@penvhq/cli 0.2.0 → 0.3.1

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
 import { setKeychain } from "@penvhq/core";
-import { runMain as cittyRunMain, defineCommand as defineCommand17 } from "citty";
+import { runMain as cittyRunMain, defineCommand as defineCommand18 } from "citty";
 
 // src/commands/doctor.ts
 import {
@@ -26,12 +26,14 @@ import { dirname as dirname2, resolve as resolve2 } from "path";
 import {
   candidatesFor,
   formatValueFile,
+  isCanonicalSegment,
   isReservedToken,
   loadConfig,
   openValue,
   PenvError as PenvError2,
   parameterId,
   ReservedTokenError,
+  refFromAccessPath,
   resolveEnvironment,
   resolveKeySource
 } from "@penvhq/core";
@@ -43,13 +45,20 @@ import { dirname, resolve } from "path";
 import { pathToFileURL } from "url";
 import { PenvError } from "@penvhq/core";
 import { createFilesystemProvider } from "@penvhq/provider-filesystem";
+import { createKubernetesProvider } from "@penvhq/provider-kubernetes";
 import { createMockProvider } from "@penvhq/provider-mock";
+import { createSsmProvider } from "@penvhq/provider-ssm";
 import { createVaultProvider } from "@penvhq/provider-vault";
 var PLUGIN_FACTORY_EXPORT = "penvProviderFactory";
 var LOCAL_TREE_TYPE = "filesystem";
 var REGISTRY = /* @__PURE__ */ new Map([
   [LOCAL_TREE_TYPE, ({ root, config }) => createFilesystemProvider({ root, config })],
   ["vault", ({ providerConfig }) => createVaultProvider({ path: providerConfig?.path ?? "penv" })],
+  ["ssm", ({ providerConfig }) => createSsmProvider({ path: providerConfig?.path ?? "penv" })],
+  [
+    "kubernetes",
+    ({ providerConfig }) => createKubernetesProvider(kubernetesOptions(providerConfig))
+  ],
   ["mock", ({ root }) => createMockProvider({ storePath: resolve(root, ".penv-mock.json") })]
 ]);
 var CONTRACT_METHODS = [
@@ -152,6 +161,14 @@ function assertSatisfiesContract(provider, specifier) {
     }
   }
 }
+function kubernetesOptions(providerConfig) {
+  const path = providerConfig?.path ?? "penv";
+  const slash = path.indexOf("/");
+  if (slash === -1) return { secretName: path };
+  const namespace = path.slice(0, slash);
+  const secretName = path.slice(slash + 1) || "penv";
+  return namespace === "" ? { secretName } : { namespace, secretName };
+}
 function unknownProvider(type, environment, specifier) {
   const known = [...REGISTRY.keys()].map((name) => `\`${name}\``).join(", ");
   const where = environment === void 0 ? "" : ` for environment ${environment}`;
@@ -220,6 +237,26 @@ function refFromKey(key, config) {
   }
   return { namespace: segments.slice(0, -1), name };
 }
+function assertWritableKey(key) {
+  const segments = key.split(KEY_SEPARATOR).filter((s) => s.length > 0);
+  if (segments.length === 0 || segments.every((s) => isCanonicalSegment(s))) {
+    return;
+  }
+  const ref = refFromAccessPath(segments);
+  if (ref !== void 0) {
+    const suggestion = [...ref.namespace, ref.name].join("/");
+    throw new PenvError2(
+      "PARAMETER_KEY_CASING",
+      `\`${key}\` is not a canonical parameter name`,
+      `Parameter files are lower-case and hyphenated. Did you mean \`${suggestion}\`? That is the file that backs the \`${key}\` key in your schema.`
+    );
+  }
+  throw new PenvError2(
+    "PARAMETER_KEY_UNREACHABLE",
+    `No value file can be named that reaches \`${key}\``,
+    "Parameter files are lower-case and hyphenated, and this key maps to no such file \u2014 a run of capitals like `apiURL` cannot be reached (use `api-url`, which the schema reads as `apiUrl`). Run `penv validate` or `penv fill` to see the names penv expects."
+  );
+}
 function keySourceFor(project, environment) {
   return resolveKeySource(project.config, environment);
 }
@@ -266,7 +303,7 @@ import {
   accessPath,
   isReservedToken as isReservedToken2,
   parameterId as parameterId2,
-  refFromAccessPath,
+  refFromAccessPath as refFromAccessPath2,
   variableName
 } from "@penvhq/core";
 function defOf(node) {
@@ -374,7 +411,7 @@ function computeDrift(input) {
       continue;
     }
     const path = leaf.path.join(".");
-    const ref = refFromAccessPath(leaf.path);
+    const ref = refFromAccessPath2(leaf.path);
     if (ref === void 0 || isReservedToken2(ref.name, config)) {
       declared.push({
         subject: path,
@@ -646,6 +683,7 @@ import { pathToFileURL as pathToFileURL2 } from "url";
 import {
   accessPath as accessPath2,
   checkNameCollisions as checkNameCollisions2,
+  jitiFor,
   NameCollisionError,
   PenvError as PenvError5,
   ReservedTokenError as ReservedTokenError2,
@@ -654,7 +692,6 @@ import {
   validateConfig
 } from "@penvhq/core";
 import { defineCommand as defineCommand2 } from "citty";
-import { createJiti } from "jiti";
 var SCHEMA_EXPORT = "schema";
 var LABELS = {
   config: "Config",
@@ -733,7 +770,7 @@ function loadSchema(project, environment) {
   return exclusively(() => loadSchemaExclusively(file, schemaPath, environment));
 }
 async function loadSchemaExclusively(file, schemaPath, environment) {
-  const jiti = createJiti(file, { interopDefault: false, moduleCache: false });
+  const jiti = jitiFor(file);
   const previous = process.env.PENV_ENV;
   process.env.PENV_ENV = environment;
   let loaded;
@@ -1735,6 +1772,7 @@ async function sealAwareWrite(options) {
 }
 async function runSet(options) {
   const project = openProject(options.cwd);
+  assertWritableKey(options.key);
   const ref = refFromKey(options.key, project.config);
   const scope = targetScope(project, options, options.key);
   const environment = policyEnvironment(project, options);
@@ -1937,18 +1975,123 @@ var decryptCommand = defineCommand5({
   }
 });
 
+// src/commands/fill.ts
+import { createInterface } from "readline/promises";
+import { PenvError as PenvError8 } from "@penvhq/core";
+import { defineCommand as defineCommand6 } from "citty";
+var BLOCKING = /* @__PURE__ */ new Set(["config", "collision", "reserved"]);
+async function runFill(options) {
+  const validation = await runValidate({
+    cwd: options.cwd,
+    ...options.environment === void 0 ? {} : { environment: options.environment }
+  });
+  const environment = validation.environment;
+  const blockers = validation.issues.filter((issue) => BLOCKING.has(issue.kind));
+  if (blockers.length > 0) {
+    const detail = blockers.map(
+      (issue) => `  - ${issue.message}${issue.remedy === void 0 ? "" : ` (${issue.remedy})`}`
+    ).join("\n");
+    throw new PenvError8(
+      "FILL_BLOCKED",
+      `penv fill cannot run: environment ${environment} has ${blockers.length} unresolved configuration ${blockers.length === 1 ? "issue" : "issues"}:
+${detail}`,
+      `Fix these \u2014 \`penv validate\` reports them \u2014 then run \`penv fill\`. If you have not written a schema yet, declare the required parameters in ${PENV_DIR}/env.ts.`
+    );
+  }
+  const written = [];
+  const skipped2 = [];
+  const unreachable = [];
+  for (const drift of validation.drift.declared) {
+    if (drift.ref === void 0) {
+      unreachable.push({ subject: drift.subject, remedy: drift.remedy });
+      continue;
+    }
+    const ref = drift.ref;
+    const key = [...ref.namespace, ref.name].join("/");
+    const value = await options.ask({ parameter: key, environment, secret: false });
+    if (value === void 0 || value === "") {
+      skipped2.push(drift.subject);
+      continue;
+    }
+    const result2 = await runSet({ cwd: options.cwd, key, value, environment });
+    written.push({
+      parameter: drift.subject,
+      location: result2.location,
+      encrypted: result2.encrypted
+    });
+  }
+  return { environment, written, skipped: skipped2, unreachable };
+}
+function summaryLine(result2) {
+  const filled = result2.written.length;
+  if (filled === 0 && result2.skipped.length === 0 && result2.unreachable.length === 0) {
+    return `Nothing to fill for environment ${result2.environment}: every declared parameter has a value`;
+  }
+  const parts = [`${filled} written`];
+  if (result2.skipped.length > 0) {
+    parts.push(`${result2.skipped.length} skipped`);
+  }
+  if (result2.unreachable.length > 0) {
+    parts.push(`${result2.unreachable.length} unreachable`);
+  }
+  return `${parts.join(", ")} for environment ${result2.environment}`;
+}
+function renderFill(result2) {
+  const rows = result2.written.map((entry) => ({
+    glyph: CHECK,
+    label: "Wrote",
+    subject: `${PENV_DIR}/${entry.location}`,
+    // Meta decided the seal, not the answer, so the line says so — as `set` does.
+    ...entry.encrypted ? { detail: "encrypted, per the parameter's meta policy" } : {}
+  }));
+  for (const entry of result2.unreachable) {
+    rows.push({ glyph: WARN, label: "Unreachable", subject: entry.subject, detail: entry.remedy });
+  }
+  const lines = formatRows(rows);
+  lines.push(summaryLine(result2));
+  return lines;
+}
+var fillCommand = defineCommand6({
+  meta: {
+    name: "fill",
+    description: "Prompt for each declared parameter the tree has no value for"
+  },
+  args: {
+    env: { type: "string", description: "The environment to fill" }
+  },
+  run({ args }) {
+    return guard(async () => {
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const ask = (prompt) => rl.question(`${prompt.parameter} (${prompt.environment}): `);
+      try {
+        write(
+          renderFill(
+            await runFill({
+              cwd: process.cwd(),
+              ...args.env === void 0 ? {} : { environment: args.env },
+              ask
+            })
+          )
+        );
+      } finally {
+        rl.close();
+      }
+    });
+  }
+});
+
 // src/commands/generate.ts
 import { writeFileSync } from "fs";
 import { isAbsolute, relative, resolve as resolve3 } from "path";
 import {
   checkNameCollisions as checkNameCollisions3,
   effectiveMeta as effectiveMeta2,
-  PenvError as PenvError8,
+  PenvError as PenvError9,
   requireValue as requireValue2,
   serializeDotenv,
   variableName as variableName4
 } from "@penvhq/core";
-import { defineCommand as defineCommand6 } from "citty";
+import { defineCommand as defineCommand7 } from "citty";
 var DEFAULT_OUTPUT = ".env";
 function entriesFor(project, environment, allowDecrypt) {
   const keys = keySourceFor(project, environment);
@@ -1967,7 +2110,7 @@ function entriesFor(project, environment, allowDecrypt) {
     const winner = resolution.winner;
     if (winner?.file.encrypted === true) {
       if (!allowDecrypt) {
-        throw new PenvError8(
+        throw new PenvError9(
           "ENCRYPTED_VALUE_REFUSED",
           `Parameter ${resolution.parameter} for environment ${environment} resolves to the encrypted value file ${PENV_DIR}/${winner.location}, and \`penv generate\` writes plaintext`,
           `Re-run with \`--allow-decrypt\` to write the decrypted value into the artifact, or generate for an environment whose values are plaintext. The artifact is gitignored; a committed plaintext secret is a \`penv doctor\` failure.`
@@ -2025,7 +2168,7 @@ function renderGenerate(result2, cwd) {
   }
   return formatRows(rows);
 }
-var generateCommand = defineCommand6({
+var generateCommand = defineCommand7({
   meta: { name: "generate", description: "Write a standard .env artifact for deploy targets" },
   args: {
     env: { type: "string", description: "The environment to generate for" },
@@ -2050,8 +2193,8 @@ var generateCommand = defineCommand6({
 });
 
 // src/commands/get.ts
-import { PenvError as PenvError9, requireValue as requireValue3, resolveParameter } from "@penvhq/core";
-import { defineCommand as defineCommand7 } from "citty";
+import { PenvError as PenvError10, requireValue as requireValue3, resolveParameter } from "@penvhq/core";
+import { defineCommand as defineCommand8 } from "citty";
 async function runGet(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
@@ -2060,7 +2203,7 @@ async function runGet(options) {
   const resolution = await resolveParameter(ref, environment, project.provider, keys);
   const value = requireValue3(resolution, environment);
   if (value === void 0) {
-    throw new PenvError9(
+    throw new PenvError10(
       "PARAMETER_ABSENT",
       `Parameter ${resolution.parameter} resolves to no value for environment ${environment}`,
       `Set it with \`penv set ${options.key} --env ${environment}\`, or run \`penv get ${options.key} --env ${environment} --explain\` to see every file penv looked at.`
@@ -2110,7 +2253,7 @@ function renderExplain(explanation) {
     ...columns(rows).map((line) => `  ${line}`)
   ];
 }
-var getCommand = defineCommand7({
+var getCommand = defineCommand8({
   meta: { name: "get", description: "Read a parameter" },
   args: {
     key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
@@ -2145,7 +2288,7 @@ import {
   isReservedToken as isReservedToken3,
   loadConfigFrom as loadConfigFrom2,
   lookupEnvironment,
-  PenvError as PenvError11,
+  PenvError as PenvError12,
   parseDotenv,
   ReservedTokenError as ReservedTokenError3,
   refFromVariable,
@@ -2154,7 +2297,7 @@ import {
   UnknownEnvironmentError,
   variableName as variableName5
 } from "@penvhq/core";
-import { defineCommand as defineCommand9 } from "citty";
+import { defineCommand as defineCommand10 } from "citty";
 
 // src/detect.ts
 import { existsSync, readFileSync } from "fs";
@@ -2260,18 +2403,18 @@ function hasImportsBlock(cwd) {
 // src/commands/init.ts
 import { existsSync as existsSync2, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname3, join as join2, resolve as resolve4 } from "path";
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface2 } from "readline/promises";
 import {
   DEFAULT_SCHEMA_FILE as DEFAULT_SCHEMA_FILE2,
   isLegalEnvironmentName,
   loadConfigFrom,
-  PenvError as PenvError10,
+  PenvError as PenvError11,
   RESERVED_TOKENS,
   schemaFileOf as schemaFileOf2,
   schemaInsideTree,
   validateSchemaFile
 } from "@penvhq/core";
-import { defineCommand as defineCommand8 } from "citty";
+import { defineCommand as defineCommand9 } from "citty";
 var CONFIG_FILE = "penv.config.ts";
 var TSCONFIG_FILE = "tsconfig.json";
 var GITIGNORE_FILE = ".gitignore";
@@ -2309,7 +2452,7 @@ function suggestEnvironments(root) {
   return [...found].sort();
 }
 function emptyFlag(flag) {
-  return new PenvError10(
+  return new PenvError11(
     "INIT_FLAG_EMPTY",
     `\`--${flag}\` was given without a value`,
     flag === "schema" ? `Name the module that exports the schema, e.g. \`--schema src/env.ts\`, or drop the flag to use ${DEFAULT_SCHEMA_FILE2}.` : "Name the environment, e.g. `--env production`, or drop the flag to leave the whitelist empty and declare it in penv.config.ts."
@@ -2372,7 +2515,7 @@ function planInit(root, flags = {}) {
     throw emptyFlag("alias");
   }
   if (!ALIAS_NAME.test(alias)) {
-    throw new PenvError10(
+    throw new PenvError11(
       "INIT_ALIAS_INVALID",
       `\`${alias}\` is not an alias penv can write`,
       `An alias is \`@name\` \u2014 a tsconfig \`paths\` entry a bundler resolves \u2014 or \`#name\`, a package.json \`imports\` entry Node resolves itself. Those are the two things a module specifier can be that is not a package.`
@@ -2659,7 +2802,7 @@ ${objectIndent}${source.slice(close)}`;
 ${entryIndent}${member},${source.slice(open + 1)}`;
 }
 function shapeError(what, target, alias) {
-  return new PenvError10(
+  return new PenvError11(
     "TSCONFIG_SHAPE",
     `penv cannot add the \`${alias}\` path alias to tsconfig.json: ${what}`,
     `Add it by hand: \`{ "compilerOptions": { "paths": { "${alias}": ["${target}"] } } }\`.`
@@ -2853,7 +2996,7 @@ function renderInit(result2) {
   ];
 }
 async function askOnTty(plan2) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     return await promptForDecisions(plan2, {
       ask: (question) => rl.question(question),
@@ -2864,7 +3007,7 @@ async function askOnTty(plan2) {
     rl.close();
   }
 }
-var initCommand = defineCommand8({
+var initCommand = defineCommand9({
   meta: { name: "init", description: "Initialize a project (.penv/, env.ts, config, @env alias)" },
   args: {
     yes: {
@@ -2938,7 +3081,7 @@ function assertImportable(ref, variable) {
   if (!ref.name.includes(".")) {
     return;
   }
-  throw new PenvError11(
+  throw new PenvError12(
     "IMPORT_UNPARSEABLE_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, whose \`.\` would be read as a scope`,
     `Filenames are split on \`.\`. Rename ${variable} in the source file, then import it again.`
@@ -2957,7 +3100,7 @@ function assertRoundTrips(ref, variable, config) {
     return;
   }
   const generated = variableName5(ref, config);
-  throw new PenvError11(
+  throw new PenvError12(
     "IMPORT_LOSSY_NAME",
     `The variable ${variable} becomes the parameter \`${ref.name}\`, which regenerates as ${generated}`,
     `\`penv generate\` would write ${generated}, so anything reading \`process.env["${variable}"]\` would read \`undefined\`. Declare the name you want in the \`names\` block of penv.config.ts \u2014 \`names: { "${ref.name}": "${variable}" }\` \u2014 then import it again. Nothing was imported.`
@@ -3041,7 +3184,7 @@ function explicitEnvironment(options, source, config) {
   if (value.length > 0) {
     return value;
   }
-  throw new PenvError11(
+  throw new PenvError12(
     "IMPORT_ENV_FLAG_EMPTY",
     `\`--env\` for the import of ${source} names no environment`,
     `Pass a declared environment \u2014 ${config.environments.map((e) => `\`${e}\``).join(", ")} \u2014 e.g. \`--env production\`, or drop \`--env\` to import ${source} as the scope that has no environment. Nothing was imported.`
@@ -3051,7 +3194,7 @@ function assertEnvironmentAgrees(derived, explicit, source) {
   if (derived === void 0 || explicit === void 0 || derived === explicit) {
     return;
   }
-  throw new PenvError11(
+  throw new PenvError12(
     "IMPORT_ENV_CONFLICT",
     `The file ${source} is scoped to environment ${derived}, but \`--env ${explicit}\` names ${explicit}`,
     `Drop \`--env\` to import ${source} as ${derived}, pass \`--env ${derived}\` to say the same thing twice, or point \`penv import\` at the file that holds ${explicit}'s values. Nothing was imported.`
@@ -3095,7 +3238,7 @@ function importDotenv(options) {
   const cwd = resolve5(options.cwd);
   const file = isAbsolute2(options.file) ? options.file : resolve5(cwd, options.file);
   if (!existsSync3(file)) {
-    throw new PenvError11(
+    throw new PenvError12(
       "IMPORT_FILE_MISSING",
       `There is no file at ${file} to import`,
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
@@ -3208,7 +3351,7 @@ function renderImport(result2, validation) {
   lines.push("", "Done. .penv/ is now your source of truth.");
   return lines;
 }
-var importCommand = defineCommand9({
+var importCommand = defineCommand10({
   meta: {
     name: "import",
     description: "Import an existing dotenv file; it becomes the source of truth"
@@ -3240,8 +3383,8 @@ var importCommand = defineCommand9({
 
 // src/commands/key.ts
 import { randomBytes } from "crypto";
-import { KEY_BYTES, KEYCHAIN_SERVICE, PenvError as PenvError12 } from "@penvhq/core";
-import { defineCommand as defineCommand10 } from "citty";
+import { KEY_BYTES, KEYCHAIN_SERVICE, PenvError as PenvError13 } from "@penvhq/core";
+import { defineCommand as defineCommand11 } from "citty";
 
 // src/keychain.ts
 import { createRequire as createRequire2 } from "module";
@@ -3273,7 +3416,7 @@ function runKeyCreate(options) {
   const environment = targetEnvironment(project, options.environment);
   const declared = project.config.keys?.[environment];
   if (declared === void 0) {
-    throw new PenvError12(
+    throw new PenvError13(
       "KEY_SOURCE_UNDECLARED",
       `Environment ${environment} declares no key source, so penv does not know what a key for it would be`,
       `Add a \`keys\` entry to penv.config.ts \u2014 e.g. \`keys: { ${environment}: { source: "env", id: "${environment}" } }\` \u2014 then run this again.`
@@ -3287,14 +3430,14 @@ function runKeyCreate(options) {
       try {
         existing = keychain.getPassword(KEYCHAIN_SERVICE, declared.id);
       } catch (cause) {
-        throw new PenvError12(
+        throw new PenvError13(
           "KEYCHAIN_UNAVAILABLE",
           `penv could not read your OS keychain to check for an existing key \`${declared.id}\``,
           `Unlock your keychain and run this again. Original error: ${cause instanceof Error ? cause.message : String(cause)}`
         );
       }
       if (existing !== null) {
-        throw new PenvError12(
+        throw new PenvError13(
           "KEY_EXISTS",
           `Environment ${environment} already has a key \`${declared.id}\` in your OS keychain`,
           "Replacing it would orphan every value already sealed under it \u2014 they could never be decrypted again. Re-run with `--force` only if you are certain nothing is sealed under the current key."
@@ -3331,10 +3474,10 @@ function renderKeyCreate(result2) {
     "without it, and penv keeps no copy to fall back on."
   ];
 }
-var keyCommand = defineCommand10({
+var keyCommand = defineCommand11({
   meta: { name: "key", description: "Work with encryption keys" },
   subCommands: {
-    create: defineCommand10({
+    create: defineCommand11({
       meta: { name: "create", description: "Generate a key for an environment" },
       args: {
         env: { type: "string", description: "The environment the key is for" },
@@ -3362,7 +3505,7 @@ var keyCommand = defineCommand10({
 
 // src/commands/list.ts
 import { assertNever as assertNever3, resolveAll as resolveAll3, variableName as variableName6 } from "@penvhq/core";
-import { defineCommand as defineCommand11 } from "citty";
+import { defineCommand as defineCommand12 } from "citty";
 function scopeLabel2(scope) {
   switch (scope.kind) {
     case "environment":
@@ -3402,7 +3545,7 @@ function renderList(result2) {
   }
   return columns(result2.parameters.map((entry) => [entry.parameter, entry.scope, entry.variable]));
 }
-var listCommand = defineCommand11({
+var listCommand = defineCommand12({
   meta: { name: "list", description: "List parameters" },
   args: {
     env: { type: "string", description: "The environment to resolve against" },
@@ -3425,11 +3568,11 @@ import {
   formatMetaFile,
   formatValueFile as formatValueFile5,
   openValue as openValue4,
-  PenvError as PenvError13,
+  PenvError as PenvError14,
   parameterId as parameterId5,
   sealValue as sealValue3
 } from "@penvhq/core";
-import { defineCommand as defineCommand12 } from "citty";
+import { defineCommand as defineCommand13 } from "citty";
 function environmentOf2(file) {
   const scope = file.scope;
   return scope.kind === "environment" || scope.kind === "environment-local" ? scope.environment : void 0;
@@ -3444,7 +3587,7 @@ async function planFile(project, source, target, parameter) {
   }
   const environment = environmentOf2(source);
   if (environment === void 0) {
-    throw new PenvError13(
+    throw new PenvError14(
       "SECRET_SCOPE_AMBIGUOUS",
       `${PENV_DIR}/${formatValueFile5(source)} is encrypted at a scope that names no environment, so penv cannot tell which key would re-seal it`,
       "Keys are declared per environment in the `keys` block of penv.config.ts. Decrypt it with `penv decrypt`, move the parameter, then encrypt it again at its new address."
@@ -3453,7 +3596,7 @@ async function planFile(project, source, target, parameter) {
   const keys = keySourceFor(project, environment);
   const opened = openValue4(source, stored, keys);
   if (opened.kind === "failed") {
-    throw new PenvError13(
+    throw new PenvError14(
       "VALUE_UNDECRYPTABLE",
       `${PENV_DIR}/${formatValueFile5(source)} could not be decrypted, so penv cannot re-seal it at its new address: ${opened.failure.detail}`,
       "A sealed value is bound to the file it lives in, so moving it means opening it and sealing it again. Make the key available and run this again. Nothing has been moved."
@@ -3473,9 +3616,10 @@ function filesOf(all, ref) {
 async function runMove(options) {
   const project = openProject(options.cwd);
   const from = refFromKey(options.from, project.config);
+  assertWritableKey(options.to);
   const to = refFromKey(options.to, project.config);
   if (parameterId5(from) === parameterId5(to)) {
-    throw new PenvError13(
+    throw new PenvError14(
       "PARAMETER_UNCHANGED",
       `\`${options.from}\` and \`${options.to}\` are the same parameter`,
       "Name a different destination, e.g. `penv mv redis-password redis/password`."
@@ -3485,7 +3629,7 @@ async function runMove(options) {
   const sources = filesOf(all, from);
   const meta = await project.provider.readMeta(from);
   if (sources.length === 0 && meta === void 0) {
-    throw new PenvError13(
+    throw new PenvError14(
       "PARAMETER_ABSENT",
       `Parameter ${parameterId5(from)} has no value files and no meta, so there is nothing to move`,
       `\`penv list\` shows every parameter penv holds.`
@@ -3493,7 +3637,7 @@ async function runMove(options) {
   }
   const occupied2 = filesOf(all, to);
   if (occupied2.length > 0 || await project.provider.readMeta(to) !== void 0) {
-    throw new PenvError13(
+    throw new PenvError14(
       "PARAMETER_EXISTS",
       `Parameter ${parameterId5(to)} already exists, and penv will not merge two parameters into one`,
       `Remove or rename ${parameterId5(to)} first. \`penv get ${options.to} --explain\` shows every file it holds.`
@@ -3552,7 +3696,7 @@ function renderMove(result2) {
   );
   return lines;
 }
-var mvCommand = defineCommand12({
+var mvCommand = defineCommand13({
   meta: { name: "mv", description: "Rename a parameter, every scope and its meta at once" },
   args: {
     from: {
@@ -3574,7 +3718,7 @@ var mvCommand = defineCommand12({
 });
 
 // src/commands/pull.ts
-import { defineCommand as defineCommand13 } from "citty";
+import { defineCommand as defineCommand14 } from "citty";
 async function runPull(options) {
   const project = openProject(options.cwd);
   const environment = targetEnvironment(project, options.environment);
@@ -3631,7 +3775,7 @@ function renderPull(result2) {
     }
   ]);
 }
-var pullCommand = defineCommand13({
+var pullCommand = defineCommand14({
   meta: {
     name: "pull",
     description: "Materialise the local .penv tree from an environment's source-of-truth provider"
@@ -3652,7 +3796,7 @@ var pullCommand = defineCommand13({
 
 // src/commands/remove.ts
 import { formatValueFile as formatValueFile6 } from "@penvhq/core";
-import { defineCommand as defineCommand14 } from "citty";
+import { defineCommand as defineCommand15 } from "citty";
 async function runRemove(options) {
   const project = openProject(options.cwd);
   const ref = refFromKey(options.key);
@@ -3696,7 +3840,7 @@ function renderRemove(result2) {
   }));
   return formatRows(rows);
 }
-var removeCommand = defineCommand14({
+var removeCommand = defineCommand15({
   meta: { name: "remove", description: "Delete a parameter" },
   args: {
     key: { type: "positional", required: true, description: "The parameter, e.g. redis/password" },
@@ -3726,11 +3870,11 @@ var removeCommand = defineCommand14({
 import {
   beginRotation,
   completeRotation,
-  PenvError as PenvError14,
+  PenvError as PenvError15,
   retainsPrevious,
   rotationOf as rotationOf2
 } from "@penvhq/core";
-import { defineCommand as defineCommand15 } from "citty";
+import { defineCommand as defineCommand16 } from "citty";
 function rotatingFile(ref, environment) {
   return {
     namespace: ref.namespace,
@@ -3755,7 +3899,7 @@ async function writeRotatedValue(project, provider, ref, environment, value) {
 }
 function requireNewValue(value, phase, key) {
   if (value === void 0) {
-    throw new PenvError14(
+    throw new PenvError15(
       "ROTATION_NO_VALUE",
       `A ${phase} rotation of ${key} writes a new value, and none was given`,
       "Pass the new value as the argument \u2014 `penv rotate <key> <value>` \u2014 or pipe it in on stdin."
@@ -3765,7 +3909,7 @@ function requireNewValue(value, phase, key) {
 }
 function requireRetaining(provider, environment) {
   if (!retainsPrevious(provider)) {
-    throw new PenvError14(
+    throw new PenvError15(
       "ROTATION_NOT_RETAINING",
       `A dual-valid rotation needs the previous value to stay readable during the grace window, and the \`${provider.type}\` provider for environment ${environment} does not retain it`,
       "Point this environment at a provider that keeps prior versions (its `readPrevious` is what penv reads during the window), or, if a momentary overlap is not required, declare the parameter `atomic-cutover` in its meta and flip it in one step."
@@ -3782,7 +3926,7 @@ async function runRotate(options) {
   const before = await provider.readMeta(ref);
   const { mechanism } = rotationOf2(before, environment);
   if (mechanism === void 0) {
-    throw new PenvError14(
+    throw new PenvError15(
       "ROTATION_NO_MECHANISM",
       `Parameter ${options.key} declares no rotation mechanism for environment ${environment}, so penv does not know how to rotate it`,
       'Set `rotationMechanism` in the parameter\'s meta to `"dual-valid"` (a grace-window overlap) or `"atomic-cutover"` (a single flip), then run `penv rotate` again.'
@@ -3792,7 +3936,7 @@ async function runRotate(options) {
   const complete = options.complete === true;
   if (mechanism === "atomic-cutover") {
     if (begin || complete) {
-      throw new PenvError14(
+      throw new PenvError15(
         "ROTATION_MECHANISM_MISMATCH",
         `Parameter ${options.key} is atomic-cutover, which flips in one step, so \`--begin\`/\`--complete\` do not apply`,
         "Run `penv rotate <key> <value>` with no phase flag to flip it. `--begin`/`--complete` bracket a dual-valid grace window, which atomic-cutover has none of."
@@ -3806,7 +3950,7 @@ async function runRotate(options) {
   }
   const retaining = requireRetaining(provider, environment);
   if (begin === complete) {
-    throw new PenvError14(
+    throw new PenvError15(
       "ROTATION_PHASE_REQUIRED",
       `A dual-valid rotation of ${options.key} needs exactly one of \`--begin\` or \`--complete\``,
       "`--begin` writes the new value and opens the grace window; `--complete` closes it once every reader has moved to the new value. Run them in that order, one at a time."
@@ -3873,7 +4017,7 @@ function renderRotate(result2) {
     }
   ]);
 }
-var rotateCommand = defineCommand15({
+var rotateCommand = defineCommand16({
   meta: {
     name: "rotate",
     description: "Rotate a parameter's value by the mechanism its meta declares"
@@ -3912,7 +4056,7 @@ var rotateCommand = defineCommand15({
 import { existsSync as existsSync4, watch } from "fs";
 import { basename as basename2, dirname as dirname4, resolve as resolve6 } from "path";
 import { schemaFileOf as schemaFileOf4, schemaInsideTree as schemaInsideTree2 } from "@penvhq/core";
-import { defineCommand as defineCommand16 } from "citty";
+import { defineCommand as defineCommand17 } from "citty";
 var DEBOUNCE_MS = 100;
 function runWatch(options) {
   const project = openProject(options.cwd);
@@ -4089,7 +4233,7 @@ function renderDrift(drift, environment) {
   }
   return lines;
 }
-var watchCommand = defineCommand16({
+var watchCommand = defineCommand17({
   meta: {
     name: "watch",
     description: "Re-validate whenever .penv/ or penv.config.ts changes"
@@ -4128,7 +4272,7 @@ var watchCommand = defineCommand16({
 });
 
 // src/index.ts
-var main = defineCommand17({
+var main = defineCommand18({
   meta: {
     name: "penv",
     description: "Configuration that shares a data model with your production secret manager"
@@ -4139,6 +4283,7 @@ var main = defineCommand17({
     generate: generateCommand,
     get: getCommand,
     set: setCommand,
+    fill: fillCommand,
     mv: mvCommand,
     pull: pullCommand,
     push: pushCommand,
@@ -4164,6 +4309,7 @@ export {
   insertEnvAlias,
   main,
   renderDoctor,
+  renderFill,
   renderMove,
   renderPull,
   renderPush,
@@ -4173,6 +4319,7 @@ export {
   runDoctor,
   runEncrypt,
   runExplain,
+  runFill,
   runGenerate,
   runGet,
   runInit,