@penvhq/cli 0.14.0 → 0.16.0

package/dist/index.cjs

@@ -602,22 +602,10 @@ var import_provider_filesystem2 = require("@penvhq/provider-filesystem");
 // src/env-flags.ts
 var import_core3 = require("@penvhq/core");
 var BASE_RESERVED = ["help", "version", "h", "v", "_", "--"];
-var COMMAND_FLAGS = [
-  ...BASE_RESERVED,
-  "env",
-  "out",
-  "allow-decrypt",
-  "destination",
-  "dest",
-  "d",
-  "location",
-  "l",
-  "yes",
-  "y"
-];
+var COMMAND_FLAGS = [...BASE_RESERVED, "env", "out", "allow-decrypt", "yes", "y"];
 function shadowedEnvironments(config) {
   const flags = new Set(COMMAND_FLAGS);
-  return config.environments.filter((environment) => flags.has(environment));
+  return (0, import_core3.environmentNames)(config).filter((environment) => flags.has(environment));
 }
 function shorthandCandidates(args, declared) {
   const reserved = /* @__PURE__ */ new Set([...BASE_RESERVED, ...declared]);
@@ -630,13 +618,14 @@ function environmentFromShorthand(config, candidates, explicit) {
   if (candidates.length === 0) {
     return void 0;
   }
-  const hits = candidates.filter((candidate) => config.environments.includes(candidate));
-  const strangers = candidates.filter((candidate) => !config.environments.includes(candidate));
+  const declared = (0, import_core3.environmentNames)(config);
+  const hits = candidates.filter((candidate) => declared.includes(candidate));
+  const strangers = candidates.filter((candidate) => !declared.includes(candidate));
   if (strangers.length > 0) {
     throw new import_core3.PenvError(
       "UNKNOWN_FLAG",
       `${quoteList(strangers)} ${strangers.length === 1 ? "is not a flag" : "are not flags"} this command takes, and ${strangers.length === 1 ? "names" : "name"} no declared environment`,
-      `Declared environments work as bare flags: ${quoteList(config.environments)}. Anything else needs \`--env <name>\`.`
+      `Declared environments work as bare flags: ${quoteList(declared)}. Anything else needs \`--env <name>\`.`
     );
   }
   if (hits.length > 1) {
@@ -727,14 +716,18 @@ async function loadPluginProvider(type, context) {
 function assertProvidersRegistered(config, projectRoot, options) {
   const local = localExtensions(projectRoot);
   const ci = options?.ci ?? isCi(process.env.CI);
-  for (const [environment, provider] of Object.entries(config.providers)) {
-    if (isProviderRegistered(provider.type)) {
+  for (const environment of (0, import_core4.environmentNames)(config)) {
+    const provider = (0, import_core4.environmentEntry)(config, environment)?.provider;
+    if (typeof provider !== "string" || provider.trim().length === 0) {
+      throw (0, import_core4.providerMissing)(environment);
+    }
+    if (isProviderRegistered(provider)) {
       continue;
     }
-    if (ci && local.includes(provider.type)) {
-      throw localExtensionInCi(provider.type, environment);
+    if (ci && local.includes(provider)) {
+      throw localExtensionInCi(provider, environment);
     }
-    resolveExtension(provider.type, projectRoot, environment, local);
+    resolveExtension(provider, projectRoot, environment, local);
   }
 }
 function resolveExtension(type, projectRoot, environment, local = localExtensions(projectRoot)) {
@@ -892,11 +885,11 @@ function schemaShapeFileOf(project) {
   return selfContainedSchemaModule(project.root, schemaFile) ?? import_core5.SCHEMA_SHAPE_FILE;
 }
 async function sourceProviderFor(project, environment) {
-  const providerConfig = project.config.providers[environment];
+  const providerConfig = (0, import_core5.environmentEntry)(project.config, environment);
   if (providerConfig === void 0) {
     return createProvider(LOCAL_TREE_TYPE, { root: project.root, config: project.config });
   }
-  return createSourceProvider(providerConfig.type, {
+  return createSourceProvider(providerConfig.provider, {
     root: project.root,
     config: project.config,
     providerConfig,
@@ -908,7 +901,7 @@ function targetEnvironment(project, explicit, shorthand) {
   return (0, import_core5.resolveEnvironment)(project.config, explicit ?? fromFlags);
 }
 var KEY_SEPARATOR = /[./\\]/;
-var NO_ENVIRONMENTS = { environments: [], providers: {} };
+var NO_ENVIRONMENTS = { environments: {} };
 function refFromKey(key, config) {
   const segments = key.split(KEY_SEPARATOR).filter((segment) => segment.length > 0);
   const name = segments[segments.length - 1];
@@ -1232,8 +1225,9 @@ function discoverDotenvFiles(root) {
   return files.sort((a, b) => order(a) < order(b) ? -1 : order(a) > order(b) ? 1 : 0);
 }
 function activeDotenvFiles(root, config) {
+  const declared = (0, import_core7.environmentNames)(config);
   return discoverDotenvFiles(root).filter(
-    (file) => file.environment === void 0 || config.environments.includes(file.environment)
+    (file) => file.environment === void 0 || declared.includes(file.environment)
   );
 }
 function environmentsDeclaredBy(files) {
@@ -1974,11 +1968,12 @@ function packageManifest(specifier, root) {
 }
 function declaredCredentials(config, root) {
   const declared = {};
-  for (const provider of Object.values(config.providers)) {
-    if ((0, import_core11.own)(declared, provider.type) !== void 0) {
+  for (const environment of (0, import_core11.environmentNames)(config)) {
+    const provider = (0, import_core11.environmentEntry)(config, environment)?.provider;
+    if (provider === void 0 || (0, import_core11.own)(declared, provider) !== void 0) {
       continue;
     }
-    const penv = packageManifest(provider.type, root)?.penv;
+    const penv = packageManifest(provider, root)?.penv;
     const credentials = isPlainObject(penv) ? penv.credentials : void 0;
     if (credentials === void 0) {
       continue;
@@ -1986,11 +1981,11 @@ function declaredCredentials(config, root) {
     if (!Array.isArray(credentials) || credentials.some((name) => typeof name !== "string" || !VARIABLE.test(name))) {
       throw new import_core11.PenvError(
         "PROVIDER_CREDENTIALS_INVALID",
-        `\`${provider.type}\` declares \`penv.credentials\`, and it is not a list of variable names`,
+        `\`${provider}\` declares \`penv.credentials\`, and it is not a list of variable names`,
         `Its package.json should read \`"penv": { "credentials": ["ACME_TOKEN"] }\` \u2014 penv strips exactly what an extension declares, so it will not guess at a declaration it cannot read.`
       );
     }
-    declared[provider.type] = credentials;
+    declared[provider] = credentials;
   }
   return declared;
 }
@@ -2682,38 +2677,23 @@ function lineReader(input = process.stdin, output = process.stdout) {
 // src/commands/push.ts
 var LAST_PUSHED_KEY = "lastPushedAt";
 async function destinationFor(project, environment, options) {
-  if (options.destination !== void 0) {
-    const providerConfig = {
-      type: options.destination,
-      ...options.location === void 0 ? {} : { location: options.location }
-    };
-    const provider2 = options.provider ?? await createSourceProvider(options.destination, {
-      root: project.root,
-      config: project.config,
-      providerConfig,
-      environment
-    });
-    return { provider: provider2, location: options.location };
-  }
-  const declared = project.config.providers[environment];
-  const location = declared?.location;
-  if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
+  const declared = (0, import_core15.environmentEntry)(project.config, environment);
+  if (declared === void 0 || declared.provider === LOCAL_TREE_TYPE) {
     throw new import_core15.PenvError(
       "NO_DESTINATION",
       `Environment ${environment}'s provider is the local records tree itself, so penv has nowhere to push`,
-      `Declare a provider for it in penv.config.ts \u2014 e.g. \`${environment}: { type: "@penvhq/provider-github", location: "owner/repo" }\` \u2014 or push somewhere once with \`penv push --env ${environment} --destination <package> --location <place>\`.`
+      `Declare the backend that holds it in penv.config.ts \u2014 e.g. \`${environment}: { provider: "@penvhq/provider-github", repository: "owner/repo" }\` \u2014 and run this again. A push only ever goes where the config says this environment lives.`
     );
   }
   if (options.provider !== void 0) {
-    return { provider: options.provider, location };
+    return options.provider;
   }
-  const provider = await createSourceProvider(declared.type, {
+  return createSourceProvider(declared.provider, {
     root: project.root,
     config: project.config,
     providerConfig: declared,
     environment
   });
-  return { provider, location };
 }
 function plan(resolutions, config, environment, allowDecrypt) {
   const outbound = [];
@@ -2797,7 +2777,7 @@ async function ensureTargetApproved(provider, environment, options) {
   await provider.ensureTarget(environment);
   return true;
 }
-async function pushProjection(project, provider, environment, location, options) {
+async function pushProjection(project, provider, environment, options) {
   const tree = localTree(project);
   const keys = keySourceFor(project, environment);
   const resolutions = resolveAllSync(tree, environment, keys, true);
@@ -2828,7 +2808,6 @@ async function pushProjection(project, provider, environment, location, options)
     environment,
     destination: provider.type,
     mode: "projection",
-    location,
     pushed: outbound.length,
     meta: 0,
     repositorySecrets,
@@ -2844,7 +2823,7 @@ function crossesToRecords(file, environment) {
   }
   return scope.kind === "environment" && scope.environment === environment;
 }
-async function pushRecords(project, provider, environment, location) {
+async function pushRecords(project, provider, environment) {
   const tree = localTree(project);
   const files = tree.listSync().filter((file) => crossesToRecords(file, environment));
   let pushed = 0;
@@ -2870,7 +2849,6 @@ async function pushRecords(project, provider, environment, location) {
     environment,
     destination: provider.type,
     mode: "records",
-    location,
     pushed,
     meta,
     repositorySecrets: 0,
@@ -2882,11 +2860,11 @@ async function pushRecords(project, provider, environment, location) {
 async function runPush(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment, options.envFlags);
-  const { provider, location } = await destinationFor(project, environment, options);
+  const provider = await destinationFor(project, environment, options);
   if ((0, import_core15.holdsProjection)(provider)) {
-    return pushProjection(project, provider, environment, location, options);
+    return pushProjection(project, provider, environment, options);
   }
-  return pushRecords(project, provider, environment, location);
+  return pushRecords(project, provider, environment);
 }
 function renderPush(result2) {
   if (result2.pushed === 0 && result2.meta === 0) {
@@ -2898,7 +2876,7 @@ function renderPush(result2) {
       }
     ]);
   }
-  const target = `${result2.destination} for environment ${result2.environment}${result2.location === void 0 ? "" : ` (${result2.location})`}`;
+  const target = `${result2.destination} for environment ${result2.environment}`;
   if (result2.mode === "records") {
     return formatRows([
       {
@@ -2947,6 +2925,19 @@ function renderPush(result2) {
   }
   return formatRows(rows);
 }
+var REDIRECT_FLAGS = ["destination", "dest", "d", "location", "l"];
+function assertNoRedirect(args) {
+  const given = REDIRECT_FLAGS.filter((flag) => args[flag] !== void 0);
+  const named = given[0];
+  if (named === void 0) {
+    return;
+  }
+  throw new import_core15.PenvError(
+    "REMOVED_FLAG",
+    `\`--${named}\` is not a flag \`penv push\` takes`,
+    "A push only ever goes where the config says this environment lives. Declare the destination in `environments.<env>` \u2014 the provider package, addressed in that provider's own words \u2014 and push with `--env <name>`."
+  );
+}
 var pushCommand = (0, import_citty6.defineCommand)({
   meta: {
     name: "push",
@@ -2958,16 +2949,6 @@ var pushCommand = (0, import_citty6.defineCommand)({
       type: "boolean",
       description: "Decrypt sealed values locally and push them as plaintext for the destination to re-seal"
     },
-    destination: {
-      type: "string",
-      alias: ["dest", "d"],
-      description: "Push once to this provider package instead of the declared one"
-    },
-    location: {
-      type: "string",
-      alias: "l",
-      description: "The destination-side place, when --destination needs one"
-    },
     yes: {
       type: "boolean",
       alias: "y",
@@ -2976,25 +2957,13 @@ var pushCommand = (0, import_citty6.defineCommand)({
   },
   run({ args }) {
     return guard(async () => {
+      assertNoRedirect(args);
       const result2 = await runPush({
         cwd: process.cwd(),
         ...args.env === void 0 ? {} : { environment: args.env },
         ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] },
-        ...args.destination === void 0 ? {} : { destination: args.destination },
-        ...args.location === void 0 ? {} : { location: args.location },
         ...args.yes === void 0 ? {} : { yes: args.yes },
-        envFlags: shorthandCandidates(args, [
-          "env",
-          "allow-decrypt",
-          "allowDecrypt",
-          "destination",
-          "dest",
-          "d",
-          "location",
-          "l",
-          "yes",
-          "y"
-        ])
+        envFlags: shorthandCandidates(args, ["env", "allow-decrypt", "allowDecrypt", "yes", "y"])
       });
       write(renderPush(result2));
     });
@@ -3093,7 +3062,7 @@ async function runDoctor(options) {
     check: "provider",
     severity: "pass",
     label: "Provider",
-    subject: project.config.providers[environment]?.type ?? project.provider.type
+    subject: (0, import_core16.environmentEntry)(project.config, environment)?.provider ?? project.provider.type
   });
   return {
     environment,
@@ -3363,8 +3332,8 @@ async function projectionFindings(project, environment, override) {
   if (override !== void 0) {
     projection = override;
   } else {
-    const declared = project.config.providers[environment];
-    if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
+    const declared = (0, import_core16.environmentEntry)(project.config, environment);
+    if (declared === void 0 || declared.provider === LOCAL_TREE_TYPE) {
       return [];
     }
     let source;
@@ -3376,7 +3345,7 @@ async function projectionFindings(project, environment, override) {
           check: "projection-unreachable",
           severity: "unknown",
           label: "Destination",
-          subject: `could not build the ${declared.type} provider for ${environment}`,
+          subject: `could not build the ${declared.provider} provider for ${environment}`,
           detail: errorDetail(error)
         }
       ];
@@ -3649,8 +3618,8 @@ function refPathOf(ref) {
   return [...ref.namespace, ref.name].join("/");
 }
 async function rotationSubjects(project, environment, local, override) {
-  const providerConfig = project.config.providers[environment];
-  if (override === void 0 && (providerConfig === void 0 || providerConfig.type === LOCAL_TREE_TYPE)) {
+  const providerConfig = (0, import_core16.environmentEntry)(project.config, environment);
+  if (override === void 0 && (providerConfig === void 0 || providerConfig.provider === LOCAL_TREE_TYPE)) {
     return { kind: "read", subjects: local };
   }
   const source = override ?? await sourceProviderFor(project, environment);
@@ -3672,7 +3641,7 @@ async function rotationSubjects(project, environment, local, override) {
         check: "rotation-overdue",
         severity: "unknown",
         label: "Rotation",
-        subject: `could not reach the ${providerConfig?.type ?? source.type} source of truth for ${environment}`,
+        subject: `could not reach the ${providerConfig?.provider ?? source.type} source of truth for ${environment}`,
         detail: errorDetail(error)
       }
     };
@@ -3793,8 +3762,8 @@ async function readRelevant(provider, environment) {
   return entries;
 }
 async function providerDriftFindings(project, environment, override) {
-  const providerConfig = project.config.providers[environment];
-  if (providerConfig === void 0 || providerConfig.type === LOCAL_TREE_TYPE) {
+  const providerConfig = (0, import_core16.environmentEntry)(project.config, environment);
+  if (providerConfig === void 0 || providerConfig.provider === LOCAL_TREE_TYPE) {
     return [
       {
         check: "provider-value-drift",
@@ -3819,7 +3788,7 @@ async function providerDriftFindings(project, environment, override) {
         check: "provider-value-drift",
         severity: "unknown",
         label: "Provider values",
-        subject: `could not reach the ${providerConfig.type} provider for ${environment}`,
+        subject: `could not reach the ${providerConfig.provider} provider for ${environment}`,
         detail: errorDetail(error)
       }
     ];
@@ -3838,7 +3807,7 @@ async function providerDriftFindings(project, environment, override) {
           severity: "unknown",
           label: "Provider value unreadable",
           subject: (0, import_core16.formatValueFile)(here.file),
-          detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.type} source of truth`
+          detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.provider} source of truth`
         });
         continue;
       }
@@ -3848,7 +3817,7 @@ async function providerDriftFindings(project, environment, override) {
           severity: "failure",
           label: "Provider value drift",
           subject: (0, import_core16.formatValueFile)(here.file),
-          detail: `the local tree and the ${providerConfig.type} source of truth hold different values`
+          detail: `the local tree and the ${providerConfig.provider} source of truth hold different values`
         });
       }
       continue;
@@ -3862,7 +3831,7 @@ async function providerDriftFindings(project, environment, override) {
       severity: "warning",
       label: here !== void 0 ? "Only in the local tree" : "Only in the source",
       subject: (0, import_core16.formatValueFile)(present.file),
-      detail: here !== void 0 ? `present locally, absent from the ${providerConfig.type} source of truth` : `present in the ${providerConfig.type} source of truth, absent from the local tree`
+      detail: here !== void 0 ? `present locally, absent from the ${providerConfig.provider} source of truth` : `present in the ${providerConfig.provider} source of truth, absent from the local tree`
     });
   }
   if (findings.length > 0) {
@@ -3873,7 +3842,7 @@ async function providerDriftFindings(project, environment, override) {
       check: "provider-value-drift",
       severity: "pass",
       label: "Provider values",
-      subject: `every value matches the ${providerConfig.type} source of truth for ${environment}`
+      subject: `every value matches the ${providerConfig.provider} source of truth for ${environment}`
     }
   ];
 }
@@ -3975,7 +3944,7 @@ function targetScope(project, options, key) {
     throw new import_core17.PenvError(
       "ENVIRONMENT_FLAG_EMPTY",
       `\`--env\` for parameter ${key} names no environment`,
-      `Pass a declared environment \u2014 ${project.config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
+      `Pass a declared environment \u2014 ${(0, import_core17.environmentNames)(project.config).map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
     );
   }
   return scopeFrom({ ...options, environment: targetEnvironment(project, environment) });
@@ -3988,7 +3957,7 @@ function sealFor(project, file, value, parameter, environment) {
     throw new import_core17.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
       `Parameter ${parameter} is a secret, and ${(0, import_core17.recordPath)((0, import_core17.formatValueFile)(file))} names no environment`,
-      "Keys are declared per environment in the `keys` block of penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
+      "A key is declared by its environment's `keySource` in penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
     );
   }
   return (0, import_core17.sealValue)(file, value, keySourceFor(project, environment), parameter, environment);
@@ -5074,8 +5043,14 @@ function environmentsFromFlag(flag) {
   }
   return [...new Set(names)];
 }
+function environmentsRecord(names) {
+  return Object.fromEntries(names.map((environment) => [environment, LOCAL_PROVIDER]));
+}
 function configOf(decisions) {
-  return { environments: decisions.environments, providers: {}, schemaFile: decisions.schemaFile };
+  return {
+    environments: environmentsRecord(decisions.environments),
+    schemaFile: decisions.schemaFile
+  };
 }
 function declaredIn2(root) {
   const file = (0, import_node_path13.join)(root, CONFIG_FILE);
@@ -5107,7 +5082,7 @@ function planInit(root, flags = {}) {
     if (schemaFile.length === 0) {
       throw emptyFlag("schema");
     }
-    const error = (0, import_core25.validateSchemaFile)({ environments: [], providers: {}, schemaFile })[0];
+    const error = (0, import_core25.validateSchemaFile)({ environments: {}, schemaFile })[0];
     if (error !== void 0) {
       throw error;
     }
@@ -5130,7 +5105,7 @@ function planInit(root, flags = {}) {
   }
   const suggestedEnvironments = suggestEnvironments(root);
   const safeDefault = flags.yes === true && declared === void 0;
-  const environments = flags.environments ?? declared?.environments ?? (safeDefault ? [DEVELOPMENT] : []);
+  const environments = flags.environments ?? (declared === void 0 ? void 0 : (0, import_core25.environmentNames)(declared)) ?? (safeDefault ? [DEVELOPMENT] : []);
   const defaultEnvironment = declared?.defaultEnvironment ?? (safeDefault ? DEVELOPMENT : void 0);
   if (safeDefault) {
     notes.push(
@@ -5263,27 +5238,27 @@ export { schema };
 
 ` + loadComment + loadCall;
 }
+function entryKey(name) {
+  return /^[A-Za-z_$][\w$]*$/.test(name) ? name : JSON.stringify(name);
+}
 function renderEnvironments(decisions) {
-  const shared = "  // Environments are a whitelist. A filename segment is an environment only if\n  // it is declared here \u2014 penv never infers one from a folder or a filename.\n";
+  const shared = "  // Environments are a whitelist, and each entry is that environment's whole\n  // declaration: which provider holds it, in that provider's own words, and\n  // which key seals it. A segment is an environment only if it is named here.\n";
   if (decisions.environments.length === 0) {
     return `${shared}  // It starts empty because which environments you deploy is not something penv
   // can read off your codebase, and an environment you do not have is worse
-  // than one you have not declared yet. Name yours, and give each a provider:
-  //   environments: ["development", "production"],
-  //   providers: { development: { type: "@penvhq/provider-filesystem" }, production: { type: "@penvhq/provider-vault" } },
-  environments: [],
-
-  providers: {},
+  // than one you have not declared yet. Name yours:
+  //   environments: {
+  //     development: "@penvhq/provider-filesystem",
+  //     production: { provider: "@penvhq/provider-vault", path: "penv", keySource: "env" },
+  //   },
+  environments: {},
 `;
   }
-  const names = decisions.environments.map((name) => JSON.stringify(name)).join(", ");
-  const providers = decisions.environments.map((name) => `    ${JSON.stringify(name)}: { type: "@penvhq/provider-filesystem" },
+  const entries = decisions.environments.map((name) => `    ${entryKey(name)}: ${JSON.stringify(LOCAL_PROVIDER)},
 `).join("");
-  return `${shared}  environments: [${names}],
-
-  // One entry per environment: where that environment's values are read from.
-  providers: {
-${providers}  },
+  return `${shared}  // A provider that needs no fields is just its package name.
+  environments: {
+${entries}  },
 `;
 }
 function renderConfigModule(decisions) {
@@ -5802,13 +5777,13 @@ function planCutover(input) {
   const declared = declaredIn2(root);
   const named = environmentsDeclaredBy(selected);
   const chosen = named.length > 0 ? named : [requireEnvironment(input)];
-  const environments = declared === void 0 ? chosen : declared.environments;
+  const environments = declared === void 0 ? chosen : (0, import_core25.environmentNames)(declared);
   for (const environment of chosen) {
     if (!environments.includes(environment)) {
       throw new import_core25.PenvError(
         "INIT_ENVIRONMENT_UNDECLARED",
         `${CONFIG_FILE} declares ${describeList(environments)}, and adopting these files needs \`${environment}\` declared too`,
-        `Add \`${environment}\` to \`environments\` in ${CONFIG_FILE}, with a provider for it, then run \`penv init\` again. Nothing was changed.`
+        `Add \`${environment}: "${LOCAL_PROVIDER}"\` to \`environments\` in ${CONFIG_FILE}, or name the backend that holds it, then run \`penv init\` again. Nothing was changed.`
       );
     }
   }
@@ -5875,10 +5850,7 @@ function distinct(refs) {
 }
 function configFor(decisions) {
   return {
-    environments: decisions.environments,
-    providers: Object.fromEntries(
-      decisions.environments.map((environment) => [environment, { type: LOCAL_PROVIDER }])
-    ),
+    environments: environmentsRecord(decisions.environments),
     schemaFile: decisions.schemaFile,
     ...decisions.defaultEnvironment === void 0 ? {} : { defaultEnvironment: decisions.defaultEnvironment },
     ...decisions.publicPrefixes.length === 0 ? {} : { publicPrefixes: [...decisions.publicPrefixes] }
@@ -6218,7 +6190,8 @@ function offeredEnvironment(root) {
   if (declared === void 0) {
     return DEVELOPMENT;
   }
-  return declared.defaultEnvironment ?? (declared.environments.includes(DEVELOPMENT) ? DEVELOPMENT : declared.environments[0] ?? DEVELOPMENT);
+  const names = (0, import_core25.environmentNames)(declared);
+  return declared.defaultEnvironment ?? (names.includes(DEVELOPMENT) ? DEVELOPMENT : names[0] ?? DEVELOPMENT);
 }
 async function cutoverWithYes(root, base, adoption) {
   const selected = selectionForYes(adoption);
@@ -6326,10 +6299,11 @@ var BACKUP_SUFFIX = ".backup";
 var DOTENV_SEGMENT = "env";
 var LOCAL2 = "local";
 function assertDeclared(segment, config) {
-  if (config.environments.includes(segment)) {
+  const declared = (0, import_core26.environmentNames)(config);
+  if (declared.includes(segment)) {
     return segment;
   }
-  throw new import_core26.UnknownEnvironmentError(segment, config.environments);
+  throw new import_core26.UnknownEnvironmentError(segment, declared);
 }
 function scopeFromFilename(file, config) {
   const name = (0, import_node_path14.basename)(file);
@@ -6399,7 +6373,7 @@ function explicitEnvironment(options, source, config) {
   throw new import_core26.PenvError(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
-    `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
+    `Pass a declared environment \u2014 ${(0, import_core26.environmentNames)(config).map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
   );
 }
 function assertEnvironmentAgrees(derived, explicit, source) {
@@ -6426,7 +6400,7 @@ function environmentNamed(file, explicit) {
 }
 function decisionsOf(config, cwd) {
   return {
-    environments: config.environments,
+    environments: (0, import_core26.environmentNames)(config),
     // `import` re-scaffolds env.ts for an existing project; injection is an init
     // choice, so it is not turned on here.
     inject: false,
@@ -6482,7 +6456,7 @@ function importDotenv(options) {
     backup,
     scope,
     environment,
-    environments: config.environments,
+    environments: (0, import_core26.environmentNames)(config),
     variables: parsed.entries.length,
     orphanComments: parsed.orphanComments,
     steps
@@ -6630,12 +6604,12 @@ function envVarFor(id) {
 function runKeyCreate(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
-  const declared = project.config.keys?.[environment];
+  const declared = (0, import_core28.keyConfigFor)(project.config, environment);
   if (declared === void 0) {
     throw new import_core28.PenvError(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
-      `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
+      `Give its entry in penv.config.ts a \`keySource\` \u2014 e.g. \`${environment}: { provider: "@penvhq/provider-filesystem", keySource: "env" }\` \u2014 then run this again. The key is named after the environment unless the object form names another.`
     );
   }
   const key = (0, import_node_crypto.randomBytes)(import_core28.KEY_BYTES).toString("base64");
@@ -6978,7 +6952,7 @@ async function planFile(project, source, target, parameter) {
     throw new import_core31.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
       `${(0, import_core31.recordPath)((0, import_core31.formatValueFile)(source))} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
-      "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
+      "A key is declared by its environment's `keySource` in penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
     );
   }
   const keys = keySourceFor(project, environment);