@penvhq/runtime 0.3.1 → 0.4.0

package/dist/index.cjs

@@ -107,6 +107,12 @@ function place(root, path, value) {
   node[leaf] = value;
 }
 function load(schema, options) {
+  if ((0, import_core2.schemaHarvestActive)()) {
+    return deferLoad(schema, options);
+  }
+  return loadEagerly(schema, options);
+}
+function loadEagerly(schema, options) {
   const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);
   const object = {};
   for (const { ref, value } of values) {
@@ -124,6 +130,35 @@ function load(schema, options) {
   }
   return result.data;
 }
+function deferLoad(schema, options) {
+  let materialized = false;
+  let value;
+  const materialize = () => {
+    if (!materialized) {
+      value = loadEagerly(schema, options);
+      materialized = true;
+    }
+    return Object(value);
+  };
+  return new Proxy({}, {
+    get(_target, property) {
+      if ((0, import_core2.schemaHarvestActive)() && (typeof property === "symbol" || property === "then")) {
+        return void 0;
+      }
+      return Reflect.get(materialize(), property);
+    },
+    has(_target, property) {
+      return Reflect.has(materialize(), property);
+    },
+    ownKeys() {
+      return Reflect.ownKeys(materialize());
+    },
+    getOwnPropertyDescriptor(_target, property) {
+      const descriptor = Reflect.getOwnPropertyDescriptor(materialize(), property);
+      return descriptor === void 0 ? void 0 : { ...descriptor, configurable: true };
+    }
+  });
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ConfigError,

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/load.ts","../src/resolve.ts"],"sourcesContent":["/**\n * The public surface of `@penvhq/runtime` — what `penv` re-exports.\n *\n * `defineConfig` is re-exported from `@penvhq/core` because the docs show\n * `penv.config.ts` importing it from `penv`: one import specifier for the whole\n * tool, whatever package a symbol happens to live in.\n */\n\nexport {\n  ConfigError,\n  defineConfig,\n  FilenameGrammarError,\n  MissingParameterError,\n  NameCollisionError,\n  PenvError,\n  ReservedTokenError,\n  UnknownEnvironmentError,\n  ValidationError,\n} from \"@penvhq/core\";\nexport type { LoadOptions } from \"./load.js\";\nexport { load } from \"./load.js\";\n","/**\n * The runtime loader. `load` is generic and returns `z.infer<T>` — the type the\n * caller's own schema describes, never a widened one. The inferred type is only\n * true because the same schema validates the values before they are returned,\n * so the type you code against and the value you receive cannot diverge.\n */\n\nimport { accessPath, ValidationError } from \"@penvhq/core\";\nimport type { z } from \"zod\";\nimport { resolveSync } from \"./resolve.js\";\n\nexport interface LoadOptions {\n  /** Where to start looking for `penv.config.ts`. Defaults to `process.cwd()`. */\n  readonly cwd?: string;\n  /** Overrides `PENV_ENV` / `NODE_ENV`. Must be a declared environment. */\n  readonly environment?: string;\n}\n\n/**\n * Places a value at its access path, creating namespaces on the way.\n * Values are placed exactly as the provider holds them: coercion is the\n * schema's job, so a value file's contents stay a string here.\n */\nfunction place(root: Record<string, unknown>, path: readonly string[], value: string): void {\n  const leaf = path[path.length - 1];\n  if (leaf === undefined) {\n    return;\n  }\n\n  let node = root;\n  for (const key of path.slice(0, -1)) {\n    const existing = node[key];\n    if (typeof existing === \"object\" && existing !== null) {\n      node = existing as Record<string, unknown>;\n      continue;\n    }\n    const child: Record<string, unknown> = {};\n    node[key] = child;\n    node = child;\n  }\n  node[leaf] = value;\n}\n\n/**\n * Loads, validates, and returns configuration for the current environment.\n * Eager and synchronous: invalid configuration fails at startup with a\n * parameter-named error rather than later at first use.\n */\nexport function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);\n\n  const object: Record<string, unknown> = {};\n  for (const { ref, value } of values) {\n    place(object, accessPath(ref), value);\n  }\n\n  const result = schema.safeParse(object);\n  if (!result.success) {\n    throw new ValidationError(\n      environment,\n      result.error.issues.map((issue) => ({\n        parameter: issue.path.join(\".\"),\n        message: issue.message,\n      })),\n    );\n  }\n  return result.data;\n}\n","/**\n * The synchronous half of the value cascade, shared by `load` and the\n * `penv/config` compatibility entry.\n *\n * `resolveParameter` in `@penvhq/core` is async because the provider contract is,\n * and `load` is synchronous — so this module walks the cascade against the\n * filesystem provider's synchronous reads instead. It does not restate the\n * precedence rule: `candidatesFor` owns the order and everything here only\n * walks the list it returns, so the two paths cannot drift apart.\n *\n * The runtime reads the local tree for every environment, whatever provider\n * that environment declares, and this is the design rather than a limitation.\n * A provider is where an environment's source of truth *lives*, not where the\n * runtime reads from: `penv pull` materialises the tree from the provider, and\n * the runtime then reads what is on disk. So `load` never inspects\n * `providers.*.type` — a Vault-backed environment resolves through exactly the\n * code path a filesystem-backed one does, which is what makes changing provider\n * a configuration change rather than an application rewrite.\n *\n * Decryption happens here, synchronously, and that is the same knife applied a\n * second time. Key *acquisition* is async and happens before the process starts:\n * a deploy unwraps the KMS-derived data key and exports it, exactly as it already\n * runs `penv pull` to materialise the tree. Key *use* is a synchronous pure\n * function over bytes. penv never calls a KMS in-process — a key is where an\n * environment's secret material *lives*, not what the runtime dials at boot, just\n * as a provider is a sync target and not a runtime source. So invariant 3 is not\n * traded against encryption: `load` stays generic and synchronous because the\n * network half of both problems was moved out of the process entirely, rather\n * than awaited inside it.\n */\n\nimport { dirname, resolve as resolvePath } from \"node:path\";\nimport type { ParameterRef, PenvConfig, ValueFile } from \"@penvhq/core\";\nimport {\n  candidatesFor,\n  formatValueFile,\n  loadConfig,\n  openValue,\n  parameterId,\n  resolveEnvironment,\n  resolveKeySource,\n  UndecryptableValueError,\n} from \"@penvhq/core\";\nimport { createFilesystemProvider } from \"@penvhq/provider-filesystem\";\n\n/** One parameter that resolved to a present value for the target environment. */\nexport interface ResolvedValue {\n  readonly ref: ParameterRef;\n  readonly value: string;\n}\n\nexport interface ResolvedConfig {\n  readonly config: PenvConfig;\n  readonly environment: string;\n  /**\n   * Only parameters with a present candidate. A parameter that resolved to\n   * nothing is absent rather than `undefined`, so requiredness stays the\n   * schema's call.\n   */\n  readonly values: readonly ResolvedValue[];\n}\n\n/**\n * The parameters behind a set of value files, scopes collapsed —\n * `redis/password.production` and `redis/password` are one parameter. Ordered\n * so a `process.env` population is identical on every machine.\n */\nfunction refsFrom(files: readonly ValueFile[]): ParameterRef[] {\n  const refs = new Map<string, ParameterRef>();\n  for (const file of files) {\n    const ref: ParameterRef = { namespace: file.namespace, name: file.name };\n    const id = parameterId(ref);\n    if (!refs.has(id)) {\n      refs.set(id, ref);\n    }\n  }\n  return [...refs.values()].sort((a, b) => {\n    const left = parameterId(a);\n    const right = parameterId(b);\n    return left < right ? -1 : left > right ? 1 : 0;\n  });\n}\n\n/**\n * Loads the config, settles the environment, and resolves every parameter the\n * local tree holds — the work `load` and `penv/config` both start from.\n */\nexport function resolveSync(cwd: string, environment?: string): ResolvedConfig {\n  const { config, file } = loadConfig(cwd);\n  const target = resolveEnvironment(config, environment);\n\n  const provider = createFilesystemProvider({\n    root: resolvePath(dirname(file), \".penv\"),\n    config,\n  });\n\n  const keys = resolveKeySource(config, target);\n\n  const values: ResolvedValue[] = [];\n  for (const ref of refsFrom(provider.listSync())) {\n    for (const candidate of candidatesFor(ref, target)) {\n      const read = provider.readSync(candidate);\n      if (read === undefined) {\n        continue;\n      }\n      // The winner is the winner whether or not it opens. Continuing the walk on\n      // a failed decrypt would serve a lower scope's plaintext twin instead —\n      // the scope widening the cascade exists to prevent, arrived at by treating\n      // \"I cannot read this\" as \"this is not here\".\n      const opened = openValue(candidate, read, keys);\n      if (opened.kind === \"failed\") {\n        throw new UndecryptableValueError(\n          parameterId(ref),\n          target,\n          formatValueFile(candidate),\n          opened.failure,\n        );\n      }\n      values.push({ ref, value: opened.value });\n      break;\n    }\n  }\n\n  return { config, environment: target, values };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,IAAAA,eAUO;;;ACXP,IAAAC,eAA4C;;;ACwB5C,uBAAgD;AAEhD,kBASO;AACP,iCAAyC;AAwBzC,SAAS,SAAS,OAA6C;AAC7D,QAAM,OAAO,oBAAI,IAA0B;AAC3C,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAoB,EAAE,WAAW,KAAK,WAAW,MAAM,KAAK,KAAK;AACvE,UAAM,SAAK,yBAAY,GAAG;AAC1B,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,IAAI,GAAG;AAAA,IAClB;AAAA,EACF;AACA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM;AACvC,UAAM,WAAO,yBAAY,CAAC;AAC1B,UAAM,YAAQ,yBAAY,CAAC;AAC3B,WAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,EAChD,CAAC;AACH;AAMO,SAAS,YAAY,KAAa,aAAsC;AAC7E,QAAM,EAAE,QAAQ,KAAK,QAAI,wBAAW,GAAG;AACvC,QAAM,aAAS,gCAAmB,QAAQ,WAAW;AAErD,QAAM,eAAW,qDAAyB;AAAA,IACxC,UAAM,iBAAAC,aAAY,0BAAQ,IAAI,GAAG,OAAO;AAAA,IACxC;AAAA,EACF,CAAC;AAED,QAAM,WAAO,8BAAiB,QAAQ,MAAM;AAE5C,QAAM,SAA0B,CAAC;AACjC,aAAW,OAAO,SAAS,SAAS,SAAS,CAAC,GAAG;AAC/C,eAAW,iBAAa,2BAAc,KAAK,MAAM,GAAG;AAClD,YAAM,OAAO,SAAS,SAAS,SAAS;AACxC,UAAI,SAAS,QAAW;AACtB;AAAA,MACF;AAKA,YAAM,aAAS,uBAAU,WAAW,MAAM,IAAI;AAC9C,UAAI,OAAO,SAAS,UAAU;AAC5B,cAAM,IAAI;AAAA,cACR,yBAAY,GAAG;AAAA,UACf;AAAA,cACA,6BAAgB,SAAS;AAAA,UACzB,OAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,KAAK,EAAE,KAAK,OAAO,OAAO,MAAM,CAAC;AACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,QAAQ,OAAO;AAC/C;;;ADrGA,SAAS,MAAM,MAA+B,MAAyB,OAAqB;AAC1F,QAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,MAAI,SAAS,QAAW;AACtB;AAAA,EACF;AAEA,MAAI,OAAO;AACX,aAAW,OAAO,KAAK,MAAM,GAAG,EAAE,GAAG;AACnC,UAAM,WAAW,KAAK,GAAG;AACzB,QAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,aAAO;AACP;AAAA,IACF;AACA,UAAM,QAAiC,CAAC;AACxC,SAAK,GAAG,IAAI;AACZ,WAAO;AAAA,EACT;AACA,OAAK,IAAI,IAAI;AACf;AAOO,SAAS,KAA0B,QAAW,SAAmC;AACtF,QAAM,EAAE,aAAa,OAAO,IAAI,YAAY,SAAS,OAAO,QAAQ,IAAI,GAAG,SAAS,WAAW;AAE/F,QAAM,SAAkC,CAAC;AACzC,aAAW,EAAE,KAAK,MAAM,KAAK,QAAQ;AACnC,UAAM,YAAQ,yBAAW,GAAG,GAAG,KAAK;AAAA,EACtC;AAEA,QAAM,SAAS,OAAO,UAAU,MAAM;AACtC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QAClC,WAAW,MAAM,KAAK,KAAK,GAAG;AAAA,QAC9B,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,OAAO;AAChB;","names":["import_core","import_core","resolvePath"]}
+{"version":3,"sources":["../src/index.ts","../src/load.ts","../src/resolve.ts"],"sourcesContent":["/**\n * The public surface of `@penvhq/runtime` — what `penv` re-exports.\n *\n * `defineConfig` is re-exported from `@penvhq/core` because the docs show\n * `penv.config.ts` importing it from `penv`: one import specifier for the whole\n * tool, whatever package a symbol happens to live in.\n */\n\nexport {\n  ConfigError,\n  defineConfig,\n  FilenameGrammarError,\n  MissingParameterError,\n  NameCollisionError,\n  PenvError,\n  ReservedTokenError,\n  UnknownEnvironmentError,\n  ValidationError,\n} from \"@penvhq/core\";\nexport type { LoadOptions } from \"./load.js\";\nexport { load } from \"./load.js\";\n","/**\n * The runtime loader. `load` is generic and returns `z.infer<T>` — the type the\n * caller's own schema describes, never a widened one. The inferred type is only\n * true because the same schema validates the values before they are returned,\n * so the type you code against and the value you receive cannot diverge.\n */\n\nimport { accessPath, schemaHarvestActive, ValidationError } from \"@penvhq/core\";\nimport type { z } from \"zod\";\nimport { resolveSync } from \"./resolve.js\";\n\nexport interface LoadOptions {\n  /** Where to start looking for `penv.config.ts`. Defaults to `process.cwd()`. */\n  readonly cwd?: string;\n  /** Overrides `PENV_ENV` / `NODE_ENV`. Must be a declared environment. */\n  readonly environment?: string;\n}\n\n/**\n * Places a value at its access path, creating namespaces on the way.\n * Values are placed exactly as the provider holds them: coercion is the\n * schema's job, so a value file's contents stay a string here.\n */\nfunction place(root: Record<string, unknown>, path: readonly string[], value: string): void {\n  const leaf = path[path.length - 1];\n  if (leaf === undefined) {\n    return;\n  }\n\n  let node = root;\n  for (const key of path.slice(0, -1)) {\n    const existing = node[key];\n    if (typeof existing === \"object\" && existing !== null) {\n      node = existing as Record<string, unknown>;\n      continue;\n    }\n    const child: Record<string, unknown> = {};\n    node[key] = child;\n    node = child;\n  }\n  node[leaf] = value;\n}\n\n/**\n * Loads, validates, and returns configuration for the current environment.\n * Eager and synchronous: invalid configuration fails at startup with a\n * parameter-named error rather than later at first use.\n *\n * One deliberate exception to the eagerness: while the CLI is harvesting the\n * `schema` export of `.penv/env.ts` (see `SCHEMA_HARVEST_ENV` in core), the\n * scaffolded module's own `export const env = load(schema)` must not stop the\n * module from evaluating — an empty tree would throw here and take the `schema`\n * export down with it, which is exactly the state `penv fill` exists to fix. In\n * that window `load` returns a lazy stand-in that performs the real load — and\n * raises the same parameter-named error — on first property access. Application\n * runtime never sets the flag, so ordinary loads stay eager and fail-fast.\n */\nexport function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  if (schemaHarvestActive()) {\n    return deferLoad(schema, options);\n  }\n  return loadEagerly(schema, options);\n}\n\nfunction loadEagerly<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);\n\n  const object: Record<string, unknown> = {};\n  for (const { ref, value } of values) {\n    place(object, accessPath(ref), value);\n  }\n\n  const result = schema.safeParse(object);\n  if (!result.success) {\n    throw new ValidationError(\n      environment,\n      result.error.issues.map((issue) => ({\n        parameter: issue.path.join(\".\"),\n        message: issue.message,\n      })),\n    );\n  }\n  return result.data;\n}\n\n/**\n * `load`'s harvest-time stand-in: nothing is resolved or validated until a\n * property is actually read. The schema module's top level only *binds*\n * `export const env`, so under harvest the binding succeeds, the CLI reads the\n * `schema` export, and the deferred error — if the tree still cannot satisfy the\n * schema — surfaces on first real use with the same `ValidationError` the eager\n * path throws.\n */\nfunction deferLoad<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  let materialized = false;\n  let value: unknown;\n  const materialize = (): object => {\n    if (!materialized) {\n      value = loadEagerly(schema, options);\n      materialized = true;\n    }\n    // `Object(...)` keeps the traps total even for a schema whose root is not an\n    // object — property reads then forward to the boxed primitive.\n    return Object(value);\n  };\n\n  return new Proxy({} as Record<PropertyKey, unknown>, {\n    get(_target, property) {\n      // Module plumbing probes exported values while the harvest import is still\n      // in flight — `then` (module namespaces are awaited by some loaders) and\n      // well-known symbols (inspection). Those probes must not force the load;\n      // real reads, which arrive after the harvest window closes, must.\n      if (schemaHarvestActive() && (typeof property === \"symbol\" || property === \"then\")) {\n        return undefined;\n      }\n      return Reflect.get(materialize(), property);\n    },\n    has(_target, property) {\n      return Reflect.has(materialize(), property);\n    },\n    ownKeys() {\n      return Reflect.ownKeys(materialize());\n    },\n    getOwnPropertyDescriptor(_target, property) {\n      const descriptor = Reflect.getOwnPropertyDescriptor(materialize(), property);\n      // Configurable, so the descriptor stays compatible with the empty proxy\n      // target — the invariant check would throw for a frozen original otherwise.\n      return descriptor === undefined ? undefined : { ...descriptor, configurable: true };\n    },\n  }) as z.infer<T>;\n}\n","/**\n * The synchronous half of the value cascade, shared by `load` and the\n * `penv/config` compatibility entry.\n *\n * `resolveParameter` in `@penvhq/core` is async because the provider contract is,\n * and `load` is synchronous — so this module walks the cascade against the\n * filesystem provider's synchronous reads instead. It does not restate the\n * precedence rule: `candidatesFor` owns the order and everything here only\n * walks the list it returns, so the two paths cannot drift apart.\n *\n * The runtime reads the local tree for every environment, whatever provider\n * that environment declares, and this is the design rather than a limitation.\n * A provider is where an environment's source of truth *lives*, not where the\n * runtime reads from: `penv pull` materialises the tree from the provider, and\n * the runtime then reads what is on disk. So `load` never inspects\n * `providers.*.type` — a Vault-backed environment resolves through exactly the\n * code path a filesystem-backed one does, which is what makes changing provider\n * a configuration change rather than an application rewrite.\n *\n * Decryption happens here, synchronously, and that is the same knife applied a\n * second time. Key *acquisition* is async and happens before the process starts:\n * a deploy unwraps the KMS-derived data key and exports it, exactly as it already\n * runs `penv pull` to materialise the tree. Key *use* is a synchronous pure\n * function over bytes. penv never calls a KMS in-process — a key is where an\n * environment's secret material *lives*, not what the runtime dials at boot, just\n * as a provider is a sync target and not a runtime source. So invariant 3 is not\n * traded against encryption: `load` stays generic and synchronous because the\n * network half of both problems was moved out of the process entirely, rather\n * than awaited inside it.\n */\n\nimport { dirname, resolve as resolvePath } from \"node:path\";\nimport type { ParameterRef, PenvConfig, ValueFile } from \"@penvhq/core\";\nimport {\n  candidatesFor,\n  formatValueFile,\n  loadConfig,\n  openValue,\n  parameterId,\n  resolveEnvironment,\n  resolveKeySource,\n  UndecryptableValueError,\n} from \"@penvhq/core\";\nimport { createFilesystemProvider } from \"@penvhq/provider-filesystem\";\n\n/** One parameter that resolved to a present value for the target environment. */\nexport interface ResolvedValue {\n  readonly ref: ParameterRef;\n  readonly value: string;\n}\n\nexport interface ResolvedConfig {\n  readonly config: PenvConfig;\n  readonly environment: string;\n  /**\n   * Only parameters with a present candidate. A parameter that resolved to\n   * nothing is absent rather than `undefined`, so requiredness stays the\n   * schema's call.\n   */\n  readonly values: readonly ResolvedValue[];\n}\n\n/**\n * The parameters behind a set of value files, scopes collapsed —\n * `redis/password.production` and `redis/password` are one parameter. Ordered\n * so a `process.env` population is identical on every machine.\n */\nfunction refsFrom(files: readonly ValueFile[]): ParameterRef[] {\n  const refs = new Map<string, ParameterRef>();\n  for (const file of files) {\n    const ref: ParameterRef = { namespace: file.namespace, name: file.name };\n    const id = parameterId(ref);\n    if (!refs.has(id)) {\n      refs.set(id, ref);\n    }\n  }\n  return [...refs.values()].sort((a, b) => {\n    const left = parameterId(a);\n    const right = parameterId(b);\n    return left < right ? -1 : left > right ? 1 : 0;\n  });\n}\n\n/**\n * Loads the config, settles the environment, and resolves every parameter the\n * local tree holds — the work `load` and `penv/config` both start from.\n */\nexport function resolveSync(cwd: string, environment?: string): ResolvedConfig {\n  const { config, file } = loadConfig(cwd);\n  const target = resolveEnvironment(config, environment);\n\n  const provider = createFilesystemProvider({\n    root: resolvePath(dirname(file), \".penv\"),\n    config,\n  });\n\n  const keys = resolveKeySource(config, target);\n\n  const values: ResolvedValue[] = [];\n  for (const ref of refsFrom(provider.listSync())) {\n    for (const candidate of candidatesFor(ref, target)) {\n      const read = provider.readSync(candidate);\n      if (read === undefined) {\n        continue;\n      }\n      // The winner is the winner whether or not it opens. Continuing the walk on\n      // a failed decrypt would serve a lower scope's plaintext twin instead —\n      // the scope widening the cascade exists to prevent, arrived at by treating\n      // \"I cannot read this\" as \"this is not here\".\n      const opened = openValue(candidate, read, keys);\n      if (opened.kind === \"failed\") {\n        throw new UndecryptableValueError(\n          parameterId(ref),\n          target,\n          formatValueFile(candidate),\n          opened.failure,\n        );\n      }\n      values.push({ ref, value: opened.value });\n      break;\n    }\n  }\n\n  return { config, environment: target, values };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,IAAAA,eAUO;;;ACXP,IAAAC,eAAiE;;;ACwBjE,uBAAgD;AAEhD,kBASO;AACP,iCAAyC;AAwBzC,SAAS,SAAS,OAA6C;AAC7D,QAAM,OAAO,oBAAI,IAA0B;AAC3C,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAoB,EAAE,WAAW,KAAK,WAAW,MAAM,KAAK,KAAK;AACvE,UAAM,SAAK,yBAAY,GAAG;AAC1B,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,IAAI,GAAG;AAAA,IAClB;AAAA,EACF;AACA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM;AACvC,UAAM,WAAO,yBAAY,CAAC;AAC1B,UAAM,YAAQ,yBAAY,CAAC;AAC3B,WAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,EAChD,CAAC;AACH;AAMO,SAAS,YAAY,KAAa,aAAsC;AAC7E,QAAM,EAAE,QAAQ,KAAK,QAAI,wBAAW,GAAG;AACvC,QAAM,aAAS,gCAAmB,QAAQ,WAAW;AAErD,QAAM,eAAW,qDAAyB;AAAA,IACxC,UAAM,iBAAAC,aAAY,0BAAQ,IAAI,GAAG,OAAO;AAAA,IACxC;AAAA,EACF,CAAC;AAED,QAAM,WAAO,8BAAiB,QAAQ,MAAM;AAE5C,QAAM,SAA0B,CAAC;AACjC,aAAW,OAAO,SAAS,SAAS,SAAS,CAAC,GAAG;AAC/C,eAAW,iBAAa,2BAAc,KAAK,MAAM,GAAG;AAClD,YAAM,OAAO,SAAS,SAAS,SAAS;AACxC,UAAI,SAAS,QAAW;AACtB;AAAA,MACF;AAKA,YAAM,aAAS,uBAAU,WAAW,MAAM,IAAI;AAC9C,UAAI,OAAO,SAAS,UAAU;AAC5B,cAAM,IAAI;AAAA,cACR,yBAAY,GAAG;AAAA,UACf;AAAA,cACA,6BAAgB,SAAS;AAAA,UACzB,OAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,KAAK,EAAE,KAAK,OAAO,OAAO,MAAM,CAAC;AACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,QAAQ,OAAO;AAC/C;;;ADrGA,SAAS,MAAM,MAA+B,MAAyB,OAAqB;AAC1F,QAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,MAAI,SAAS,QAAW;AACtB;AAAA,EACF;AAEA,MAAI,OAAO;AACX,aAAW,OAAO,KAAK,MAAM,GAAG,EAAE,GAAG;AACnC,UAAM,WAAW,KAAK,GAAG;AACzB,QAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,aAAO;AACP;AAAA,IACF;AACA,UAAM,QAAiC,CAAC;AACxC,SAAK,GAAG,IAAI;AACZ,WAAO;AAAA,EACT;AACA,OAAK,IAAI,IAAI;AACf;AAgBO,SAAS,KAA0B,QAAW,SAAmC;AACtF,UAAI,kCAAoB,GAAG;AACzB,WAAO,UAAU,QAAQ,OAAO;AAAA,EAClC;AACA,SAAO,YAAY,QAAQ,OAAO;AACpC;AAEA,SAAS,YAAiC,QAAW,SAAmC;AACtF,QAAM,EAAE,aAAa,OAAO,IAAI,YAAY,SAAS,OAAO,QAAQ,IAAI,GAAG,SAAS,WAAW;AAE/F,QAAM,SAAkC,CAAC;AACzC,aAAW,EAAE,KAAK,MAAM,KAAK,QAAQ;AACnC,UAAM,YAAQ,yBAAW,GAAG,GAAG,KAAK;AAAA,EACtC;AAEA,QAAM,SAAS,OAAO,UAAU,MAAM;AACtC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QAClC,WAAW,MAAM,KAAK,KAAK,GAAG;AAAA,QAC9B,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAUA,SAAS,UAA+B,QAAW,SAAmC;AACpF,MAAI,eAAe;AACnB,MAAI;AACJ,QAAM,cAAc,MAAc;AAChC,QAAI,CAAC,cAAc;AACjB,cAAQ,YAAY,QAAQ,OAAO;AACnC,qBAAe;AAAA,IACjB;AAGA,WAAO,OAAO,KAAK;AAAA,EACrB;AAEA,SAAO,IAAI,MAAM,CAAC,GAAmC;AAAA,IACnD,IAAI,SAAS,UAAU;AAKrB,cAAI,kCAAoB,MAAM,OAAO,aAAa,YAAY,aAAa,SAAS;AAClF,eAAO;AAAA,MACT;AACA,aAAO,QAAQ,IAAI,YAAY,GAAG,QAAQ;AAAA,IAC5C;AAAA,IACA,IAAI,SAAS,UAAU;AACrB,aAAO,QAAQ,IAAI,YAAY,GAAG,QAAQ;AAAA,IAC5C;AAAA,IACA,UAAU;AACR,aAAO,QAAQ,QAAQ,YAAY,CAAC;AAAA,IACtC;AAAA,IACA,yBAAyB,SAAS,UAAU;AAC1C,YAAM,aAAa,QAAQ,yBAAyB,YAAY,GAAG,QAAQ;AAG3E,aAAO,eAAe,SAAY,SAAY,EAAE,GAAG,YAAY,cAAc,KAAK;AAAA,IACpF;AAAA,EACF,CAAC;AACH;","names":["import_core","import_core","resolvePath"]}

package/dist/index.d.cts

@@ -18,6 +18,15 @@ interface LoadOptions {
  * Loads, validates, and returns configuration for the current environment.
  * Eager and synchronous: invalid configuration fails at startup with a
  * parameter-named error rather than later at first use.
+ *
+ * One deliberate exception to the eagerness: while the CLI is harvesting the
+ * `schema` export of `.penv/env.ts` (see `SCHEMA_HARVEST_ENV` in core), the
+ * scaffolded module's own `export const env = load(schema)` must not stop the
+ * module from evaluating — an empty tree would throw here and take the `schema`
+ * export down with it, which is exactly the state `penv fill` exists to fix. In
+ * that window `load` returns a lazy stand-in that performs the real load — and
+ * raises the same parameter-named error — on first property access. Application
+ * runtime never sets the flag, so ordinary loads stay eager and fail-fast.
  */
 declare function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T>;
 

package/dist/index.d.ts

@@ -18,6 +18,15 @@ interface LoadOptions {
  * Loads, validates, and returns configuration for the current environment.
  * Eager and synchronous: invalid configuration fails at startup with a
  * parameter-named error rather than later at first use.
+ *
+ * One deliberate exception to the eagerness: while the CLI is harvesting the
+ * `schema` export of `.penv/env.ts` (see `SCHEMA_HARVEST_ENV` in core), the
+ * scaffolded module's own `export const env = load(schema)` must not stop the
+ * module from evaluating — an empty tree would throw here and take the `schema`
+ * export down with it, which is exactly the state `penv fill` exists to fix. In
+ * that window `load` returns a lazy stand-in that performs the real load — and
+ * raises the same parameter-named error — on first property access. Application
+ * runtime never sets the flag, so ordinary loads stay eager and fail-fast.
  */
 declare function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T>;
 

package/dist/index.js

@@ -16,7 +16,7 @@ import {
 } from "@penvhq/core";
 
 // src/load.ts
-import { accessPath, ValidationError } from "@penvhq/core";
+import { accessPath, schemaHarvestActive, ValidationError } from "@penvhq/core";
 function place(root, path, value) {
   const leaf = path[path.length - 1];
   if (leaf === void 0) {
@@ -36,6 +36,12 @@ function place(root, path, value) {
   node[leaf] = value;
 }
 function load(schema, options) {
+  if (schemaHarvestActive()) {
+    return deferLoad(schema, options);
+  }
+  return loadEagerly(schema, options);
+}
+function loadEagerly(schema, options) {
   const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);
   const object = {};
   for (const { ref, value } of values) {
@@ -53,6 +59,35 @@ function load(schema, options) {
   }
   return result.data;
 }
+function deferLoad(schema, options) {
+  let materialized = false;
+  let value;
+  const materialize = () => {
+    if (!materialized) {
+      value = loadEagerly(schema, options);
+      materialized = true;
+    }
+    return Object(value);
+  };
+  return new Proxy({}, {
+    get(_target, property) {
+      if (schemaHarvestActive() && (typeof property === "symbol" || property === "then")) {
+        return void 0;
+      }
+      return Reflect.get(materialize(), property);
+    },
+    has(_target, property) {
+      return Reflect.has(materialize(), property);
+    },
+    ownKeys() {
+      return Reflect.ownKeys(materialize());
+    },
+    getOwnPropertyDescriptor(_target, property) {
+      const descriptor = Reflect.getOwnPropertyDescriptor(materialize(), property);
+      return descriptor === void 0 ? void 0 : { ...descriptor, configurable: true };
+    }
+  });
+}
 export {
   ConfigError,
   FilenameGrammarError,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/load.ts"],"sourcesContent":["/**\n * The public surface of `@penvhq/runtime` — what `penv` re-exports.\n *\n * `defineConfig` is re-exported from `@penvhq/core` because the docs show\n * `penv.config.ts` importing it from `penv`: one import specifier for the whole\n * tool, whatever package a symbol happens to live in.\n */\n\nexport {\n  ConfigError,\n  defineConfig,\n  FilenameGrammarError,\n  MissingParameterError,\n  NameCollisionError,\n  PenvError,\n  ReservedTokenError,\n  UnknownEnvironmentError,\n  ValidationError,\n} from \"@penvhq/core\";\nexport type { LoadOptions } from \"./load.js\";\nexport { load } from \"./load.js\";\n","/**\n * The runtime loader. `load` is generic and returns `z.infer<T>` — the type the\n * caller's own schema describes, never a widened one. The inferred type is only\n * true because the same schema validates the values before they are returned,\n * so the type you code against and the value you receive cannot diverge.\n */\n\nimport { accessPath, ValidationError } from \"@penvhq/core\";\nimport type { z } from \"zod\";\nimport { resolveSync } from \"./resolve.js\";\n\nexport interface LoadOptions {\n  /** Where to start looking for `penv.config.ts`. Defaults to `process.cwd()`. */\n  readonly cwd?: string;\n  /** Overrides `PENV_ENV` / `NODE_ENV`. Must be a declared environment. */\n  readonly environment?: string;\n}\n\n/**\n * Places a value at its access path, creating namespaces on the way.\n * Values are placed exactly as the provider holds them: coercion is the\n * schema's job, so a value file's contents stay a string here.\n */\nfunction place(root: Record<string, unknown>, path: readonly string[], value: string): void {\n  const leaf = path[path.length - 1];\n  if (leaf === undefined) {\n    return;\n  }\n\n  let node = root;\n  for (const key of path.slice(0, -1)) {\n    const existing = node[key];\n    if (typeof existing === \"object\" && existing !== null) {\n      node = existing as Record<string, unknown>;\n      continue;\n    }\n    const child: Record<string, unknown> = {};\n    node[key] = child;\n    node = child;\n  }\n  node[leaf] = value;\n}\n\n/**\n * Loads, validates, and returns configuration for the current environment.\n * Eager and synchronous: invalid configuration fails at startup with a\n * parameter-named error rather than later at first use.\n */\nexport function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);\n\n  const object: Record<string, unknown> = {};\n  for (const { ref, value } of values) {\n    place(object, accessPath(ref), value);\n  }\n\n  const result = schema.safeParse(object);\n  if (!result.success) {\n    throw new ValidationError(\n      environment,\n      result.error.issues.map((issue) => ({\n        parameter: issue.path.join(\".\"),\n        message: issue.message,\n      })),\n    );\n  }\n  return result.data;\n}\n"],"mappings":";;;;;AAQA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAAA;AAAA,OACK;;;ACXP,SAAS,YAAY,uBAAuB;AAgB5C,SAAS,MAAM,MAA+B,MAAyB,OAAqB;AAC1F,QAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,MAAI,SAAS,QAAW;AACtB;AAAA,EACF;AAEA,MAAI,OAAO;AACX,aAAW,OAAO,KAAK,MAAM,GAAG,EAAE,GAAG;AACnC,UAAM,WAAW,KAAK,GAAG;AACzB,QAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,aAAO;AACP;AAAA,IACF;AACA,UAAM,QAAiC,CAAC;AACxC,SAAK,GAAG,IAAI;AACZ,WAAO;AAAA,EACT;AACA,OAAK,IAAI,IAAI;AACf;AAOO,SAAS,KAA0B,QAAW,SAAmC;AACtF,QAAM,EAAE,aAAa,OAAO,IAAI,YAAY,SAAS,OAAO,QAAQ,IAAI,GAAG,SAAS,WAAW;AAE/F,QAAM,SAAkC,CAAC;AACzC,aAAW,EAAE,KAAK,MAAM,KAAK,QAAQ;AACnC,UAAM,QAAQ,WAAW,GAAG,GAAG,KAAK;AAAA,EACtC;AAEA,QAAM,SAAS,OAAO,UAAU,MAAM;AACtC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QAClC,WAAW,MAAM,KAAK,KAAK,GAAG;AAAA,QAC9B,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,OAAO;AAChB;","names":["ValidationError"]}
+{"version":3,"sources":["../src/index.ts","../src/load.ts"],"sourcesContent":["/**\n * The public surface of `@penvhq/runtime` — what `penv` re-exports.\n *\n * `defineConfig` is re-exported from `@penvhq/core` because the docs show\n * `penv.config.ts` importing it from `penv`: one import specifier for the whole\n * tool, whatever package a symbol happens to live in.\n */\n\nexport {\n  ConfigError,\n  defineConfig,\n  FilenameGrammarError,\n  MissingParameterError,\n  NameCollisionError,\n  PenvError,\n  ReservedTokenError,\n  UnknownEnvironmentError,\n  ValidationError,\n} from \"@penvhq/core\";\nexport type { LoadOptions } from \"./load.js\";\nexport { load } from \"./load.js\";\n","/**\n * The runtime loader. `load` is generic and returns `z.infer<T>` — the type the\n * caller's own schema describes, never a widened one. The inferred type is only\n * true because the same schema validates the values before they are returned,\n * so the type you code against and the value you receive cannot diverge.\n */\n\nimport { accessPath, schemaHarvestActive, ValidationError } from \"@penvhq/core\";\nimport type { z } from \"zod\";\nimport { resolveSync } from \"./resolve.js\";\n\nexport interface LoadOptions {\n  /** Where to start looking for `penv.config.ts`. Defaults to `process.cwd()`. */\n  readonly cwd?: string;\n  /** Overrides `PENV_ENV` / `NODE_ENV`. Must be a declared environment. */\n  readonly environment?: string;\n}\n\n/**\n * Places a value at its access path, creating namespaces on the way.\n * Values are placed exactly as the provider holds them: coercion is the\n * schema's job, so a value file's contents stay a string here.\n */\nfunction place(root: Record<string, unknown>, path: readonly string[], value: string): void {\n  const leaf = path[path.length - 1];\n  if (leaf === undefined) {\n    return;\n  }\n\n  let node = root;\n  for (const key of path.slice(0, -1)) {\n    const existing = node[key];\n    if (typeof existing === \"object\" && existing !== null) {\n      node = existing as Record<string, unknown>;\n      continue;\n    }\n    const child: Record<string, unknown> = {};\n    node[key] = child;\n    node = child;\n  }\n  node[leaf] = value;\n}\n\n/**\n * Loads, validates, and returns configuration for the current environment.\n * Eager and synchronous: invalid configuration fails at startup with a\n * parameter-named error rather than later at first use.\n *\n * One deliberate exception to the eagerness: while the CLI is harvesting the\n * `schema` export of `.penv/env.ts` (see `SCHEMA_HARVEST_ENV` in core), the\n * scaffolded module's own `export const env = load(schema)` must not stop the\n * module from evaluating — an empty tree would throw here and take the `schema`\n * export down with it, which is exactly the state `penv fill` exists to fix. In\n * that window `load` returns a lazy stand-in that performs the real load — and\n * raises the same parameter-named error — on first property access. Application\n * runtime never sets the flag, so ordinary loads stay eager and fail-fast.\n */\nexport function load<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  if (schemaHarvestActive()) {\n    return deferLoad(schema, options);\n  }\n  return loadEagerly(schema, options);\n}\n\nfunction loadEagerly<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  const { environment, values } = resolveSync(options?.cwd ?? process.cwd(), options?.environment);\n\n  const object: Record<string, unknown> = {};\n  for (const { ref, value } of values) {\n    place(object, accessPath(ref), value);\n  }\n\n  const result = schema.safeParse(object);\n  if (!result.success) {\n    throw new ValidationError(\n      environment,\n      result.error.issues.map((issue) => ({\n        parameter: issue.path.join(\".\"),\n        message: issue.message,\n      })),\n    );\n  }\n  return result.data;\n}\n\n/**\n * `load`'s harvest-time stand-in: nothing is resolved or validated until a\n * property is actually read. The schema module's top level only *binds*\n * `export const env`, so under harvest the binding succeeds, the CLI reads the\n * `schema` export, and the deferred error — if the tree still cannot satisfy the\n * schema — surfaces on first real use with the same `ValidationError` the eager\n * path throws.\n */\nfunction deferLoad<T extends z.ZodType>(schema: T, options?: LoadOptions): z.infer<T> {\n  let materialized = false;\n  let value: unknown;\n  const materialize = (): object => {\n    if (!materialized) {\n      value = loadEagerly(schema, options);\n      materialized = true;\n    }\n    // `Object(...)` keeps the traps total even for a schema whose root is not an\n    // object — property reads then forward to the boxed primitive.\n    return Object(value);\n  };\n\n  return new Proxy({} as Record<PropertyKey, unknown>, {\n    get(_target, property) {\n      // Module plumbing probes exported values while the harvest import is still\n      // in flight — `then` (module namespaces are awaited by some loaders) and\n      // well-known symbols (inspection). Those probes must not force the load;\n      // real reads, which arrive after the harvest window closes, must.\n      if (schemaHarvestActive() && (typeof property === \"symbol\" || property === \"then\")) {\n        return undefined;\n      }\n      return Reflect.get(materialize(), property);\n    },\n    has(_target, property) {\n      return Reflect.has(materialize(), property);\n    },\n    ownKeys() {\n      return Reflect.ownKeys(materialize());\n    },\n    getOwnPropertyDescriptor(_target, property) {\n      const descriptor = Reflect.getOwnPropertyDescriptor(materialize(), property);\n      // Configurable, so the descriptor stays compatible with the empty proxy\n      // target — the invariant check would throw for a frozen original otherwise.\n      return descriptor === undefined ? undefined : { ...descriptor, configurable: true };\n    },\n  }) as z.infer<T>;\n}\n"],"mappings":";;;;;AAQA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAAA;AAAA,OACK;;;ACXP,SAAS,YAAY,qBAAqB,uBAAuB;AAgBjE,SAAS,MAAM,MAA+B,MAAyB,OAAqB;AAC1F,QAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,MAAI,SAAS,QAAW;AACtB;AAAA,EACF;AAEA,MAAI,OAAO;AACX,aAAW,OAAO,KAAK,MAAM,GAAG,EAAE,GAAG;AACnC,UAAM,WAAW,KAAK,GAAG;AACzB,QAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,aAAO;AACP;AAAA,IACF;AACA,UAAM,QAAiC,CAAC;AACxC,SAAK,GAAG,IAAI;AACZ,WAAO;AAAA,EACT;AACA,OAAK,IAAI,IAAI;AACf;AAgBO,SAAS,KAA0B,QAAW,SAAmC;AACtF,MAAI,oBAAoB,GAAG;AACzB,WAAO,UAAU,QAAQ,OAAO;AAAA,EAClC;AACA,SAAO,YAAY,QAAQ,OAAO;AACpC;AAEA,SAAS,YAAiC,QAAW,SAAmC;AACtF,QAAM,EAAE,aAAa,OAAO,IAAI,YAAY,SAAS,OAAO,QAAQ,IAAI,GAAG,SAAS,WAAW;AAE/F,QAAM,SAAkC,CAAC;AACzC,aAAW,EAAE,KAAK,MAAM,KAAK,QAAQ;AACnC,UAAM,QAAQ,WAAW,GAAG,GAAG,KAAK;AAAA,EACtC;AAEA,QAAM,SAAS,OAAO,UAAU,MAAM;AACtC,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QAClC,WAAW,MAAM,KAAK,KAAK,GAAG;AAAA,QAC9B,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAUA,SAAS,UAA+B,QAAW,SAAmC;AACpF,MAAI,eAAe;AACnB,MAAI;AACJ,QAAM,cAAc,MAAc;AAChC,QAAI,CAAC,cAAc;AACjB,cAAQ,YAAY,QAAQ,OAAO;AACnC,qBAAe;AAAA,IACjB;AAGA,WAAO,OAAO,KAAK;AAAA,EACrB;AAEA,SAAO,IAAI,MAAM,CAAC,GAAmC;AAAA,IACnD,IAAI,SAAS,UAAU;AAKrB,UAAI,oBAAoB,MAAM,OAAO,aAAa,YAAY,aAAa,SAAS;AAClF,eAAO;AAAA,MACT;AACA,aAAO,QAAQ,IAAI,YAAY,GAAG,QAAQ;AAAA,IAC5C;AAAA,IACA,IAAI,SAAS,UAAU;AACrB,aAAO,QAAQ,IAAI,YAAY,GAAG,QAAQ;AAAA,IAC5C;AAAA,IACA,UAAU;AACR,aAAO,QAAQ,QAAQ,YAAY,CAAC;AAAA,IACtC;AAAA,IACA,yBAAyB,SAAS,UAAU;AAC1C,YAAM,aAAa,QAAQ,yBAAyB,YAAY,GAAG,QAAQ;AAG3E,aAAO,eAAe,SAAY,SAAY,EAAE,GAAG,YAAY,cAAc,KAAK;AAAA,IACpF;AAAA,EACF,CAAC;AACH;","names":["ValidationError"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@penvhq/runtime",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "penv's load() and the typed env surface. Ships into user apps — keep it light.",
   "license": "MIT",
   "type": "module",
@@ -23,8 +23,8 @@
     "dist"
   ],
   "dependencies": {
-    "@penvhq/core": "0.3.1",
-    "@penvhq/provider-filesystem": "0.3.1"
+    "@penvhq/core": "0.4.0",
+    "@penvhq/provider-filesystem": "0.4.0"
   },
   "peerDependencies": {
     "zod": "^4.4.3"