@penvhq/provider-github 0.13.0 → 0.15.0

package/dist/index.d.cts

@@ -20,8 +20,8 @@ interface ParameterRef {
  * ```
  *
  * — so the compile-time union is exactly the set of providers the project has
- * installed, and {@link defineConfig} can hold a known `type`'s fields to the
- * provider's own declaration while leaving an unknown `type` the open base shape.
+ * installed, and {@link defineConfig} can hold a known `provider`'s fields to the
+ * provider's own declaration while leaving an unknown one the open base shape.
  */
 interface ProviderConfigMap {
 }
@@ -30,20 +30,18 @@ type KnownProviderType = keyof ProviderConfigMap & string;
 interface ProviderConfig {
     /**
      * The provider package's fully-qualified name — `"@penvhq/provider-vault"`.
-     * The name is the import specifier: penv resolves it from the project's own
-     * `node_modules`, so declaring a provider and installing its package are the
-     * same decision stated twice, and the config never needs a second field to
-     * say where the implementation lives.
+     * Always a plain package specifier, never a factory import: provider packages
+     * are integrity-pinned CLI extensions recorded in the manifest, not necessarily
+     * installed dependencies, so the config stays data-only and importable in a
+     * repo where no adapter code exists.
      */
-    readonly type: KnownProviderType | (string & {});
+    readonly provider: KnownProviderType | (string & {});
     /**
-     * The place inside the provider that penv maps the tree onto. The format is
-     * the provider's own — a Vault KV base path, a Kubernetes
-     * `namespace/secretName` — and its package's config type documents it; the
-     * field name never changes between providers.
+     * Everything else an entry carries is the provider's own vocabulary — vercel's
+     * `project`, ssm's `path` — declared by its package's config type. Core owns no
+     * generic address field: a name the developer has to translate is a name that
+     * belongs to penv rather than to the store.
      */
-    readonly location?: string;
-    /** Fields beyond `location` belong to the provider's own config type. */
     readonly [key: string]: unknown;
 }
 /**
@@ -66,9 +64,9 @@ interface ProviderFactoryContext {
      */
     readonly config: PenvConfig;
     /**
-     * The one environment's own `providers.*` entry, when building its declared
-     * source of truth. Carries provider-side settings — the `location` above all —
-     * that the config authored, never inferred.
+     * The one environment's own `environments.*` entry, when building its declared
+     * source of truth. Carries the fields the provider itself declared — vercel's
+     * `project`, ssm's `path` — that the config authored, never inferred.
      */
     readonly providerConfig?: ProviderConfig;
     /**
@@ -140,27 +138,16 @@ interface ProviderCapabilities {
      */
     readonly readsValues: boolean;
 }
-/**
- * Where one environment's encryption key comes from. Declared, never guessed: a
- * key source penv picked for you is a key you did not choose.
- */
-interface KeyConfig {
-    readonly source: "env" | "keychain";
-    /**
-     * Names the key. Written into every value file sealed under it, so it must
-     * outlive any one machine — and cannot contain `:`, which separates the
-     * envelope's fields.
-     */
-    readonly id: string;
-}
 interface PenvConfig {
     /**
-     * The whitelist of valid environment names — the only source of truth for
-     * what counts as an environment. Segments are matched against this list,
-     * never inferred from folders or filenames.
+     * Every environment this project has, each mapped to its complete declaration.
+     *
+     * The record's keys *are* the whitelist (invariant 10) — a key is a
+     * declaration, not an inference, so segments are matched against these names
+     * and never read out of a folder or a filename. Read them through
+     * {@link environmentNames} and {@link environmentEntry} rather than by hand.
      */
-    readonly environments: readonly string[];
-    readonly providers: Readonly<Record<string, ProviderConfig>>;
+    readonly environments: Readonly<Record<string, string | ProviderConfig>>;
     /**
      * The environment a command acts on when `--env` is absent and nothing in the
      * environment says otherwise. It must be one of {@link environments}.
@@ -207,11 +194,6 @@ interface PenvConfig {
      * error instead of an override that silently never applies.
      */
     readonly override?: OverrideBlock;
-    /**
-     * Where each environment's encryption key lives. An environment with no entry
-     * has no key source, which is not the same as having no key — see `keys.ts`.
-     */
-    readonly keys?: Readonly<Record<string, KeyConfig>>;
 }
 /**
  * Which destination store a value lands in. The two members are penv's own
@@ -376,10 +358,9 @@ declare class GithubUnavailableError extends PenvError {
 }
 
 /**
- * The plugin seam: what the penv CLI calls when a `providers.*.type` names this
- * package. The factory owns the translation from the config's provider-agnostic
- * surface (`location`) to this provider's own options, so the config never
- * learns GitHub vocabulary and the provider never parses config.
+ * The plugin seam: what the penv CLI calls when an `environments.*.provider`
+ * names this package. The factory reads the entry's `repository` and hands the
+ * provider its options, so the provider never parses config.
  */
 
 /** Builds the GitHub provider for one environment's declared destination. */

package/dist/index.d.ts

@@ -20,8 +20,8 @@ interface ParameterRef {
  * ```
  *
  * — so the compile-time union is exactly the set of providers the project has
- * installed, and {@link defineConfig} can hold a known `type`'s fields to the
- * provider's own declaration while leaving an unknown `type` the open base shape.
+ * installed, and {@link defineConfig} can hold a known `provider`'s fields to the
+ * provider's own declaration while leaving an unknown one the open base shape.
  */
 interface ProviderConfigMap {
 }
@@ -30,20 +30,18 @@ type KnownProviderType = keyof ProviderConfigMap & string;
 interface ProviderConfig {
     /**
      * The provider package's fully-qualified name — `"@penvhq/provider-vault"`.
-     * The name is the import specifier: penv resolves it from the project's own
-     * `node_modules`, so declaring a provider and installing its package are the
-     * same decision stated twice, and the config never needs a second field to
-     * say where the implementation lives.
+     * Always a plain package specifier, never a factory import: provider packages
+     * are integrity-pinned CLI extensions recorded in the manifest, not necessarily
+     * installed dependencies, so the config stays data-only and importable in a
+     * repo where no adapter code exists.
      */
-    readonly type: KnownProviderType | (string & {});
+    readonly provider: KnownProviderType | (string & {});
     /**
-     * The place inside the provider that penv maps the tree onto. The format is
-     * the provider's own — a Vault KV base path, a Kubernetes
-     * `namespace/secretName` — and its package's config type documents it; the
-     * field name never changes between providers.
+     * Everything else an entry carries is the provider's own vocabulary — vercel's
+     * `project`, ssm's `path` — declared by its package's config type. Core owns no
+     * generic address field: a name the developer has to translate is a name that
+     * belongs to penv rather than to the store.
      */
-    readonly location?: string;
-    /** Fields beyond `location` belong to the provider's own config type. */
     readonly [key: string]: unknown;
 }
 /**
@@ -66,9 +64,9 @@ interface ProviderFactoryContext {
      */
     readonly config: PenvConfig;
     /**
-     * The one environment's own `providers.*` entry, when building its declared
-     * source of truth. Carries provider-side settings — the `location` above all —
-     * that the config authored, never inferred.
+     * The one environment's own `environments.*` entry, when building its declared
+     * source of truth. Carries the fields the provider itself declared — vercel's
+     * `project`, ssm's `path` — that the config authored, never inferred.
      */
     readonly providerConfig?: ProviderConfig;
     /**
@@ -140,27 +138,16 @@ interface ProviderCapabilities {
      */
     readonly readsValues: boolean;
 }
-/**
- * Where one environment's encryption key comes from. Declared, never guessed: a
- * key source penv picked for you is a key you did not choose.
- */
-interface KeyConfig {
-    readonly source: "env" | "keychain";
-    /**
-     * Names the key. Written into every value file sealed under it, so it must
-     * outlive any one machine — and cannot contain `:`, which separates the
-     * envelope's fields.
-     */
-    readonly id: string;
-}
 interface PenvConfig {
     /**
-     * The whitelist of valid environment names — the only source of truth for
-     * what counts as an environment. Segments are matched against this list,
-     * never inferred from folders or filenames.
+     * Every environment this project has, each mapped to its complete declaration.
+     *
+     * The record's keys *are* the whitelist (invariant 10) — a key is a
+     * declaration, not an inference, so segments are matched against these names
+     * and never read out of a folder or a filename. Read them through
+     * {@link environmentNames} and {@link environmentEntry} rather than by hand.
      */
-    readonly environments: readonly string[];
-    readonly providers: Readonly<Record<string, ProviderConfig>>;
+    readonly environments: Readonly<Record<string, string | ProviderConfig>>;
     /**
      * The environment a command acts on when `--env` is absent and nothing in the
      * environment says otherwise. It must be one of {@link environments}.
@@ -207,11 +194,6 @@ interface PenvConfig {
      * error instead of an override that silently never applies.
      */
     readonly override?: OverrideBlock;
-    /**
-     * Where each environment's encryption key lives. An environment with no entry
-     * has no key source, which is not the same as having no key — see `keys.ts`.
-     */
-    readonly keys?: Readonly<Record<string, KeyConfig>>;
 }
 /**
  * Which destination store a value lands in. The two members are penv's own
@@ -376,10 +358,9 @@ declare class GithubUnavailableError extends PenvError {
 }
 
 /**
- * The plugin seam: what the penv CLI calls when a `providers.*.type` names this
- * package. The factory owns the translation from the config's provider-agnostic
- * surface (`location`) to this provider's own options, so the config never
- * learns GitHub vocabulary and the provider never parses config.
+ * The plugin seam: what the penv CLI calls when an `environments.*.provider`
+ * names this package. The factory reads the entry's `repository` and hands the
+ * provider its options, so the provider never parses config.
  */
 
 /** Builds the GitHub provider for one environment's declared destination. */

package/dist/index.js

@@ -15030,7 +15030,7 @@ var GithubProvider = class {
   /**
    * The `owner/repo` the API paths below need. `gh secret` resolves the repo
    * from the working directory on its own, but `gh api` takes a literal path —
-   * so when no `location` named one, ask `gh` once and keep the answer.
+   * so when no `repository` named one, ask `gh` once and keep the answer.
    */
   #targetRepo() {
     if (this.#repo !== void 0) {
@@ -15047,7 +15047,7 @@ var GithubProvider = class {
       if (repo === "") {
         throw commandFailed(
           "resolve the repository this directory belongs to",
-          "gh reported no repository. Set `location` to `owner/repo` in the provider entry."
+          "gh reported no repository. Set `repository` to `owner/repo` in the environment's entry."
         );
       }
       this.#resolvedRepo = repo;
@@ -15093,8 +15093,8 @@ function createGithubProvider(options = {}) {
 
 // src/factory.ts
 function penvProviderFactory(context) {
-  const location = context.providerConfig?.location;
-  return createGithubProvider(location === void 0 ? {} : { repo: location });
+  const repository = context.providerConfig?.["repository"];
+  return createGithubProvider(typeof repository === "string" ? { repo: repository } : {});
 }
 export {
   GhInvocationError,