@penvhq/runtime 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Itzfeminisce
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/chunk-57AVY2K5.js

@@ -0,0 +1,63 @@
+// src/resolve.ts
+import { dirname, resolve as resolvePath } from "path";
+import {
+  candidatesFor,
+  formatValueFile,
+  loadConfig,
+  openValue,
+  parameterId,
+  resolveEnvironment,
+  resolveKeySource,
+  UndecryptableValueError
+} from "@penvhq/core";
+import { createFilesystemProvider } from "@penvhq/provider-filesystem";
+function refsFrom(files) {
+  const refs = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const ref = { namespace: file.namespace, name: file.name };
+    const id = parameterId(ref);
+    if (!refs.has(id)) {
+      refs.set(id, ref);
+    }
+  }
+  return [...refs.values()].sort((a, b) => {
+    const left = parameterId(a);
+    const right = parameterId(b);
+    return left < right ? -1 : left > right ? 1 : 0;
+  });
+}
+function resolveSync(cwd, environment) {
+  const { config, file } = loadConfig(cwd);
+  const target = resolveEnvironment(config, environment);
+  const provider = createFilesystemProvider({
+    root: resolvePath(dirname(file), ".penv"),
+    config
+  });
+  const keys = resolveKeySource(config, target);
+  const values = [];
+  for (const ref of refsFrom(provider.listSync())) {
+    for (const candidate of candidatesFor(ref, target)) {
+      const read = provider.readSync(candidate);
+      if (read === void 0) {
+        continue;
+      }
+      const opened = openValue(candidate, read, keys);
+      if (opened.kind === "failed") {
+        throw new UndecryptableValueError(
+          parameterId(ref),
+          target,
+          formatValueFile(candidate),
+          opened.failure
+        );
+      }
+      values.push({ ref, value: opened.value });
+      break;
+    }
+  }
+  return { config, environment: target, values };
+}
+
+export {
+  resolveSync
+};
+//# sourceMappingURL=chunk-57AVY2K5.js.map

package/dist/chunk-57AVY2K5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resolve.ts"],"sourcesContent":["/**\n * The synchronous half of the value cascade, shared by `load` and the\n * `penv/config` compatibility entry.\n *\n * `resolveParameter` in `@penvhq/core` is async because the provider contract is,\n * and `load` is synchronous — so this module walks the cascade against the\n * filesystem provider's synchronous reads instead. It does not restate the\n * precedence rule: `candidatesFor` owns the order and everything here only\n * walks the list it returns, so the two paths cannot drift apart.\n *\n * The runtime reads the local tree for every environment, whatever provider\n * that environment declares, and this is the design rather than a limitation.\n * A provider is where an environment's source of truth *lives*, not where the\n * runtime reads from: `penv pull` materialises the tree from the provider, and\n * the runtime then reads what is on disk. So `load` never inspects\n * `providers.*.type` — a Vault-backed environment resolves through exactly the\n * code path a filesystem-backed one does, which is what makes changing provider\n * a configuration change rather than an application rewrite.\n *\n * Decryption happens here, synchronously, and that is the same knife applied a\n * second time. Key *acquisition* is async and happens before the process starts:\n * a deploy unwraps the KMS-derived data key and exports it, exactly as it already\n * runs `penv pull` to materialise the tree. Key *use* is a synchronous pure\n * function over bytes. penv never calls a KMS in-process — a key is where an\n * environment's secret material *lives*, not what the runtime dials at boot, just\n * as a provider is a sync target and not a runtime source. So invariant 3 is not\n * traded against encryption: `load` stays generic and synchronous because the\n * network half of both problems was moved out of the process entirely, rather\n * than awaited inside it.\n */\n\nimport { dirname, resolve as resolvePath } from \"node:path\";\nimport type { ParameterRef, PenvConfig, ValueFile } from \"@penvhq/core\";\nimport {\n  candidatesFor,\n  formatValueFile,\n  loadConfig,\n  openValue,\n  parameterId,\n  resolveEnvironment,\n  resolveKeySource,\n  UndecryptableValueError,\n} from \"@penvhq/core\";\nimport { createFilesystemProvider } from \"@penvhq/provider-filesystem\";\n\n/** One parameter that resolved to a present value for the target environment. */\nexport interface ResolvedValue {\n  readonly ref: ParameterRef;\n  readonly value: string;\n}\n\nexport interface ResolvedConfig {\n  readonly config: PenvConfig;\n  readonly environment: string;\n  /**\n   * Only parameters with a present candidate. A parameter that resolved to\n   * nothing is absent rather than `undefined`, so requiredness stays the\n   * schema's call.\n   */\n  readonly values: readonly ResolvedValue[];\n}\n\n/**\n * The parameters behind a set of value files, scopes collapsed —\n * `redis/password.production` and `redis/password` are one parameter. Ordered\n * so a `process.env` population is identical on every machine.\n */\nfunction refsFrom(files: readonly ValueFile[]): ParameterRef[] {\n  const refs = new Map<string, ParameterRef>();\n  for (const file of files) {\n    const ref: ParameterRef = { namespace: file.namespace, name: file.name };\n    const id = parameterId(ref);\n    if (!refs.has(id)) {\n      refs.set(id, ref);\n    }\n  }\n  return [...refs.values()].sort((a, b) => {\n    const left = parameterId(a);\n    const right = parameterId(b);\n    return left < right ? -1 : left > right ? 1 : 0;\n  });\n}\n\n/**\n * Loads the config, settles the environment, and resolves every parameter the\n * local tree holds — the work `load` and `penv/config` both start from.\n */\nexport function resolveSync(cwd: string, environment?: string): ResolvedConfig {\n  const { config, file } = loadConfig(cwd);\n  const target = resolveEnvironment(config, environment);\n\n  const provider = createFilesystemProvider({\n    root: resolvePath(dirname(file), \".penv\"),\n    config,\n  });\n\n  const keys = resolveKeySource(config, target);\n\n  const values: ResolvedValue[] = [];\n  for (const ref of refsFrom(provider.listSync())) {\n    for (const candidate of candidatesFor(ref, target)) {\n      const read = provider.readSync(candidate);\n      if (read === undefined) {\n        continue;\n      }\n      // The winner is the winner whether or not it opens. Continuing the walk on\n      // a failed decrypt would serve a lower scope's plaintext twin instead —\n      // the scope widening the cascade exists to prevent, arrived at by treating\n      // \"I cannot read this\" as \"this is not here\".\n      const opened = openValue(candidate, read, keys);\n      if (opened.kind === \"failed\") {\n        throw new UndecryptableValueError(\n          parameterId(ref),\n          target,\n          formatValueFile(candidate),\n          opened.failure,\n        );\n      }\n      values.push({ ref, value: opened.value });\n      break;\n    }\n  }\n\n  return { config, environment: target, values };\n}\n"],"mappings":";AA+BA,SAAS,SAAS,WAAW,mBAAmB;AAEhD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AAwBzC,SAAS,SAAS,OAA6C;AAC7D,QAAM,OAAO,oBAAI,IAA0B;AAC3C,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAoB,EAAE,WAAW,KAAK,WAAW,MAAM,KAAK,KAAK;AACvE,UAAM,KAAK,YAAY,GAAG;AAC1B,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,IAAI,GAAG;AAAA,IAClB;AAAA,EACF;AACA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM;AACvC,UAAM,OAAO,YAAY,CAAC;AAC1B,UAAM,QAAQ,YAAY,CAAC;AAC3B,WAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,EAChD,CAAC;AACH;AAMO,SAAS,YAAY,KAAa,aAAsC;AAC7E,QAAM,EAAE,QAAQ,KAAK,IAAI,WAAW,GAAG;AACvC,QAAM,SAAS,mBAAmB,QAAQ,WAAW;AAErD,QAAM,WAAW,yBAAyB;AAAA,IACxC,MAAM,YAAY,QAAQ,IAAI,GAAG,OAAO;AAAA,IACxC;AAAA,EACF,CAAC;AAED,QAAM,OAAO,iBAAiB,QAAQ,MAAM;AAE5C,QAAM,SAA0B,CAAC;AACjC,aAAW,OAAO,SAAS,SAAS,SAAS,CAAC,GAAG;AAC/C,eAAW,aAAa,cAAc,KAAK,MAAM,GAAG;AAClD,YAAM,OAAO,SAAS,SAAS,SAAS;AACxC,UAAI,SAAS,QAAW;AACtB;AAAA,MACF;AAKA,YAAM,SAAS,UAAU,WAAW,MAAM,IAAI;AAC9C,UAAI,OAAO,SAAS,UAAU;AAC5B,cAAM,IAAI;AAAA,UACR,YAAY,GAAG;AAAA,UACf;AAAA,UACA,gBAAgB,SAAS;AAAA,UACzB,OAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,KAAK,EAAE,KAAK,OAAO,OAAO,MAAM,CAAC;AACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,QAAQ,OAAO;AAC/C;","names":[]}

package/dist/config.cjs

@@ -0,0 +1,71 @@
+"use strict";
+
+// src/config.ts
+var import_core2 = require("@penvhq/core");
+
+// src/resolve.ts
+var import_node_path = require("path");
+var import_core = require("@penvhq/core");
+var import_provider_filesystem = require("@penvhq/provider-filesystem");
+function refsFrom(files) {
+  const refs = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const ref = { namespace: file.namespace, name: file.name };
+    const id = (0, import_core.parameterId)(ref);
+    if (!refs.has(id)) {
+      refs.set(id, ref);
+    }
+  }
+  return [...refs.values()].sort((a, b) => {
+    const left = (0, import_core.parameterId)(a);
+    const right = (0, import_core.parameterId)(b);
+    return left < right ? -1 : left > right ? 1 : 0;
+  });
+}
+function resolveSync(cwd, environment) {
+  const { config: config2, file } = (0, import_core.loadConfig)(cwd);
+  const target = (0, import_core.resolveEnvironment)(config2, environment);
+  const provider = (0, import_provider_filesystem.createFilesystemProvider)({
+    root: (0, import_node_path.resolve)((0, import_node_path.dirname)(file), ".penv"),
+    config: config2
+  });
+  const keys = (0, import_core.resolveKeySource)(config2, target);
+  const values2 = [];
+  for (const ref of refsFrom(provider.listSync())) {
+    for (const candidate of (0, import_core.candidatesFor)(ref, target)) {
+      const read = provider.readSync(candidate);
+      if (read === void 0) {
+        continue;
+      }
+      const opened = (0, import_core.openValue)(candidate, read, keys);
+      if (opened.kind === "failed") {
+        throw new import_core.UndecryptableValueError(
+          (0, import_core.parameterId)(ref),
+          target,
+          (0, import_core.formatValueFile)(candidate),
+          opened.failure
+        );
+      }
+      values2.push({ ref, value: opened.value });
+      break;
+    }
+  }
+  return { config: config2, environment: target, values: values2 };
+}
+
+// src/config.ts
+var { config, values } = resolveSync(process.cwd());
+var collision = (0, import_core2.checkNameCollisions)(
+  values.map(({ ref }) => ref),
+  config
+)[0];
+if (collision !== void 0) {
+  throw collision;
+}
+for (const { ref, value } of values) {
+  const variable = (0, import_core2.variableName)(ref, config);
+  if (process.env[variable] === void 0) {
+    process.env[variable] = value;
+  }
+}
+//# sourceMappingURL=config.cjs.map

package/dist/config.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts","../src/resolve.ts"],"sourcesContent":["/**\n * The `import \"@penvhq/penv/config\"` compatibility entry: populates `process.env`,\n * dotenv-shaped, so penv can be adopted without changing existing code.\n *\n * ESM ordering caveat: this module must run before any module that reads\n * `process.env`. ES imports are hoisted and evaluated before the importing\n * module's body, but sibling imports evaluate in source order — so a module\n * imported above this one, and reading `process.env` at its top level, reads it\n * before penv has populated it. This is the same hazard `dotenv/config` carries.\n * The typed `import { env } from \"@env\"` surface has no ordering hazard and is\n * the recommended path.\n */\n\nimport { checkNameCollisions, variableName } from \"@penvhq/core\";\nimport { resolveSync } from \"./resolve.js\";\n\nconst { config, values } = resolveSync(process.cwd());\n\n// Invariant 12, enforced where the loss would happen: two parameters mapping to\n// one variable would otherwise resolve first-write-wins, dropping the second\n// silently. That is the same sin as last-write-wins, so throw before touching\n// process.env — a half-populated environment is worse than none.\nconst collision = checkNameCollisions(\n  values.map(({ ref }) => ref),\n  config,\n)[0];\nif (collision !== undefined) {\n  throw collision;\n}\n\nfor (const { ref, value } of values) {\n  const variable = variableName(ref, config);\n  // dotenv semantics: an already-set variable is the caller's deliberate\n  // override and is never clobbered.\n  if (process.env[variable] === undefined) {\n    process.env[variable] = value;\n  }\n}\n","/**\n * The synchronous half of the value cascade, shared by `load` and the\n * `penv/config` compatibility entry.\n *\n * `resolveParameter` in `@penvhq/core` is async because the provider contract is,\n * and `load` is synchronous — so this module walks the cascade against the\n * filesystem provider's synchronous reads instead. It does not restate the\n * precedence rule: `candidatesFor` owns the order and everything here only\n * walks the list it returns, so the two paths cannot drift apart.\n *\n * The runtime reads the local tree for every environment, whatever provider\n * that environment declares, and this is the design rather than a limitation.\n * A provider is where an environment's source of truth *lives*, not where the\n * runtime reads from: `penv pull` materialises the tree from the provider, and\n * the runtime then reads what is on disk. So `load` never inspects\n * `providers.*.type` — a Vault-backed environment resolves through exactly the\n * code path a filesystem-backed one does, which is what makes changing provider\n * a configuration change rather than an application rewrite.\n *\n * Decryption happens here, synchronously, and that is the same knife applied a\n * second time. Key *acquisition* is async and happens before the process starts:\n * a deploy unwraps the KMS-derived data key and exports it, exactly as it already\n * runs `penv pull` to materialise the tree. Key *use* is a synchronous pure\n * function over bytes. penv never calls a KMS in-process — a key is where an\n * environment's secret material *lives*, not what the runtime dials at boot, just\n * as a provider is a sync target and not a runtime source. So invariant 3 is not\n * traded against encryption: `load` stays generic and synchronous because the\n * network half of both problems was moved out of the process entirely, rather\n * than awaited inside it.\n */\n\nimport { dirname, resolve as resolvePath } from \"node:path\";\nimport type { ParameterRef, PenvConfig, ValueFile } from \"@penvhq/core\";\nimport {\n  candidatesFor,\n  formatValueFile,\n  loadConfig,\n  openValue,\n  parameterId,\n  resolveEnvironment,\n  resolveKeySource,\n  UndecryptableValueError,\n} from \"@penvhq/core\";\nimport { createFilesystemProvider } from \"@penvhq/provider-filesystem\";\n\n/** One parameter that resolved to a present value for the target environment. */\nexport interface ResolvedValue {\n  readonly ref: ParameterRef;\n  readonly value: string;\n}\n\nexport interface ResolvedConfig {\n  readonly config: PenvConfig;\n  readonly environment: string;\n  /**\n   * Only parameters with a present candidate. A parameter that resolved to\n   * nothing is absent rather than `undefined`, so requiredness stays the\n   * schema's call.\n   */\n  readonly values: readonly ResolvedValue[];\n}\n\n/**\n * The parameters behind a set of value files, scopes collapsed —\n * `redis/password.production` and `redis/password` are one parameter. Ordered\n * so a `process.env` population is identical on every machine.\n */\nfunction refsFrom(files: readonly ValueFile[]): ParameterRef[] {\n  const refs = new Map<string, ParameterRef>();\n  for (const file of files) {\n    const ref: ParameterRef = { namespace: file.namespace, name: file.name };\n    const id = parameterId(ref);\n    if (!refs.has(id)) {\n      refs.set(id, ref);\n    }\n  }\n  return [...refs.values()].sort((a, b) => {\n    const left = parameterId(a);\n    const right = parameterId(b);\n    return left < right ? -1 : left > right ? 1 : 0;\n  });\n}\n\n/**\n * Loads the config, settles the environment, and resolves every parameter the\n * local tree holds — the work `load` and `penv/config` both start from.\n */\nexport function resolveSync(cwd: string, environment?: string): ResolvedConfig {\n  const { config, file } = loadConfig(cwd);\n  const target = resolveEnvironment(config, environment);\n\n  const provider = createFilesystemProvider({\n    root: resolvePath(dirname(file), \".penv\"),\n    config,\n  });\n\n  const keys = resolveKeySource(config, target);\n\n  const values: ResolvedValue[] = [];\n  for (const ref of refsFrom(provider.listSync())) {\n    for (const candidate of candidatesFor(ref, target)) {\n      const read = provider.readSync(candidate);\n      if (read === undefined) {\n        continue;\n      }\n      // The winner is the winner whether or not it opens. Continuing the walk on\n      // a failed decrypt would serve a lower scope's plaintext twin instead —\n      // the scope widening the cascade exists to prevent, arrived at by treating\n      // \"I cannot read this\" as \"this is not here\".\n      const opened = openValue(candidate, read, keys);\n      if (opened.kind === \"failed\") {\n        throw new UndecryptableValueError(\n          parameterId(ref),\n          target,\n          formatValueFile(candidate),\n          opened.failure,\n        );\n      }\n      values.push({ ref, value: opened.value });\n      break;\n    }\n  }\n\n  return { config, environment: target, values };\n}\n"],"mappings":";;;AAaA,IAAAA,eAAkD;;;ACkBlD,uBAAgD;AAEhD,kBASO;AACP,iCAAyC;AAwBzC,SAAS,SAAS,OAA6C;AAC7D,QAAM,OAAO,oBAAI,IAA0B;AAC3C,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAoB,EAAE,WAAW,KAAK,WAAW,MAAM,KAAK,KAAK;AACvE,UAAM,SAAK,yBAAY,GAAG;AAC1B,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,IAAI,GAAG;AAAA,IAClB;AAAA,EACF;AACA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM;AACvC,UAAM,WAAO,yBAAY,CAAC;AAC1B,UAAM,YAAQ,yBAAY,CAAC;AAC3B,WAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,EAChD,CAAC;AACH;AAMO,SAAS,YAAY,KAAa,aAAsC;AAC7E,QAAM,EAAE,QAAAC,SAAQ,KAAK,QAAI,wBAAW,GAAG;AACvC,QAAM,aAAS,gCAAmBA,SAAQ,WAAW;AAErD,QAAM,eAAW,qDAAyB;AAAA,IACxC,UAAM,iBAAAC,aAAY,0BAAQ,IAAI,GAAG,OAAO;AAAA,IACxC,QAAAD;AAAA,EACF,CAAC;AAED,QAAM,WAAO,8BAAiBA,SAAQ,MAAM;AAE5C,QAAME,UAA0B,CAAC;AACjC,aAAW,OAAO,SAAS,SAAS,SAAS,CAAC,GAAG;AAC/C,eAAW,iBAAa,2BAAc,KAAK,MAAM,GAAG;AAClD,YAAM,OAAO,SAAS,SAAS,SAAS;AACxC,UAAI,SAAS,QAAW;AACtB;AAAA,MACF;AAKA,YAAM,aAAS,uBAAU,WAAW,MAAM,IAAI;AAC9C,UAAI,OAAO,SAAS,UAAU;AAC5B,cAAM,IAAI;AAAA,cACR,yBAAY,GAAG;AAAA,UACf;AAAA,cACA,6BAAgB,SAAS;AAAA,UACzB,OAAO;AAAA,QACT;AAAA,MACF;AACA,MAAAA,QAAO,KAAK,EAAE,KAAK,OAAO,OAAO,MAAM,CAAC;AACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAAF,SAAQ,aAAa,QAAQ,QAAAE,QAAO;AAC/C;;;AD5GA,IAAM,EAAE,QAAQ,OAAO,IAAI,YAAY,QAAQ,IAAI,CAAC;AAMpD,IAAM,gBAAY;AAAA,EAChB,OAAO,IAAI,CAAC,EAAE,IAAI,MAAM,GAAG;AAAA,EAC3B;AACF,EAAE,CAAC;AACH,IAAI,cAAc,QAAW;AAC3B,QAAM;AACR;AAEA,WAAW,EAAE,KAAK,MAAM,KAAK,QAAQ;AACnC,QAAM,eAAW,2BAAa,KAAK,MAAM;AAGzC,MAAI,QAAQ,IAAI,QAAQ,MAAM,QAAW;AACvC,YAAQ,IAAI,QAAQ,IAAI;AAAA,EAC1B;AACF;","names":["import_core","config","resolvePath","values"]}

package/dist/config.d.cts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/config.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/config.js

@@ -0,0 +1,21 @@
+import {
+  resolveSync
+} from "./chunk-57AVY2K5.js";
+
+// src/config.ts
+import { checkNameCollisions, variableName } from "@penvhq/core";
+var { config, values } = resolveSync(process.cwd());
+var collision = checkNameCollisions(
+  values.map(({ ref }) => ref),
+  config
+)[0];
+if (collision !== void 0) {
+  throw collision;
+}
+for (const { ref, value } of values) {
+  const variable = variableName(ref, config);
+  if (process.env[variable] === void 0) {
+    process.env[variable] = value;
+  }
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["/**\n * The `import \"@penvhq/penv/config\"` compatibility entry: populates `process.env`,\n * dotenv-shaped, so penv can be adopted without changing existing code.\n *\n * ESM ordering caveat: this module must run before any module that reads\n * `process.env`. ES imports are hoisted and evaluated before the importing\n * module's body, but sibling imports evaluate in source order — so a module\n * imported above this one, and reading `process.env` at its top level, reads it\n * before penv has populated it. This is the same hazard `dotenv/config` carries.\n * The typed `import { env } from \"@env\"` surface has no ordering hazard and is\n * the recommended path.\n */\n\nimport { checkNameCollisions, variableName } from \"@penvhq/core\";\nimport { resolveSync } from \"./resolve.js\";\n\nconst { config, values } = resolveSync(process.cwd());\n\n// Invariant 12, enforced where the loss would happen: two parameters mapping to\n// one variable would otherwise resolve first-write-wins, dropping the second\n// silently. That is the same sin as last-write-wins, so throw before touching\n// process.env — a half-populated environment is worse than none.\nconst collision = checkNameCollisions(\n  values.map(({ ref }) => ref),\n  config,\n)[0];\nif (collision !== undefined) {\n  throw collision;\n}\n\nfor (const { ref, value } of values) {\n  const variable = variableName(ref, config);\n  // dotenv semantics: an already-set variable is the caller's deliberate\n  // override and is never clobbered.\n  if (process.env[variable] === undefined) {\n    process.env[variable] = value;\n  }\n}\n"],"mappings":";;;;;AAaA,SAAS,qBAAqB,oBAAoB;AAGlD,IAAM,EAAE,QAAQ,OAAO,IAAI,YAAY,QAAQ,IAAI,CAAC;AAMpD,IAAM,YAAY;AAAA,EAChB,OAAO,IAAI,CAAC,EAAE,IAAI,MAAM,GAAG;AAAA,EAC3B;AACF,EAAE,CAAC;AACH,IAAI,cAAc,QAAW;AAC3B,QAAM;AACR;AAEA,WAAW,EAAE,KAAK,MAAM,KAAK,QAAQ;AACnC,QAAM,WAAW,aAAa,KAAK,MAAM;AAGzC,MAAI,QAAQ,IAAI,QAAQ,MAAM,QAAW;AACvC,YAAQ,IAAI,QAAQ,IAAI;AAAA,EAC1B;AACF;","names":[]}

package/dist/index.cjs

@@ -0,0 +1,140 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ConfigError: () => import_core3.ConfigError,
+  FilenameGrammarError: () => import_core3.FilenameGrammarError,
+  MissingParameterError: () => import_core3.MissingParameterError,
+  NameCollisionError: () => import_core3.NameCollisionError,
+  PenvError: () => import_core3.PenvError,
+  ReservedTokenError: () => import_core3.ReservedTokenError,
+  UnknownEnvironmentError: () => import_core3.UnknownEnvironmentError,
+  ValidationError: () => import_core3.ValidationError,
+  defineConfig: () => import_core3.defineConfig,
+  load: () => load
+});
+module.exports = __toCommonJS(index_exports);
+var import_core3 = require("@penvhq/core");
+
+// src/load.ts
+var import_core2 = require("@penvhq/core");
+
+// src/resolve.ts
+var import_node_path = require("path");
+var import_core = require("@penvhq/core");
+var import_provider_filesystem = require("@penvhq/provider-filesystem");
+function refsFrom(files) {
+  const refs = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const ref = { namespace: file.namespace, name: file.name };
+    const id = (0, import_core.parameterId)(ref);
+    if (!refs.has(id)) {
+      refs.set(id, ref);
+    }
+  }
+  return [...refs.values()].sort((a, b) => {
+    const left = (0, import_core.parameterId)(a);
+    const right = (0, import_core.parameterId)(b);
+    return left < right ? -1 : left > right ? 1 : 0;
+  });
+}
+function resolveSync(cwd, environment) {
+  const { config, file } = (0, import_core.loadConfig)(cwd);
+  const target = (0, import_core.resolveEnvironment)(config, environment);
+  const provider = (0, import_provider_filesystem.createFilesystemProvider)({
+    root: (0, import_node_path.resolve)((0, import_node_path.dirname)(file), ".penv"),
+    config
+  });
+  const keys = (0, import_core.resolveKeySource)(config, target);
+  const values = [];
+  for (const ref of refsFrom(provider.listSync())) {
+    for (const candidate of (0, import_core.candidatesFor)(ref, target)) {
+      const read = provider.readSync(candidate);
+      if (read === void 0) {
+        continue;
+      }
+      const opened = (0, import_core.openValue)(candidate, read, keys);
+      if (opened.kind === "failed") {
+        throw new import_core.UndecryptableValueError(
+          (0, import_core.parameterId)(ref),
+          target,
+          (0, import_core.formatValueFile)(candidate),
+          opened.failure
+        );
+      }
+      values.push({ ref, value: opened.value });
+      break;
+    }
+  }
+  return { config, environment: target, values };
+}
+
+// src/load.ts
+function place(root, path, value) {
+  const leaf = path[path.length - 1];
+  if (leaf === void 0) {
+    return;
+  }
+  let node = root;
+  for (const key of path.slice(0, -1)) {
+    const existing = node[key];
+    if (typeof existing === "object" && existing !== null) {
+      node = existing;
+      continue;
+    }
+    const child = {};
+    node[key] = child;
+    node = child;
+  }
+  node[leaf] = value;
+}
+function load(schema, options) {
+  const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);
+  const object = {};
+  for (const { ref, value } of values) {
+    place(object, (0, import_core2.accessPath)(ref), value);
+  }
+  const result = schema.safeParse(object);
+  if (!result.success) {
+    throw new import_core2.ValidationError(
+      environment,
+      result.error.issues.map((issue) => ({
+        parameter: issue.path.join("."),
+        message: issue.message
+      }))
+    );
+  }
+  return result.data;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ConfigError,
+  FilenameGrammarError,
+  MissingParameterError,
+  NameCollisionError,
+  PenvError,
+  ReservedTokenError,
+  UnknownEnvironmentError,
+  ValidationError,
+  defineConfig,
+  load
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/load.ts","../src/resolve.ts"],"sourcesContent":["/**\n * The public surface of `@penvhq/runtime` — what `penv` re-exports.\n *\n * `defineConfig` is re-exported from `@penvhq/core` because the docs show\n * `penv.config.ts` importing it from `penv`: one import specifier for the whole\n * tool, whatever package a symbol happens to live in.\n */\n\nexport {\n  ConfigError,\n  defineConfig,\n  FilenameGrammarError,\n  MissingParameterError,\n  NameCollisionError,\n  PenvError,\n  ReservedTokenError,\n  UnknownEnvironmentError,\n  ValidationError,\n} from \"@penvhq/core\";\nexport type { LoadOptions } from \"./load.js\";\nexport { load } from \"./load.js\";\n","/**\n * The runtime loader. `load` is generic and returns `z.infer<T>` — the type the\n * caller's own schema describes, never a widened one. The inferred type is only\n * true because the same schema validates the values before they are returned,\n * so the type you code against and the value you receive cannot diverge.\n */\n\nimport { accessPath, ValidationError } from \"@penvhq/core\";\nimport type { z } from \"zod\";\nimport { resolveSync } from \"./resolve.js\";\n\nexport interface LoadOptions {\n  /** Where to start looking for `penv.config.ts`. Defaults to `process.cwd()`. */\n  readonly cwd?: string;\n  /** Overrides `PENV_ENV` / `NODE_ENV`. Must be a declared environment. */\n  readonly environment?: string;\n}\n\n/**\n * Places a value at its access path, creating namespaces on the way.\n * Values are placed exactly as the provider holds them: coercion is the\n * schema's job, so a value file's contents stay a string here.\n */\nfunction place(root: Record<string, unknown>, path: readonly string[], value: string): void {\n  const leaf = path[path.length - 1];\n  if (leaf === undefined) {\n    return;\n  }\n\n  let node = root;\n  for (const key of path.slice(0, -1)) {\n    const existing = node[key];\n    if (typeof existing === \"object\" && existing !== null) {\n      node = existing as Record<string, unknown>;\n      continue;\n    }\n    const child: Record<string, unknown> = {};\n    node[key] = child;\n    node = child;\n  }\n  node[leaf] = value;\n}\n\n/**\n * Loads, validates, and returns configuration for the current environment.\n * Eager and synchronous: invalid configuration fails at startup with a\n * parameter-named error rather than later at first use.\n */\nexport function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);\n\n  const object: Record<string, unknown> = {};\n  for (const { ref, value } of values) {\n    place(object, accessPath(ref), value);\n  }\n\n  const result = schema.safeParse(object);\n  if (!result.success) {\n    throw new ValidationError(\n      environment,\n      result.error.issues.map((issue) => ({\n        parameter: issue.path.join(\".\"),\n        message: issue.message,\n      })),\n    );\n  }\n  return result.data;\n}\n","/**\n * The synchronous half of the value cascade, shared by `load` and the\n * `penv/config` compatibility entry.\n *\n * `resolveParameter` in `@penvhq/core` is async because the provider contract is,\n * and `load` is synchronous — so this module walks the cascade against the\n * filesystem provider's synchronous reads instead. It does not restate the\n * precedence rule: `candidatesFor` owns the order and everything here only\n * walks the list it returns, so the two paths cannot drift apart.\n *\n * The runtime reads the local tree for every environment, whatever provider\n * that environment declares, and this is the design rather than a limitation.\n * A provider is where an environment's source of truth *lives*, not where the\n * runtime reads from: `penv pull` materialises the tree from the provider, and\n * the runtime then reads what is on disk. So `load` never inspects\n * `providers.*.type` — a Vault-backed environment resolves through exactly the\n * code path a filesystem-backed one does, which is what makes changing provider\n * a configuration change rather than an application rewrite.\n *\n * Decryption happens here, synchronously, and that is the same knife applied a\n * second time. Key *acquisition* is async and happens before the process starts:\n * a deploy unwraps the KMS-derived data key and exports it, exactly as it already\n * runs `penv pull` to materialise the tree. Key *use* is a synchronous pure\n * function over bytes. penv never calls a KMS in-process — a key is where an\n * environment's secret material *lives*, not what the runtime dials at boot, just\n * as a provider is a sync target and not a runtime source. So invariant 3 is not\n * traded against encryption: `load` stays generic and synchronous because the\n * network half of both problems was moved out of the process entirely, rather\n * than awaited inside it.\n */\n\nimport { dirname, resolve as resolvePath } from \"node:path\";\nimport type { ParameterRef, PenvConfig, ValueFile } from \"@penvhq/core\";\nimport {\n  candidatesFor,\n  formatValueFile,\n  loadConfig,\n  openValue,\n  parameterId,\n  resolveEnvironment,\n  resolveKeySource,\n  UndecryptableValueError,\n} from \"@penvhq/core\";\nimport { createFilesystemProvider } from \"@penvhq/provider-filesystem\";\n\n/** One parameter that resolved to a present value for the target environment. */\nexport interface ResolvedValue {\n  readonly ref: ParameterRef;\n  readonly value: string;\n}\n\nexport interface ResolvedConfig {\n  readonly config: PenvConfig;\n  readonly environment: string;\n  /**\n   * Only parameters with a present candidate. A parameter that resolved to\n   * nothing is absent rather than `undefined`, so requiredness stays the\n   * schema's call.\n   */\n  readonly values: readonly ResolvedValue[];\n}\n\n/**\n * The parameters behind a set of value files, scopes collapsed —\n * `redis/password.production` and `redis/password` are one parameter. Ordered\n * so a `process.env` population is identical on every machine.\n */\nfunction refsFrom(files: readonly ValueFile[]): ParameterRef[] {\n  const refs = new Map<string, ParameterRef>();\n  for (const file of files) {\n    const ref: ParameterRef = { namespace: file.namespace, name: file.name };\n    const id = parameterId(ref);\n    if (!refs.has(id)) {\n      refs.set(id, ref);\n    }\n  }\n  return [...refs.values()].sort((a, b) => {\n    const left = parameterId(a);\n    const right = parameterId(b);\n    return left < right ? -1 : left > right ? 1 : 0;\n  });\n}\n\n/**\n * Loads the config, settles the environment, and resolves every parameter the\n * local tree holds — the work `load` and `penv/config` both start from.\n */\nexport function resolveSync(cwd: string, environment?: string): ResolvedConfig {\n  const { config, file } = loadConfig(cwd);\n  const target = resolveEnvironment(config, environment);\n\n  const provider = createFilesystemProvider({\n    root: resolvePath(dirname(file), \".penv\"),\n    config,\n  });\n\n  const keys = resolveKeySource(config, target);\n\n  const values: ResolvedValue[] = [];\n  for (const ref of refsFrom(provider.listSync())) {\n    for (const candidate of candidatesFor(ref, target)) {\n      const read = provider.readSync(candidate);\n      if (read === undefined) {\n        continue;\n      }\n      // The winner is the winner whether or not it opens. Continuing the walk on\n      // a failed decrypt would serve a lower scope's plaintext twin instead —\n      // the scope widening the cascade exists to prevent, arrived at by treating\n      // \"I cannot read this\" as \"this is not here\".\n      const opened = openValue(candidate, read, keys);\n      if (opened.kind === \"failed\") {\n        throw new UndecryptableValueError(\n          parameterId(ref),\n          target,\n          formatValueFile(candidate),\n          opened.failure,\n        );\n      }\n      values.push({ ref, value: opened.value });\n      break;\n    }\n  }\n\n  return { config, environment: target, values };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,IAAAA,eAUO;;;ACXP,IAAAC,eAA4C;;;ACwB5C,uBAAgD;AAEhD,kBASO;AACP,iCAAyC;AAwBzC,SAAS,SAAS,OAA6C;AAC7D,QAAM,OAAO,oBAAI,IAA0B;AAC3C,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAoB,EAAE,WAAW,KAAK,WAAW,MAAM,KAAK,KAAK;AACvE,UAAM,SAAK,yBAAY,GAAG;AAC1B,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,IAAI,GAAG;AAAA,IAClB;AAAA,EACF;AACA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM;AACvC,UAAM,WAAO,yBAAY,CAAC;AAC1B,UAAM,YAAQ,yBAAY,CAAC;AAC3B,WAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,EAChD,CAAC;AACH;AAMO,SAAS,YAAY,KAAa,aAAsC;AAC7E,QAAM,EAAE,QAAQ,KAAK,QAAI,wBAAW,GAAG;AACvC,QAAM,aAAS,gCAAmB,QAAQ,WAAW;AAErD,QAAM,eAAW,qDAAyB;AAAA,IACxC,UAAM,iBAAAC,aAAY,0BAAQ,IAAI,GAAG,OAAO;AAAA,IACxC;AAAA,EACF,CAAC;AAED,QAAM,WAAO,8BAAiB,QAAQ,MAAM;AAE5C,QAAM,SAA0B,CAAC;AACjC,aAAW,OAAO,SAAS,SAAS,SAAS,CAAC,GAAG;AAC/C,eAAW,iBAAa,2BAAc,KAAK,MAAM,GAAG;AAClD,YAAM,OAAO,SAAS,SAAS,SAAS;AACxC,UAAI,SAAS,QAAW;AACtB;AAAA,MACF;AAKA,YAAM,aAAS,uBAAU,WAAW,MAAM,IAAI;AAC9C,UAAI,OAAO,SAAS,UAAU;AAC5B,cAAM,IAAI;AAAA,cACR,yBAAY,GAAG;AAAA,UACf;AAAA,cACA,6BAAgB,SAAS;AAAA,UACzB,OAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,KAAK,EAAE,KAAK,OAAO,OAAO,MAAM,CAAC;AACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,QAAQ,OAAO;AAC/C;;;ADrGA,SAAS,MAAM,MAA+B,MAAyB,OAAqB;AAC1F,QAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,MAAI,SAAS,QAAW;AACtB;AAAA,EACF;AAEA,MAAI,OAAO;AACX,aAAW,OAAO,KAAK,MAAM,GAAG,EAAE,GAAG;AACnC,UAAM,WAAW,KAAK,GAAG;AACzB,QAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,aAAO;AACP;AAAA,IACF;AACA,UAAM,QAAiC,CAAC;AACxC,SAAK,GAAG,IAAI;AACZ,WAAO;AAAA,EACT;AACA,OAAK,IAAI,IAAI;AACf;AAOO,SAAS,KAA0B,QAAW,SAAmC;AACtF,QAAM,EAAE,aAAa,OAAO,IAAI,YAAY,SAAS,OAAO,QAAQ,IAAI,GAAG,SAAS,WAAW;AAE/F,QAAM,SAAkC,CAAC;AACzC,aAAW,EAAE,KAAK,MAAM,KAAK,QAAQ;AACnC,UAAM,YAAQ,yBAAW,GAAG,GAAG,KAAK;AAAA,EACtC;AAEA,QAAM,SAAS,OAAO,UAAU,MAAM;AACtC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QAClC,WAAW,MAAM,KAAK,KAAK,GAAG;AAAA,QAC9B,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,OAAO;AAChB;","names":["import_core","import_core","resolvePath"]}

package/dist/index.d.cts

@@ -0,0 +1,24 @@
+export { ConfigError, FilenameGrammarError, MissingParameterError, NameCollisionError, PenvError, ReservedTokenError, UnknownEnvironmentError, ValidationError, defineConfig } from '@penvhq/core';
+import { z } from 'zod';
+
+/**
+ * The runtime loader. `load` is generic and returns `z.infer<T>` — the type the
+ * caller's own schema describes, never a widened one. The inferred type is only
+ * true because the same schema validates the values before they are returned,
+ * so the type you code against and the value you receive cannot diverge.
+ */
+
+interface LoadOptions {
+    /** Where to start looking for `penv.config.ts`. Defaults to `process.cwd()`. */
+    readonly cwd?: string;
+    /** Overrides `PENV_ENV` / `NODE_ENV`. Must be a declared environment. */
+    readonly environment?: string;
+}
+/**
+ * Loads, validates, and returns configuration for the current environment.
+ * Eager and synchronous: invalid configuration fails at startup with a
+ * parameter-named error rather than later at first use.
+ */
+declare function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T>;
+
+export { type LoadOptions, load };

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+export { ConfigError, FilenameGrammarError, MissingParameterError, NameCollisionError, PenvError, ReservedTokenError, UnknownEnvironmentError, ValidationError, defineConfig } from '@penvhq/core';
+import { z } from 'zod';
+
+/**
+ * The runtime loader. `load` is generic and returns `z.infer<T>` — the type the
+ * caller's own schema describes, never a widened one. The inferred type is only
+ * true because the same schema validates the values before they are returned,
+ * so the type you code against and the value you receive cannot diverge.
+ */
+
+interface LoadOptions {
+    /** Where to start looking for `penv.config.ts`. Defaults to `process.cwd()`. */
+    readonly cwd?: string;
+    /** Overrides `PENV_ENV` / `NODE_ENV`. Must be a declared environment. */
+    readonly environment?: string;
+}
+/**
+ * Loads, validates, and returns configuration for the current environment.
+ * Eager and synchronous: invalid configuration fails at startup with a
+ * parameter-named error rather than later at first use.
+ */
+declare function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T>;
+
+export { type LoadOptions, load };

package/dist/index.js

@@ -0,0 +1,68 @@
+import {
+  resolveSync
+} from "./chunk-57AVY2K5.js";
+
+// src/index.ts
+import {
+  ConfigError,
+  defineConfig,
+  FilenameGrammarError,
+  MissingParameterError,
+  NameCollisionError,
+  PenvError,
+  ReservedTokenError,
+  UnknownEnvironmentError,
+  ValidationError as ValidationError2
+} from "@penvhq/core";
+
+// src/load.ts
+import { accessPath, ValidationError } from "@penvhq/core";
+function place(root, path, value) {
+  const leaf = path[path.length - 1];
+  if (leaf === void 0) {
+    return;
+  }
+  let node = root;
+  for (const key of path.slice(0, -1)) {
+    const existing = node[key];
+    if (typeof existing === "object" && existing !== null) {
+      node = existing;
+      continue;
+    }
+    const child = {};
+    node[key] = child;
+    node = child;
+  }
+  node[leaf] = value;
+}
+function load(schema, options) {
+  const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);
+  const object = {};
+  for (const { ref, value } of values) {
+    place(object, accessPath(ref), value);
+  }
+  const result = schema.safeParse(object);
+  if (!result.success) {
+    throw new ValidationError(
+      environment,
+      result.error.issues.map((issue) => ({
+        parameter: issue.path.join("."),
+        message: issue.message
+      }))
+    );
+  }
+  return result.data;
+}
+export {
+  ConfigError,
+  FilenameGrammarError,
+  MissingParameterError,
+  NameCollisionError,
+  PenvError,
+  ReservedTokenError,
+  UnknownEnvironmentError,
+  ValidationError2 as ValidationError,
+  defineConfig,
+  load
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/load.ts"],"sourcesContent":["/**\n * The public surface of `@penvhq/runtime` — what `penv` re-exports.\n *\n * `defineConfig` is re-exported from `@penvhq/core` because the docs show\n * `penv.config.ts` importing it from `penv`: one import specifier for the whole\n * tool, whatever package a symbol happens to live in.\n */\n\nexport {\n  ConfigError,\n  defineConfig,\n  FilenameGrammarError,\n  MissingParameterError,\n  NameCollisionError,\n  PenvError,\n  ReservedTokenError,\n  UnknownEnvironmentError,\n  ValidationError,\n} from \"@penvhq/core\";\nexport type { LoadOptions } from \"./load.js\";\nexport { load } from \"./load.js\";\n","/**\n * The runtime loader. `load` is generic and returns `z.infer<T>` — the type the\n * caller's own schema describes, never a widened one. The inferred type is only\n * true because the same schema validates the values before they are returned,\n * so the type you code against and the value you receive cannot diverge.\n */\n\nimport { accessPath, ValidationError } from \"@penvhq/core\";\nimport type { z } from \"zod\";\nimport { resolveSync } from \"./resolve.js\";\n\nexport interface LoadOptions {\n  /** Where to start looking for `penv.config.ts`. Defaults to `process.cwd()`. */\n  readonly cwd?: string;\n  /** Overrides `PENV_ENV` / `NODE_ENV`. Must be a declared environment. */\n  readonly environment?: string;\n}\n\n/**\n * Places a value at its access path, creating namespaces on the way.\n * Values are placed exactly as the provider holds them: coercion is the\n * schema's job, so a value file's contents stay a string here.\n */\nfunction place(root: Record<string, unknown>, path: readonly string[], value: string): void {\n  const leaf = path[path.length - 1];\n  if (leaf === undefined) {\n    return;\n  }\n\n  let node = root;\n  for (const key of path.slice(0, -1)) {\n    const existing = node[key];\n    if (typeof existing === \"object\" && existing !== null) {\n      node = existing as Record<string, unknown>;\n      continue;\n    }\n    const child: Record<string, unknown> = {};\n    node[key] = child;\n    node = child;\n  }\n  node[leaf] = value;\n}\n\n/**\n * Loads, validates, and returns configuration for the current environment.\n * Eager and synchronous: invalid configuration fails at startup with a\n * parameter-named error rather than later at first use.\n */\nexport function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);\n\n  const object: Record<string, unknown> = {};\n  for (const { ref, value } of values) {\n    place(object, accessPath(ref), value);\n  }\n\n  const result = schema.safeParse(object);\n  if (!result.success) {\n    throw new ValidationError(\n      environment,\n      result.error.issues.map((issue) => ({\n        parameter: issue.path.join(\".\"),\n        message: issue.message,\n      })),\n    );\n  }\n  return result.data;\n}\n"],"mappings":";;;;;AAQA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAAA;AAAA,OACK;;;ACXP,SAAS,YAAY,uBAAuB;AAgB5C,SAAS,MAAM,MAA+B,MAAyB,OAAqB;AAC1F,QAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,MAAI,SAAS,QAAW;AACtB;AAAA,EACF;AAEA,MAAI,OAAO;AACX,aAAW,OAAO,KAAK,MAAM,GAAG,EAAE,GAAG;AACnC,UAAM,WAAW,KAAK,GAAG;AACzB,QAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,aAAO;AACP;AAAA,IACF;AACA,UAAM,QAAiC,CAAC;AACxC,SAAK,GAAG,IAAI;AACZ,WAAO;AAAA,EACT;AACA,OAAK,IAAI,IAAI;AACf;AAOO,SAAS,KAA0B,QAAW,SAAmC;AACtF,QAAM,EAAE,aAAa,OAAO,IAAI,YAAY,SAAS,OAAO,QAAQ,IAAI,GAAG,SAAS,WAAW;AAE/F,QAAM,SAAkC,CAAC;AACzC,aAAW,EAAE,KAAK,MAAM,KAAK,QAAQ;AACnC,UAAM,QAAQ,WAAW,GAAG,GAAG,KAAK;AAAA,EACtC;AAEA,QAAM,SAAS,OAAO,UAAU,MAAM;AACtC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QAClC,WAAW,MAAM,KAAK,KAAK,GAAG;AAAA,QAC9B,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,OAAO;AAChB;","names":["ValidationError"]}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@penvhq/runtime",
+  "version": "0.1.0",
+  "description": "penv's load() and the typed env surface. Ships into user apps — keep it light.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "import": "./dist/config.js",
+      "require": "./dist/config.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@penvhq/core": "0.1.0",
+    "@penvhq/provider-filesystem": "0.1.0"
+  },
+  "peerDependencies": {
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "zod": "4.4.3"
+  },
+  "scripts": {
+    "build": "tsup"
+  }
+}