@penvhq/cli 0.16.0 → 0.16.2

package/dist/index.d.cts

@@ -123,10 +123,22 @@ interface ScopeOptions {
     readonly environment?: string;
     readonly local?: boolean;
 }
+/** What `set` knows when it has to ask for the value: which file, and whether to hide the typing. */
+interface SetPrompt {
+    readonly parameter: string;
+    /** Whether meta says this is a secret, so the wrapper mutes the echo. */
+    readonly secret: boolean;
+}
 interface SetOptions extends ScopeOptions {
     readonly cwd: string;
     readonly key: string;
-    readonly value: string;
+    /** The value, when the command line carried one. */
+    readonly value?: string;
+    /**
+     * How the value is obtained when the command line carried none. `undefined`
+     * or an empty answer is a refusal: an empty secret is never what was meant.
+     */
+    readonly ask?: (prompt: SetPrompt) => Promise<string | undefined>;
 }
 interface SetResult {
     readonly parameter: string;
@@ -183,10 +195,7 @@ interface FillPrompt {
     /** The value file's key, kebab and slash-separated — the name the user need never derive. */
     readonly parameter: string;
     readonly environment: string;
-    /**
-     * Whether meta says this is a secret. Carried so a wrapper can mute the echo;
-     * v1 does not, and the drift carries no meta, so this is `false` today.
-     */
+    /** Whether meta says this is a secret, so the wrapper mutes the echo. */
     readonly secret: boolean;
     /**
      * Whether the schema excuses absence — `.optional()`, `.default()`. An answer

package/dist/index.d.ts

@@ -123,10 +123,22 @@ interface ScopeOptions {
     readonly environment?: string;
     readonly local?: boolean;
 }
+/** What `set` knows when it has to ask for the value: which file, and whether to hide the typing. */
+interface SetPrompt {
+    readonly parameter: string;
+    /** Whether meta says this is a secret, so the wrapper mutes the echo. */
+    readonly secret: boolean;
+}
 interface SetOptions extends ScopeOptions {
     readonly cwd: string;
     readonly key: string;
-    readonly value: string;
+    /** The value, when the command line carried one. */
+    readonly value?: string;
+    /**
+     * How the value is obtained when the command line carried none. `undefined`
+     * or an empty answer is a refusal: an empty secret is never what was meant.
+     */
+    readonly ask?: (prompt: SetPrompt) => Promise<string | undefined>;
 }
 interface SetResult {
     readonly parameter: string;
@@ -183,10 +195,7 @@ interface FillPrompt {
     /** The value file's key, kebab and slash-separated — the name the user need never derive. */
     readonly parameter: string;
     readonly environment: string;
-    /**
-     * Whether meta says this is a secret. Carried so a wrapper can mute the echo;
-     * v1 does not, and the drift carries no meta, so this is `false` today.
-     */
+    /** Whether meta says this is a secret, so the wrapper mutes the echo. */
     readonly secret: boolean;
     /**
      * Whether the schema excuses absence — `.optional()`, `.default()`. An answer

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   planInstall,
   renderInstallPlan,
   startChild
-} from "./chunk-4RR6UFVZ.js";
+} from "./chunk-5UQEMWMW.js";
 
 // src/index.ts
 import { setKeychain } from "@penvhq/core";
@@ -2187,8 +2187,21 @@ import { defineCommand as defineCommand6 } from "citty";
 
 // src/input.ts
 import { createInterface } from "readline";
+import { Writable } from "stream";
+function isTerminal(output) {
+  return output.isTTY === true;
+}
 function lineReader(input = process.stdin, output = process.stdout) {
-  const rl = createInterface({ input, output });
+  let muted = false;
+  const sink = new Writable({
+    write(chunk, _encoding, callback) {
+      if (!muted) {
+        output.write(chunk);
+      }
+      callback();
+    }
+  });
+  const rl = createInterface({ input, output: sink, terminal: isTerminal(output) });
   const buffered = [];
   const waiting = [];
   let closed = false;
@@ -2207,7 +2220,7 @@ function lineReader(input = process.stdin, output = process.stdout) {
     }
   });
   return {
-    ask(question) {
+    ask(question, options) {
       const early = buffered.shift();
       if (early !== void 0) {
         return Promise.resolve(early);
@@ -2215,6 +2228,19 @@ function lineReader(input = process.stdin, output = process.stdout) {
       if (closed) {
         return Promise.resolve(void 0);
       }
+      if (options?.secret === true) {
+        output.write(question);
+        muted = true;
+        rl.setPrompt("");
+        rl.prompt();
+        return new Promise((resolve9) => {
+          waiting.push((line) => {
+            muted = false;
+            output.write("\n");
+            resolve9(line);
+          });
+        });
+      }
       rl.setPrompt(question);
       rl.prompt();
       return new Promise((resolve9) => {
@@ -3551,16 +3577,30 @@ async function runSet(options) {
   const ref = refFromKey(options.key, project.config);
   const scope = targetScope(project, options, options.key);
   const environment = policyEnvironment(project, options);
+  const value = options.value ?? await askForValue(project, ref, environment, options);
   const { encrypted, location } = await sealAwareWrite({
     project,
     provider: project.provider,
     ref,
     scope,
-    value: options.value,
+    value,
     environment
   });
   return { parameter: options.key, location, encrypted };
 }
+async function askForValue(project, ref, environment, options) {
+  const parameter = parameterId4(ref);
+  const remedy = `Pass it on the command line \u2014 \`penv set ${options.key} <value>\` \u2014 pipe it in, or answer the prompt.`;
+  if (options.ask === void 0) {
+    throw new PenvError9("VALUE_MISSING", `No value was given for parameter ${parameter}`, remedy);
+  }
+  const secret = isSecret4(await project.provider.readMeta(ref), environment);
+  const answer = await options.ask({ parameter, secret });
+  if (answer === void 0 || answer.length === 0) {
+    throw new PenvError9("VALUE_MISSING", `No value was entered for parameter ${parameter}`, remedy);
+  }
+  return answer;
+}
 function renderSet(result2) {
   return formatRows([
     {
@@ -3598,18 +3638,29 @@ var setCommand = defineCommand8({
   },
   run({ args }) {
     return guard(async () => {
-      const value = args.value ?? await readStdin();
-      write(
-        renderSet(
-          await runSet({
-            cwd: process.cwd(),
-            key: args.key,
-            value,
-            ...args.env === void 0 ? {} : { environment: args.env },
-            ...args.local === void 0 ? {} : { local: args.local }
-          })
-        )
-      );
+      const base = {
+        cwd: process.cwd(),
+        key: args.key,
+        ...args.env === void 0 ? {} : { environment: args.env },
+        ...args.local === void 0 ? {} : { local: args.local }
+      };
+      if (args.value !== void 0) {
+        write(renderSet(await runSet({ ...base, value: args.value })));
+        return;
+      }
+      if (process.stdin.isTTY !== true) {
+        write(renderSet(await runSet({ ...base, value: await readStdin() })));
+        return;
+      }
+      const reader = lineReader();
+      try {
+        const ask = ({ parameter, secret }) => reader.ask(prompt(parameter, secret ? "secret, typing is hidden" : void 0), {
+          secret
+        });
+        write(renderSet(await runSet({ ...base, ask })));
+      } finally {
+        reader.close();
+      }
     });
   }
 });
@@ -3751,7 +3802,7 @@ var decryptCommand = defineCommand9({
 });
 
 // src/commands/fill.ts
-import { PenvError as PenvError11, recordPath as recordPath4, SCHEMA_SHAPE_FILE as SCHEMA_SHAPE_FILE2 } from "@penvhq/core";
+import { isSecret as isSecret6, PenvError as PenvError11, recordPath as recordPath4, SCHEMA_SHAPE_FILE as SCHEMA_SHAPE_FILE2 } from "@penvhq/core";
 import { defineCommand as defineCommand10 } from "citty";
 var BLOCKING = /* @__PURE__ */ new Set(["config", "collision", "reserved"]);
 async function runFill(options) {
@@ -3773,6 +3824,8 @@ ${detail}`,
       `Fix these \u2014 \`penv validate\` reports them \u2014 then run \`penv fill\`. If you have not written a schema yet, declare the required parameters in ${SCHEMA_SHAPE_FILE2}.`
     );
   }
+  const project = openProject(options.cwd);
+  const secretFor = async (ref) => isSecret6(await project.provider.readMeta(ref), environment);
   const written = [];
   const skipped2 = [];
   const kept = [];
@@ -3787,7 +3840,7 @@ ${detail}`,
     const value = await options.ask({
       parameter: key,
       environment,
-      secret: false,
+      secret: await secretFor(ref),
       optional: false
     });
     if (value === void 0 || value === "") {
@@ -3811,7 +3864,7 @@ ${detail}`,
     const value = await options.ask({
       parameter: key,
       environment,
-      secret: false,
+      secret: await secretFor(ref),
       optional: true,
       ...item.defaultValue === void 0 ? {} : { defaultValue: item.defaultValue }
     });
@@ -3881,7 +3934,7 @@ var fillCommand = defineCommand10({
   run({ args }) {
     return guard(async () => {
       const reader = lineReader();
-      const ask = (prompt2) => reader.ask(prompt(prompt2.parameter, contextFor(prompt2)));
+      const ask = (prompt2) => reader.ask(prompt(prompt2.parameter, contextFor(prompt2)), { secret: prompt2.secret });
       try {
         write(
           renderFill(