@penvhq/cli 0.4.0 → 0.6.0

package/dist/index.cjs

@@ -52,42 +52,93 @@ __export(index_exports, {
   runWatch: () => runWatch
 });
 module.exports = __toCommonJS(index_exports);
-var import_core22 = require("@penvhq/core");
+var import_core24 = require("@penvhq/core");
 var import_citty18 = require("citty");
 
 // src/commands/doctor.ts
-var import_core7 = require("@penvhq/core");
-var import_sink_github2 = require("@penvhq/sink-github");
+var import_core8 = require("@penvhq/core");
 var import_citty3 = require("citty");
 
+// src/env-flags.ts
+var import_core = require("@penvhq/core");
+var BASE_RESERVED = ["help", "version", "h", "v", "_", "--"];
+var COMMAND_FLAGS = [
+  ...BASE_RESERVED,
+  "env",
+  "out",
+  "allow-decrypt",
+  "destination",
+  "dest",
+  "d",
+  "location",
+  "l",
+  "yes",
+  "y"
+];
+function shadowedEnvironments(config) {
+  const flags = new Set(COMMAND_FLAGS);
+  return config.environments.filter((environment) => flags.has(environment));
+}
+function shorthandCandidates(args, declared) {
+  const reserved = /* @__PURE__ */ new Set([...BASE_RESERVED, ...declared]);
+  return Object.keys(args).filter((key) => !reserved.has(key) && args[key] === true);
+}
+function quoteList(values) {
+  return values.map((value) => `\`--${value}\``).join(", ");
+}
+function environmentFromShorthand(config, candidates, explicit) {
+  if (candidates.length === 0) {
+    return void 0;
+  }
+  const hits = candidates.filter((candidate) => config.environments.includes(candidate));
+  const strangers = candidates.filter((candidate) => !config.environments.includes(candidate));
+  if (strangers.length > 0) {
+    throw new import_core.PenvError(
+      "UNKNOWN_FLAG",
+      `${quoteList(strangers)} ${strangers.length === 1 ? "is not a flag" : "are not flags"} this command takes, and ${strangers.length === 1 ? "names" : "name"} no declared environment`,
+      `Declared environments work as bare flags: ${quoteList(config.environments)}. Anything else needs \`--env <name>\`.`
+    );
+  }
+  if (hits.length > 1) {
+    throw new import_core.PenvError(
+      "ENVIRONMENT_FLAG_AMBIGUOUS",
+      `${quoteList(hits)} name two environments at once, and a command acts on exactly one`,
+      "Pass a single environment flag, or the canonical `--env <name>`."
+    );
+  }
+  const hit = hits[0];
+  if (hit !== void 0 && explicit !== void 0 && explicit !== hit) {
+    throw new import_core.PenvError(
+      "ENVIRONMENT_FLAG_AMBIGUOUS",
+      `\`--env ${explicit}\` and \`--${hit}\` name two environments at once`,
+      "Drop one of them \u2014 `--env` is the canonical spelling."
+    );
+  }
+  return hit;
+}
+
 // src/project.ts
 var import_node_path2 = require("path");
-var import_core2 = require("@penvhq/core");
+var import_core3 = require("@penvhq/core");
 var import_provider_filesystem2 = require("@penvhq/provider-filesystem");
 
 // src/registry.ts
 var import_node_module = require("module");
 var import_node_path = require("path");
 var import_node_url = require("url");
-var import_core = require("@penvhq/core");
+var import_core2 = require("@penvhq/core");
 var import_provider_filesystem = require("@penvhq/provider-filesystem");
-var import_provider_kubernetes = require("@penvhq/provider-kubernetes");
 var import_provider_mock = require("@penvhq/provider-mock");
-var import_provider_ssm = require("@penvhq/provider-ssm");
-var import_provider_vault = require("@penvhq/provider-vault");
 var PLUGIN_FACTORY_EXPORT = "penvProviderFactory";
-var LOCAL_TREE_TYPE = "filesystem";
+var LOCAL_TREE_TYPE = "@penvhq/provider-filesystem";
 var REGISTRY = /* @__PURE__ */ new Map([
   [LOCAL_TREE_TYPE, ({ root, config }) => (0, import_provider_filesystem.createFilesystemProvider)({ root, config })],
-  ["vault", ({ providerConfig }) => (0, import_provider_vault.createVaultProvider)({ path: providerConfig?.path ?? "penv" })],
-  ["ssm", ({ providerConfig }) => (0, import_provider_ssm.createSsmProvider)({ path: providerConfig?.path ?? "penv" })],
   [
-    "kubernetes",
-    ({ providerConfig }) => (0, import_provider_kubernetes.createKubernetesProvider)(kubernetesOptions(providerConfig))
-  ],
-  ["mock", ({ root }) => (0, import_provider_mock.createMockProvider)({ storePath: (0, import_node_path.resolve)(root, ".penv-mock.json") })]
+    "@penvhq/provider-mock",
+    ({ root }) => (0, import_provider_mock.createMockProvider)({ storePath: (0, import_node_path.resolve)(root, ".penv-mock.json") })
+  ]
 ]);
-var CONTRACT_METHODS = [
+var RECORD_CONTRACT_METHODS = [
   "read",
   "write",
   "list",
@@ -96,6 +147,7 @@ var CONTRACT_METHODS = [
   "writeMeta",
   "removeMeta"
 ];
+var PROJECTION_CONTRACT_METHODS = ["verify", "push", "list"];
 var pluginModuleCache = /* @__PURE__ */ new Map();
 function isProviderRegistered(type) {
   return REGISTRY.has(type);
@@ -115,31 +167,30 @@ async function createSourceProvider(type, context) {
 }
 async function loadPluginProvider(type, context) {
   const fromDir = resolutionBase(context);
-  const specifier = pluginSpecifier(context.providerConfig, type);
-  const resolved = resolvePlugin(specifier, fromDir);
+  const resolved = resolvePlugin(type, fromDir);
   if (resolved === void 0) {
-    throw unknownProvider(type, context.environment, specifier);
+    throw unknownProvider(type, context.environment);
   }
   let mod;
   try {
     mod = await importPlugin(resolved);
   } catch {
-    throw new import_core.PenvError(
+    throw new import_core2.PenvError(
       "PROVIDER_PLUGIN_LOAD",
-      `The provider package \`${specifier}\` for type \`${type}\` failed to load`,
+      `The provider package \`${type}\` failed to load`,
       "It resolved but threw while importing. Check it builds and its dependencies are installed."
     );
   }
   const factory = mod[PLUGIN_FACTORY_EXPORT];
   if (typeof factory !== "function") {
-    throw new import_core.PenvError(
+    throw new import_core2.PenvError(
       "PROVIDER_PLUGIN_INVALID",
-      `\`${specifier}\` does not export \`${PLUGIN_FACTORY_EXPORT}\``,
+      `\`${type}\` does not export \`${PLUGIN_FACTORY_EXPORT}\``,
       `A penv provider package must export \`${PLUGIN_FACTORY_EXPORT}(context) => Provider\`.`
     );
   }
   const provider = await factory(context);
-  assertSatisfiesContract(provider, specifier);
+  assertSatisfiesContract(provider, type);
   return provider;
 }
 function assertProvidersRegistered(config, projectRoot) {
@@ -147,15 +198,11 @@ function assertProvidersRegistered(config, projectRoot) {
     if (isProviderRegistered(provider.type)) {
       continue;
     }
-    const specifier = pluginSpecifier(provider, provider.type);
-    if (resolvePlugin(specifier, projectRoot) === void 0) {
-      throw unknownProvider(provider.type, environment, specifier);
+    if (resolvePlugin(provider.type, projectRoot) === void 0) {
+      throw unknownProvider(provider.type, environment);
     }
   }
 }
-function pluginSpecifier(providerConfig, type) {
-  return providerConfig?.module ?? `@penvhq/provider-${type}`;
-}
 function resolutionBase(context) {
   return (0, import_node_path.dirname)(context.root);
 }
@@ -177,39 +224,33 @@ function importPlugin(resolvedPath) {
   return loading;
 }
 function assertSatisfiesContract(provider, specifier) {
-  for (const method of CONTRACT_METHODS) {
+  const projection = (0, import_core2.holdsProjection)(provider);
+  const methods = projection ? PROJECTION_CONTRACT_METHODS : RECORD_CONTRACT_METHODS;
+  const contract = projection ? "the @penvhq/core ProjectionProvider contract its declared capabilities select" : "the @penvhq/core Provider contract that the filesystem provider defines";
+  for (const method of methods) {
     if (typeof provider[method] !== "function") {
-      throw new import_core.PenvError(
+      throw new import_core2.PenvError(
         "PROVIDER_PLUGIN_INVALID",
         `The provider from \`${specifier}\` is missing \`${method}()\``,
-        "It must satisfy the @penvhq/core Provider contract that the filesystem provider defines."
+        `It must satisfy ${contract}.`
       );
     }
   }
 }
-function kubernetesOptions(providerConfig) {
-  const path = providerConfig?.path ?? "penv";
-  const slash = path.indexOf("/");
-  if (slash === -1) return { secretName: path };
-  const namespace = path.slice(0, slash);
-  const secretName = path.slice(slash + 1) || "penv";
-  return namespace === "" ? { secretName } : { namespace, secretName };
-}
-function unknownProvider(type, environment, specifier) {
-  const known = [...REGISTRY.keys()].map((name) => `\`${name}\``).join(", ");
+function unknownProvider(type, environment) {
+  const preinstalled = [...REGISTRY.keys()].map((name) => `\`${name}\``).join(", ");
   const where = environment === void 0 ? "" : ` for environment ${environment}`;
-  const remedy = specifier === void 0 ? `This build registers ${known}. Name a registered provider, or install the build that carries \`${type}\`.` : `Install its package with \`npm i ${specifier}\`, or name a built-in provider: ${known}.`;
-  return new import_core.PenvError(
+  return new import_core2.PenvError(
     "UNKNOWN_PROVIDER",
-    `The provider type \`${type}\`${where} in penv.config.ts is not one this penv build carries`,
-    remedy
+    `The provider \`${type}\`${where} in penv.config.ts is not installed in this project`,
+    `Install it with \`npm i ${type}\` \u2014 a provider's \`type\` is the package penv imports. The CLI ships ${preinstalled} pre-installed.`
   );
 }
 
 // src/project.ts
 var PENV_DIR = ".penv";
 function openProject(cwd) {
-  const { config, file } = (0, import_core2.loadConfig)(cwd);
+  const { config, file } = (0, import_core3.loadConfig)(cwd);
   const root = (0, import_node_path2.dirname)(file);
   const penvDir = (0, import_node_path2.resolve)(root, PENV_DIR);
   assertProvidersRegistered(config, root);
@@ -223,7 +264,7 @@ function openProject(cwd) {
 }
 function localTree(project) {
   if (!(project.provider instanceof import_provider_filesystem2.FilesystemProvider)) {
-    throw new import_core2.PenvError(
+    throw new import_core3.PenvError(
       "PROVIDER_NOT_LOCAL",
       `This command reads the local .penv tree synchronously, which the \`${project.provider.type}\` provider is not`,
       "Run this against a filesystem-backed project, or use a command that speaks the async provider contract."
@@ -243,8 +284,9 @@ async function sourceProviderFor(project, environment) {
     environment
   });
 }
-function targetEnvironment(project, explicit) {
-  return (0, import_core2.resolveEnvironment)(project.config, explicit);
+function targetEnvironment(project, explicit, shorthand) {
+  const fromFlags = shorthand === void 0 ? void 0 : environmentFromShorthand(project.config, shorthand, explicit);
+  return (0, import_core3.resolveEnvironment)(project.config, explicit ?? fromFlags);
 }
 var KEY_SEPARATOR = /[./\\]/;
 var NO_ENVIRONMENTS = { environments: [], providers: {} };
@@ -252,56 +294,56 @@ function refFromKey(key, config) {
   const segments = key.split(KEY_SEPARATOR).filter((segment) => segment.length > 0);
   const name = segments[segments.length - 1];
   if (name === void 0) {
-    throw new import_core2.PenvError(
+    throw new import_core3.PenvError(
       "PARAMETER_KEY",
       `\`${key}\` names no parameter`,
       "A key is `<namespace>/<name>` or `<namespace>.<name>`, e.g. `redis/password`."
     );
   }
-  if ((0, import_core2.isReservedToken)(name, config ?? NO_ENVIRONMENTS)) {
-    throw new import_core2.ReservedTokenError("parameter", name, key);
+  if ((0, import_core3.isReservedToken)(name, config ?? NO_ENVIRONMENTS)) {
+    throw new import_core3.ReservedTokenError("parameter", name, key);
   }
   return { namespace: segments.slice(0, -1), name };
 }
 function assertWritableKey(key) {
   const segments = key.split(KEY_SEPARATOR).filter((s) => s.length > 0);
-  if (segments.length === 0 || segments.every((s) => (0, import_core2.isCanonicalSegment)(s))) {
+  if (segments.length === 0 || segments.every((s) => (0, import_core3.isCanonicalSegment)(s))) {
     return;
   }
-  const ref = (0, import_core2.refFromAccessPath)(segments);
+  const ref = (0, import_core3.refFromAccessPath)(segments);
   if (ref !== void 0) {
     const suggestion = [...ref.namespace, ref.name].join("/");
-    throw new import_core2.PenvError(
+    throw new import_core3.PenvError(
       "PARAMETER_KEY_CASING",
       `\`${key}\` is not a canonical parameter name`,
       `Parameter files are lower-case and hyphenated. Did you mean \`${suggestion}\`? That is the file that backs the \`${key}\` key in your schema.`
     );
   }
-  throw new import_core2.PenvError(
+  throw new import_core3.PenvError(
     "PARAMETER_KEY_UNREACHABLE",
     `No value file can be named that reaches \`${key}\``,
     "Parameter files are lower-case and hyphenated, and this key maps to no such file \u2014 a run of capitals like `apiURL` cannot be reached (use `api-url`, which the schema reads as `apiUrl`). Run `penv validate` or `penv fill` to see the names penv expects."
   );
 }
 function keySourceFor(project, environment) {
-  return (0, import_core2.resolveKeySource)(project.config, environment);
+  return (0, import_core3.resolveKeySource)(project.config, environment);
 }
 function resolveSync(provider, ref, environment, keys, skipPersonal) {
-  for (const file of (0, import_core2.candidatesFor)(ref, environment, skipPersonal)) {
+  for (const file of (0, import_core3.candidatesFor)(ref, environment, skipPersonal)) {
     const read = provider.readSync(file);
     if (read === void 0) {
       continue;
     }
-    const opened = (0, import_core2.openValue)(file, read, keys);
+    const opened = (0, import_core3.openValue)(file, read, keys);
     return {
       ref,
-      parameter: (0, import_core2.parameterId)(ref),
+      parameter: (0, import_core3.parameterId)(ref),
       value: opened.kind === "plaintext" ? opened.value : void 0,
       ...opened.kind === "failed" ? { undecryptable: opened.failure } : {},
-      winner: { file, location: (0, import_core2.formatValueFile)(file), present: true }
+      winner: { file, location: (0, import_core3.formatValueFile)(file), present: true }
     };
   }
-  return { ref, parameter: (0, import_core2.parameterId)(ref), value: void 0, winner: void 0 };
+  return { ref, parameter: (0, import_core3.parameterId)(ref), value: void 0, winner: void 0 };
 }
 function resolveAllSync(provider, environment, keys, skipPersonal) {
   return refsFrom(provider.listSync()).map(
@@ -312,33 +354,33 @@ function refsFrom(files) {
   const refs = /* @__PURE__ */ new Map();
   for (const file of files) {
     const ref = { namespace: file.namespace, name: file.name };
-    const id = (0, import_core2.parameterId)(ref);
+    const id = (0, import_core3.parameterId)(ref);
     if (!refs.has(id)) {
       refs.set(id, ref);
     }
   }
   return [...refs.values()].sort((a, b) => {
-    const left = (0, import_core2.parameterId)(a);
-    const right = (0, import_core2.parameterId)(b);
+    const left = (0, import_core3.parameterId)(a);
+    const right = (0, import_core3.parameterId)(b);
     return left < right ? -1 : left > right ? 1 : 0;
   });
 }
 
 // src/schema.ts
-var import_core3 = require("@penvhq/core");
-function defOf(node) {
-  if (typeof node !== "object" || node === null) {
+var import_core4 = require("@penvhq/core");
+function defOf(node2) {
+  if (typeof node2 !== "object" || node2 === null) {
     return void 0;
   }
-  const def = node.def;
+  const def = node2.def;
   return typeof def === "object" && def !== null ? def : void 0;
 }
-function typeOf(node) {
-  const type = defOf(node)?.type;
+function typeOf(node2) {
+  const type = defOf(node2)?.type;
   return typeof type === "string" ? type : void 0;
 }
-function unwrap(node) {
-  let current = node;
+function unwrap(node2) {
+  let current = node2;
   for (let depth = 0; depth < 8; depth += 1) {
     const inner = defOf(current)?.innerType;
     if (inner === void 0) {
@@ -348,38 +390,38 @@ function unwrap(node) {
   }
   return current;
 }
-function shapeOf(node) {
-  if (typeOf(node) !== "object") {
+function shapeOf(node2) {
+  if (typeOf(node2) !== "object") {
     return void 0;
   }
-  const shape = node.shape;
+  const shape = node2.shape;
   return typeof shape === "object" && shape !== null ? shape : void 0;
 }
 function lookup(root, path) {
-  let node = unwrap(root);
+  let node2 = unwrap(root);
   for (const key of path) {
-    const shape = shapeOf(node);
+    const shape = shapeOf(node2);
     if (shape === void 0) {
       return { kind: "unknown" };
     }
     if (!Object.hasOwn(shape, key)) {
       return { kind: "absent" };
     }
-    node = unwrap(shape[key]);
+    node2 = unwrap(shape[key]);
   }
-  return { kind: "found", node };
+  return { kind: "found", node: node2 };
 }
-function minLengthOf(node) {
-  if (typeOf(node) !== "string") {
+function minLengthOf(node2) {
+  if (typeOf(node2) !== "string") {
     return void 0;
   }
-  const min = node.minLength;
+  const min = node2.minLength;
   return typeof min === "number" ? min : void 0;
 }
 var ABSENCE_PERMITTED = /* @__PURE__ */ new Set(["optional", "default", "catch", "prefault"]);
 var ABSENCE_REFUSED = /* @__PURE__ */ new Set(["nullable", "nonoptional", "readonly"]);
-function permitsAbsence(node) {
-  let current = node;
+function permitsAbsence(node2) {
+  let current = node2;
   for (let depth = 0; depth < 8; depth += 1) {
     const type = typeOf(current);
     if (type !== void 0 && ABSENCE_PERMITTED.has(type)) {
@@ -396,13 +438,13 @@ function permitsAbsence(node) {
   }
   return void 0;
 }
-function leaves(node, path, inherited, out2) {
-  const own = permitsAbsence(node);
+function leaves(node2, path, inherited, out2) {
+  const own = permitsAbsence(node2);
   const absencePermitted = inherited === true || own === true ? true : combine(inherited, own);
-  const shape = shapeOf(unwrap(node));
+  const shape = shapeOf(unwrap(node2));
   if (shape === void 0) {
     if (path.length > 0) {
-      out2.push({ path, absencePermitted, node });
+      out2.push({ path, absencePermitted, node: node2 });
     }
     return;
   }
@@ -418,8 +460,8 @@ function declaredLeaves(schema) {
   leaves(schema, [], false, out2);
   return out2;
 }
-function defaultValueOf(node) {
-  let current = node;
+function defaultValueOf(node2) {
+  let current = node2;
   for (let depth = 0; depth < 8; depth += 1) {
     const def = defOf(current);
     if (def === void 0) {
@@ -464,9 +506,9 @@ function computeDrift(input) {
       continue;
     }
     const path = leaf.path.join(".");
-    const ref = (0, import_core3.refFromAccessPath)(leaf.path);
+    const ref = (0, import_core4.refFromAccessPath)(leaf.path);
     const renameRemedy = `Rename the \`${path}\` key in .penv/env.ts \u2014 a parameter name is lower-case, hyphenated, and never a reserved token, so no value file reaches this key.`;
-    if (ref === void 0 || (0, import_core3.isReservedToken)(ref.name, config)) {
+    if (ref === void 0 || (0, import_core4.isReservedToken)(ref.name, config)) {
       if (leaf.absencePermitted) {
         optional.push({ subject: path, remedy: renameRemedy });
       } else {
@@ -478,13 +520,13 @@ function computeDrift(input) {
       }
       continue;
     }
-    if (valued.has((0, import_core3.parameterId)(ref))) {
+    if (valued.has((0, import_core4.parameterId)(ref))) {
       continue;
     }
     if (leaf.absencePermitted) {
       const defaultValue = defaultValueOf(leaf.node);
       optional.push({
-        subject: (0, import_core3.parameterId)(ref),
+        subject: (0, import_core4.parameterId)(ref),
         ref,
         ...defaultValue === void 0 ? {} : { defaultValue },
         remedy: `penv set ${[...ref.namespace, ref.name].join("/")} --env ${environment}`
@@ -492,7 +534,7 @@ function computeDrift(input) {
       continue;
     }
     declared.push({
-      subject: (0, import_core3.parameterId)(ref),
+      subject: (0, import_core4.parameterId)(ref),
       ref,
       remedy: `penv set ${[...ref.namespace, ref.name].join("/")} --env ${environment}`,
       detail: `declared in .penv/env.ts, no value for ${environment}`
@@ -500,12 +542,12 @@ function computeDrift(input) {
   }
   const undeclared = [];
   for (const resolution of resolutions) {
-    if (lookup(schema, (0, import_core3.accessPath)(resolution.ref)).kind !== "absent") {
+    if (lookup(schema, (0, import_core4.accessPath)(resolution.ref)).kind !== "absent") {
       continue;
     }
     undeclared.push({
       ref: resolution.ref,
-      variable: (0, import_core3.variableName)(resolution.ref, config)
+      variable: (0, import_core4.variableName)(resolution.ref, config)
     });
   }
   return { declared, undeclared, optional };
@@ -560,7 +602,7 @@ function padVisible(text, width) {
 }
 
 // src/ui.ts
-var import_core4 = require("@penvhq/core");
+var import_core5 = require("@penvhq/core");
 var CHECK = "\u2713";
 var WARN = "\u26A0";
 var CROSS = "\u2717";
@@ -634,7 +676,7 @@ function write(lines) {
   }
 }
 function reportError(error) {
-  if (error instanceof import_core4.PenvError) {
+  if (error instanceof import_core5.PenvError) {
     const suffix = error.remedy === void 0 ? void 0 : `
   ${error.remedy}`;
     const message = suffix !== void 0 && error.message.endsWith(suffix) ? error.message.slice(0, -suffix.length) : error.message;
@@ -668,31 +710,86 @@ async function guard(run) {
 }
 
 // src/commands/push.ts
-var import_core5 = require("@penvhq/core");
-var import_sink_github = require("@penvhq/sink-github");
+var import_core6 = require("@penvhq/core");
 var import_citty = require("citty");
+
+// src/input.ts
+var import_node_readline = require("readline");
+function lineReader(input = process.stdin, output = process.stdout) {
+  const rl = (0, import_node_readline.createInterface)({ input, output });
+  const buffered = [];
+  const waiting = [];
+  let closed = false;
+  rl.on("line", (line) => {
+    const next = waiting.shift();
+    if (next === void 0) {
+      buffered.push(line);
+    } else {
+      next(line);
+    }
+  });
+  rl.on("close", () => {
+    closed = true;
+    for (const next of waiting.splice(0)) {
+      next(void 0);
+    }
+  });
+  return {
+    ask(question) {
+      const early = buffered.shift();
+      if (early !== void 0) {
+        return Promise.resolve(early);
+      }
+      if (closed) {
+        return Promise.resolve(void 0);
+      }
+      rl.setPrompt(question);
+      rl.prompt();
+      return new Promise((resolve7) => {
+        waiting.push(resolve7);
+      });
+    },
+    close() {
+      rl.close();
+    }
+  };
+}
+
+// src/commands/push.ts
 var LAST_PUSHED_KEY = "lastPushedAt";
-function sinkFor(project, environment, override) {
-  const declared = project.config.sinks?.[environment];
-  if (declared === void 0) {
-    throw new import_core5.PenvError(
-      "NO_SINK",
-      `Environment ${environment} declares no sink in penv.config.ts, so penv has nowhere to push`,
-      `Add a \`sinks\` entry, e.g. \`sinks: { ${environment}: { type: "github" } }\`, then run \`penv push --env ${environment}\` again.`
+async function destinationFor(project, environment, options) {
+  if (options.destination !== void 0) {
+    const providerConfig = {
+      type: options.destination,
+      ...options.location === void 0 ? {} : { location: options.location }
+    };
+    const provider2 = options.provider ?? await createSourceProvider(options.destination, {
+      root: project.penvDir,
+      config: project.config,
+      providerConfig,
+      environment
+    });
+    return { provider: provider2, location: options.location };
+  }
+  const declared = project.config.providers[environment];
+  const location = declared?.location;
+  if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
+    throw new import_core6.PenvError(
+      "NO_DESTINATION",
+      `Environment ${environment}'s provider is the local .penv tree itself, so penv has nowhere to push`,
+      `Declare a provider for it in penv.config.ts \u2014 e.g. \`${environment}: { type: "@penvhq/provider-github", location: "owner/repo" }\` \u2014 or push somewhere once with \`penv push --env ${environment} --destination <package> --location <place>\`.`
     );
   }
-  const repo = declared.repo;
-  if (override !== void 0) {
-    return { sink: override, repo };
-  }
-  if (declared.type === "github") {
-    return { sink: (0, import_sink_github.createGithubSink)(repo === void 0 ? {} : { repo }), repo };
+  if (options.provider !== void 0) {
+    return { provider: options.provider, location };
   }
-  throw new import_core5.PenvError(
-    "UNKNOWN_SINK",
-    `Environment ${environment} declares sink type \`${declared.type}\`, which penv does not know`,
-    'The only sink in this release is `github`. Set `type: "github"`.'
-  );
+  const provider = await createSourceProvider(declared.type, {
+    root: project.penvDir,
+    config: project.config,
+    providerConfig: declared,
+    environment
+  });
+  return { provider, location };
 }
 function plan(resolutions, config, environment, allowDecrypt) {
   const outbound = [];
@@ -704,13 +801,13 @@ function plan(resolutions, config, environment, allowDecrypt) {
     let encrypted = false;
     if (winner.file.encrypted) {
       if (!allowDecrypt) {
-        throw new import_core5.PenvError(
+        throw new import_core6.PenvError(
           "ENCRYPTED_VALUE_REFUSED",
-          `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and a push sends plaintext for GitHub to re-seal`,
-          "Re-run with `--allow-decrypt` to decrypt it locally and push it, or push an environment whose values are plaintext. penv's encryption stops at the sink; the destination seals it under its own key."
+          `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and a push sends plaintext for the destination to re-seal`,
+          "Re-run with `--allow-decrypt` to decrypt it locally and push it, or push an environment whose values are plaintext. penv's encryption stops at the projection; the destination seals it under its own key."
         );
       }
-      (0, import_core5.requireValue)(resolution, environment);
+      (0, import_core6.requireValue)(resolution, environment);
       encrypted = true;
     }
     if (resolution.value === void 0) {
@@ -719,7 +816,7 @@ function plan(resolutions, config, environment, allowDecrypt) {
     const scope = winner.file.scope.kind === "unscoped" ? { kind: "repository" } : { kind: "environment", environment };
     outbound.push({
       ref: resolution.ref,
-      variable: (0, import_core5.variableName)(resolution.ref, config),
+      variable: (0, import_core6.variableName)(resolution.ref, config),
       value: resolution.value,
       scope,
       encrypted
@@ -737,28 +834,65 @@ function recordPush(tree, ref, environment, iso) {
   const meta = withLastPushed(tree.readMetaSync(ref), environment, iso);
   tree.writeMetaSync(ref, meta);
 }
-async function runPush(options) {
-  const project = openProject(options.cwd);
-  const environment = targetEnvironment(project, options.environment);
-  const { sink, repo } = sinkFor(project, environment, options.sink);
+async function terminalConfirm(question) {
+  if (process.stdin.isTTY !== true) {
+    return false;
+  }
+  const reader = lineReader();
+  try {
+    const answer = await reader.ask(`${question} [y/N] `);
+    return answer !== void 0 && /^y(es)?$/i.test(answer.trim());
+  } finally {
+    reader.close();
+  }
+}
+async function ensureTargetApproved(provider, environment, options) {
+  if (provider.targetExists === void 0) {
+    return false;
+  }
+  if (await provider.targetExists(environment)) {
+    return false;
+  }
+  if (provider.ensureTarget === void 0) {
+    throw new import_core6.PenvError(
+      "MISSING_TARGET",
+      `The destination has no environment \`${environment}\` to receive this push, and this provider cannot create one`,
+      `Create the environment on the destination side, then run \`penv push --env ${environment}\` again.`
+    );
+  }
+  const approved = options.yes === true || await (options.confirm ?? terminalConfirm)(
+    `The destination has no environment \`${environment}\`. Create it?`
+  );
+  if (!approved) {
+    throw new import_core6.PenvError(
+      "MISSING_TARGET",
+      `The destination has no environment \`${environment}\` to receive this push`,
+      `Re-run with \`--yes\` to create it, answer \`y\` at the prompt, or create it on the destination side yourself.`
+    );
+  }
+  await provider.ensureTarget(environment);
+  return true;
+}
+async function pushProjection(project, provider, environment, location, options) {
   const tree = localTree(project);
   const keys = keySourceFor(project, environment);
   const resolutions = resolveAllSync(tree, environment, keys, true);
   const refs = refsFrom(resolutions.map((resolution) => resolution.ref));
-  const collision = (0, import_core5.checkNameCollisions)(refs, project.config)[0];
+  const collision = (0, import_core6.checkNameCollisions)(refs, project.config)[0];
   if (collision !== void 0) {
     throw collision;
   }
-  const nameError = (0, import_sink_github.checkGithubNames)(refs, project.config)[0];
+  const nameError = provider.checkNames?.(refs, project.config)[0];
   if (nameError !== void 0) {
     throw nameError;
   }
   const outbound = plan(resolutions, project.config, environment, options.allowDecrypt === true);
-  await sink.verify();
+  await provider.verify();
+  const createdTarget = outbound.some((item) => item.scope.kind === "environment") && await ensureTargetApproved(provider, environment, options);
   let repositorySecrets = 0;
   let environmentSecrets = 0;
   for (const item of outbound) {
-    await sink.push(item.variable, item.value, item.scope);
+    await provider.push(item.variable, item.value, item.scope);
     if (item.scope.kind === "repository") {
       repositorySecrets += 1;
     } else {
@@ -768,15 +902,70 @@ async function runPush(options) {
   }
   return {
     environment,
-    repo,
+    destination: provider.type,
+    mode: "projection",
+    location,
     pushed: outbound.length,
+    meta: 0,
     repositorySecrets,
     environmentSecrets,
-    decrypted: outbound.filter((item) => item.encrypted).length
+    decrypted: outbound.filter((item) => item.encrypted).length,
+    createdTarget
+  };
+}
+function crossesToRecords(file, environment) {
+  const scope = file.scope;
+  if (scope.kind === "unscoped") {
+    return true;
+  }
+  return scope.kind === "environment" && scope.environment === environment;
+}
+async function pushRecords(project, provider, environment, location) {
+  const tree = localTree(project);
+  const files = tree.listSync().filter((file) => crossesToRecords(file, environment));
+  let pushed = 0;
+  for (const file of files) {
+    const value = tree.readSync(file);
+    if (value === void 0) {
+      continue;
+    }
+    await provider.write(file, value);
+    pushed += 1;
+  }
+  const refs = refsFrom(files);
+  let meta = 0;
+  for (const ref of refs) {
+    const block = tree.readMetaSync(ref);
+    if (block === void 0) {
+      continue;
+    }
+    await provider.writeMeta(ref, block);
+    meta += 1;
+  }
+  return {
+    environment,
+    destination: provider.type,
+    mode: "records",
+    location,
+    pushed,
+    meta,
+    repositorySecrets: 0,
+    environmentSecrets: 0,
+    decrypted: 0,
+    createdTarget: false
   };
 }
+async function runPush(options) {
+  const project = openProject(options.cwd);
+  const environment = targetEnvironment(project, options.environment, options.envFlags);
+  const { provider, location } = await destinationFor(project, environment, options);
+  if ((0, import_core6.holdsProjection)(provider)) {
+    return pushProjection(project, provider, environment, location, options);
+  }
+  return pushRecords(project, provider, environment, location);
+}
 function renderPush(result2) {
-  if (result2.pushed === 0) {
+  if (result2.pushed === 0 && result2.meta === 0) {
     return formatRows([
       {
         glyph: CHECK,
@@ -785,7 +974,23 @@ function renderPush(result2) {
       }
     ]);
   }
-  const target = `GitHub Actions for environment ${result2.environment}${result2.repo === void 0 ? "" : ` (${result2.repo})`}`;
+  const target = `${result2.destination} for environment ${result2.environment}${result2.location === void 0 ? "" : ` (${result2.location})`}`;
+  if (result2.mode === "records") {
+    return formatRows([
+      {
+        glyph: CHECK,
+        label: "Pushed",
+        subject: `${result2.pushed} value ${result2.pushed === 1 ? "file" : "files"}, ${result2.meta} meta`,
+        detail: `mirrored verbatim to ${target}`
+      },
+      {
+        glyph: CHECK,
+        label: "Sealed values",
+        subject: "crossed byte-for-byte, still sealed",
+        detail: "the destination holds envelopes; no key was needed to push them"
+      }
+    ]);
+  }
   const rows = [
     {
       glyph: CHECK,
@@ -800,12 +1005,20 @@ function renderPush(result2) {
       detail: "environment secrets override repository secrets, as penv's env scope overrides the default"
     }
   ];
+  if (result2.createdTarget) {
+    rows.push({
+      glyph: CHECK,
+      label: "Created",
+      subject: `the destination environment ${result2.environment}`,
+      detail: "it did not exist yet; created on your approval"
+    });
+  }
   if (result2.decrypted > 0) {
     rows.push({
       glyph: WARN,
       label: "Decrypted",
       subject: `${result2.decrypted} ${result2.decrypted === 1 ? "secret" : "secrets"}`,
-      detail: "sent as plaintext for GitHub to re-seal under its own key"
+      detail: "sent as plaintext for the destination to re-seal under its own key"
     });
   }
   return formatRows(rows);
@@ -813,13 +1026,28 @@ function renderPush(result2) {
 var pushCommand = (0, import_citty.defineCommand)({
   meta: {
     name: "push",
-    description: "Push an environment's resolved values to its sink (GitHub Actions Secrets)"
+    description: "Push an environment's values to its provider"
   },
   args: {
     env: { type: "string", description: "The environment to push" },
     "allow-decrypt": {
       type: "boolean",
-      description: "Decrypt sealed values locally and push them as plaintext for GitHub to re-seal"
+      description: "Decrypt sealed values locally and push them as plaintext for the destination to re-seal"
+    },
+    destination: {
+      type: "string",
+      alias: ["dest", "d"],
+      description: "Push once to this provider package instead of the declared one"
+    },
+    location: {
+      type: "string",
+      alias: "l",
+      description: "The destination-side place, when --destination needs one"
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Create a missing destination-side environment without prompting"
     }
   },
   run({ args }) {
@@ -827,7 +1055,22 @@ var pushCommand = (0, import_citty.defineCommand)({
       const result2 = await runPush({
         cwd: process.cwd(),
         ...args.env === void 0 ? {} : { environment: args.env },
-        ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] }
+        ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] },
+        ...args.destination === void 0 ? {} : { destination: args.destination },
+        ...args.location === void 0 ? {} : { location: args.location },
+        ...args.yes === void 0 ? {} : { yes: args.yes },
+        envFlags: shorthandCandidates(args, [
+          "env",
+          "allow-decrypt",
+          "allowDecrypt",
+          "destination",
+          "dest",
+          "d",
+          "location",
+          "l",
+          "yes",
+          "y"
+        ])
       });
       write(renderPush(result2));
     });
@@ -837,7 +1080,7 @@ var pushCommand = (0, import_citty.defineCommand)({
 // src/commands/validate.ts
 var import_node_path3 = require("path");
 var import_node_url2 = require("url");
-var import_core6 = require("@penvhq/core");
+var import_core7 = require("@penvhq/core");
 var import_citty2 = require("citty");
 var SCHEMA_EXPORT = "schema";
 var LABELS = {
@@ -855,10 +1098,10 @@ function issueFrom(error, fallbackSubject) {
     message: firstLine(error.message),
     ...error.remedy === void 0 ? {} : { remedy: error.remedy }
   };
-  if (error instanceof import_core6.ReservedTokenError) {
+  if (error instanceof import_core7.ReservedTokenError) {
     return { kind: "reserved", subject: error.token, ...base };
   }
-  if (error instanceof import_core6.NameCollisionError) {
+  if (error instanceof import_core7.NameCollisionError) {
     return { kind: "collision", subject: error.variable, ...base };
   }
   return { kind: "config", subject: fallbackSubject, ...base };
@@ -868,18 +1111,18 @@ function place(root, path, value) {
   if (leaf === void 0) {
     return;
   }
-  let node = root;
+  let node2 = root;
   for (const key of path.slice(0, -1)) {
-    const existing = node[key];
+    const existing = node2[key];
     if (typeof existing === "object" && existing !== null) {
-      node = existing;
+      node2 = existing;
       continue;
     }
     const child = {};
-    node[key] = child;
-    node = child;
+    node2[key] = child;
+    node2 = child;
   }
-  node[leaf] = value;
+  node2[leaf] = value;
 }
 function isZodType(value) {
   return typeof value === "object" && value !== null && "safeParse" in value && typeof value.safeParse === "function";
@@ -912,16 +1155,16 @@ function exclusively(work) {
   return result2;
 }
 function loadSchema(project, environment) {
-  const schemaPath = (0, import_core6.schemaFileOf)(project.config);
+  const schemaPath = (0, import_core7.schemaFileOf)(project.config);
   const file = (0, import_node_url2.pathToFileURL)((0, import_node_path3.resolve)(project.root, schemaPath)).href;
   return exclusively(() => loadSchemaExclusively(file, schemaPath, environment));
 }
 async function loadSchemaExclusively(file, schemaPath, environment) {
-  const jiti = (0, import_core6.jitiFor)(file);
+  const jiti = (0, import_core7.jitiFor)(file);
   const previous = process.env.PENV_ENV;
-  const previousHarvest = process.env[import_core6.SCHEMA_HARVEST_ENV];
+  const previousHarvest = process.env[import_core7.SCHEMA_HARVEST_ENV];
   process.env.PENV_ENV = environment;
-  process.env[import_core6.SCHEMA_HARVEST_ENV] = "1";
+  process.env[import_core7.SCHEMA_HARVEST_ENV] = "1";
   let loaded;
   try {
     loaded = await jiti.import(file);
@@ -948,9 +1191,9 @@ async function loadSchemaExclusively(file, schemaPath, environment) {
       process.env.PENV_ENV = previous;
     }
     if (previousHarvest === void 0) {
-      delete process.env[import_core6.SCHEMA_HARVEST_ENV];
+      delete process.env[import_core7.SCHEMA_HARVEST_ENV];
     } else {
-      process.env[import_core6.SCHEMA_HARVEST_ENV] = previousHarvest;
+      process.env[import_core7.SCHEMA_HARVEST_ENV] = previousHarvest;
     }
   }
   const exported = typeof loaded === "object" && loaded !== null ? loaded[SCHEMA_EXPORT] : void 0;
@@ -970,14 +1213,14 @@ async function loadSchemaExclusively(file, schemaPath, environment) {
 }
 async function runValidate(options) {
   const project = openProject(options.cwd);
-  const environment = targetEnvironment(project, options.environment);
-  const schemaPath = (0, import_core6.schemaFileOf)(project.config);
+  const environment = targetEnvironment(project, options.environment, options.envFlags);
+  const schemaPath = (0, import_core7.schemaFileOf)(project.config);
   const issues = [];
   let files;
   try {
     files = await project.provider.list();
   } catch (error) {
-    if (!(error instanceof import_core6.PenvError)) {
+    if (!(error instanceof import_core7.PenvError)) {
       throw error;
     }
     return {
@@ -989,17 +1232,17 @@ async function runValidate(options) {
     };
   }
   const refs = refsFrom(files);
-  for (const error of (0, import_core6.validateConfig)(project.config)) {
+  for (const error of (0, import_core7.validateConfig)(project.config)) {
     issues.push(issueFrom(error, "penv.config.ts"));
   }
-  for (const collision of (0, import_core6.checkNameCollisions)(refs, project.config)) {
+  for (const collision of (0, import_core7.checkNameCollisions)(refs, project.config)) {
     issues.push(issueFrom(collision, collision.variable));
   }
   const { schema, issues: schemaIssues } = await loadSchema(project, environment);
   issues.push(...schemaIssues);
   let drift = EMPTY_DRIFT;
   if (schema !== void 0) {
-    const resolutions = await (0, import_core6.resolveAll)(
+    const resolutions = await (0, import_core7.resolveAll)(
       environment,
       project.provider,
       keySourceFor(project, environment)
@@ -1008,7 +1251,7 @@ async function runValidate(options) {
     const undecryptable = /* @__PURE__ */ new Set();
     for (const resolution of resolutions) {
       if (resolution.undecryptable !== void 0) {
-        undecryptable.add((0, import_core6.accessPath)(resolution.ref).join("."));
+        undecryptable.add((0, import_core7.accessPath)(resolution.ref).join("."));
         issues.push({
           kind: "undecryptable",
           subject: resolution.parameter,
@@ -1018,7 +1261,7 @@ async function runValidate(options) {
         continue;
       }
       if (resolution.value !== void 0) {
-        place(object, (0, import_core6.accessPath)(resolution.ref), resolution.value);
+        place(object, (0, import_core7.accessPath)(resolution.ref), resolution.value);
       }
     }
     drift = computeDrift({ schema, resolutions, config: project.config, environment });
@@ -1085,7 +1328,8 @@ var validateCommand = (0, import_citty2.defineCommand)({
     return guard(async () => {
       const result2 = await runValidate({
         cwd: process.cwd(),
-        ...args.env === void 0 ? {} : { environment: args.env }
+        ...args.env === void 0 ? {} : { environment: args.env },
+        envFlags: shorthandCandidates(args, ["env"])
       });
       write(renderValidate(result2));
       if (!result2.ok) {
@@ -1108,10 +1352,19 @@ function skipped(check, label) {
 }
 async function runDoctor(options) {
   const project = openProject(options.cwd);
-  const environment = targetEnvironment(project, options.environment);
+  const environment = targetEnvironment(project, options.environment, options.envFlags);
   const findings = [];
   const now = new Date(options.now ?? (/* @__PURE__ */ new Date()).toISOString());
   const stuckThresholdMs = options.stuckThresholdMs ?? STUCK_THRESHOLD_MS;
+  for (const shadowed of shadowedEnvironments(project.config)) {
+    findings.push({
+      check: "environment-flag-shadow",
+      severity: "warning",
+      label: "Environment shadows a flag",
+      subject: shadowed,
+      detail: `\`--${shadowed}\` is a flag penv defines, so this environment has no shorthand \u2014 \`--env ${shadowed}\` always works`
+    });
+  }
   const { schema, issues } = await loadSchema(project, environment);
   if (schema !== void 0) {
     findings.push({ check: "schema", severity: "pass", label: "Schema valid" });
@@ -1126,7 +1379,7 @@ async function runDoctor(options) {
       });
     }
   }
-  const resolutions = await (0, import_core7.resolveAll)(
+  const resolutions = await (0, import_core8.resolveAll)(
     environment,
     project.provider,
     keySourceFor(project, environment)
@@ -1168,7 +1421,7 @@ async function runDoctor(options) {
     findings.push(...stuckFindings(rotation.subjects, environment, now, stuckThresholdMs));
   }
   findings.push(...await providerDriftFindings(project, environment, options.source));
-  findings.push(...await sinkFindings(project, environment, options.sink));
+  findings.push(...await projectionFindings(project, environment, options.projection));
   findings.push({
     check: "provider",
     severity: "pass",
@@ -1182,7 +1435,7 @@ async function runDoctor(options) {
   };
 }
 function missingFindings(subjects, environment) {
-  const required = subjects.filter(({ meta }) => (0, import_core7.isRequired)(meta, environment));
+  const required = subjects.filter(({ meta }) => (0, import_core8.isRequired)(meta, environment));
   const findings = required.filter(({ resolution }) => resolution.winner === void 0).map(({ resolution }) => ({
     check: "missing",
     severity: "failure",
@@ -1233,7 +1486,7 @@ function weakFindings(subjects, schema) {
     if (value === void 0) {
       continue;
     }
-    const field = lookup(schema, (0, import_core7.accessPath)(resolution.ref));
+    const field = lookup(schema, (0, import_core8.accessPath)(resolution.ref));
     if (field.kind !== "found") {
       continue;
     }
@@ -1306,7 +1559,7 @@ function fallbackFindings(subjects, environment) {
   ];
 }
 function plaintextSecretFindings(subjects, environment) {
-  const secrets = subjects.filter(({ meta }) => (0, import_core7.isSecret)(meta, environment));
+  const secrets = subjects.filter(({ meta }) => (0, import_core8.isSecret)(meta, environment));
   const findings = [];
   for (const { resolution } of secrets) {
     const winner = resolution.winner;
@@ -1346,11 +1599,11 @@ function publicSecretFindings(subjects, environment, config) {
       }
     ];
   }
-  const secrets = subjects.filter(({ meta }) => (0, import_core7.isSecret)(meta, environment));
+  const secrets = subjects.filter(({ meta }) => (0, import_core8.isSecret)(meta, environment));
   const findings = [];
   for (const { resolution } of secrets) {
-    const variable = (0, import_core7.variableName)(resolution.ref, config);
-    if (!(0, import_core7.isPublicVariable)(variable, config)) {
+    const variable = (0, import_core8.variableName)(resolution.ref, config);
+    if (!(0, import_core8.isPublicVariable)(variable, config)) {
       continue;
     }
     const prefix = prefixes.find((candidate) => variable.startsWith(candidate));
@@ -1404,15 +1657,6 @@ function encryptionFindings(subjects, environment) {
   ];
 }
 var EDIT_SKEW_MS = 12e4;
-function buildSink(declared, override) {
-  if (override !== void 0) {
-    return override;
-  }
-  if (declared.type === "github") {
-    return (0, import_sink_github2.createGithubSink)(declared.repo === void 0 ? {} : { repo: declared.repo });
-  }
-  return void 0;
-}
 function errorDetail(error) {
   if (error instanceof Error) {
     return error.message.split("\n")[0] ?? error.message;
@@ -1422,32 +1666,43 @@ function errorDetail(error) {
 function scopeLabel(scope) {
   return scope.kind === "repository" ? "repository secrets" : `environment secrets for ${scope.environment}`;
 }
-async function sinkFindings(project, environment, override) {
-  const declared = project.config.sinks?.[environment];
-  if (declared === void 0) {
-    return [];
-  }
-  const sink = buildSink(declared, override);
-  if (sink === void 0) {
-    return [
-      {
-        check: "sink-unreachable",
-        severity: "unknown",
-        label: "Sink",
-        subject: `sink type \`${declared.type}\` is not one penv knows`,
-        detail: "penv cannot check a sink it cannot build"
-      }
-    ];
+async function projectionFindings(project, environment, override) {
+  let projection;
+  if (override !== void 0) {
+    projection = override;
+  } else {
+    const declared = project.config.providers[environment];
+    if (declared === void 0 || declared.type === LOCAL_TREE_TYPE) {
+      return [];
+    }
+    let source;
+    try {
+      source = await sourceProviderFor(project, environment);
+    } catch (error) {
+      return [
+        {
+          check: "projection-unreachable",
+          severity: "unknown",
+          label: "Destination",
+          subject: `could not build the ${declared.type} provider for ${environment}`,
+          detail: errorDetail(error)
+        }
+      ];
+    }
+    if (!(0, import_core8.holdsProjection)(source)) {
+      return [];
+    }
+    projection = source;
   }
   try {
-    await sink.verify();
+    await projection.verify();
   } catch (error) {
     return [
       {
-        check: "sink-unreachable",
+        check: "projection-unreachable",
         severity: "unknown",
-        label: "Sink",
-        subject: `could not reach the ${declared.type} sink for ${environment}`,
+        label: "Destination",
+        subject: `could not reach the ${projection.type} destination for ${environment}`,
         detail: errorDetail(error)
       }
     ];
@@ -1455,20 +1710,20 @@ async function sinkFindings(project, environment, override) {
   let repoSecrets;
   let envSecrets;
   try {
-    repoSecrets = await sink.list({ kind: "repository" });
-    envSecrets = await sink.list({ kind: "environment", environment });
+    repoSecrets = await projection.list({ kind: "repository" });
+    envSecrets = await projection.list({ kind: "environment", environment });
   } catch (error) {
     return [
       {
-        check: "sink-unreachable",
+        check: "projection-unreachable",
         severity: "unknown",
-        label: "Sink",
-        subject: `could not list secrets in the ${declared.type} sink for ${environment}`,
+        label: "Destination",
+        subject: `could not list secrets in the ${projection.type} destination for ${environment}`,
         detail: errorDetail(error)
       }
     ];
   }
-  const resolutions = await (0, import_core7.resolveAll)(
+  const resolutions = await (0, import_core8.resolveAll)(
     environment,
     project.provider,
     keySourceFor(project, environment),
@@ -1482,7 +1737,7 @@ async function sinkFindings(project, environment, override) {
     }
     expected.push({
       ref: resolution.ref,
-      variable: (0, import_core7.variableName)(resolution.ref, project.config),
+      variable: (0, import_core8.variableName)(resolution.ref, project.config),
       scope: winner.file.scope.kind === "unscoped" ? { kind: "repository" } : { kind: "environment", environment }
     });
   }
@@ -1501,7 +1756,7 @@ async function sinkFindings(project, environment, override) {
     }
     if (!destOf(item.scope).has(key)) {
       nameDrift.push({
-        check: "sink-name-drift",
+        check: "projection-name-drift",
         severity: "warning",
         label: "Declared, not pushed",
         subject: item.variable,
@@ -1513,7 +1768,7 @@ async function sinkFindings(project, environment, override) {
   for (const secret of repoSecrets) {
     if (!allVariables.has(upper(secret.name))) {
       nameDrift.push({
-        check: "sink-name-drift",
+        check: "projection-name-drift",
         severity: "warning",
         label: "In destination, not declared",
         subject: secret.name,
@@ -1524,7 +1779,7 @@ async function sinkFindings(project, environment, override) {
   for (const secret of envSecrets) {
     if (!expectedEnv.has(upper(secret.name))) {
       nameDrift.push({
-        check: "sink-name-drift",
+        check: "projection-name-drift",
         severity: "warning",
         label: "In destination, not declared",
         subject: secret.name,
@@ -1538,7 +1793,7 @@ async function sinkFindings(project, environment, override) {
     if (secret === void 0) {
       continue;
     }
-    const pushed = (0, import_core7.effectiveMeta)(await project.provider.readMeta(item.ref), environment)[LAST_PUSHED_KEY];
+    const pushed = (0, import_core8.effectiveMeta)(await project.provider.readMeta(item.ref), environment)[LAST_PUSHED_KEY];
     if (typeof pushed !== "string") {
       continue;
     }
@@ -1548,7 +1803,7 @@ async function sinkFindings(project, environment, override) {
       continue;
     }
     manualEdits.push({
-      check: "sink-manual-edit",
+      check: "projection-manual-edit",
       severity: "warning",
       label: "Edited outside penv",
       subject: item.variable,
@@ -1559,9 +1814,9 @@ async function sinkFindings(project, environment, override) {
   findings.push(
     ...nameDrift.length > 0 ? nameDrift : [
       {
-        check: "sink-name-drift",
+        check: "projection-name-drift",
         severity: "pass",
-        label: "Sink names",
+        label: "Destination names",
         subject: `every parameter resolving for ${environment} is present, and nothing undeclared is`
       }
     ]
@@ -1569,17 +1824,17 @@ async function sinkFindings(project, environment, override) {
   findings.push(
     ...manualEdits.length > 0 ? manualEdits : [
       {
-        check: "sink-manual-edit",
+        check: "projection-manual-edit",
         severity: "pass",
-        label: "Sink hand-edits",
+        label: "Destination hand-edits",
         subject: `no secret has changed outside penv since its last push for ${environment}`
       }
     ]
   );
   findings.push({
-    check: "sink-value-drift",
+    check: "projection-value-drift",
     severity: "unknown",
-    label: "Sink values",
+    label: "Destination values",
     subject: "cannot be read back from a write-only destination",
     detail: "value drift between the tree and the destination is unknowable by design"
   });
@@ -1608,6 +1863,9 @@ async function rotationSubjects(project, environment, local, override) {
     return { kind: "read", subjects: local };
   }
   const source = override ?? await sourceProviderFor(project, environment);
+  if (!(0, import_core8.holdsRecords)(source)) {
+    return { kind: "read", subjects: local };
+  }
   try {
     const subjects = await Promise.all(
       local.map(async ({ resolution }) => ({
@@ -1632,11 +1890,11 @@ async function rotationSubjects(project, environment, local, override) {
 function overdueFindings(subjects, environment, now) {
   const findings = [];
   for (const { resolution, meta } of subjects) {
-    const { policy, lastRotated } = (0, import_core7.rotationOf)(meta, environment);
+    const { policy, lastRotated } = (0, import_core8.rotationOf)(meta, environment);
     if (policy === void 0 || lastRotated === null) {
       continue;
     }
-    const interval = (0, import_core7.tryParseDuration)(policy);
+    const interval = (0, import_core8.tryParseDuration)(policy);
     if (interval === void 0) {
       findings.push({
         check: "rotation-overdue",
@@ -1679,10 +1937,10 @@ function overdueFindings(subjects, environment, now) {
 function stuckFindings(subjects, environment, now, stuckThresholdMs) {
   const findings = [];
   for (const { resolution, meta } of subjects) {
-    if (!(0, import_core7.isStuck)(meta, environment, now, stuckThresholdMs)) {
+    if (!(0, import_core8.isStuck)(meta, environment, now, stuckThresholdMs)) {
       continue;
     }
-    const { rotatingSince } = (0, import_core7.rotationOf)(meta, environment);
+    const { rotatingSince } = (0, import_core8.rotationOf)(meta, environment);
     if (rotatingSince === null) {
       continue;
     }
@@ -1722,7 +1980,7 @@ function scopeKey(scope) {
     case "environment-local":
       return `environment-local:${scope.environment}`;
     default:
-      return (0, import_core7.assertNever)(scope, "scope");
+      return (0, import_core8.assertNever)(scope, "scope");
   }
 }
 function relevantToEnvironment(file, environment) {
@@ -1756,6 +2014,9 @@ async function providerDriftFindings(project, environment, override) {
     ];
   }
   const source = override ?? await sourceProviderFor(project, environment);
+  if (!(0, import_core8.holdsRecords)(source)) {
+    return [];
+  }
   let local;
   let remote;
   try {
@@ -1779,13 +2040,13 @@ async function providerDriftFindings(project, environment, override) {
     const here = local.get(address);
     const there = remote.get(address);
     if (here !== void 0 && there !== void 0) {
-      const opened = (0, import_core7.openValue)(here.file, here.stored, keys);
+      const opened = (0, import_core8.openValue)(here.file, here.stored, keys);
       if (opened.kind !== "plaintext") {
         findings.push({
           check: "provider-value-drift",
           severity: "unknown",
           label: "Provider value unreadable",
-          subject: (0, import_core7.formatValueFile)(here.file),
+          subject: (0, import_core8.formatValueFile)(here.file),
           detail: `the local value is sealed and did not open, so it cannot be compared against the ${providerConfig.type} source of truth`
         });
         continue;
@@ -1795,7 +2056,7 @@ async function providerDriftFindings(project, environment, override) {
           check: "provider-value-drift",
           severity: "failure",
           label: "Provider value drift",
-          subject: (0, import_core7.formatValueFile)(here.file),
+          subject: (0, import_core8.formatValueFile)(here.file),
           detail: `the local tree and the ${providerConfig.type} source of truth hold different values`
         });
       }
@@ -1809,7 +2070,7 @@ async function providerDriftFindings(project, environment, override) {
       check: "provider-value-drift",
       severity: "warning",
       label: here !== void 0 ? "Only in the local tree" : "Only in the source",
-      subject: (0, import_core7.formatValueFile)(present.file),
+      subject: (0, import_core8.formatValueFile)(present.file),
       detail: here !== void 0 ? `present locally, absent from the ${providerConfig.type} source of truth` : `present in the ${providerConfig.type} source of truth, absent from the local tree`
     });
   }
@@ -1875,7 +2136,7 @@ function renderDoctor(report) {
 var doctorCommand = (0, import_citty3.defineCommand)({
   meta: {
     name: "doctor",
-    description: "Report missing, weak, unused, fallback, plaintext-secret, and sink-drift issues"
+    description: "Report missing, weak, unused, fallback, plaintext-secret, and drift issues"
   },
   args: {
     env: { type: "string", description: "The environment to report on" }
@@ -1884,7 +2145,8 @@ var doctorCommand = (0, import_citty3.defineCommand)({
     return guard(async () => {
       const report = await runDoctor({
         cwd: process.cwd(),
-        ...args.env === void 0 ? {} : { environment: args.env }
+        ...args.env === void 0 ? {} : { environment: args.env },
+        envFlags: shorthandCandidates(args, ["env"])
       });
       write(renderDoctor(report));
       if (!report.ok) {
@@ -1895,11 +2157,11 @@ var doctorCommand = (0, import_citty3.defineCommand)({
 });
 
 // src/commands/encrypt.ts
-var import_core9 = require("@penvhq/core");
+var import_core10 = require("@penvhq/core");
 var import_citty5 = require("citty");
 
 // src/commands/set.ts
-var import_core8 = require("@penvhq/core");
+var import_core9 = require("@penvhq/core");
 var import_citty4 = require("citty");
 function scopeFrom(options) {
   if (options.local === true) {
@@ -1919,7 +2181,7 @@ function targetScope(project, options, key) {
     return scopeFrom(options);
   }
   if (environment.trim().length === 0) {
-    throw new import_core8.PenvError(
+    throw new import_core9.PenvError(
       "ENVIRONMENT_FLAG_EMPTY",
       `\`--env\` for parameter ${key} names no environment`,
       `Pass a declared environment \u2014 ${project.config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to write the scope that has no environment.`
@@ -1932,27 +2194,27 @@ function policyEnvironment(project, options) {
 }
 function sealFor(project, file, value, parameter, environment) {
   if (environment === void 0) {
-    throw new import_core8.PenvError(
+    throw new import_core9.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
-      `Parameter ${parameter} is a secret, and ${PENV_DIR}/${(0, import_core8.formatValueFile)(file)} names no environment`,
+      `Parameter ${parameter} is a secret, and ${PENV_DIR}/${(0, import_core9.formatValueFile)(file)} names no environment`,
       "Keys are declared per environment in the `keys` block of penv.config.ts, so penv cannot tell which key should seal a file that every environment reads. Write it at an environment scope \u2014 add `--env <environment>` \u2014 or drop `secret` from the parameter's meta."
     );
   }
-  return (0, import_core8.sealValue)(file, value, keySourceFor(project, environment), parameter, environment);
+  return (0, import_core9.sealValue)(file, value, keySourceFor(project, environment), parameter, environment);
 }
 async function sealAwareWrite(options) {
   const { project, provider, ref, scope, value, environment } = options;
-  const secret = (0, import_core8.isSecret)(await provider.readMeta(ref), environment);
+  const secret = (0, import_core9.isSecret)(await provider.readMeta(ref), environment);
   const file = {
     namespace: ref.namespace,
     name: ref.name,
     scope,
     encrypted: secret
   };
-  const stored = secret ? sealFor(project, file, value, (0, import_core8.parameterId)(ref), environment) : value;
+  const stored = secret ? sealFor(project, file, value, (0, import_core9.parameterId)(ref), environment) : value;
   await provider.write(file, stored);
   await provider.remove({ ...file, encrypted: !secret });
-  return { encrypted: secret, location: (0, import_core8.formatValueFile)(file) };
+  return { encrypted: secret, location: (0, import_core9.formatValueFile)(file) };
 }
 async function runSet(options) {
   const project = openProject(options.cwd);
@@ -2034,7 +2296,7 @@ function twins(project, key, options) {
 }
 function environmentFor(project, options, verb) {
   if (options.environment === void 0) {
-    throw new import_core9.PenvError(
+    throw new import_core10.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
       `\`penv ${verb}\` names no environment, and keys are declared per environment`,
       "Pass `--env <environment>`. penv cannot tell which environment's key applies to a file that names none, and will not pick one for you."
@@ -2049,32 +2311,32 @@ async function runEncrypt(options) {
   const project = openProject(options.cwd);
   const environment = environmentFor(project, options, "encrypt");
   const [plain, sealed] = twins(project, options.key, options);
-  const parameter = (0, import_core9.parameterId)(plain);
+  const parameter = (0, import_core10.parameterId)(plain);
   const value = await readOne(project, plain);
   if (value === void 0) {
     const already = await readOne(project, sealed);
-    throw new import_core9.PenvError(
+    throw new import_core10.PenvError(
       "PARAMETER_ABSENT",
-      already === void 0 ? `Parameter ${parameter} has no value file at ${PENV_DIR}/${(0, import_core9.formatValueFile)(plain)}` : `Parameter ${parameter} is already encrypted at ${PENV_DIR}/${(0, import_core9.formatValueFile)(sealed)}`,
+      already === void 0 ? `Parameter ${parameter} has no value file at ${PENV_DIR}/${(0, import_core10.formatValueFile)(plain)}` : `Parameter ${parameter} is already encrypted at ${PENV_DIR}/${(0, import_core10.formatValueFile)(sealed)}`,
       already === void 0 ? `Write it first with \`penv set ${options.key} --env ${environment}\`, which seals it automatically when the parameter's meta declares it a secret.` : "Nothing to do."
     );
   }
-  const text = (0, import_core9.sealValue)(sealed, value, keySourceFor(project, environment), parameter, environment);
+  const text = (0, import_core10.sealValue)(sealed, value, keySourceFor(project, environment), parameter, environment);
   await project.provider.write(sealed, text);
   await project.provider.remove(plain);
   return {
     parameter,
-    location: (0, import_core9.formatValueFile)(sealed),
-    removed: (0, import_core9.formatValueFile)(plain)
+    location: (0, import_core10.formatValueFile)(sealed),
+    removed: (0, import_core10.formatValueFile)(plain)
   };
 }
 async function runDecrypt(options) {
   const project = openProject(options.cwd);
   const environment = environmentFor(project, options, "decrypt");
   const [plain, sealed] = twins(project, options.key, options);
-  const parameter = (0, import_core9.parameterId)(plain);
-  if ((0, import_core9.isSecret)(await project.provider.readMeta(plain), environment)) {
-    throw new import_core9.PenvError(
+  const parameter = (0, import_core10.parameterId)(plain);
+  if ((0, import_core10.isSecret)(await project.provider.readMeta(plain), environment)) {
+    throw new import_core10.PenvError(
       "SECRET_DECRYPT_REFUSED",
       `Parameter ${parameter} is declared a secret for environment ${environment}, so penv will not write it in plaintext`,
       "A secret with a plaintext value file is a `penv doctor` failure. Drop `secret` from the parameter's meta if it is not one, or run `penv generate --allow-decrypt` if you need the plaintext value in a `.env` artifact."
@@ -2082,18 +2344,18 @@ async function runDecrypt(options) {
   }
   const stored = await readOne(project, sealed);
   if (stored === void 0) {
-    throw new import_core9.PenvError(
+    throw new import_core10.PenvError(
       "PARAMETER_ABSENT",
-      `Parameter ${parameter} has no encrypted value file at ${PENV_DIR}/${(0, import_core9.formatValueFile)(sealed)}`,
+      `Parameter ${parameter} has no encrypted value file at ${PENV_DIR}/${(0, import_core10.formatValueFile)(sealed)}`,
       `Nothing to decrypt. \`penv get ${options.key} --env ${environment} --explain\` shows every file penv looked at.`
     );
   }
-  const opened = (0, import_core9.openValue)(sealed, stored, keySourceFor(project, environment));
+  const opened = (0, import_core10.openValue)(sealed, stored, keySourceFor(project, environment));
   if (opened.kind === "failed") {
     throw new UndecryptableAt(
       parameter,
       environment,
-      (0, import_core9.formatValueFile)(sealed),
+      (0, import_core10.formatValueFile)(sealed),
       opened.failure.detail
     );
   }
@@ -2101,11 +2363,11 @@ async function runDecrypt(options) {
   await project.provider.remove(sealed);
   return {
     parameter,
-    location: (0, import_core9.formatValueFile)(plain),
-    removed: (0, import_core9.formatValueFile)(sealed)
+    location: (0, import_core10.formatValueFile)(plain),
+    removed: (0, import_core10.formatValueFile)(sealed)
   };
 }
-var UndecryptableAt = class extends import_core9.PenvError {
+var UndecryptableAt = class extends import_core10.PenvError {
   constructor(parameter, environment, location, detail) {
     super(
       "VALUE_UNDECRYPTABLE",
@@ -2160,57 +2422,14 @@ var decryptCommand = (0, import_citty5.defineCommand)({
 });
 
 // src/commands/fill.ts
-var import_core10 = require("@penvhq/core");
+var import_core11 = require("@penvhq/core");
 var import_citty6 = require("citty");
-
-// src/input.ts
-var import_node_readline = require("readline");
-function lineReader(input = process.stdin, output = process.stdout) {
-  const rl = (0, import_node_readline.createInterface)({ input, output });
-  const buffered = [];
-  const waiting = [];
-  let closed = false;
-  rl.on("line", (line) => {
-    const next = waiting.shift();
-    if (next === void 0) {
-      buffered.push(line);
-    } else {
-      next(line);
-    }
-  });
-  rl.on("close", () => {
-    closed = true;
-    for (const next of waiting.splice(0)) {
-      next(void 0);
-    }
-  });
-  return {
-    ask(question) {
-      const early = buffered.shift();
-      if (early !== void 0) {
-        return Promise.resolve(early);
-      }
-      if (closed) {
-        return Promise.resolve(void 0);
-      }
-      rl.setPrompt(question);
-      rl.prompt();
-      return new Promise((resolve7) => {
-        waiting.push(resolve7);
-      });
-    },
-    close() {
-      rl.close();
-    }
-  };
-}
-
-// src/commands/fill.ts
 var BLOCKING = /* @__PURE__ */ new Set(["config", "collision", "reserved"]);
 async function runFill(options) {
   const validation = await runValidate({
     cwd: options.cwd,
-    ...options.environment === void 0 ? {} : { environment: options.environment }
+    ...options.environment === void 0 ? {} : { environment: options.environment },
+    ...options.envFlags === void 0 ? {} : { envFlags: options.envFlags }
   });
   const environment = validation.environment;
   const blockers = validation.issues.filter((issue) => BLOCKING.has(issue.kind));
@@ -2218,7 +2437,7 @@ async function runFill(options) {
     const detail = blockers.map(
       (issue) => `  - ${issue.message}${issue.remedy === void 0 ? "" : ` (${issue.remedy})`}`
     ).join("\n");
-    throw new import_core10.PenvError(
+    throw new import_core11.PenvError(
       "FILL_BLOCKED",
       `penv fill cannot run: environment ${environment} has ${blockers.length} unresolved configuration ${blockers.length === 1 ? "issue" : "issues"}:
 ${detail}`,
@@ -2340,7 +2559,8 @@ var fillCommand = (0, import_citty6.defineCommand)({
             await runFill({
               cwd: process.cwd(),
               ...args.env === void 0 ? {} : { environment: args.env },
-              ask
+              ask,
+              envFlags: shorthandCandidates(args, ["env"])
             })
           )
         );
@@ -2354,14 +2574,14 @@ var fillCommand = (0, import_citty6.defineCommand)({
 // src/commands/generate.ts
 var import_node_fs = require("fs");
 var import_node_path4 = require("path");
-var import_core11 = require("@penvhq/core");
+var import_core12 = require("@penvhq/core");
 var import_citty7 = require("citty");
 var DEFAULT_OUTPUT = ".env";
 function entriesFor(project, environment, allowDecrypt) {
   const keys = keySourceFor(project, environment);
   const tree = localTree(project);
   const resolutions = resolveAllSync(tree, environment, keys);
-  const collision = (0, import_core11.checkNameCollisions)(
+  const collision = (0, import_core12.checkNameCollisions)(
     refsFrom(resolutions.map((resolution) => resolution.ref)),
     project.config
   )[0];
@@ -2374,21 +2594,21 @@ function entriesFor(project, environment, allowDecrypt) {
     const winner = resolution.winner;
     if (winner?.file.encrypted === true) {
       if (!allowDecrypt) {
-        throw new import_core11.PenvError(
+        throw new import_core12.PenvError(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and \`penv generate\` writes plaintext`,
           `Re-run with \`--allow-decrypt\` to write the decrypted value into the artifact, or generate for an environment whose values are plaintext. The artifact is gitignored; a committed plaintext secret is a \`penv doctor\` failure.`
         );
       }
-      (0, import_core11.requireValue)(resolution, environment);
+      (0, import_core12.requireValue)(resolution, environment);
       decrypted += 1;
     }
     if (resolution.value === void 0) {
       continue;
     }
-    const description = (0, import_core11.effectiveMeta)(tree.readMetaSync(resolution.ref), environment).description;
+    const description = (0, import_core12.effectiveMeta)(tree.readMetaSync(resolution.ref), environment).description;
     entries.push({
-      key: (0, import_core11.variableName)(resolution.ref, project.config),
+      key: (0, import_core12.variableName)(resolution.ref, project.config),
       value: resolution.value,
       ...typeof description === "string" ? { description } : {}
     });
@@ -2398,15 +2618,15 @@ function entriesFor(project, environment, allowDecrypt) {
 }
 function generateDotenv(options) {
   const project = openProject(options.cwd);
-  const environment = targetEnvironment(project, options.environment);
-  return (0, import_core11.serializeDotenv)(entriesFor(project, environment, options.allowDecrypt === true).entries);
+  const environment = targetEnvironment(project, options.environment, options.envFlags);
+  return (0, import_core12.serializeDotenv)(entriesFor(project, environment, options.allowDecrypt === true).entries);
 }
 function runGenerate(options) {
   const project = openProject(options.cwd);
-  const environment = targetEnvironment(project, options.environment);
+  const environment = targetEnvironment(project, options.environment, options.envFlags);
   const { entries, decrypted } = entriesFor(project, environment, options.allowDecrypt === true);
   const file = options.out === void 0 ? (0, import_node_path4.resolve)(project.root, DEFAULT_OUTPUT) : (0, import_node_path4.isAbsolute)(options.out) ? options.out : (0, import_node_path4.resolve)(options.cwd, options.out);
-  (0, import_node_fs.writeFileSync)(file, (0, import_core11.serializeDotenv)(entries), "utf8");
+  (0, import_node_fs.writeFileSync)(file, (0, import_core12.serializeDotenv)(entries), "utf8");
   return { file, environment, entries: entries.length, decrypted };
 }
 function displayPath(cwd, file) {
@@ -2449,7 +2669,8 @@ var generateCommand = (0, import_citty7.defineCommand)({
         cwd,
         ...args.env === void 0 ? {} : { environment: args.env },
         ...args.out === void 0 ? {} : { out: args.out },
-        ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] }
+        ...args["allow-decrypt"] === void 0 ? {} : { allowDecrypt: args["allow-decrypt"] },
+        envFlags: shorthandCandidates(args, ["env", "out", "allow-decrypt", "allowDecrypt"])
       });
       write(renderGenerate(result2, cwd));
     });
@@ -2457,17 +2678,17 @@ var generateCommand = (0, import_citty7.defineCommand)({
 });
 
 // src/commands/get.ts
-var import_core12 = require("@penvhq/core");
+var import_core13 = require("@penvhq/core");
 var import_citty8 = require("citty");
 async function runGet(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key);
   const keys = keySourceFor(project, environment);
-  const resolution = await (0, import_core12.resolveParameter)(ref, environment, project.provider, keys);
-  const value = (0, import_core12.requireValue)(resolution, environment);
+  const resolution = await (0, import_core13.resolveParameter)(ref, environment, project.provider, keys);
+  const value = (0, import_core13.requireValue)(resolution, environment);
   if (value === void 0) {
-    throw new import_core12.PenvError(
+    throw new import_core13.PenvError(
       "PARAMETER_ABSENT",
       `Parameter ${resolution.parameter} resolves to no value for environment ${environment}`,
       `Set it with \`penv set ${options.key} --env ${environment}\`, or run \`penv get ${options.key} --env ${environment} --explain\` to see every file penv looked at.`
@@ -2489,7 +2710,7 @@ async function runExplain(options) {
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key);
   const keys = keySourceFor(project, environment);
-  const resolution = await (0, import_core12.resolveParameter)(ref, environment, project.provider, keys);
+  const resolution = await (0, import_core13.resolveParameter)(ref, environment, project.provider, keys);
   const winner = resolution.winner;
   return {
     parameter: resolution.parameter,
@@ -2545,15 +2766,17 @@ var getCommand = (0, import_citty8.defineCommand)({
 // src/commands/import.ts
 var import_node_fs4 = require("fs");
 var import_node_path7 = require("path");
-var import_core15 = require("@penvhq/core");
+var import_core16 = require("@penvhq/core");
 var import_citty10 = require("citty");
 
 // src/detect.ts
 var import_node_fs2 = require("fs");
 var import_node_path5 = require("path");
-var import_core13 = require("@penvhq/core");
+var import_core14 = require("@penvhq/core");
 var SIGNATURES = [
   { name: "Next.js", packages: ["next"], publicPrefixes: ["NEXT_PUBLIC_"] },
+  { name: "SvelteKit", packages: ["@sveltejs/kit"], publicPrefixes: ["PUBLIC_"] },
+  { name: "Nuxt", packages: ["nuxt"], publicPrefixes: ["NUXT_PUBLIC_"] },
   {
     name: "TanStack Start",
     packages: ["@tanstack/react-start", "@tanstack/start"],
@@ -2589,7 +2812,7 @@ function schemaFileFor(cwd) {
   if (!occupied(cwd, beside)) {
     return { file: beside, displaced: preferred };
   }
-  return { file: import_core13.DEFAULT_SCHEMA_FILE, displaced: preferred };
+  return { file: import_core14.DEFAULT_SCHEMA_FILE, displaced: preferred };
 }
 function dependenciesOf(cwd) {
   const manifest = manifestOf(cwd);
@@ -2627,17 +2850,23 @@ function detectFramework(cwd) {
   }
   for (const signature of SIGNATURES) {
     if (signature.packages.some((name) => dependencies.has(name))) {
-      const schema = schemaFileFor(cwd);
-      return {
-        name: signature.name,
-        schemaFile: schema.file,
-        ...schema.displaced === void 0 ? {} : { displacedFrom: schema.displaced },
-        publicPrefixes: signature.publicPrefixes
-      };
+      return detectedFrom(cwd, signature.name, signature.publicPrefixes);
     }
   }
+  if ((0, import_node_fs2.existsSync)((0, import_node_path5.join)(cwd, "bunfig.toml")) || dependencies.has("bun-types")) {
+    return detectedFrom(cwd, "Bun", []);
+  }
   return void 0;
 }
+function detectedFrom(cwd, name, publicPrefixes) {
+  const schema = schemaFileFor(cwd);
+  return {
+    name,
+    schemaFile: schema.file,
+    ...schema.displaced === void 0 ? {} : { displacedFrom: schema.displaced },
+    publicPrefixes
+  };
+}
 var DEFAULT_ALIAS = "@env";
 var IMPORTS_ALIAS = "#env";
 function detectAlias(cwd) {
@@ -2653,8 +2882,134 @@ function hasImportsBlock(cwd) {
 var import_node_fs3 = require("fs");
 var import_node_path6 = require("path");
 var import_promises = require("readline/promises");
-var import_core14 = require("@penvhq/core");
+var import_core15 = require("@penvhq/core");
 var import_citty9 = require("citty");
+
+// src/seams.ts
+function nextjs({ alias, srcDir }) {
+  return {
+    kind: "scaffold",
+    file: `${srcDir}instrumentation.ts`,
+    content: `// This is instrumentation.ts, Next.js's own startup hook \u2014 Next runs it once,
+// before any of your app code, on every server boot. penv put one line here so
+// your config is in process.env before the first library reads it. The filename
+// is Next's requirement (it only finds \`instrumentation.ts\`), so keep it as-is.
+export async function register() {
+  // Next also calls register on the Edge runtime, where penv cannot read the
+  // filesystem \u2014 so inject runs on the Node runtime only.
+  if (process.env.NEXT_RUNTIME === "nodejs") {
+    await import("${alias}");
+  }
+}
+`,
+    ifPresent: `Add to your existing \`${srcDir}instrumentation.ts\`, inside \`register()\` and first:
+  if (process.env.NEXT_RUNTIME === "nodejs") { await import("${alias}"); }`,
+    notes: []
+  };
+}
+function sveltekit({ alias }) {
+  return {
+    kind: "scaffold",
+    // SvelteKit's hooks module is always under `src/`, whatever the schema path.
+    file: "src/hooks.server.ts",
+    content: `// This is hooks.server.ts, SvelteKit's server-startup module \u2014 it loads before
+// your routes handle a request. penv put this import first so your config is in
+// process.env before any library reads it. Keep it the first line; the name and
+// location are SvelteKit's, not penv's.
+import "${alias}";
+`,
+    ifPresent: `Add \`import "${alias}";\` as the FIRST line of src/hooks.server.ts, above every other import.`,
+    notes: [
+      `SvelteKit resolves app aliases through \`kit.alias\` \u2014 make sure \`${alias}\` is registered in svelte.config.js, not only tsconfig.`
+    ]
+  };
+}
+function nuxt({ alias }) {
+  return {
+    kind: "scaffold",
+    // The `0.` prefix is load-bearing: Nitro sorts plugin filenames as strings,
+    // so it must sort first to run before any other plugin reads process.env.
+    file: "server/plugins/0.penv.ts",
+    content: `// This is a Nitro server plugin (Nuxt's server layer runs it once at startup,
+// before any middleware or request handler). penv put the import here so your
+// config is in process.env before a library reads it. The \`0.\` prefix keeps this
+// plugin first \u2014 Nitro sorts plugin filenames as text \u2014 so don't rename it.
+import "${alias}";
+
+// Nitro requires every plugin file to default-export a function; the injection
+// above already ran at import, so this body is intentionally empty.
+export default defineNitroPlugin(() => {});
+`,
+    ifPresent: `Create server/plugins/0.penv.ts with \`import "${alias}";\` and \`export default defineNitroPlugin(() => {});\`.`,
+    notes: [
+      `Wire \`${alias}\` for the Nitro (server) build so it never leaks into the client bundle.`
+    ]
+  };
+}
+function bun({ alias }) {
+  return {
+    kind: "scaffold",
+    file: ".penv/preload.ts",
+    content: `// Bun evaluates this file before your entry point, because it is listed under
+// \`preload\` in bunfig.toml (see the note penv printed). Running it injects your
+// config into process.env before any library reads it.
+import "${alias}";
+`,
+    ifPresent: `Keep .penv/preload.ts as \`import "${alias}";\`.`,
+    notes: [
+      'Register it in bunfig.toml so Bun runs it: `preload = ["./.penv/preload.ts"]` (and the same under `[test]`).',
+      `\`${alias}\` must be a tsconfig \`paths\` alias for Bun to resolve it.`
+    ]
+  };
+}
+function node({ alias, srcDir }) {
+  const runtimeSpecifier = alias.startsWith("#") ? alias : `./${srcDir}.penv/env.js`;
+  return {
+    kind: "instruct",
+    instruction: `Plain Node / Express / Fastify have no framework hook that runs before your
+code, so place the injection yourself, one of two ways (both run first):
+  \u2022 Preload at launch \u2014 add to your start script:  node --import "${runtimeSpecifier}" your-entry.js
+  \u2022 Or make it the FIRST line of your entry file:   import "${runtimeSpecifier}";
+` + (alias.startsWith("#") ? "" : `Note: \`${alias}\` is a tsconfig alias that Node does not resolve at runtime \u2014 the paths above point at the built schema module instead.
+`)
+  };
+}
+function tanstack({ alias, srcDir }) {
+  return {
+    kind: "instruct",
+    instruction: `Add \`import "${alias}";\` as the FIRST line of ${srcDir}server.ts (TanStack Start's
+server entry), above the \`@tanstack/react-start/server-entry\` import \u2014 nothing may
+import before it. If you have no server.ts yet, create it from TanStack's server-entry
+template and put that import first.`
+  };
+}
+function astro(_context) {
+  return {
+    kind: "instruct",
+    instruction: 'Astro has no single pre-app hook. Add a small integration to astro.config that\ninjects the import into every SSR page, then cover the routes it cannot reach:\n  \u2022 In astro.config integrations, add:\n      { name: "penv", hooks: { "astro:config:setup": ({ injectScript }) =>\n          injectScript("page-ssr", \'import "@env";\') } }\n  \u2022 Also add `import "@env";` as the first line of src/middleware.ts and of any\n    endpoint route (src/pages/*.ts) that imports a library reading process.env.\nInjection only applies under a server (on-demand) adapter, not a static build.'
+  };
+}
+function viteSpa(_context) {
+  return {
+    kind: "none",
+    reason: "This is a client-only app \u2014 nothing reads process.env at runtime, so injection does not apply. Read client config through import.meta.env (only VITE_-prefixed vars, which ship to the browser and must not hold secrets). If you add a server later, place the injection there."
+  };
+}
+var SEAMS = {
+  "Next.js": nextjs,
+  SvelteKit: sveltekit,
+  Nuxt: nuxt,
+  Bun: bun,
+  "TanStack Start": tanstack,
+  Astro: astro,
+  Vite: viteSpa
+};
+function seamFor(framework, context) {
+  const build = framework === void 0 ? node : SEAMS[framework] ?? node;
+  return build(context);
+}
+
+// src/commands/init.ts
 var CONFIG_FILE = "penv.config.ts";
 var TSCONFIG_FILE = "tsconfig.json";
 var GITIGNORE_FILE = ".gitignore";
@@ -2664,11 +3019,12 @@ var IMPORTS_PREFIX = "#";
 var PACKAGE_FILE = "package.json";
 var DEFAULT_DECISIONS = {
   environments: [],
-  schemaFile: import_core14.DEFAULT_SCHEMA_FILE,
+  inject: false,
+  schemaFile: import_core15.DEFAULT_SCHEMA_FILE,
   publicPrefixes: [],
   alias: DEFAULT_ALIAS
 };
-var NOT_ENVIRONMENTS = [...import_core14.RESERVED_TOKENS, "example", "sample", "template"];
+var NOT_ENVIRONMENTS = [...import_core15.RESERVED_TOKENS, "example", "sample", "template"];
 function suggestEnvironments(root) {
   let entries;
   try {
@@ -2684,7 +3040,7 @@ function suggestEnvironments(root) {
     const segments = entry.slice(".env.".length).split(".");
     const withoutLocal = segments.at(-1) === "local" ? segments.slice(0, -1) : segments;
     const name = withoutLocal.length === 1 ? withoutLocal[0] : void 0;
-    if (name === void 0 || !(0, import_core14.isLegalEnvironmentName)(name) || NOT_ENVIRONMENTS.includes(name)) {
+    if (name === void 0 || !(0, import_core15.isLegalEnvironmentName)(name) || NOT_ENVIRONMENTS.includes(name)) {
       continue;
     }
     found.add(name);
@@ -2692,10 +3048,10 @@ function suggestEnvironments(root) {
   return [...found].sort();
 }
 function emptyFlag(flag) {
-  return new import_core14.PenvError(
+  return new import_core15.PenvError(
     "INIT_FLAG_EMPTY",
     `\`--${flag}\` was given without a value`,
-    flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${import_core14.DEFAULT_SCHEMA_FILE}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
+    flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${import_core15.DEFAULT_SCHEMA_FILE}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
   );
 }
 function splitEnvironments(value) {
@@ -2720,7 +3076,7 @@ function declaredIn(root) {
   if (!(0, import_node_fs3.existsSync)(file)) {
     return void 0;
   }
-  return (0, import_core14.loadConfigFrom)(file);
+  return (0, import_core15.loadConfigFrom)(file);
 }
 function planInit(root, flags = {}) {
   const declared = declaredIn(root);
@@ -2730,7 +3086,7 @@ function planInit(root, flags = {}) {
     notes.push(`${CONFIG_FILE} already exists \u2014 init keeps every decision it records.`);
   } else if (detected === void 0) {
     notes.push(
-      `No framework detected in package.json \u2014 the schema goes to ${import_core14.DEFAULT_SCHEMA_FILE}.`
+      `No framework detected in package.json \u2014 the schema goes to ${import_core15.DEFAULT_SCHEMA_FILE}.`
     );
   } else {
     notes.push(`Detected ${detected.name}.`);
@@ -2740,12 +3096,12 @@ function planInit(root, flags = {}) {
       );
     }
   }
-  const schemaFile = flags.schema === void 0 ? declared !== void 0 ? (0, import_core14.schemaFileOf)(declared) : detected?.schemaFile ?? import_core14.DEFAULT_SCHEMA_FILE : flags.schema.trim();
+  const schemaFile = flags.schema === void 0 ? declared !== void 0 ? (0, import_core15.schemaFileOf)(declared) : detected?.schemaFile ?? import_core15.DEFAULT_SCHEMA_FILE : flags.schema.trim();
   if (flags.schema !== void 0) {
     if (schemaFile.length === 0) {
       throw emptyFlag("schema");
     }
-    const error = (0, import_core14.validateSchemaFile)({ environments: [], providers: {}, schemaFile })[0];
+    const error = (0, import_core15.validateSchemaFile)({ environments: [], providers: {}, schemaFile })[0];
     if (error !== void 0) {
       throw error;
     }
@@ -2755,7 +3111,7 @@ function planInit(root, flags = {}) {
     throw emptyFlag("alias");
   }
   if (!ALIAS_NAME.test(alias)) {
-    throw new import_core14.PenvError(
+    throw new import_core15.PenvError(
       "INIT_ALIAS_INVALID",
       `\`${alias}\` is not an alias penv can write`,
       `An alias is \`@name\` \u2014 a tsconfig \`paths\` entry a bundler resolves \u2014 or \`#name\`, a package.json \`imports\` entry Node resolves itself. Those are the two things a module specifier can be that is not a package.`
@@ -2782,6 +3138,9 @@ function planInit(root, flags = {}) {
     detected,
     decisions: {
       environments,
+      // Injection is a choice about the app's needs, not something on disk — so
+      // the plan defaults it off, and only the interactive prompt turns it on.
+      inject: false,
       schemaFile,
       publicPrefixes: declared?.publicPrefixes ?? detected?.publicPrefixes ?? [],
       alias
@@ -2802,7 +3161,7 @@ function renderPlan(plan2) {
   rows.push([
     `  ${out.dim("schemaFile")}`,
     plan2.decisions.schemaFile,
-    plan2.decisions.schemaFile === import_core14.DEFAULT_SCHEMA_FILE ? "" : out.dim(`(default: ${import_core14.DEFAULT_SCHEMA_FILE})`)
+    plan2.decisions.schemaFile === import_core15.DEFAULT_SCHEMA_FILE ? "" : out.dim(`(default: ${import_core15.DEFAULT_SCHEMA_FILE})`)
   ]);
   for (const prefix of plan2.decisions.publicPrefixes) {
     rows.push([`  ${out.dim("publicPrefix")}`, prefix, ""]);
@@ -2828,16 +3187,33 @@ async function promptForDecisions(plan2, io) {
     );
     io.write("");
   }
+  const inject = seamKindFor(plan2) === "none" ? false : await askInject(io);
   const proceed = (await io.ask(prompt("Proceed?", "Y/n"))).trim().toLowerCase();
   if (proceed.length > 0 && proceed !== "y" && proceed !== "yes") {
     return void 0;
   }
-  return { ...plan2.decisions, environments };
+  return { ...plan2.decisions, environments, inject };
+}
+function seamKindFor(plan2) {
+  return seamFor(plan2.detected?.name, {
+    alias: plan2.decisions.alias,
+    srcDir: plan2.decisions.schemaFile.startsWith("src/") ? "src/" : ""
+  }).kind;
+}
+async function askInject(io) {
+  io.write("");
+  io.write("Also inject your validated config into process.env?");
+  io.write("  y  libraries that read process.env directly (WorkOS, Prisma\u2026) just work");
+  io.write('  n  config stays available only through  import { env } from "@env"');
+  const answer = (await io.ask(prompt("inject", "y/N"))).trim().toLowerCase();
+  return answer === "y" || answer === "yes";
 }
 var EMPTY_SCHEMA_BODY = "  // One key per parameter, e.g. `databaseUrl: z.url(),`. Nesting a key nests\n  // the parameter: `redis: z.object({ password: z.string() })` is redis/password.";
 var DRAFT_HEADER = "// DRAFT \u2014 generated by `penv import` from one sample of each value, and yours\n// to correct. Single-sample inference cannot know that a boolean seen as `true`\n// must also accept `1`/`0`, or that a string is really a URL. penv scaffolds\n// this file once and never regenerates it, so edits here are safe.\n";
-function renderSchemaModule(fields, draft) {
+function renderSchemaModule(fields, draft, inject = false) {
   const body = fields.length === 0 ? EMPTY_SCHEMA_BODY : fields.map((field) => `  ${field.key}: ${field.type},`).join("\n");
+  const loadComment = inject ? "// The loaded, validated values for the current environment. Import this in app\n// code. `inject: true` also copies the values into process.env, for libraries\n// that read process.env directly (WorkOS, Prisma) instead of importing @env.\n" : "// The loaded, validated values for the current environment. Import this in app\n// code. Importing it loads configuration and throws (naming the parameter and\n// environment) if anything required is missing or invalid.\n";
+  const loadCall = inject ? "export const env = load(schema, { inject: true });\n" : "export const env = load(schema);\n";
   return `${draft ? DRAFT_HEADER : ""}import { z } from "zod";
 import { load } from "@penvhq/penv";
 
@@ -2847,10 +3223,15 @@ export const schema = z.object({
 ${body}
 });
 
-// The loaded, validated values for the current environment. Import this in app
-// code. Importing it loads configuration and throws (naming the parameter and
-// environment) if anything required is missing or invalid.
-export const env = load(schema);
+` + loadComment + loadCall + `
+// Registers the schema's shape with penv's types (erased at runtime, so
+// nothing cycles). This is what makes \`override\` keys in penv.config.ts
+// autocomplete from this schema \u2014 a typo'd parameter id is a compile error.
+declare module "@penvhq/core" {
+  interface PenvSchemaShape {
+    readonly shape: z.infer<typeof schema>;
+  }
+}
 `;
 }
 function renderEnvironments(decisions) {
@@ -2860,14 +3241,14 @@ function renderEnvironments(decisions) {
   // can read off your codebase, and an environment you do not have is worse
   // than one you have not declared yet. Name yours, and give each a provider:
   //   environments: ["development", "production"],
-  //   providers: { development: { type: "filesystem" }, production: { type: "filesystem" } },
+  //   providers: { development: { type: "@penvhq/provider-filesystem" }, production: { type: "@penvhq/provider-filesystem" } },
   environments: [],
 
   providers: {},
 `;
   }
   const names = decisions.environments.map((name) => JSON.stringify(name)).join(", ");
-  const providers = decisions.environments.map((name) => `    ${JSON.stringify(name)}: { type: "filesystem" },
+  const providers = decisions.environments.map((name) => `    ${JSON.stringify(name)}: { type: "@penvhq/provider-filesystem" },
 `).join("");
   return `${shared}  environments: [${names}],
 
@@ -2878,7 +3259,7 @@ ${providers}  },
 }
 function renderConfigModule(decisions) {
   let body = renderEnvironments(decisions);
-  if (decisions.schemaFile !== import_core14.DEFAULT_SCHEMA_FILE) {
+  if (decisions.schemaFile !== import_core15.DEFAULT_SCHEMA_FILE) {
     body += `
   // The module that exports the schema. It is yours \u2014 penv scaffolds it once
   // and never regenerates it \u2014 so this says where you keep it.
@@ -2901,7 +3282,7 @@ ${body}});
 `;
 }
 function renderGitignore(decisions) {
-  const inside = (0, import_core14.schemaInsideTree)(configOf(decisions));
+  const inside = (0, import_core15.schemaInsideTree)(configOf(decisions));
   const listed = inside === void 0 ? "" : `${inside}, `;
   return `# Written by penv. Value files hold configuration values and are never
 # committed; only the structure, ${listed}meta, and config are.
@@ -3046,13 +3427,13 @@ ${objectIndent}${source.slice(close)}`;
 ${entryIndent}${member},${source.slice(open + 1)}`;
 }
 function shapeError(what, target, alias) {
-  return new import_core14.PenvError(
+  return new import_core15.PenvError(
     "TSCONFIG_SHAPE",
     `penv cannot add the \`${alias}\` path alias to tsconfig.json: ${what}`,
     `Add it by hand: \`{ "compilerOptions": { "paths": { "${alias}": ["${target}"] } } }\`.`
   );
 }
-function insertEnvAlias(source, target = import_core14.DEFAULT_SCHEMA_FILE, name = DEFAULT_ALIAS) {
+function insertEnvAlias(source, target = import_core15.DEFAULT_SCHEMA_FILE, name = DEFAULT_ALIAS) {
   const alias = `"${name}": ["${target}"]`;
   const root = skipTrivia(source, 0);
   if (source.charAt(root) !== "{") {
@@ -3134,7 +3515,7 @@ function writeSchemaFile(root, fields, draft, decisions = DEFAULT_DECISIONS) {
     };
   }
   (0, import_node_fs3.mkdirSync)((0, import_node_path6.dirname)(file), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(file, renderSchemaModule(fields, draft), "utf8");
+  (0, import_node_fs3.writeFileSync)(file, renderSchemaModule(fields, draft, decisions.inject), "utf8");
   return {
     target: "schema",
     action: "created",
@@ -3211,14 +3592,56 @@ function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
     text: `${existing === void 0 ? "Created" : "Updated"} ${relative3}`
   };
 }
+function srcDirOf(root) {
+  return (0, import_node_fs3.existsSync)((0, import_node_path6.join)(root, "src")) ? "src/" : "";
+}
+function writeSeam(root, decisions = DEFAULT_DECISIONS) {
+  if (!decisions.inject) {
+    return void 0;
+  }
+  const framework = detectFramework(root)?.name;
+  const seam = seamFor(framework, { alias: decisions.alias, srcDir: srcDirOf(root) });
+  if (seam.kind === "none") {
+    return { target: "seam", action: "info", text: "No injection seam needed", note: seam.reason };
+  }
+  if (seam.kind === "instruct") {
+    return {
+      target: "seam",
+      action: "info",
+      text: "Place the injection seam",
+      note: seam.instruction
+    };
+  }
+  const file = (0, import_node_path6.join)(root, ...seam.file.split("/"));
+  const notes = seam.notes.length === 0 ? "" : `
+${seam.notes.map((n) => `  ${n}`).join("\n")}`;
+  if ((0, import_node_fs3.existsSync)(file)) {
+    return {
+      target: "seam",
+      action: "info",
+      text: `Add the injection seam to ${seam.file}`,
+      note: `${seam.ifPresent}${notes}`
+    };
+  }
+  (0, import_node_fs3.mkdirSync)((0, import_node_path6.dirname)(file), { recursive: true });
+  (0, import_node_fs3.writeFileSync)(file, seam.content, "utf8");
+  return {
+    target: "seam",
+    action: "created",
+    text: `Wrote ${seam.file} (runs the injection before your app)`,
+    ...notes === "" ? {} : { note: notes.trimStart() }
+  };
+}
 function scaffold(root, fields, draft, decisions = DEFAULT_DECISIONS) {
-  return [
+  const steps = [
     ensurePenvDir(root),
     writeSchemaFile(root, fields, draft, decisions),
     writeConfigFile(root, decisions),
     writeTsconfigAlias(root, decisions),
     writeGitignore(root, decisions)
   ];
+  const seam = writeSeam(root, decisions);
+  return seam === void 0 ? steps : [...steps, seam];
 }
 function runInit(options) {
   const root = (0, import_node_path6.resolve)(options.cwd);
@@ -3227,7 +3650,7 @@ function runInit(options) {
 }
 function renderInit(result2) {
   const steps = result2.steps.map((step) => {
-    const glyph = step.action === "conflicted" ? WARN : CHECK;
+    const glyph = step.action === "conflicted" ? WARN : step.action === "info" ? "\u2192" : CHECK;
     return step.note === void 0 ? { glyph, text: step.text } : { glyph, text: step.text, note: step.note };
   });
   return [
@@ -3261,7 +3684,7 @@ var initCommand = (0, import_citty9.defineCommand)({
     },
     schema: {
       type: "string",
-      description: `Where the schema module goes, e.g. src/env.ts (default: ${import_core14.DEFAULT_SCHEMA_FILE})`
+      description: `Where the schema module goes, e.g. src/env.ts (default: ${import_core15.DEFAULT_SCHEMA_FILE})`
     },
     alias: {
       type: "string",
@@ -3315,7 +3738,7 @@ function inferType(value) {
 }
 function draftFields(entries) {
   return entries.map((entry) => {
-    const key = (0, import_core15.accessPath)((0, import_core15.refFromVariable)(entry.key)).join(".");
+    const key = (0, import_core16.accessPath)((0, import_core16.refFromVariable)(entry.key)).join(".");
     return {
       key: IDENTIFIER.test(key) ? key : JSON.stringify(key),
       type: inferType(entry.value)
@@ -3326,33 +3749,33 @@ function assertImportable(ref, variable) {
   if (!ref.name.includes(".")) {
     return;
   }
-  throw new import_core15.PenvError(
+  throw new import_core16.PenvError(
     "IMPORT_UNPARSEABLE_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, whose \`.\` would be read as a scope`,
     `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
   );
 }
 function assertNotReserved(ref, variable, where, config) {
-  if ((0, import_core15.isReservedToken)(ref.name, config)) {
-    throw new import_core15.ReservedTokenError("parameter", variable, where);
+  if ((0, import_core16.isReservedToken)(ref.name, config)) {
+    throw new import_core16.ReservedTokenError("parameter", variable, where);
   }
 }
 function assertRoundTrips(ref, variable, config) {
-  if ((0, import_core15.roundTripsCleanly)(variable)) {
+  if ((0, import_core16.roundTripsCleanly)(variable)) {
     return;
   }
-  if ((0, import_core15.variableName)(ref, config) === variable) {
+  if ((0, import_core16.variableName)(ref, config) === variable) {
     return;
   }
-  const generated = (0, import_core15.variableName)(ref, config);
-  throw new import_core15.PenvError(
+  const generated = (0, import_core16.variableName)(ref, config);
+  throw new import_core16.PenvError(
     "IMPORT_LOSSY_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, which regenerates as ${generated}`,
-    `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`names\` block of penv.config.ts \u2014 \`names: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
+    `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`override\` block of penv.config.ts \u2014 \`override: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
   );
 }
 function collisionsIn(refs, config) {
-  const errors = (0, import_core15.checkNameCollisions)(refs, config);
+  const errors = (0, import_core16.checkNameCollisions)(refs, config);
   const first = errors[0];
   if (first !== void 0) {
     throw first;
@@ -3362,7 +3785,7 @@ function assertDeclared(segment, config) {
   if (config.environments.includes(segment)) {
     return segment;
   }
-  throw new import_core15.UnknownEnvironmentError(segment, config.environments);
+  throw new import_core16.UnknownEnvironmentError(segment, config.environments);
 }
 function scopeFromFilename(file, config) {
   const name = (0, import_node_path7.basename)(file);
@@ -3387,13 +3810,13 @@ function scopeFromFilename(file, config) {
     return { kind: "environment-local", environment: assertDeclared(first, config) };
   }
   if (first === LOCAL && rest.length === 2) {
-    throw new import_core15.FilenameGrammarError(
+    throw new import_core16.FilenameGrammarError(
       name,
       "`local` precedes the environment segment",
       `The environment segment always precedes \`local\` \u2014 \`.env.${second}.${LOCAL}\` is the file Next.js and Vite read, and \`.env.${LOCAL}.${second}\` is not a synonym for it. Rename it to \`.env.${second}.${LOCAL}\`, then import it again. Nothing was imported.`
     );
   }
-  throw new import_core15.FilenameGrammarError(
+  throw new import_core16.FilenameGrammarError(
     name,
     `\`${rest.join("` and `")}\` are ${rest.length} scope segments`,
     "A dotenv file carries exactly one scope: `.env`, `.env.<environment>`, `.env.local`, or `.env.<environment>.local`. Point `penv import` at one of those. Nothing was imported."
@@ -3408,7 +3831,7 @@ function environmentOf(scope) {
     case "local":
       return void 0;
     default:
-      return (0, import_core15.assertNever)(scope, "scope");
+      return (0, import_core16.assertNever)(scope, "scope");
   }
 }
 function scopeWithEnvironment(scope, environment) {
@@ -3421,7 +3844,7 @@ function scopeWithEnvironment(scope, environment) {
     case "environment-local":
       return scope;
     default:
-      return (0, import_core15.assertNever)(scope, "scope");
+      return (0, import_core16.assertNever)(scope, "scope");
   }
 }
 function explicitEnvironment(options, source, config) {
@@ -3429,7 +3852,7 @@ function explicitEnvironment(options, source, config) {
   if (value.length > 0) {
     return value;
   }
-  throw new import_core15.PenvError(
+  throw new import_core16.PenvError(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
     `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
@@ -3439,7 +3862,7 @@ function assertEnvironmentAgrees(derived, explicit, source) {
   if (derived === void 0 || explicit === void 0 || derived === explicit) {
     return;
   }
-  throw new import_core15.PenvError(
+  throw new import_core16.PenvError(
     "IMPORT_ENV_CONFLICT",
     `The file ${source} is scoped to environment ${derived}, but \`--env ${explicit}\` names ${explicit}`,
     `Drop \`--env\` to import ${source} as ${derived}, pass \`--env ${derived}\` to say the same thing twice, or point \`penv import\` at the file that holds ${explicit}'s values. Nothing was imported.`
@@ -3460,15 +3883,18 @@ function environmentNamed(file, explicit) {
 function decisionsOf(config, cwd) {
   return {
     environments: config.environments,
-    schemaFile: (0, import_core15.schemaFileOf)(config),
+    // `import` re-scaffolds env.ts for an existing project; injection is an init
+    // choice, so it is not turned on here.
+    inject: false,
+    schemaFile: (0, import_core16.schemaFileOf)(config),
     publicPrefixes: config.publicPrefixes ?? [],
     alias: detectAlias(cwd)
   };
 }
 function configInEffect(cwd, environment) {
-  const existing = (0, import_core15.findConfigFile)(cwd);
+  const existing = (0, import_core16.findConfigFile)(cwd);
   if (existing !== void 0) {
-    const config = (0, import_core15.loadConfigFrom)(existing);
+    const config = (0, import_core16.loadConfigFrom)(existing);
     return { config, decisions: decisionsOf(config, cwd) };
   }
   const planned = planInit(cwd).decisions;
@@ -3483,13 +3909,13 @@ function importDotenv(options) {
   const cwd = (0, import_node_path7.resolve)(options.cwd);
   const file = (0, import_node_path7.isAbsolute)(options.file) ? options.file : (0, import_node_path7.resolve)(cwd, options.file);
   if (!(0, import_node_fs4.existsSync)(file)) {
-    throw new import_core15.PenvError(
+    throw new import_core16.PenvError(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = (0, import_core15.parseDotenv)((0, import_node_fs4.readFileSync)(file, "utf8"));
+  const parsed = (0, import_core16.parseDotenv)((0, import_node_fs4.readFileSync)(file, "utf8"));
   const { config, decisions } = configInEffect(cwd, environmentNamed(file, options.environment));
   const source = displayPath2(cwd, file);
   const named = scopeFromFilename(file, config);
@@ -3497,10 +3923,10 @@ function importDotenv(options) {
   const explicit = options.environment === void 0 ? void 0 : explicitEnvironment(options, source, config);
   assertEnvironmentAgrees(derived, explicit, source);
   const scope = explicit === void 0 ? named : scopeWithEnvironment(named, assertDeclared(explicit, config));
-  const environment = (0, import_core15.lookupEnvironment)(config, explicit ?? derived);
+  const environment = (0, import_core16.lookupEnvironment)(config, explicit ?? derived);
   const refs = [];
   for (const entry of parsed.entries) {
-    const ref = (0, import_core15.refFromVariable)(entry.key);
+    const ref = (0, import_core16.refFromVariable)(entry.key);
     assertImportable(ref, entry.key);
     assertNotReserved(ref, entry.key, source, config);
     assertRoundTrips(ref, entry.key, config);
@@ -3628,7 +4054,7 @@ var importCommand = (0, import_citty10.defineCommand)({
 
 // src/commands/key.ts
 var import_node_crypto = require("crypto");
-var import_core16 = require("@penvhq/core");
+var import_core17 = require("@penvhq/core");
 var import_citty11 = require("citty");
 
 // src/keychain.ts
@@ -3662,35 +4088,35 @@ function runKeyCreate(options) {
   const environment = targetEnvironment(project, options.environment);
   const declared = project.config.keys?.[environment];
   if (declared === void 0) {
-    throw new import_core16.PenvError(
+    throw new import_core17.PenvError(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
       `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
     );
   }
-  const key = (0, import_node_crypto.randomBytes)(import_core16.KEY_BYTES).toString("base64");
+  const key = (0, import_node_crypto.randomBytes)(import_core17.KEY_BYTES).toString("base64");
   if (declared.source === "keychain") {
     const keychain = options.keychain ?? defaultKeychain;
     if (options.force !== true) {
       let existing;
       try {
-        existing = keychain.getPassword(import_core16.KEYCHAIN_SERVICE, declared.id);
+        existing = keychain.getPassword(import_core17.KEYCHAIN_SERVICE, declared.id);
       } catch (cause) {
-        throw new import_core16.PenvError(
+        throw new import_core17.PenvError(
           "KEYCHAIN_UNAVAILABLE",
           `penv could not read your OS keychain to check for an existing key \`${declared.id}\``,
           `Unlock your keychain and run this again. Original error: ${cause instanceof Error ? cause.message : String(cause)}`
         );
       }
       if (existing !== null) {
-        throw new import_core16.PenvError(
+        throw new import_core17.PenvError(
           "KEY_EXISTS",
           `Environment ${environment} already has a key \`${declared.id}\` in your OS keychain`,
           "Replacing it would orphan every value already sealed under it \u2014 they could never be decrypted again. Re-run with `--force` only if you are certain nothing is sealed under the current key."
         );
       }
     }
-    keychain.setPassword(import_core16.KEYCHAIN_SERVICE, declared.id, key);
+    keychain.setPassword(import_core17.KEYCHAIN_SERVICE, declared.id, key);
     return { source: "keychain", environment, id: declared.id };
   }
   return {
@@ -3758,7 +4184,7 @@ var keyCommand = (0, import_citty11.defineCommand)({
 });
 
 // src/commands/list.ts
-var import_core17 = require("@penvhq/core");
+var import_core18 = require("@penvhq/core");
 var import_citty12 = require("citty");
 function scopeLabel2(scope) {
   switch (scope.kind) {
@@ -3771,7 +4197,7 @@ function scopeLabel2(scope) {
     case "unscoped":
       return "default";
     default:
-      return (0, import_core17.assertNever)(scope, "scope");
+      return (0, import_core18.assertNever)(scope, "scope");
   }
 }
 async function runList(options) {
@@ -3779,12 +4205,12 @@ async function runList(options) {
   const environment = targetEnvironment(project, options.environment);
   const keys = keySourceFor(project, environment);
   const parameters = [];
-  for (const resolution of await (0, import_core17.resolveAll)(environment, project.provider, keys)) {
+  for (const resolution of await (0, import_core18.resolveAll)(environment, project.provider, keys)) {
     const winner = resolution.winner;
     const scope = winner?.file.scope;
     parameters.push({
       parameter: resolution.parameter,
-      variable: (0, import_core17.variableName)(resolution.ref, project.config),
+      variable: (0, import_core18.variableName)(resolution.ref, project.config),
       scope: scope === void 0 ? "absent" : scopeLabel2(scope),
       location: winner?.location,
       encrypted: winner?.file.encrypted === true,
@@ -3837,7 +4263,7 @@ var listCommand = (0, import_citty12.defineCommand)({
 });
 
 // src/commands/mv.ts
-var import_core18 = require("@penvhq/core");
+var import_core19 = require("@penvhq/core");
 var import_citty13 = require("citty");
 function environmentOf2(file) {
   const scope = file.scope;
@@ -3853,39 +4279,39 @@ async function planFile(project, source, target, parameter) {
   }
   const environment = environmentOf2(source);
   if (environment === void 0) {
-    throw new import_core18.PenvError(
+    throw new import_core19.PenvError(
       "SECRET_SCOPE_AMBIGUOUS",
-      `${PENV_DIR}/${(0, import_core18.formatValueFile)(source)} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
+      `${PENV_DIR}/${(0, import_core19.formatValueFile)(source)} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
       "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
     );
   }
   const keys = keySourceFor(project, environment);
-  const opened = (0, import_core18.openValue)(source, stored, keys);
+  const opened = (0, import_core19.openValue)(source, stored, keys);
   if (opened.kind === "failed") {
-    throw new import_core18.PenvError(
+    throw new import_core19.PenvError(
       "VALUE_UNDECRYPTABLE",
-      `${PENV_DIR}/${(0, import_core18.formatValueFile)(source)} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
+      `${PENV_DIR}/${(0, import_core19.formatValueFile)(source)} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
       "A sealed value is bound to the file it lives in, so moving it means opening it and sealing it again. Make the key available and run this again. Nothing has been moved."
     );
   }
   return {
     source,
     target,
-    contents: (0, import_core18.sealValue)(target, opened.value, keys, parameter, environment),
+    contents: (0, import_core19.sealValue)(target, opened.value, keys, parameter, environment),
     resealed: true
   };
 }
 function filesOf(all, ref) {
-  const id = (0, import_core18.parameterId)(ref);
-  return all.filter((file) => (0, import_core18.parameterId)(file) === id);
+  const id = (0, import_core19.parameterId)(ref);
+  return all.filter((file) => (0, import_core19.parameterId)(file) === id);
 }
 async function runMove(options) {
   const project = openProject(options.cwd);
   const from = refFromKey(options.from, project.config);
   assertWritableKey(options.to);
   const to = refFromKey(options.to, project.config);
-  if ((0, import_core18.parameterId)(from) === (0, import_core18.parameterId)(to)) {
-    throw new import_core18.PenvError(
+  if ((0, import_core19.parameterId)(from) === (0, import_core19.parameterId)(to)) {
+    throw new import_core19.PenvError(
       "PARAMETER_UNCHANGED",
       `\`${options.from}\` and \`${options.to}\` are the same parameter`,
       "Name a different destination, e.g. `penv mv redis-password redis/password`."
@@ -3895,24 +4321,24 @@ async function runMove(options) {
   const sources = filesOf(all, from);
   const meta = await project.provider.readMeta(from);
   if (sources.length === 0 && meta === void 0) {
-    throw new import_core18.PenvError(
+    throw new import_core19.PenvError(
       "PARAMETER_ABSENT",
-      `Parameter ${(0, import_core18.parameterId)(from)} has no value files and no meta, so there is nothing to move`,
+      `Parameter ${(0, import_core19.parameterId)(from)} has no value files and no meta, so there is nothing to move`,
       `\`penv list\` shows every parameter penv holds.`
     );
   }
   const occupied2 = filesOf(all, to);
   if (occupied2.length > 0 || await project.provider.readMeta(to) !== void 0) {
-    throw new import_core18.PenvError(
+    throw new import_core19.PenvError(
       "PARAMETER_EXISTS",
-      `Parameter ${(0, import_core18.parameterId)(to)} already exists, and penv will not merge two parameters into one`,
-      `Remove or rename ${(0, import_core18.parameterId)(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
+      `Parameter ${(0, import_core19.parameterId)(to)} already exists, and penv will not merge two parameters into one`,
+      `Remove or rename ${(0, import_core19.parameterId)(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
     );
   }
   const planned = [];
   for (const source of sources) {
     const target = { ...source, namespace: to.namespace, name: to.name };
-    const one = await planFile(project, source, target, (0, import_core18.parameterId)(to));
+    const one = await planFile(project, source, target, (0, import_core19.parameterId)(to));
     if (one !== void 0) {
       planned.push(one);
     }
@@ -3930,18 +4356,18 @@ async function runMove(options) {
     await project.provider.removeMeta(from);
   }
   return {
-    from: (0, import_core18.parameterId)(from),
-    to: (0, import_core18.parameterId)(to),
+    from: (0, import_core19.parameterId)(from),
+    to: (0, import_core19.parameterId)(to),
     files: planned.map((file) => ({
-      from: (0, import_core18.formatValueFile)(file.source),
-      to: (0, import_core18.formatValueFile)(file.target),
+      from: (0, import_core19.formatValueFile)(file.source),
+      to: (0, import_core19.formatValueFile)(file.target),
       resealed: file.resealed
     })),
     // The meta's path, not the parameter's dotted id: `redis.password` is what
     // the schema calls it and `redis/password.json` is the file, and a report
     // that printed the first while moving the second names no file on disk.
-    meta: meta === void 0 ? void 0 : (0, import_core18.formatMetaFile)({ ...to, format: "json" }),
-    schema: { was: (0, import_core18.accessPath)(from).join("."), now: (0, import_core18.accessPath)(to).join(".") }
+    meta: meta === void 0 ? void 0 : (0, import_core19.formatMetaFile)({ ...to, format: "json" }),
+    schema: { was: (0, import_core19.accessPath)(from).join("."), now: (0, import_core19.accessPath)(to).join(".") }
   };
 }
 function renderMove(result2) {
@@ -3985,14 +4411,45 @@ var mvCommand = (0, import_citty13.defineCommand)({
 });
 
 // src/commands/pull.ts
+var import_core20 = require("@penvhq/core");
 var import_citty14 = require("citty");
+async function pullProjection(project, source, environment) {
+  const tree = localTree(project);
+  const names = /* @__PURE__ */ new Set();
+  for (const secret of await source.list({ kind: "repository" })) {
+    names.add(secret.name);
+  }
+  for (const secret of await source.list({ kind: "environment", environment })) {
+    names.add(secret.name);
+  }
+  let meta = 0;
+  for (const name of [...names].sort()) {
+    const ref = (0, import_core20.refFromVariable)(name);
+    if (tree.readMetaSync(ref) === void 0) {
+      tree.writeMetaSync(ref, {});
+      meta += 1;
+    }
+  }
+  return {
+    environment,
+    source: source.type,
+    localSource: false,
+    values: 0,
+    meta,
+    refs: names.size,
+    valuesUnreadable: true
+  };
+}
 async function runPull(options) {
   const project = openProject(options.cwd);
-  const environment = targetEnvironment(project, options.environment);
-  const source = await sourceProviderFor(project, environment);
+  const environment = targetEnvironment(project, options.environment, options.envFlags);
+  const source = options.source ?? await sourceProviderFor(project, environment);
   if (source.type === LOCAL_TREE_TYPE) {
     return { environment, source: source.type, localSource: true, values: 0, meta: 0, refs: 0 };
   }
+  if ((0, import_core20.holdsProjection)(source)) {
+    return pullProjection(project, source, environment);
+  }
   const tree = localTree(project);
   const files = await source.list();
   let values = 0;
@@ -4027,6 +4484,22 @@ function renderPull(result2) {
       }
     ]);
   }
+  if (result2.valuesUnreadable === true) {
+    return formatRows([
+      {
+        glyph: CHECK,
+        label: "Pulled",
+        subject: `${result2.refs} ${result2.refs === 1 ? "parameter name" : "parameter names"}`,
+        detail: `from ${result2.source} for environment ${result2.environment}`
+      },
+      {
+        glyph: WARN,
+        label: "Values not readable",
+        subject: "this destination never returns a secret's value",
+        detail: "fill them locally with `penv set` or `penv fill` \u2014 `penv validate` names every gap"
+      }
+    ]);
+  }
   return formatRows([
     {
       glyph: CHECK,
@@ -4048,13 +4521,17 @@ var pullCommand = (0, import_citty14.defineCommand)({
     description: "Materialise the local .penv tree from an environment's source-of-truth provider"
   },
   args: {
-    env: { type: "string", description: "The environment to pull" }
+    env: {
+      type: "string",
+      description: "The environment to pull (or pass it as a bare flag: --production)"
+    }
   },
   run({ args }) {
     return guard(async () => {
       const result2 = await runPull({
         cwd: process.cwd(),
-        ...args.env === void 0 ? {} : { environment: args.env }
+        ...args.env === void 0 ? {} : { environment: args.env },
+        envFlags: shorthandCandidates(args, ["env"])
       });
       write(renderPull(result2));
     });
@@ -4062,7 +4539,7 @@ var pullCommand = (0, import_citty14.defineCommand)({
 });
 
 // src/commands/remove.ts
-var import_core19 = require("@penvhq/core");
+var import_core21 = require("@penvhq/core");
 var import_citty15 = require("citty");
 async function runRemove(options) {
   const project = openProject(options.cwd);
@@ -4080,12 +4557,12 @@ async function runRemove(options) {
       continue;
     }
     await project.provider.remove(file);
-    removed.push((0, import_core19.formatValueFile)(file));
+    removed.push((0, import_core21.formatValueFile)(file));
   }
   return {
     parameter: options.key,
     removed,
-    considered: files.map((file) => (0, import_core19.formatValueFile)(file))
+    considered: files.map((file) => (0, import_core21.formatValueFile)(file))
   };
 }
 function renderRemove(result2) {
@@ -4134,7 +4611,7 @@ var removeCommand = (0, import_citty15.defineCommand)({
 });
 
 // src/commands/rotate.ts
-var import_core20 = require("@penvhq/core");
+var import_core22 = require("@penvhq/core");
 var import_citty16 = require("citty");
 function rotatingFile(ref, environment) {
   return {
@@ -4160,7 +4637,7 @@ async function writeRotatedValue(project, provider, ref, environment, value) {
 }
 function requireNewValue(value, phase, key) {
   if (value === void 0) {
-    throw new import_core20.PenvError(
+    throw new import_core22.PenvError(
       "ROTATION_NO_VALUE",
       `A ${phase} rotation of ${key} writes a new value, and none was given`,
       "Pass the new value as the argument \u2014 `penv rotate <key> <value>` \u2014 or pipe it in on stdin."
@@ -4169,8 +4646,8 @@ function requireNewValue(value, phase, key) {
   return value;
 }
 function requireRetaining(provider, environment) {
-  if (!(0, import_core20.retainsPrevious)(provider)) {
-    throw new import_core20.PenvError(
+  if (!(0, import_core22.retainsPrevious)(provider)) {
+    throw new import_core22.PenvError(
       "ROTATION_NOT_RETAINING",
       `A dual-valid rotation needs the previous value to stay readable during the grace window, and the \`${provider.type}\` provider for environment ${environment} does not retain it`,
       "Point this environment at a provider that keeps prior versions (its `readPrevious` is what penv reads during the window), or, if a momentary overlap is not required, declare the parameter `atomic-cutover` in its meta and flip it in one step."
@@ -4182,12 +4659,20 @@ async function runRotate(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
   const ref = refFromKey(options.key, project.config);
-  const provider = await sourceProviderFor(project, environment);
+  const source = await sourceProviderFor(project, environment);
+  if (!(0, import_core22.holdsRecords)(source)) {
+    throw new import_core22.PenvError(
+      "ROTATION_NOT_RECORDS",
+      `Environment ${environment} is backed by \`${source.type}\`, which holds a resolved projection penv cannot rotate in place`,
+      "Rotate the parameter in the environment that holds the records (the local tree, Vault, SSM), then `penv push` the result to this destination."
+    );
+  }
+  const provider = source;
   const nowIso = options.now ?? (/* @__PURE__ */ new Date()).toISOString();
   const before = await provider.readMeta(ref);
-  const { mechanism } = (0, import_core20.rotationOf)(before, environment);
+  const { mechanism } = (0, import_core22.rotationOf)(before, environment);
   if (mechanism === void 0) {
-    throw new import_core20.PenvError(
+    throw new import_core22.PenvError(
       "ROTATION_NO_MECHANISM",
       `Parameter ${options.key} declares no rotation mechanism for environment ${environment}, so penv does not know how to rotate it`,
       'Set `rotationMechanism` in the parameter\'s meta to `"dual-valid"` (a grace-window overlap) or `"atomic-cutover"` (a single flip), then run `penv rotate` again.'
@@ -4197,7 +4682,7 @@ async function runRotate(options) {
   const complete = options.complete === true;
   if (mechanism === "atomic-cutover") {
     if (begin || complete) {
-      throw new import_core20.PenvError(
+      throw new import_core22.PenvError(
         "ROTATION_MECHANISM_MISMATCH",
         `Parameter ${options.key} is atomic-cutover, which flips in one step, so \`--begin\`/\`--complete\` do not apply`,
         "Run `penv rotate <key> <value>` with no phase flag to flip it. `--begin`/`--complete` bracket a dual-valid grace window, which atomic-cutover has none of."
@@ -4205,13 +4690,13 @@ async function runRotate(options) {
     }
     const value = requireNewValue(options.value, "cutover", options.key);
     await writeRotatedValue(project, provider, ref, environment, value);
-    const after2 = (0, import_core20.completeRotation)(before, environment, nowIso);
+    const after2 = (0, import_core22.completeRotation)(before, environment, nowIso);
     await provider.writeMeta(ref, after2);
     return result(ref, environment, mechanism, "cutover", provider.type, true, after2);
   }
   const retaining = requireRetaining(provider, environment);
   if (begin === complete) {
-    throw new import_core20.PenvError(
+    throw new import_core22.PenvError(
       "ROTATION_PHASE_REQUIRED",
       `A dual-valid rotation of ${options.key} needs exactly one of \`--begin\` or \`--complete\``,
       "`--begin` writes the new value and opens the grace window; `--complete` closes it once every reader has moved to the new value. Run them in that order, one at a time."
@@ -4220,16 +4705,16 @@ async function runRotate(options) {
   if (begin) {
     const value = requireNewValue(options.value, "begin", options.key);
     await writeRotatedValue(project, retaining, ref, environment, value);
-    const after2 = (0, import_core20.beginRotation)(before, environment, nowIso);
+    const after2 = (0, import_core22.beginRotation)(before, environment, nowIso);
     await retaining.writeMeta(ref, after2);
     return result(ref, environment, mechanism, "begin", retaining.type, true, after2);
   }
-  const after = (0, import_core20.completeRotation)(before, environment, nowIso);
+  const after = (0, import_core22.completeRotation)(before, environment, nowIso);
   await retaining.writeMeta(ref, after);
   return result(ref, environment, mechanism, "complete", retaining.type, false, after);
 }
 function result(ref, environment, mechanism, phase, source, wroteValue, after) {
-  const { state, rotatingSince, lastRotated } = (0, import_core20.rotationOf)(after, environment);
+  const { state, rotatingSince, lastRotated } = (0, import_core22.rotationOf)(after, environment);
   return {
     parameter: [...ref.namespace, ref.name].join("/"),
     environment,
@@ -4316,7 +4801,7 @@ var rotateCommand = (0, import_citty16.defineCommand)({
 // src/commands/watch.ts
 var import_node_fs5 = require("fs");
 var import_node_path8 = require("path");
-var import_core21 = require("@penvhq/core");
+var import_core23 = require("@penvhq/core");
 var import_citty17 = require("citty");
 var DEBOUNCE_MS = 100;
 function runWatch(options) {
@@ -4449,8 +4934,8 @@ function runWatch(options) {
   }
   addWatcher(project.penvDir, true);
   addWatcher((0, import_node_path8.dirname)(project.configFile), false, configFile);
-  if ((0, import_core21.schemaInsideTree)(project.config) === void 0) {
-    const schemaFile = (0, import_node_path8.resolve)(project.root, (0, import_core21.schemaFileOf)(project.config));
+  if ((0, import_core23.schemaInsideTree)(project.config) === void 0) {
+    const schemaFile = (0, import_node_path8.resolve)(project.root, (0, import_core23.schemaFileOf)(project.config));
     addWatcher((0, import_node_path8.dirname)(schemaFile), false, (0, import_node_path8.basename)(schemaFile));
   }
   void validate();
@@ -4560,7 +5045,7 @@ var main = (0, import_citty18.defineCommand)({
   }
 });
 function runMain() {
-  (0, import_core22.setKeychain)(defaultKeychain);
+  (0, import_core24.setKeychain)(defaultKeychain);
   return (0, import_citty18.runMain)(main);
 }
 // Annotate the CommonJS export names for ESM import in node: