);
@@ -4127,6 +4105,7 @@ import { copyFileSync, existsSync as existsSync7, readFileSync as readFileSync9
 import { basename as basename2, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve7 } from "path";
 import {
   assertNever as assertNever2,
+  environmentNames as environmentNames7,
   FilenameGrammarError,
   findConfigFile as findConfigFile2,
   loadConfigFrom as loadConfigFrom2,
@@ -4383,6 +4362,7 @@ import { createInterface as createInterface2 } from "readline/promises";
 import {
   CUTOVER_PATH as CUTOVER_PATH3,
   DEFAULT_SCHEMA_FILE as DEFAULT_SCHEMA_FILE2,
+  environmentNames as environmentNames6,
   isLegalEnvironmentName as isLegalEnvironmentName2,
   loadConfigFrom,
   PENV_DIR as PENV_DIR2,
@@ -4687,8 +4667,14 @@ function environmentsFromFlag(flag) {
   }
   return [...new Set(names)];
 }
+function environmentsRecord(names) {
+  return Object.fromEntries(names.map((environment) => [environment, LOCAL_PROVIDER]));
+}
 function configOf(decisions) {
-  return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
+  return {
+    environments: environmentsRecord(decisions.environments),
+    schemaFile: decisions.schemaFile
+  };
 }
 function declaredIn(root) {
   const file = join8(root, CONFIG_FILE);
@@ -4720,7 +4706,7 @@ function planInit(root, flags = {}) {
     if (schemaFile.length === 0) {
       throw emptyFlag("schema");
     }
-    const error = validateSchemaFile({ environments: [], providers: {}, schemaFile })[0];
+    const error = validateSchemaFile({ environments: {}, schemaFile })[0];
     if (error !== void 0) {
       throw error;
     }
@@ -4743,7 +4729,7 @@ function planInit(root, flags = {}) {
   }
   const suggestedEnvironments = suggestEnvironments(root);
   const safeDefault = flags.yes === true && declared === void 0;
-  const environments = flags.environments ?? declared?.environments ?? (safeDefault ? [DEVELOPMENT] : []);
+  const environments = flags.environments ?? (declared === void 0 ? void 0 : environmentNames6(declared)) ?? (safeDefault ? [DEVELOPMENT] : []);
   const defaultEnvironment = declared?.defaultEnvironment ?? (safeDefault ? DEVELOPMENT : void 0);
   if (safeDefault) {
     notes.push(
@@ -4876,27 +4862,27 @@ export { schema };
 
 ` + loadComment + loadCall;
 }
+function entryKey(name) {
+  return /^[A-Za-z_$][\w$]*$/.test(name) ? name : JSON.stringify(name);
+}
 function renderEnvironments(decisions) {
-  const shared = "  // Environments are a whitelist. A filename segment is an environment only if\n  // it is declared here \u2014 penv never infers one from a folder or a filename.\n";
+  const shared = "  // Environments are a whitelist, and each entry is that environment's whole\n  // declaration: which provider holds it, in that provider's own words, and\n  // which key seals it. A segment is an environment only if it is named here.\n";
   if (decisions.environments.length === 0) {
     return `${shared}  // It starts empty because which environments you deploy is not something penv
   // can read off your codebase, and an environment you do not have is worse
-  // than one you have not declared yet. Name yours, and give each a provider:
-  //   environments: ["development", "production"],
-  //   providers: { development: { type: "@penvhq/provider-filesystem" }, production: { type: "@penvhq/provider-vault" } },
-  environments: [],
-
-  providers: {},
+  // than one you have not declared yet. Name yours:
+  //   environments: {
+  //     development: "@penvhq/provider-filesystem",
+  //     production: { provider: "@penvhq/provider-vault", path: "penv", keySource: "env" },
+  //   },
+  environments: {},
 `;
   }
-  const names = decisions.environments.map((name) => JSON.stringify(name)).join(", ");
-  const providers = decisions.environments.map((name) => `    ${JSON.stringify(name)}: { type: "@penvhq/provider-filesystem" },
+  const entries = decisions.environments.map((name) => `    ${entryKey(name)}: ${JSON.stringify(LOCAL_PROVIDER)},
 `).join("");
-  return `${shared}  environments: [${names}],
-
-  // One entry per environment: where that environment's values are read from.
-  providers: {
-${providers}  },
+  return `${shared}  // A provider that needs no fields is just its package name.
+  environments: {
+${entries}  },
 `;
 }
 function renderConfigModule(decisions) {
@@ -5415,13 +5401,13 @@ function planCutover(input) {
   const declared = declaredIn(root);
   const named = environmentsDeclaredBy(selected);
   const chosen = named.length > 0 ? named : [requireEnvironment(input)];
-  const environments = declared === void 0 ? chosen : declared.environments;
+  const environments = declared === void 0 ? chosen : environmentNames6(declared);
   for (const environment of chosen) {
     if (!environments.includes(environment)) {
       throw new PenvError15(
         "INIT_ENVIRONMENT_UNDECLARED",
         `${CONFIG_FILE} declares ${describeList(environments)}, and adopting these files needs \`${environment}\` declared too`,
-        `Add \`${environment}\` to \`environments\` in ${CONFIG_FILE}, with a provider for it, then run \`penv init\` again. Nothing was changed.`
+        `Add \`${environment}: "${LOCAL_PROVIDER}"\` to \`environments\` in ${CONFIG_FILE}, or name the backend that holds it, then run \`penv init\` again. Nothing was changed.`
       );
     }
   }
@@ -5488,10 +5474,7 @@ function distinct(refs) {
 }
 function configFor(decisions) {
   return {
-    environments: decisions.environments,
-    providers: Object.fromEntries(
-      decisions.environments.map((environment) => [environment, { type: LOCAL_PROVIDER }])
-    ),
+    environments: environmentsRecord(decisions.environments),
     schemaFile: decisions.schemaFile,
     ...decisions.defaultEnvironment === void 0 ? {} : { defaultEnvironment: decisions.defaultEnvironment },
     ...decisions.publicPrefixes.length === 0 ? {} : { publicPrefixes: [...decisions.publicPrefixes] }
@@ -5831,7 +5814,8 @@ function offeredEnvironment(root) {
   if (declared === void 0) {
     return DEVELOPMENT;
   }
-  return declared.defaultEnvironment ?? (declared.environments.includes(DEVELOPMENT) ? DEVELOPMENT : declared.environments[0] ?? DEVELOPMENT);
+  const names = environmentNames6(declared);
+  return declared.defaultEnvironment ?? (names.includes(DEVELOPMENT) ? DEVELOPMENT : names[0] ?? DEVELOPMENT);
 }
 async function cutoverWithYes(root, base, adoption) {
   const selected = selectionForYes(adoption);
@@ -5939,10 +5923,11 @@ var BACKUP_SUFFIX = ".backup";
 var DOTENV_SEGMENT = "env";
 var LOCAL2 = "local";
 function assertDeclared(segment, config) {
-  if (config.environments.includes(segment)) {
+  const declared = environmentNames7(config);
+  if (declared.includes(segment)) {
     return segment;
   }
-  throw new UnknownEnvironmentError(segment, config.environments);
+  throw new UnknownEnvironmentError(segment, declared);
 }
 function scopeFromFilename(file, config) {
   const name = basename2(file);
@@ -6012,7 +5997,7 @@ function explicitEnvironment(options, source, config) {
   throw new PenvError16(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
-    `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
+    `Pass a declared environment \u2014 ${environmentNames7(config).map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
   );
 }
 function assertEnvironmentAgrees(derived, explicit, source) {
@@ -6039,7 +6024,7 @@ function environmentNamed(file, explicit) {
 }
 function decisionsOf(config, cwd) {
   return {
-    environments: config.environments,
+    environments: environmentNames7(config),
     // `import` re-scaffolds env.ts for an existing project; injection is an init
     // choice, so it is not turned on here.
     inject: false,
@@ -6095,7 +6080,7 @@ function importDotenv(options) {
     backup,
     scope,
     environment,
-    environments: config.environments,
+    environments: environmentNames7(config),
     variables: parsed.entries.length,
     orphanComments: parsed.orphanComments,
     steps
@@ -6190,7 +6175,7 @@ var importCommand = defineCommand14({
 
 // src/commands/key.ts
 import { randomBytes } from "crypto";
-import { KEY_BYTES, KEYCHAIN_SERVICE, PenvError as PenvError18 } from "@penvhq/core";
+import { KEY_BYTES, KEYCHAIN_SERVICE, keyConfigFor, PenvError as PenvError18 } from "@penvhq/core";
 import { defineCommand as defineCommand15 } from "citty";
 
 // src/keychain.ts
@@ -6242,12 +6227,12 @@ function envVarFor(id) {
 function runKeyCreate(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
-  const declared = project.config.keys?.[environment];
+  const declared = keyConfigFor(project.config, environment);
   if (declared === void 0) {
     throw new PenvError18(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
-      `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
+      `Give its entry in penv.config.ts a \`keySource\` \u2014 e.g. \`${environment}: { provider: "@penvhq/provider-filesystem", keySource: "env" }\` \u2014 then run this again. The key is named after the environment unless the object form names another.`
     );
   }
   const key = randomBytes(KEY_BYTES).toString("base64");
@@ -6616,7 +6601,7 @@ async function planFile(project, source, target, parameter) {
     throw new PenvError20(
       "SECRET_SCOPE_AMBIGUOUS",
       `${recordPath7(formatValueFile6(source))} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
-      "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
+      "A key is declared by its environment's `keySource` in penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
     );
   }
   const keys = keySourceFor(project, environment);