@penvhq/cli 0.14.0 → 0.15.0

package/dist/bin.cjs

@@ -47771,6 +47771,16 @@ function assertNever2(value2, context) {
 function own(record3, key) {
   return record3 !== void 0 && Object.hasOwn(record3, key) ? record3[key] : void 0;
 }
+function environmentNames(config2) {
+  return Object.keys(config2.environments);
+}
+function environmentEntry(config2, environment) {
+  const declared = own(config2.environments, environment);
+  if (declared === void 0) {
+    return void 0;
+  }
+  return typeof declared === "string" ? { provider: declared } : declared;
+}
 function retainsPrevious(provider) {
   return typeof provider.readPrevious === "function";
 }
@@ -47787,11 +47797,11 @@ var CODE_FILE_EXTENSIONS = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "m
 function isCodeModule(filename, config2) {
   const segments = filename.split(".");
   const extension = segments[segments.length - 1];
-  return extension !== void 0 && CODE_FILE_EXTENSIONS.has(extension) && !config2.environments.includes(extension);
+  return extension !== void 0 && CODE_FILE_EXTENSIONS.has(extension) && !environmentNames(config2).includes(extension);
 }
 var SUPPORTED_META_FORMAT = "json";
 function reservedTokensFor(config2) {
-  return [.../* @__PURE__ */ new Set([...RESERVED_TOKENS, ...config2.environments])];
+  return [.../* @__PURE__ */ new Set([...RESERVED_TOKENS, ...environmentNames(config2)])];
 }
 function isReservedToken(token, config2) {
   return reservedTokensFor(config2).includes(token);
@@ -47831,17 +47841,19 @@ function formatMetaFile(ref) {
   return `${refPath(ref)}.${ref.format}`;
 }
 function declaredList(config2) {
-  if (config2.environments.length === 0) {
+  const names = environmentNames(config2);
+  if (names.length === 0) {
     return "no environments are declared in penv.config.ts";
   }
-  return `declared environments are ${config2.environments.map((e) => `\`${e}\``).join(", ")}`;
+  return `declared environments are ${names.map((e) => `\`${e}\``).join(", ")}`;
 }
 function asEnvironment(segment, relativePath, config2) {
-  if (config2.environments.includes(segment)) {
+  const names = environmentNames(config2);
+  if (names.includes(segment)) {
     return segment;
   }
   if (BARE_WORD.test(segment)) {
-    throw new UnknownEnvironmentError(segment, config2.environments);
+    throw new UnknownEnvironmentError(segment, names);
   }
   throw new FilenameGrammarError(
     relativePath,
@@ -47996,12 +48008,12 @@ function isLegalEnvironmentName(name) {
 }
 function validateEnvironmentNames(config2) {
   const errors = [];
-  for (const environment of config2.environments) {
+  for (const environment of environmentNames(config2)) {
     if (RESERVED_TOKENS.includes(environment)) {
       errors.push(new ReservedTokenError("environment", environment, "penv.config.ts"));
       continue;
     }
-    if (typeof environment === "string" && !isLegalEnvironmentName(environment)) {
+    if (!isLegalEnvironmentName(environment)) {
       errors.push(new IllegalEnvironmentNameError(environment));
     }
   }
@@ -48111,15 +48123,25 @@ function createKeychainKeySource(config2, keychain) {
   };
 }
 function nullKeySource(environment) {
-  const detail = `environment ${environment} declares no \`keys\` block in penv.config.ts, so penv was never told where its keys live`;
+  const detail = `environment ${environment} declares no \`keySource\` in penv.config.ts, so penv was never told where its keys live`;
   return {
     type: "none",
     lookup: () => ({ kind: "unavailable", detail }),
     current: () => ({ kind: "unavailable", detail })
   };
 }
+function keyConfigFor(config2, environment) {
+  const declared = environmentEntry(config2, environment)?.keySource;
+  if (declared === void 0) {
+    return void 0;
+  }
+  if (typeof declared === "string") {
+    return { source: declared, id: environment };
+  }
+  return { source: declared.source, id: declared.id ?? environment };
+}
 function resolveKeySource(config2, environment) {
-  const declared = own(config2.keys, environment);
+  const declared = keyConfigFor(config2, environment);
   if (declared === void 0) {
     return nullKeySource(environment);
   }
@@ -48132,13 +48154,13 @@ function resolveKeySource(config2, environment) {
   throw new PenvError(
     "KEY_SOURCE_UNSUPPORTED",
     `Environment ${environment} declares key source \`${String(declared.source)}\`, which penv cannot read`,
-    `\`${String(declared.source)}\` is not a key source penv knows. Declare \`source: "env"\` (exported as \`${envVarFor(declared.id)}\`) or \`source: "keychain"\`.`
+    `\`${String(declared.source)}\` is not a key source penv knows. Declare \`keySource: "env"\` (exported as \`${envVarFor(declared.id)}\`) or \`keySource: "keychain"\`.`
   );
 }
 var NO_KEY_SOURCE = "none";
 function keySourceIdentifier(config2, environment) {
   const source = resolveKeySource(config2, environment);
-  const declared = own(config2.keys, environment);
+  const declared = keyConfigFor(config2, environment);
   if (declared === void 0) {
     return NO_KEY_SOURCE;
   }
@@ -48168,60 +48190,47 @@ var KEY_ID = /^[A-Za-z0-9._-]+$/;
 var SOURCES = ["env", "keychain"];
 function validateKeys(config2, declared) {
   const errors = [];
-  const keys = config2.keys;
-  if (keys === void 0) {
-    return errors;
-  }
-  if (keys === null || typeof keys !== "object" || Array.isArray(keys)) {
-    errors.push(
-      new ConfigError(
-        "`keys` in penv.config.ts is not an object",
-        'Declare one key source per environment, e.g. `keys: { production: { source: "env", id: "prod" } }`, or remove the block.'
-      )
-    );
-    return errors;
-  }
-  const entries = keys;
-  for (const environment of Object.keys(entries)) {
-    if (!declared.has(environment)) {
-      errors.push(
-        new ConfigError(
-          `The \`keys\` block in penv.config.ts names environment ${environment}, which is not declared`,
-          `Add \`${environment}\` to the \`environments\` list, or remove its \`keys\` entry. Environments are a whitelist \u2014 penv never infers one.`
-        )
-      );
+  for (const environment of declared) {
+    const keySource = environmentEntry(config2, environment)?.keySource;
+    if (keySource === void 0) {
       continue;
     }
-    const entry = own(entries, environment);
-    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+    if (typeof keySource === "string") {
+      if (!SOURCES.includes(keySource)) {
+        errors.push(unknownSource(environment, keySource));
+      }
+      continue;
+    }
+    if (keySource === null || typeof keySource !== "object" || Array.isArray(keySource)) {
       errors.push(
         new ConfigError(
-          `The \`keys\` entry for environment ${environment} is not a key-source object`,
-          `Declare it as \`${environment}: { source: "env", id: "prod" }\`.`
+          `The \`keySource\` for environment ${environment} is not a key source`,
+          `Declare it as \`keySource: "env"\` \u2014 the key named after the environment \u2014 or as \`keySource: { source: "env", id: "prod" }\` to name a different key.`
         )
       );
       continue;
     }
-    const { source, id } = entry;
+    const { source, id } = keySource;
     if (typeof source !== "string" || !SOURCES.includes(source)) {
-      errors.push(
-        new ConfigError(
-          `The \`keys\` entry for environment ${environment} declares source \`${String(source)}\``,
-          `A key source is ${SOURCES.map((s) => `\`${s}\``).join(" or ")}.`
-        )
-      );
+      errors.push(unknownSource(environment, String(source)));
     }
-    if (typeof id !== "string" || !KEY_ID.test(id)) {
+    if (id !== void 0 && (typeof id !== "string" || !KEY_ID.test(id))) {
       errors.push(
         new ConfigError(
-          `The \`keys\` entry for environment ${environment} declares id \`${String(id)}\``,
-          "A key id is one or more of `A-Za-z0-9._-`. It is written into every value file sealed under it, where `:` separates the fields, so `:` cannot appear in one."
+          `The \`keySource\` for environment ${environment} declares id \`${String(id)}\``,
+          "A key id is one or more of `A-Za-z0-9._-`. It is written into every value file sealed under it, where `:` separates the fields, so `:` cannot appear in one. Omit `id` to use the environment's own name."
         )
       );
     }
   }
   return errors;
 }
+function unknownSource(environment, source) {
+  return new ConfigError(
+    `The \`keySource\` for environment ${environment} declares source \`${source}\``,
+    `A key source is ${SOURCES.map((s) => `\`${s}\``).join(" or ")}.`
+  );
+}
 var CONFIG_FILENAMES = ["penv.config.ts", "penv.config.js", "penv.config.mjs"];
 var jitiModule;
 function setJitiApi(api) {
@@ -48250,7 +48259,7 @@ function jitiFor(file2) {
     ...alias === void 0 ? {} : { alias }
   });
 }
-var EXPORT_REMEDY = "penv reads its configuration from the default export: `export default defineConfig({ environments: [...], providers: { ... } })`.";
+var EXPORT_REMEDY = 'penv reads its configuration from the default export: `export default defineConfig({ environments: { development: "@penvhq/provider-filesystem" } })`.';
 function describeValue(value2) {
   if (value2 === null) {
     return "`null`";
@@ -48353,6 +48362,11 @@ function loadConfigFrom(file2) {
       EXPORT_REMEDY
     );
   }
+  const merged = mergedEnvironmentsBlock(config2);
+  const first = merged[0];
+  if (first !== void 0) {
+    throw first;
+  }
   return config2;
 }
 function loadConfig(cwd = process.cwd()) {
@@ -48374,20 +48388,20 @@ var LEGACY_PROVIDER_TYPES = {
   github: "@penvhq/provider-github"
 };
 var PACKAGE_NAME = /^(@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
-function validateProviderType(environment, type) {
-  const legacy = own(LEGACY_PROVIDER_TYPES, type);
+function validateProviderName(environment, provider) {
+  const legacy = own(LEGACY_PROVIDER_TYPES, provider);
   if (legacy !== void 0) {
     return new PenvError(
-      "PROVIDER_TYPE_LEGACY",
-      `The provider type \`${type}\` for environment ${environment} is a short name, and provider types are package names`,
-      `Write \`${environment}: { type: "${legacy}" }\` and make sure the package is installed. A provider's \`type\` is the package penv imports, so the config and the dependency tree name the same thing.`
+      "PROVIDER_LEGACY",
+      `The provider \`${provider}\` for environment ${environment} is a short name, and a provider is a package name`,
+      `Write \`${environment}: { provider: "${legacy}" }\` and make sure the package is installed. A provider is the package penv imports, so the config and the dependency tree name the same thing.`
     );
   }
-  if (!PACKAGE_NAME.test(type)) {
+  if (!PACKAGE_NAME.test(provider)) {
     return new PenvError(
-      "PROVIDER_TYPE_INVALID",
-      `The provider type \`${type}\` for environment ${environment} is not a package name`,
-      `Name the provider's package, e.g. \`${environment}: { type: "@penvhq/provider-filesystem" }\`. penv imports the package the \`type\` names from this project's node_modules.`
+      "PROVIDER_INVALID",
+      `The provider \`${provider}\` for environment ${environment} is not a package name`,
+      `Name the provider's package, e.g. \`${environment}: "@penvhq/provider-filesystem"\`. penv imports the package the \`provider\` names from this project's node_modules.`
     );
   }
   return void 0;
@@ -48406,63 +48420,76 @@ function validateDefaultEnvironment(config2, declared) {
     ];
   }
   if (!declared.has(value2)) {
-    return [new UnknownEnvironmentError(value2, config2.environments)];
+    return [new UnknownEnvironmentError(value2, [...declared])];
   }
   return [];
 }
-function legacySinksBlock(config2) {
-  const sinks = config2.sinks;
-  if (sinks === void 0) {
+function mergedEnvironmentsBlock(config2) {
+  const raw = config2;
+  const carried = [];
+  if (Array.isArray(config2.environments)) {
+    carried.push("`environments` as a list");
+  }
+  if (raw.providers !== void 0) {
+    carried.push("a `providers` block");
+  }
+  if (raw.keys !== void 0) {
+    carried.push("a `keys` block");
+  }
+  if (carried.length === 0) {
     return [];
   }
   return [
     new PenvError(
-      "CONFIG_SINKS_REMOVED",
-      "`sinks` in penv.config.ts is no longer a config key \u2014 everything is a provider now",
-      'Move each entry into `providers` as that environment\'s provider: `sinks: { production: { type: "github", repo: "acme/api" } }` becomes `providers: { production: { type: "@penvhq/provider-github", location: "acme/api" } }`, with `npm i -D @penvhq/provider-github`. `penv push` and `penv pull` work against it directly.'
+      "CONFIG_ENVIRONMENTS_MERGED",
+      `penv.config.ts declares ${carried.join(" and ")}, and one \`environments\` record now holds all three`,
+      'Give each environment one entry, in its provider\'s own words: `type` becomes `provider`, `location` becomes the field that provider declares (`project` for vercel, `path` for ssm and vault), `targets` becomes a single `target` defaulting to the environment\'s name, and `keys.<env>` becomes that entry\'s `keySource`. So `environments: ["production"], providers: { production: { type: "@penvhq/provider-vercel", location: "penv-cloud", targets: { production: "production" } } }, keys: { production: { source: "env", id: "production" } }` becomes `environments: { production: { provider: "@penvhq/provider-vercel", project: "penv-cloud", keySource: "env" } }`. A key id that is not the environment\'s own name has to stay in the object form \u2014 `keySource: { source: "env", id: "prod" }` \u2014 because the shorthand names the key after the environment, and a renamed key is a key the sealed values do not carry. An environment whose provider needs no fields is just the package name: `development: "@penvhq/provider-filesystem"`.'
     )
   ];
 }
+function providerMissing(environment) {
+  return new PenvError(
+    "PROVIDER_MISSING",
+    `The entry for environment ${environment} declares no \`provider\``,
+    `Name the package of the backend that holds this environment's values, e.g. \`${environment}: { provider: "@penvhq/provider-filesystem" }\`. If it still says \`type\`, that is the field \`provider\` replaced.`
+  );
+}
 function validateConfig(config2) {
   const errors = [];
+  const merged = mergedEnvironmentsBlock(config2);
+  if (merged.length > 0) {
+    return merged;
+  }
   const environments = config2.environments;
-  if (!Array.isArray(environments)) {
+  if (environments === null || typeof environments !== "object") {
     errors.push(
       new PenvError(
         "CONFIG_ENVIRONMENTS_INVALID",
-        "`environments` in penv.config.ts is not an array",
-        'Declare the whitelist as an array of names, e.g. `environments: ["development", "production"]`.'
+        "`environments` in penv.config.ts is not an object",
+        'Declare one entry per environment, e.g. `environments: { development: "@penvhq/provider-filesystem" }`.'
       )
     );
     return errors;
   }
-  if (environments.length === 0) {
+  const entries = environments;
+  const names = Object.keys(entries);
+  if (names.length === 0) {
     errors.push(
       new PenvError(
         "CONFIG_ENVIRONMENTS_EMPTY",
         "`environments` in penv.config.ts is empty, so no environment can ever be loaded",
-        'Declare at least one environment, e.g. `environments: ["development", "production"]`. Environments are a whitelist \u2014 penv never infers one from a folder or a filename.'
+        'Declare at least one, e.g. `environments: { development: "@penvhq/provider-filesystem" }`. Environments are a whitelist \u2014 penv never infers one from a folder or a filename.'
       )
     );
   }
   const declared = /* @__PURE__ */ new Set();
-  for (const environment of environments) {
-    if (typeof environment !== "string" || environment.trim().length === 0) {
+  for (const environment of names) {
+    if (environment.trim().length === 0) {
       errors.push(
         new PenvError(
           "CONFIG_ENVIRONMENT_INVALID",
-          `The environment \`${String(environment)}\` in penv.config.ts is not a non-empty name`,
-          'Every entry in `environments` is a non-empty string, e.g. `"production"`.'
-        )
-      );
-      continue;
-    }
-    if (declared.has(environment)) {
-      errors.push(
-        new PenvError(
-          "CONFIG_ENVIRONMENT_DUPLICATE",
-          `The environment \`${environment}\` is declared twice in penv.config.ts`,
-          "Each environment is declared once. Remove the duplicate."
+          `The environment \`${environment}\` in penv.config.ts is not a non-empty name`,
+          'Every key in `environments` is a non-empty name, e.g. `"production"`.'
         )
       );
       continue;
@@ -48471,63 +48498,36 @@ function validateConfig(config2) {
   }
   errors.push(...validateEnvironmentNames(config2));
   errors.push(...validateDefaultEnvironment(config2, declared));
-  const providers = config2.providers;
-  if (providers === null || typeof providers !== "object" || Array.isArray(providers)) {
-    errors.push(
-      new PenvError(
-        "CONFIG_PROVIDERS_INVALID",
-        "`providers` in penv.config.ts is not an object",
-        'Declare one provider per environment, e.g. `providers: { production: { type: "@penvhq/provider-filesystem" } }`.'
-      )
-    );
-    return errors;
-  }
-  const providerEntries = providers;
   for (const environment of declared) {
-    const provider = own(providerEntries, environment);
-    if (provider === void 0) {
-      errors.push(
-        new PenvError(
-          "PROVIDER_MISSING",
-          `Environment ${environment} has no entry in \`providers\` in penv.config.ts`,
-          `Add \`${environment}: { type: "@penvhq/provider-filesystem" }\` to the \`providers\` block, or remove \`${environment}\` from \`environments\`.`
-        )
-      );
+    const entry = own(entries, environment);
+    if (typeof entry === "string") {
+      const nameError2 = validateProviderName(environment, entry);
+      if (nameError2 !== void 0) {
+        errors.push(nameError2);
+      }
       continue;
     }
-    if (provider === null || typeof provider !== "object" || Array.isArray(provider)) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
       errors.push(
         new PenvError(
-          "PROVIDER_INVALID",
-          `The provider for environment ${environment} is ${describeValue(provider)}, not a provider object`,
-          `Declare it as \`${environment}: { type: "@penvhq/provider-filesystem" }\`, adding a \`location\` when the backend needs one.`
+          "ENVIRONMENT_ENTRY_INVALID",
+          `The entry for environment ${environment} is ${describeValue(entry)}, not a provider package name or an entry object`,
+          `Declare it as \`${environment}: "@penvhq/provider-filesystem"\`, or as \`${environment}: { provider: "@penvhq/provider-vercel", project: "acme-web" }\` when the provider needs fields.`
         )
       );
       continue;
     }
-    const type = provider.type;
-    if (typeof type !== "string" || type.trim().length === 0) {
-      errors.push(
-        new PenvError(
-          "PROVIDER_TYPE_MISSING",
-          `The provider for environment ${environment} declares no \`type\``,
-          `Name the package of the backend that holds this environment's values, e.g. \`${environment}: { type: "@penvhq/provider-filesystem" }\`.`
-        )
-      );
+    const provider = entry.provider;
+    if (typeof provider !== "string" || provider.trim().length === 0) {
+      errors.push(providerMissing(environment));
       continue;
     }
-    const typeError = validateProviderType(environment, type);
-    if (typeError !== void 0) {
-      errors.push(typeError);
-    }
-  }
-  for (const environment of Object.keys(providerEntries)) {
-    if (!declared.has(environment)) {
-      errors.push(new UnknownEnvironmentError(environment, environments));
+    const nameError = validateProviderName(environment, provider);
+    if (nameError !== void 0) {
+      errors.push(nameError);
     }
   }
   errors.push(...validateKeys(config2, declared));
-  errors.push(...legacySinksBlock(config2));
   errors.push(...validateSchemaFile(config2));
   errors.push(...validatePublicPrefixes(config2));
   errors.push(...legacyNamesBlock(config2));
@@ -48596,8 +48596,9 @@ function legacyNamesBlock(config2) {
   ];
 }
 function assertEnvironment(environment, config2) {
-  if (!config2.environments.includes(environment)) {
-    throw new UnknownEnvironmentError(environment, config2.environments);
+  const declared = environmentNames(config2);
+  if (!declared.includes(environment)) {
+    throw new UnknownEnvironmentError(environment, declared);
   }
   if (!isLegalEnvironmentName(environment)) {
     throw new IllegalEnvironmentNameError(environment);
@@ -48627,7 +48628,7 @@ function resolveEnvironment(config2, explicit) {
   if (environment === void 0) {
     throw new ConfigError(
       "No environment is set, so penv cannot tell which environment to load",
-      `Pass \`--env <environment>\` \u2014 one of ${quoteList(config2.environments)} \u2014 or declare \`defaultEnvironment\` in penv.config.ts so every command has one.`
+      `Pass \`--env <environment>\` \u2014 one of ${quoteList(environmentNames(config2))} \u2014 or declare \`defaultEnvironment\` in penv.config.ts so every command has one.`
     );
   }
   return environment;
@@ -48681,7 +48682,7 @@ var ALGORITHM = "aes-256-gcm";
 function remedyFor(failure, location) {
   switch (failure.reason) {
     case "key-source-unavailable":
-      return `penv could not consult a key source: ${failure.detail}. Make the key available where this environment expects it \u2014 if the source is your OS keychain, unlock it; if no key source is declared, add a \`keys\` block to penv.config.ts.`;
+      return `penv could not consult a key source: ${failure.detail}. Make the key available where this environment expects it \u2014 if the source is your OS keychain, unlock it; if no key source is declared, add a \`keySource\` to this environment's entry in penv.config.ts.`;
     case "key-absent":
       return `The key that seals ${location} is not there: ${failure.detail}. Export the key, or re-seal the value under a key you hold with \`penv encrypt\`.`;
     case "malformed-envelope":
@@ -48717,7 +48718,7 @@ var KeyUnavailableError = class extends PenvError {
     super(
       "KEY_UNAVAILABLE",
       `Parameter ${parameter} is a secret for environment ${environment}, and penv has no key to seal it with: ${detail}`,
-      "penv will not write a secret in plaintext, and will not invent a key. Declare the key source in the `keys` block of penv.config.ts and make the key available, then run the command again."
+      "penv will not write a secret in plaintext, and will not invent a key. Declare this environment's `keySource` in penv.config.ts and make the key available, then run the command again."
     );
     this.parameter = parameter;
     this.environment = environment;
@@ -50369,7 +50370,7 @@ var import_node_path7 = require("path");
 // ../runtime/dist/index.js
 init_cjs_shims();
 
-// ../runtime/dist/chunk-SLMVNKRU.js
+// ../runtime/dist/chunk-FPKLY3QL.js
 init_cjs_shims();
 
 // ../providers/filesystem/dist/index.js
@@ -50521,11 +50522,11 @@ function createFilesystemProvider(options) {
   return new FilesystemProvider(options);
 }
 
-// ../runtime/dist/chunk-SLMVNKRU.js
+// ../runtime/dist/chunk-FPKLY3QL.js
 var LOCAL_TREE_TYPE = "@penvhq/provider-filesystem";
 function hasRemoteSource(config2, environment) {
-  const declared = own(config2.providers, environment);
-  return declared !== void 0 && declared.type !== LOCAL_TREE_TYPE;
+  const declared = environmentEntry(config2, environment);
+  return declared !== void 0 && declared.provider !== LOCAL_TREE_TYPE;
 }
 
 // ../runtime/dist/index.js
@@ -50719,11 +50720,15 @@ function penvOwnVariables(host) {
 }
 function strippedVariables(host, config2, credentials) {
   const names = penvOwnVariables(host);
-  for (const provider of Object.values(config2.providers)) {
-    for (const name of own(PROVIDER_CREDENTIALS, provider.type) ?? []) {
+  for (const environment of environmentNames(config2)) {
+    const provider = environmentEntry(config2, environment)?.provider;
+    if (provider === void 0) {
+      continue;
+    }
+    for (const name of own(PROVIDER_CREDENTIALS, provider) ?? []) {
       names.add(name);
     }
-    for (const name of own(credentials, provider.type) ?? []) {
+    for (const name of own(credentials, provider) ?? []) {
       names.add(name);
     }
   }
@@ -51319,22 +51324,10 @@ var import_node_path4 = require("path");
 // src/env-flags.ts
 init_cjs_shims();
 var BASE_RESERVED = ["help", "version", "h", "v", "_", "--"];
-var COMMAND_FLAGS = [
-  ...BASE_RESERVED,
-  "env",
-  "out",
-  "allow-decrypt",
-  "destination",
-  "dest",
-  "d",
-  "location",
-  "l",
-  "yes",
-  "y"
-];
+var COMMAND_FLAGS = [...BASE_RESERVED, "env", "out", "allow-decrypt", "yes", "y"];
 function shadowedEnvironments(config2) {
   const flags = new Set(COMMAND_FLAGS);
-  return config2.environments.filter((environment) => flags.has(environment));
+  return environmentNames(config2).filter((environment) => flags.has(environment));
 }
 function shorthandCandidates(args, declared) {
   const reserved = /* @__PURE__ */ new Set([...BASE_RESERVED, ...declared]);
@@ -51347,13 +51340,14 @@ function environmentFromShorthand(config2, candidates, explicit) {
   if (candidates.length === 0) {
     return void 0;
   }
-  const hits = candidates.filter((candidate) => config2.environments.includes(candidate));
-  const strangers = candidates.filter((candidate) => !config2.environments.includes(candidate));
+  const declared = environmentNames(config2);
+  const hits = candidates.filter((candidate) => declared.includes(candidate));
+  const strangers = candidates.filter((candidate) => !declared.includes(candidate));
   if (strangers.length > 0) {
     throw new PenvError(
       "UNKNOWN_FLAG",
       `${quoteList2(strangers)} ${strangers.length === 1 ? "is not a flag" : "are not flags"} this command takes, and ${strangers.length === 1 ? "names" : "name"} no declared environment`,
-      `Declared environments work as bare flags: ${quoteList2(config2.environments)}. Anything else needs \`--env <name>\`.`
+      `Declared environments work as bare flags: ${quoteList2(declared)}. Anything else needs \`--env <name>\`.`
     );
   }
   if (hits.length > 1) {
@@ -51560,14 +51554,18 @@ async function loadPluginProvider(type, context) {
 function assertProvidersRegistered(config2, projectRoot, options) {
   const local = localExtensions(projectRoot);
   const ci = options?.ci ?? isCi(process.env.CI);
-  for (const [environment, provider] of Object.entries(config2.providers)) {
-    if (isProviderRegistered(provider.type)) {
+  for (const environment of environmentNames(config2)) {
+    const provider = environmentEntry(config2, environment)?.provider;
+    if (typeof provider !== "string" || provider.trim().length === 0) {
+      throw providerMissing(environment);
+    }
+    if (isProviderRegistered(provider)) {
       continue;
     }
-    if (ci && local.includes(provider.type)) {
-      throw localExtensionInCi(provider.type, environment);
+    if (ci && local.includes(provider)) {
+      throw localExtensionInCi(provider, environment);
     }
-    resolveExtension(provider.type, projectRoot, environment, local);
+    resolveExtension(provider, projectRoot, environment, local);
   }
 }
 function resolveExtension(type, projectRoot, environment, local = localExtensions(projectRoot)) {
@@ -51725,11 +51723,11 @@ function schemaShapeFileOf(project) {
   return selfContainedSchemaModule(project.root, schemaFile) ?? SCHEMA_SHAPE_FILE;
 }
 async function sourceProviderFor(project, environment) {
-  const providerConfig = project.config.providers[environment];
+  const providerConfig = environmentEntry(project.config, environment);
   if (providerConfig === void 0) {
     return createProvider(LOCAL_TREE_TYPE2, { root: project.root, config: project.config });
   }
-  return createSourceProvider(providerConfig.type, {
+  return createSourceProvider(providerConfig.provider, {
     root: project.root,
     config: project.config,
     providerConfig,
@@ -51741,7 +51739,7 @@ function targetEnvironment(project, explicit, shorthand) {
   return resolveEnvironment(project.config, explicit ?? fromFlags);
 }
 var KEY_SEPARATOR = /[./\\]/;
-var NO_ENVIRONMENTS = { environments: [], providers: {} };
+var NO_ENVIRONMENTS = { environments: {} };
 function refFromKey(key, config2) {
   const segments = key.split(KEY_SEPARATOR).filter((segment) => segment.length > 0);
   const name = segments[segments.length - 1];
@@ -52064,8 +52062,9 @@ function discoverDotenvFiles(root) {
   return files.sort((a, b) => order(a) < order(b) ? -1 : order(a) > order(b) ? 1 : 0);
 }
 function activeDotenvFiles(root, config2) {
+  const declared = environmentNames(config2);
   return discoverDotenvFiles(root).filter(
-    (file2) => file2.environment === void 0 || config2.environments.includes(file2.environment)
+    (file2) => file2.environment === void 0 || declared.includes(file2.environment)
   );
 }
 function environmentsDeclaredBy(files) {
@@ -52804,11 +52803,12 @@ function packageManifest(specifier, root) {
 }
 function declaredCredentials(config2, root) {
   const declared = {};
-  for (const provider of Object.values(config2.providers)) {
-    if (own(declared, provider.type) !== void 0) {
+  for (const environment of environmentNames(config2)) {
+    const provider = environmentEntry(config2, environment)?.provider;
+    if (provider === void 0 || own(declared, provider) !== void 0) {
       continue;
     }
-    const penv = packageManifest(provider.type, root)?.penv;
+    const penv = packageManifest(provider, root)?.penv;
     const credentials = isPlainObject5(penv) ? penv.credentials : void 0;
     if (credentials === void 0) {
       continue;
@@ -52816,11 +52816,11 @@ function declaredCredentials(config2, root) {
     if (!Array.isArray(credentials) || credentials.some((name) => typeof name !== "string" || !VARIABLE2.test(name))) {
       throw new PenvError(
         "PROVIDER_CREDENTIALS_INVALID",
-        `\`${provider.type}\` declares \`penv.credentials\`, and it is not a list of variable names`,
+        `\`${provider}\` declares \`penv.credentials\`, and it is not a list of variable names`,
         `Its package.json should read \`"penv": { "credentials": ["ACME_TOKEN"] }\` \u2014 penv strips exactly what an extension declares, so it will not guess at a declaration it cannot read.`
       );
     }
-    declared[provider.type] = credentials;
+    declared[provider] = credentials;
   }
   return declared;
 }
@@ -53510,38 +53510,23 @@ function lineReader(input = process.stdin, output = process.stdout) {
 // src/commands/push.ts
 var LAST_PUSHED_KEY = "lastPushedAt";
 async function destinationFor(project, environment, options) {
-  if (options.destination !== void 0) {
-    const providerConfig = {
-      type: options.destination,
-      ...options.location === void 0 ? {} : { location: options.location }
-    };
-    const provider2 = options.provider ?? await createSourceProvider(options.destination, {
-      root: project.root,
-      config: project.config,
-      providerConfig,
-      environment
-    });
-    return { provider: provider2, location: options.location };
-  }
-  const declared = project.config.providers[environment];
-  const location = declared?.location;
-  if (declared === void 0 || declared.type === LOCAL_TREE_TYPE2) {
+  const declared = environmentEntry(project.config, environment);
+  if (declared === void 0 || declared.provider === LOCAL_TREE_TYPE2) {
     throw new PenvError(
       "NO_DESTINATION",
       `Environment ${environment}'s provider is the local records tree itself, so penv has nowhere to push`,
-      `Declare a provider for it in penv.config.ts \u2014 e.g. \`${environment}: { type: "@penvhq/provider-github", location: "owner/repo" }\` \u2014 or push somewhere once with \`penv push --env ${environment} --destination <package> --location <place>\`.`
+      `Declare the backend that holds it in penv.config.ts \u2014 e.g. \`${environment}: { provider: "@penvhq/provider-github", repository: "owner/repo" }\` \u2014 and run this again. A push only ever goes where the config says this environment lives.`
     );
   }
   if (options.provider !== void 0) {
-    return { provider: options.provider, location };
+    return options.provider;
   }
-  const provider = await createSourceProvider(declared.type, {
+  return createSourceProvider(declared.provider, {
     root: project.root,
     config: project.config,
     providerConfig: declared,
     environment
   });
-  return { provider, location };
 }
 function plan(resolutions, config2, environment, allowDecrypt) {
   const outbound = [];
@@ -53625,7 +53610,7 @@ async function ensureTargetApproved(provider, environment, options) {
   await provider.ensureTarget(environment);
   return true;
 }
-async function pushProjection(project, provider, environment, location, options) {
+async function pushProjection(project, provider, environment, options) {
   const tree = localTree(project);
   const keys = keySourceFor(project, environment);
   const resolutions = resolveAllSync(tree, environment, keys, true);
@@ -53656,7 +53641,6 @@ async function pushProjection(project, provider, environment, location, options)
     environment,
     destination: provider.type,
     mode: "projection",
-    location,
     pushed: outbound.length,
     meta: 0,
     repositorySecrets,
@@ -53672,7 +53656,7 @@ function crossesToRecords(file2, environment) {
   }
   return scope.kind === "environment" && scope.environment === environment;
 }
-async function pushRecords(project, provider, environment, location) {
+async function pushRecords(project, provider, environment) {
   const tree = localTree(project);
   const files = tree.listSync().filter((file2) => crossesToRecords(file2, environment));
   let pushed = 0;
@@ -53698,7 +53682,6 @@ async function pushRecords(project, provider, environment, location) {
     environment,
     destination: provider.type,
     mode: "records",
-    location,
     pushed,
     meta: meta3,
     repositorySecrets: 0,
@@ -53710,11 +53693,11 @@ async function pushRecords(project, provider, environment, location) {
 async function runPush(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment, options.envFlags);
-  const { provider, location } = await destinationFor(project, environment, options);
+  const provider = await destinationFor(project, environment, options);
   if (holdsProjection(provider)) {
-    return pushProjection(project, provider, environment, location, options);
+    return pushProjection(project, provider, environment, options);
   }
-  return pushRecords(project, provider, environment, location);
+  return pushRecords(project, provider, environment);
 }
 function renderPush(result2) {
   if (result2.pushed === 0 && result2.meta === 0) {
@@ -53726,7 +53709,7 @@ function renderPush(result2) {
       }
     ]);
   }
-  const target = `${result2.destination} for environment ${result2.environment}${result2.location === void 0 ? "" : ` (${result2.location})`}`;
+  const target = `${result2.destination} for environment ${result2.environment}`;
   if (result2.mode === "records") {
     return formatRows([
       {
@@ -53775,6 +53758,19 @@ function renderPush(result2) {
   }
   return formatRows(rows);
 }
+var REDIRECT_FLAGS = ["destination", "dest", "d", "location", "l"];
+function assertNoRedirect(args) {
+  const given = REDIRECT_FLAGS.filter((flag) => args[flag] !== void 0);
+  const named = given[0];
+  if (named === void 0) {
+    return;
+  }
+  throw new PenvError(
+    "REMOVED_FLAG",
+    `\`--${named}\` is not a flag \`penv push\` takes`,
+    "A push only ever goes where the config says this environment lives. Declare the destination in `environments.<env>` \u2014 the provider package, addressed in that provider's own words \u2014 and push with `--env <name>`."
+  );
+}
 var pushCommand = defineCommand({
   meta: {
     name: "push",
@@ -53786,16 +53782,6 @@ var pushCommand = defineCommand({
       type: "boolean",
       description: "Decrypt sealed values locally and push them as plaintext for the destination to re-seal"
     },
-    destination: {
-      type: "string",
-      alias: ["dest", "d"],
-      description: "Push once to this provider package instead of the declared one"
-    },
-    location: {
-      type: "string",
-      alias: "l",
-      description: "The destination-side place, when --destination needs one"
-    },
     yes: {
       type: "boolean",
       alias: "y",
@@ -53804,25 +53790,13 @@ var pushCommand = defineCommand({
   },
   run({ args }) {
     return guard(async () => {
+      assertNoRedirect(args);
       const result2 = await runPush({
         cwd: process.cwd(),
         ...args.env === void 0 ? {} : { environment: args.env },
         ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] },
-        ...args.destination === void 0 ? {} : { destination: args.destination },
-        ...args.location === void 0 ? {} : { location: args.location },
         ...args.yes === void 0 ? {} : { yes: args.yes },
-        envFlags: shorthandCandidates(args, [
-          "env",
-          "allow-decrypt",
-          "allowDecrypt",
-          "destination",
-          "dest",
-          "d",
-          "location",
-          "l",
-          "yes",
-          "y"
-        ])
+        envFlags: shorthandCandidates(args, ["env", "allow-decrypt", "allowDecrypt", "yes", "y"])
       });
       write(renderPush(result2));
     });
@@ -53921,7 +53895,7 @@ async function runDoctor(options) {
     check: "provider",
     severity: "pass",
     label: "Provider",
-    subject: project.config.providers[environment]?.type ?? project.provider.type
+    subject: environmentEntry(project.config, environment)?.provider ?? project.provider.type
   });
   return {
     environment,
@@ -54191,8 +54165,8 @@ async function projectionFindings(project, environment, override) {
   if (override !== void 0) {
     projection = override;
   } else {
-    const declared = project.config.providers[environment];
-    if (declared === void 0 || declared.type === LOCAL_TREE_TYPE2) {
+    const declared = environmentEntry(project.config, environment);
+    if (declared === void 0 || declared.provider === LOCAL_TREE_TYPE2) {
       return [];
     }
     let source;
@@ -54204,7 +54178,7 @@ async function projectionFindings(project, environment, override) {
           check: "projection-unreachable",
           severity: "unknown",
           label: "Destination",
-          subject: `could not build the ${declared.type} provider for ${environment}`,
+          subject: `could not build the ${declared.provider} provider for ${environment}`,
           detail: errorDetail(error51)
         }
       ];
@@ -54477,8 +54451,8 @@ function refPathOf(ref) {
   return [...ref.namespace, ref.name].join("/");
 }
 async function rotationSubjects(project, environment, local, override) {
-  const providerConfig = project.config.providers[environment];
-  if (override === void 0 && (providerConfig === void 0 || providerConfig.type === LOCAL_TREE_TYPE2)) {
+  const providerConfig = environmentEntry(project.config, environment);
+  if (override === void 0 && (providerConfig === void 0 || providerConfig.provider === LOCAL_TREE_TYPE2)) {
     return { kind: "read", subjects: local };
   }
   const source = override ?? await sourceProviderFor(project, environment);
@@ -54500,7 +54474,7 @@ async function rotationSubjects(project, environment, local, override) {
         check: "rotation-overdue",
         severity: "unknown",
         label: "Rotation",
-        subject: `could not reach the ${providerConfig?.type ?? source.type} source of truth for ${environment}`,
+        subject: `could not reach the ${providerConfig?.provider ?? source.type} source of truth for ${environment}`,
         detail: errorDetail(error51)
       }
     };
@@ -54621,8 +54595,8 @@ async function readRelevant(provider, environment) {
   return entries;
 }
 async function providerDriftFindings(project, environment, override) {
-  const providerConfig = project.config.providers[environment];
-  if (providerConfig === void 0 || providerConfig.type === LOCAL_TREE_TYPE2) {
+  const providerConfig = environmentEntry(project.config, environment);
+  if (providerConfig === void 0 || providerConfig.provider === LOCAL_TREE_TYPE2) {
     return [
       {
         check: "provider-value-drift",
@@ -54647,7 +54621,7 @@ async function providerDriftFindings(project, environment, override) {
         check: "provider-value-drift",
         severity: "unknown",
         label: "Provider values",
-        subject: `could not reach the ${providerConfig.type} provider for ${environment}`,
+        subject: `could not reach the ${providerConfig.provider} provider for ${environment}`,
         detail: errorDetail(error51)
       }
     ];
@@ -54666,7 +54640,7 @@ async function providerDriftFindings(project, environment, override) {
           severity: "unknown",
           label: "Provider value unreadable",
           subject: formatValueFile(here.file),
-          detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.type} source of truth`
+          detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.provider} source of truth`
         });
         continue;
       }
@@ -54676,7 +54650,7 @@ async function providerDriftFindings(project, environment, override) {
           severity: "failure",
           label: "Provider value drift",
           subject: formatValueFile(here.file),
-          detail: `the local tree and the ${providerConfig.type} source of truth hold different values`
+          detail: `the local tree and the ${providerConfig.provider} source of truth hold different values`
         });
       }
       continue;
@@ -54690,7 +54664,7 @@ async function providerDriftFindings(project, environment, override) {
       severity: "warning",
       label: here !== void 0 ? "Only in the local tree" : "Only in the source",
       subject: formatValueFile(present.file),
-      detail: here !== void 0 ? `present locally, absent from the ${providerConfig.type} source of truth` : `present in the ${providerConfig.type} source of truth, absent from the local tree`
+      detail: here !== void 0 ? `present locally, absent from the ${providerConfig.provider} source of truth` : `present in the ${providerConfig.provider} source of truth, absent from the local tree`
     });
   }
   if (findings.length > 0) {
@@ -54701,7 +54675,7 @@ async function providerDriftFindings(project, environment, override) {
       check: "provider-value-drift",
       severity: "pass",
       label: "Provider values",
-      subject: `every value matches the ${providerConfig.type} source of truth for ${environment}`
+      subject: `every value matches the ${providerConfig.provider} source of truth for ${environment}`
     }
   ];
 }
@@ -54801,7 +54775,7 @@ function targetScope(project, options, key) {
     throw new PenvError(
       "ENVIRONMENT_FLAG_EMPTY",
       `\`--env\` for parameter ${key} names no environment`,
-      `Pass a declared environment \u2014 ${project.config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
+      `Pass a declared environment \u2014 ${environmentNames(project.config).map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
     );
   }
   return scopeFrom({ ...options, environment: targetEnvironment(project, environment) });
@@ -54814,7 +54788,7 @@ function sealFor(project, file2, value2, parameter, environment) {
     throw new PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
       `Parameter ${parameter} is a secret, and ${recordPath(formatValueFile(file2))} names no environment`,
-      "Keys are declared per environment in the `keys` block of penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
+      "A key is declared by its environment's `keySource` in penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
     );
   }
   return sealValue(file2, value2, keySourceFor(project, environment), parameter, environment);
@@ -55892,8 +55866,14 @@ function environmentsFromFlag(flag) {
   }
   return [...new Set(names)];
 }
+function environmentsRecord(names) {
+  return Object.fromEntries(names.map((environment) => [environment, LOCAL_PROVIDER]));
+}
 function configOf(decisions) {
-  return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
+  return {
+    environments: environmentsRecord(decisions.environments),
+    schemaFile: decisions.schemaFile
+  };
 }
 function declaredIn2(root) {
   const file2 = (0, import_node_path13.join)(root, CONFIG_FILE);
@@ -55925,7 +55905,7 @@ function planInit(root, flags = {}) {
     if (schemaFile.length === 0) {
       throw emptyFlag("schema");
     }
-    const error51 = validateSchemaFile({ environments: [], providers: {}, schemaFile })[0];
+    const error51 = validateSchemaFile({ environments: {}, schemaFile })[0];
     if (error51 !== void 0) {
       throw error51;
     }
@@ -55948,7 +55928,7 @@ function planInit(root, flags = {}) {
   }
   const suggestedEnvironments = suggestEnvironments(root);
   const safeDefault = flags.yes === true && declared === void 0;
-  const environments = flags.environments ?? declared?.environments ?? (safeDefault ? [DEVELOPMENT] : []);
+  const environments = flags.environments ?? (declared === void 0 ? void 0 : environmentNames(declared)) ?? (safeDefault ? [DEVELOPMENT] : []);
   const defaultEnvironment = declared?.defaultEnvironment ?? (safeDefault ? DEVELOPMENT : void 0);
   if (safeDefault) {
     notes.push(
@@ -56081,27 +56061,27 @@ export { schema };
 
 ` + loadComment + loadCall;
 }
+function entryKey(name) {
+  return /^[A-Za-z_$][\w$]*$/.test(name) ? name : JSON.stringify(name);
+}
 function renderEnvironments(decisions) {
-  const shared = "  // Environments are a whitelist. A filename segment is an environment only if\n  // it is declared here \u2014 penv never infers one from a folder or a filename.\n";
+  const shared = "  // Environments are a whitelist, and each entry is that environment's whole\n  // declaration: which provider holds it, in that provider's own words, and\n  // which key seals it. A segment is an environment only if it is named here.\n";
   if (decisions.environments.length === 0) {
     return `${shared}  // It starts empty because which environments you deploy is not something penv
   // can read off your codebase, and an environment you do not have is worse
-  // than one you have not declared yet. Name yours, and give each a provider:
-  //   environments: ["development", "production"],
-  //   providers: { development: { type: "@penvhq/provider-filesystem" }, production: { type: "@penvhq/provider-vault" } },
-  environments: [],
-
-  providers: {},
+  // than one you have not declared yet. Name yours:
+  //   environments: {
+  //     development: "@penvhq/provider-filesystem",
+  //     production: { provider: "@penvhq/provider-vault", path: "penv", keySource: "env" },
+  //   },
+  environments: {},
 `;
   }
-  const names = decisions.environments.map((name) => JSON.stringify(name)).join(", ");
-  const providers = decisions.environments.map((name) => `    ${JSON.stringify(name)}: { type: "@penvhq/provider-filesystem" },
+  const entries = decisions.environments.map((name) => `    ${entryKey(name)}: ${JSON.stringify(LOCAL_PROVIDER)},
 `).join("");
-  return `${shared}  environments: [${names}],
-
-  // One entry per environment: where that environment's values are read from.
-  providers: {
-${providers}  },
+  return `${shared}  // A provider that needs no fields is just its package name.
+  environments: {
+${entries}  },
 `;
 }
 function renderConfigModule(decisions) {
@@ -56620,13 +56600,13 @@ function planCutover(input) {
   const declared = declaredIn2(root);
   const named = environmentsDeclaredBy(selected);
   const chosen = named.length > 0 ? named : [requireEnvironment(input)];
-  const environments = declared === void 0 ? chosen : declared.environments;
+  const environments = declared === void 0 ? chosen : environmentNames(declared);
   for (const environment of chosen) {
     if (!environments.includes(environment)) {
       throw new PenvError(
         "INIT_ENVIRONMENT_UNDECLARED",
         `${CONFIG_FILE} declares ${describeList(environments)}, and adopting these files needs \`${environment}\` declared too`,
-        `Add \`${environment}\` to \`environments\` in ${CONFIG_FILE}, with a provider for it, then run \`penv init\` again. Nothing was changed.`
+        `Add \`${environment}: "${LOCAL_PROVIDER}"\` to \`environments\` in ${CONFIG_FILE}, or name the backend that holds it, then run \`penv init\` again. Nothing was changed.`
       );
     }
   }
@@ -56693,10 +56673,7 @@ function distinct(refs) {
 }
 function configFor(decisions) {
   return {
-    environments: decisions.environments,
-    providers: Object.fromEntries(
-      decisions.environments.map((environment) => [environment, { type: LOCAL_PROVIDER }])
-    ),
+    environments: environmentsRecord(decisions.environments),
     schemaFile: decisions.schemaFile,
     ...decisions.defaultEnvironment === void 0 ? {} : { defaultEnvironment: decisions.defaultEnvironment },
     ...decisions.publicPrefixes.length === 0 ? {} : { publicPrefixes: [...decisions.publicPrefixes] }
@@ -57036,7 +57013,8 @@ function offeredEnvironment(root) {
   if (declared === void 0) {
     return DEVELOPMENT;
   }
-  return declared.defaultEnvironment ?? (declared.environments.includes(DEVELOPMENT) ? DEVELOPMENT : declared.environments[0] ?? DEVELOPMENT);
+  const names = environmentNames(declared);
+  return declared.defaultEnvironment ?? (names.includes(DEVELOPMENT) ? DEVELOPMENT : names[0] ?? DEVELOPMENT);
 }
 async function cutoverWithYes(root, base, adoption) {
   const selected = selectionForYes(adoption);
@@ -57144,10 +57122,11 @@ var BACKUP_SUFFIX = ".backup";
 var DOTENV_SEGMENT = "env";
 var LOCAL3 = "local";
 function assertDeclared(segment, config2) {
-  if (config2.environments.includes(segment)) {
+  const declared = environmentNames(config2);
+  if (declared.includes(segment)) {
     return segment;
   }
-  throw new UnknownEnvironmentError(segment, config2.environments);
+  throw new UnknownEnvironmentError(segment, declared);
 }
 function scopeFromFilename(file2, config2) {
   const name = (0, import_node_path14.basename)(file2);
@@ -57217,7 +57196,7 @@ function explicitEnvironment(options, source, config2) {
   throw new PenvError(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
-    `Pass a declared environment \u2014 ${config2.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
+    `Pass a declared environment \u2014 ${environmentNames(config2).map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
   );
 }
 function assertEnvironmentAgrees(derived, explicit, source) {
@@ -57244,7 +57223,7 @@ function environmentNamed(file2, explicit) {
 }
 function decisionsOf(config2, cwd) {
   return {
-    environments: config2.environments,
+    environments: environmentNames(config2),
     // `import` re-scaffolds env.ts for an existing project; injection is an init
     // choice, so it is not turned on here.
     inject: false,
@@ -57300,7 +57279,7 @@ function importDotenv(options) {
     backup,
     scope,
     environment,
-    environments: config2.environments,
+    environments: environmentNames(config2),
     variables: parsed.entries.length,
     orphanComments: parsed.orphanComments,
     steps
@@ -57446,12 +57425,12 @@ function envVarFor2(id) {
 function runKeyCreate(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
-  const declared = project.config.keys?.[environment];
+  const declared = keyConfigFor(project.config, environment);
   if (declared === void 0) {
     throw new PenvError(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
-      `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
+      `Give its entry in penv.config.ts a \`keySource\` \u2014 e.g. \`${environment}: { provider: "@penvhq/provider-filesystem", keySource: "env" }\` \u2014 then run this again. The key is named after the environment unless the object form names another.`
     );
   }
   const key = (0, import_node_crypto.randomBytes)(KEY_BYTES).toString("base64");
@@ -57784,7 +57763,7 @@ async function planFile(project, source, target, parameter) {
     throw new PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
       `${recordPath(formatValueFile(source))} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
-      "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
+      "A key is declared by its environment's `keySource` in penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
     );
   }
   const keys = keySourceFor(project, environment);