@penvhq/cli 0.9.4 → 0.9.5

package/dist/index.d.cts

@@ -57,7 +57,7 @@ declare function renderArtifactBuild(result: ArtifactBuildResult, cwd: string):
  * second kind.
  */
 type DoctorSeverity = "pass" | "warning" | "failure" | "unknown";
-type DoctorCheck = "schema" | "missing" | "declared" | "weak" | "unused" | "unscoped-fallback" | "plaintext-secret" | "public-secret" | "encryption" | "rotation-overdue" | "rotation-stuck" | "provider-value-drift" | "provider" | "projection-unreachable" | "projection-name-drift" | "projection-manual-edit" | "projection-value-drift" | "environment-flag-shadow" | "artifact-in-tree";
+type DoctorCheck = "schema" | "missing" | "declared" | "weak" | "unused" | "unscoped-fallback" | "secrecy-undeclared" | "plaintext-secret" | "public-secret" | "encryption" | "rotation-overdue" | "rotation-stuck" | "provider-value-drift" | "provider" | "projection-unreachable" | "projection-name-drift" | "projection-manual-edit" | "projection-value-drift" | "environment-flag-shadow" | "local-extension" | "artifact-in-tree";
 interface DoctorFinding {
     readonly check: DoctorCheck;
     readonly severity: DoctorSeverity;

package/dist/index.d.ts

@@ -57,7 +57,7 @@ declare function renderArtifactBuild(result: ArtifactBuildResult, cwd: string):
  * second kind.
  */
 type DoctorSeverity = "pass" | "warning" | "failure" | "unknown";
-type DoctorCheck = "schema" | "missing" | "declared" | "weak" | "unused" | "unscoped-fallback" | "plaintext-secret" | "public-secret" | "encryption" | "rotation-overdue" | "rotation-stuck" | "provider-value-drift" | "provider" | "projection-unreachable" | "projection-name-drift" | "projection-manual-edit" | "projection-value-drift" | "environment-flag-shadow" | "artifact-in-tree";
+type DoctorCheck = "schema" | "missing" | "declared" | "weak" | "unused" | "unscoped-fallback" | "secrecy-undeclared" | "plaintext-secret" | "public-secret" | "encryption" | "rotation-overdue" | "rotation-stuck" | "provider-value-drift" | "provider" | "projection-unreachable" | "projection-name-drift" | "projection-manual-edit" | "projection-value-drift" | "environment-flag-shadow" | "local-extension" | "artifact-in-tree";
 interface DoctorFinding {
     readonly check: DoctorCheck;
     readonly severity: DoctorSeverity;

package/dist/index.js

@@ -325,7 +325,7 @@ function installFailed(plan2) {
 }
 
 // src/project.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { dirname, join as join3 } from "path";
 import {
   assertMigrated,
@@ -406,10 +406,19 @@ function environmentFromShorthand(config, candidates, explicit) {
 }
 
 // src/registry.ts
+import { readFileSync as readFileSync2 } from "fs";
 import { createRequire } from "module";
 import { resolve } from "path";
 import { pathToFileURL } from "url";
-import { holdsProjection, PENV_DIR, PenvError as PenvError4, recordsDir } from "@penvhq/core";
+import {
+  holdsProjection,
+  LOCAL_EXTENSIONS_PATH,
+  localExtensionsFile,
+  PENV_DIR,
+  PenvError as PenvError4,
+  parseLocalExtensions,
+  recordsDir
+} from "@penvhq/core";
 import { createFilesystemProvider } from "@penvhq/provider-filesystem";
 import { createMockProvider } from "@penvhq/provider-mock";
 var PLUGIN_FACTORY_EXPORT = "penvProviderFactory";
@@ -478,16 +487,40 @@ async function loadPluginProvider(type, context) {
   assertSatisfiesContract(provider, type);
   return provider;
 }
-function assertProvidersRegistered(config, projectRoot) {
+function assertProvidersRegistered(config, projectRoot, options) {
+  const local = localExtensions(projectRoot);
+  const ci = options?.ci ?? isCi(process.env.CI);
   for (const [environment, provider] of Object.entries(config.providers)) {
     if (isProviderRegistered(provider.type)) {
       continue;
     }
+    if (ci && local.includes(provider.type)) {
+      throw localExtensionInCi(provider.type, environment);
+    }
     if (resolvePlugin(provider.type, projectRoot) === void 0) {
       throw unknownProvider(provider.type, environment);
     }
   }
 }
+function localExtensions(projectRoot) {
+  let text;
+  try {
+    text = readFileSync2(localExtensionsFile(projectRoot), "utf8");
+  } catch {
+    return [];
+  }
+  return parseLocalExtensions(text);
+}
+function isCi(value) {
+  return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+}
+function localExtensionInCi(type, environment) {
+  return new PenvError4(
+    "LOCAL_EXTENSION_IN_CI",
+    `The provider \`${type}\` for environment ${environment} is a local extension, and this is CI`,
+    `${LOCAL_EXTENSIONS_PATH} records it as a package this project develops, so nothing pins the bytes CI would run. Publish it and run \`penv add ${type}\` to pin a release.`
+  );
+}
 function resolvePlugin(specifier, fromDir) {
   try {
     const require2 = createRequire(resolve(fromDir, "noop.js"));
@@ -525,7 +558,7 @@ function unknownProvider(type, environment) {
   return new PenvError4(
     "UNKNOWN_PROVIDER",
     `The provider \`${type}\`${where} in penv.config.ts is not installed in this project`,
-    `Install it with \`npm i ${type}\` \u2014 a provider's \`type\` is the package penv imports. The CLI ships ${preinstalled} pre-installed.`
+    `A provider's \`type\` is the package penv imports, so it has to resolve from this project: install it with \`npm i ${type}\`, or \u2014 if this repository is the one that builds it \u2014 run \`penv add --local ${type}\` once it is a dependency of the root. The CLI ships ${preinstalled} pre-installed.`
   );
 }
 
@@ -558,7 +591,7 @@ function selfContainedSchemaModule(root, schemaFile) {
   if (!existsSync3(file)) {
     return void 0;
   }
-  const source = readFileSync2(file, "utf8");
+  const source = readFileSync3(file, "utf8");
   return source.includes("PenvSchemaShape") || source.includes("z.object") ? schemaFile : void 0;
 }
 function schemaShapeFileOf(project) {
@@ -794,10 +827,7 @@ function writeError(lines) {
 }
 function reportError(error) {
   if (error instanceof PenvError6) {
-    const suffix = error.remedy === void 0 ? void 0 : `
-  ${error.remedy}`;
-    const message = suffix !== void 0 && error.message.endsWith(suffix) ? error.message.slice(0, -suffix.length) : error.message;
-    process.stderr.write(`${err.red(CROSS)} ${message}
+    process.stderr.write(`${err.red(CROSS)} ${error.summary}
 `);
     if (error.remedy !== void 0) {
       process.stderr.write(`  ${err.cyan("\u2192")} ${error.remedy}
@@ -827,7 +857,7 @@ async function guard(run) {
 }
 
 // src/commands/run.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, watch } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, watch } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { basename, dirname as dirname2, join as join4, resolve as resolve2 } from "path";
 import {
@@ -1672,7 +1702,7 @@ function packageManifest(specifier, root) {
     const file = join4(directory, "package.json");
     if (existsSync4(file)) {
       try {
-        const parsed = JSON.parse(readFileSync3(file, "utf8"));
+        const parsed = JSON.parse(readFileSync4(file, "utf8"));
         if (isPlainObject(parsed) && parsed.name === specifier) {
           return parsed;
         }
@@ -1745,7 +1775,7 @@ function snapshotPath(host) {
 }
 function readSnapshot(path) {
   try {
-    return readFileSync3(path, "utf8");
+    return readFileSync4(path, "utf8");
   } catch {
     throw new PenvError8(
       "RUN_SNAPSHOT_MISSING",
@@ -2166,7 +2196,7 @@ import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync2,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync,
   rmSync,
   writeFileSync as writeFileSync2
@@ -2210,7 +2240,7 @@ function readCutover(root) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(file, "utf8"));
+    parsed = JSON.parse(readFileSync5(file, "utf8"));
   } catch {
     throw unreadable("it is not JSON");
   }
@@ -2357,7 +2387,7 @@ var cleanupCommand = defineCommand5({
 });
 
 // src/commands/doctor.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
 import { join as join6, relative as relative2 } from "path";
 import {
   ARTIFACT_BUILD_COMMAND as ARTIFACT_BUILD_COMMAND2,
@@ -2372,6 +2402,7 @@ import {
   isSecret as isSecret3,
   isStuck,
   openValue as openValue2,
+  RECORDS_PATH as RECORDS_PATH2,
   resolveAll as resolveAll2,
   rotationOf,
   tryParseDuration,
@@ -2827,6 +2858,7 @@ async function runDoctor(options) {
     findings.push(...unusedFindings(drift));
   }
   findings.push(...fallbackFindings(subjects, environment));
+  findings.push(...secrecyFindings(subjects, environment));
   findings.push(...plaintextSecretFindings(subjects, environment));
   findings.push(...publicSecretFindings(subjects, environment, project.config));
   findings.push(...encryptionFindings(subjects, environment));
@@ -2839,6 +2871,7 @@ async function runDoctor(options) {
   }
   findings.push(...await providerDriftFindings(project, environment, options.source));
   findings.push(...await projectionFindings(project, environment, options.projection));
+  findings.push(...localExtensionFindings(project));
   findings.push(...artifactFindings(project));
   findings.push({
     check: "provider",
@@ -2976,6 +3009,31 @@ function fallbackFindings(subjects, environment) {
     }
   ];
 }
+function secrecyFindings(subjects, environment) {
+  const undeclared = subjects.filter(
+    ({ meta }) => effectiveMeta(meta, environment).secret === void 0
+  );
+  if (undeclared.length === 0) {
+    return [
+      {
+        check: "secrecy-undeclared",
+        severity: "pass",
+        label: "Secrecy policy",
+        subject: subjects.length === 0 ? `no parameter resolves for ${environment}` : `every parameter declares whether it is secret for ${environment}`
+      }
+    ];
+  }
+  return [
+    {
+      check: "secrecy-undeclared",
+      severity: "unknown",
+      label: "Secrecy policy",
+      subject: `${undeclared.length} of ${subjects.length} declare neither way for ${environment}`,
+      detail: "penv was never told which of these values must be encrypted",
+      remedy: `declare \`"secret": true\` or \`"secret": false\` in a parameter's meta file, ${RECORDS_PATH2}/<name>.json`
+    }
+  ];
+}
 function plaintextSecretFindings(subjects, environment) {
   const secrets = subjects.filter(({ meta }) => isSecret3(meta, environment));
   const findings = [];
@@ -3296,6 +3354,29 @@ function scannableFiles(directory, out2) {
     }
   }
 }
+function localExtensionFindings(project) {
+  const names = localExtensions(project.root);
+  if (names.length === 0) {
+    return [
+      {
+        check: "local-extension",
+        severity: "pass",
+        label: "Extensions",
+        subject: "every extension this project names is pinned"
+      }
+    ];
+  }
+  return [
+    {
+      check: "local-extension",
+      severity: "unknown",
+      label: "Extensions",
+      subject: names.join(", "),
+      detail: "resolved from this project's node_modules \u2014 no release, no pinned bytes",
+      remedy: `publish it and run \`penv add ${names[0]}\` when this stops being a development path`
+    }
+  ];
+}
 function artifactFindings(project) {
   const files = [];
   scannableFiles(project.root, files);
@@ -3306,7 +3387,7 @@ function artifactFindings(project) {
       if (statSync2(file).size > ARTIFACT_SCAN_LIMIT) {
         continue;
       }
-      text = readFileSync5(file, "utf8");
+      text = readFileSync6(file, "utf8");
     } catch {
       continue;
     }
@@ -4281,7 +4362,7 @@ var getCommand = defineCommand12({
 });
 
 // src/commands/import.ts
-import { copyFileSync, existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { copyFileSync, existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
 import { basename as basename2, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve7 } from "path";
 import {
   assertNever as assertNever2,
@@ -4370,7 +4451,7 @@ function writeEntries(tree, entries, refs, scope) {
 }
 
 // src/detect.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
 import { join as join7 } from "path";
 import { DEFAULT_SCHEMA_FILE } from "@penvhq/core";
 var SIGNATURES = [
@@ -4388,7 +4469,7 @@ var SIGNATURES = [
 function exportsSchema(file) {
   let source;
   try {
-    source = readFileSync6(file, "utf8");
+    source = readFileSync7(file, "utf8");
   } catch {
     return false;
   }
@@ -4440,7 +4521,7 @@ function manifestOf2(cwd) {
   }
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync6(file, "utf8"));
+    manifest = JSON.parse(readFileSync7(file, "utf8"));
   } catch {
     return void 0;
   }
@@ -4535,7 +4616,7 @@ function draftFieldsAcross(sources, environments) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
 import { dirname as dirname6, join as join9, resolve as resolve6 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 import {
@@ -4547,7 +4628,7 @@ import {
   PenvError as PenvError18,
   parameterId as parameterId6,
   parseDotenv,
-  RECORDS_PATH as RECORDS_PATH2,
+  RECORDS_PATH as RECORDS_PATH3,
   RESERVED_TOKENS as RESERVED_TOKENS2,
   ROLLBACK_DOTENV_PATH as ROLLBACK_DOTENV_PATH3,
   renderStateGitignore,
@@ -4564,7 +4645,7 @@ import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   rmdirSync,
   statSync as statSync3,
   unlinkSync,
@@ -4586,7 +4667,7 @@ function record(path, files, dirs) {
     return;
   }
   if (stats.isFile()) {
-    files.set(path, readFileSync7(path));
+    files.set(path, readFileSync8(path));
   }
 }
 function captureScaffold(root, paths) {
@@ -5374,7 +5455,7 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
       text: `Created ${TSCONFIG_FILE} with the ${alias} path alias`
     };
   }
-  const source = readFileSync8(file, "utf8");
+  const source = readFileSync9(file, "utf8");
   const edit = imports ? insertImportsAlias(source, decisions.schemaFile, alias) : insertEnvAlias(source, decisions.schemaFile, alias);
   if (edit.conflict !== void 0) {
     return {
@@ -5401,7 +5482,7 @@ function writeTsconfigAlias(root, decisions = DEFAULT_DECISIONS) {
 function writeGitignore(root, decisions = DEFAULT_DECISIONS) {
   const file = join9(root, ...STATE_GITIGNORE_PATH.split("/"));
   const wanted = renderStateGitignore(configOf(decisions));
-  const existing = existsSync8(file) ? readFileSync8(file, "utf8") : void 0;
+  const existing = existsSync8(file) ? readFileSync9(file, "utf8") : void 0;
   if (existing === wanted) {
     return { target: "gitignore", action: "kept", text: `Kept ${STATE_GITIGNORE_PATH}` };
   }
@@ -5427,7 +5508,7 @@ function installedPenvVersion(root) {
     return void 0;
   }
   try {
-    const version = JSON.parse(readFileSync8(file, "utf8")).version;
+    const version = JSON.parse(readFileSync9(file, "utf8")).version;
     return typeof version === "string" ? version : void 0;
   } catch {
     return void 0;
@@ -5601,7 +5682,7 @@ function planCutover(input) {
   const diagnostics = [];
   let variables = 0;
   for (const file of selected) {
-    const parsed = parseDotenv(readFileSync8(join9(root, file.name), "utf8"));
+    const parsed = parseDotenv(readFileSync9(join9(root, file.name), "utf8"));
     const fileRefs = refsForEntries(parsed.entries, file.name, config);
     adopted.push({ file, entries: parsed.entries, refs: fileRefs, scope: scopeOf(file) });
     refs.push(...fileRefs);
@@ -5789,7 +5870,7 @@ function renderCutoverPlan(plan2) {
   ]);
   rows.push([
     `  ${out.dim("values")}`,
-    `${RECORDS_PATH2}/`,
+    `${RECORDS_PATH3}/`,
     out.dim(`\u2190 from ${plan2.variables} variables`)
   ]);
   rows.push([
@@ -5825,7 +5906,7 @@ function renderCutover(result2) {
     {
       glyph: CHECK,
       text: `Imported ${plan2.fields.length} parameters`,
-      note: `into ${RECORDS_PATH2}/`
+      note: `into ${RECORDS_PATH3}/`
     },
     { glyph: CHECK, text: `Validated ${result2.validated.join(", ")}` },
     {
@@ -5850,7 +5931,7 @@ function devScript(root) {
     return "dev";
   }
   try {
-    const scripts = JSON.parse(readFileSync8(file, "utf8")).scripts;
+    const scripts = JSON.parse(readFileSync9(file, "utf8")).scripts;
     if (scripts !== null && typeof scripts === "object" && !Array.isArray(scripts)) {
       const named = Object.keys(scripts);
       return ["dev", "start"].find((script) => named.includes(script)) ?? named[0] ?? "dev";
@@ -6084,7 +6165,7 @@ function runUndoAction(root, action) {
     ]),
     "",
     result2.missing.length === 0 ? `${out.green(CHECK)} ${out.bold("Undone.")} Your dotenv files are back exactly as they were, and ${CUTOVER_PATH3} is gone.` : `${out.yellow(WARN)} ${out.bold("Undone as far as penv could.")} Everything still in the bundle is back, and ${CUTOVER_PATH3} is gone.`,
-    `penv's records are still in ${RECORDS_PATH2}/ \u2014 nothing penv scaffolded is yours to lose.`
+    `penv's records are still in ${RECORDS_PATH3}/ \u2014 nothing penv scaffolded is yours to lose.`
   ]);
 }
 
@@ -6226,7 +6307,7 @@ function importDotenv(options) {
       "Point `penv import` at an existing dotenv file, e.g. `penv import .env`."
     );
   }
-  const parsed = parseDotenv2(readFileSync9(file, "utf8"));
+  const parsed = parseDotenv2(readFileSync10(file, "utf8"));
   const { config, decisions } = configInEffect(cwd, environmentNamed(file, options.environment));
   const source = displayPath3(cwd, file);
   const named = scopeFromFilename(file, config);
@@ -6497,7 +6578,7 @@ var keyCommand = defineCommand15({
 });
 
 // src/commands/list.ts
-import { assertNever as assertNever3, RECORDS_PATH as RECORDS_PATH3, resolveAll as resolveAll3, variableName as variableName8 } from "@penvhq/core";
+import { assertNever as assertNever3, RECORDS_PATH as RECORDS_PATH4, resolveAll as resolveAll3, variableName as variableName8 } from "@penvhq/core";
 import { defineCommand as defineCommand16 } from "citty";
 function scopeLabel2(scope) {
   switch (scope.kind) {
@@ -6541,7 +6622,7 @@ function paintScope(entry) {
 function renderList(result2) {
   if (result2.parameters.length === 0) {
     return [
-      `No parameters in ${RECORDS_PATH3}/ for environment ${result2.environment}.`,
+      `No parameters in ${RECORDS_PATH4}/ for environment ${result2.environment}.`,
       tip(`penv set <key> --env ${result2.environment}`)
     ];
   }
@@ -6580,7 +6661,7 @@ import {
   existsSync as existsSync10,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync as renameSync2,
   rmSync as rmSync2,
   writeFileSync as writeFileSync6
@@ -6592,7 +6673,7 @@ import {
   oldLayoutEntries,
   PENV_DIR as PENV_DIR3,
   PenvError as PenvError22,
-  RECORDS_PATH as RECORDS_PATH4,
+  RECORDS_PATH as RECORDS_PATH5,
   recordsDir as recordsDir3,
   renderStateGitignore as renderStateGitignore2,
   STATE_GITIGNORE_PATH as STATE_GITIGNORE_PATH2
@@ -6608,13 +6689,13 @@ function planMigrate(cwd) {
   if (collisions.length > 0) {
     throw new PenvError22(
       "HALF_MIGRATED",
-      `${describe2(collisions)} in both \`${PENV_DIR3}/\` and \`${RECORDS_PATH4}/\`, and penv cannot tell which copy is current`,
-      `Move what is left under \`${PENV_DIR3}/\` into \`${RECORDS_PATH4}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
+      `${describe2(collisions)} in both \`${PENV_DIR3}/\` and \`${RECORDS_PATH5}/\`, and penv cannot tell which copy is current`,
+      `Move what is left under \`${PENV_DIR3}/\` into \`${RECORDS_PATH5}/\` yourself, keeping the copy you want, then run \`penv validate\`.`
     );
   }
   const creates = [];
   if (entries.length > 0 && !existsSync10(tree)) {
-    creates.push(`${RECORDS_PATH4}/`);
+    creates.push(`${RECORDS_PATH5}/`);
   }
   if (readIfPresent(join10(root, ...STATE_GITIGNORE_PATH2.split("/"))) !== renderStateGitignore2(config)) {
     creates.push(STATE_GITIGNORE_PATH2);
@@ -6623,14 +6704,14 @@ function planMigrate(cwd) {
     root,
     moves: entries.map((entry) => ({
       from: `${PENV_DIR3}/${entry}`,
-      to: `${RECORDS_PATH4}/${entry}`
+      to: `${RECORDS_PATH5}/${entry}`
     })),
     creates,
     removes: existsSync10(join10(root, ...OLD_GITIGNORE.split("/"))) ? [OLD_GITIGNORE] : []
   };
 }
 function readIfPresent(file) {
-  return existsSync10(file) ? readFileSync10(file, "utf8") : void 0;
+  return existsSync10(file) ? readFileSync11(file, "utf8") : void 0;
 }
 function collidingEntries(entries, tree) {
   let held;
@@ -6678,7 +6759,7 @@ function runMigrate(options) {
 }
 function renderMigrate(result2) {
   if (result2.status === "current") {
-    return [`${out.green(CHECK)} Already on ${RECORDS_PATH4}/ \u2014 nothing to migrate.`];
+    return [`${out.green(CHECK)} Already on ${RECORDS_PATH5}/ \u2014 nothing to migrate.`];
   }
   const done = result2.status === "migrated";
   const glyph = done ? CHECK : "\u2192";
@@ -6719,7 +6800,7 @@ async function approveOnTty() {
 var migrateCommand = defineCommand17({
   meta: {
     name: "migrate",
-    description: `Move a project written under an earlier layout to ${RECORDS_PATH4}/`
+    description: `Move a project written under an earlier layout to ${RECORDS_PATH5}/`
   },
   args: {
     yes: { type: "boolean", description: "Apply the previewed move without asking" }