bwx 0.8.1 → 0.10.0

package/src/cli/commands/edit.ts

@@ -7,7 +7,7 @@ import { withSession } from "../../bw/session.ts";
 import { patchItem, bwEncode } from "../../bw/encoding.ts";
 import { generateSecret } from "../../bw/generate.ts";
 import { resolveFolderRef } from "../../bw/folders.ts";
-import { BwItemType } from "../../bw/types.ts";
+import { BwItemType, itemTypeLabel, type BwCard } from "../../bw/types.ts";
 import {
 	assertSingleStdinSource,
 	collect,
@@ -21,9 +21,18 @@ import {
 	TOTP_FAMILY,
 	type ItemTextInputs,
 } from "../input.ts";
+import {
+	assertCardIntent,
+	registerCardOptions,
+	registerCardRemovalOptions,
+	resolveCardPatch,
+	usedCardOnlyFlags,
+	type CardOptionInputs,
+	type CardRemovalInputs,
+} from "../card-options.ts";
 import { redactGeneratedPassword } from "./generate.ts";
 
-interface EditOptions extends ItemTextInputs {
+interface EditOptions extends ItemTextInputs, CardOptionInputs, CardRemovalInputs {
 	name?: string;
 	username?: string;
 	uri: string[];
@@ -52,8 +61,12 @@ export function registerEdit(program: Command): void {
 		.option("--name <name>", "New name")
 		.option("--username <user>", "New username");
 
-	registerItemTextOptions(command)
-		.option("--rm-totp", "Remove the stored TOTP secret")
+	registerItemTextOptions(command).option(
+		"--rm-totp",
+		"Remove the stored TOTP secret",
+	);
+	registerCardOptions(command);
+	registerCardRemovalOptions(command)
 		.option("--uri <url>", "Set URIs (repeatable, replaces all)", collect, [])
 		.option("--add-field <kv>", "Add/update field k=v", collect, [])
 		.option("--add-field-file <kv>", "Add/update field value from file k=path", collect, [])
@@ -87,8 +100,9 @@ export function registerEdit(program: Command): void {
 					}
 					encoded = bwEncode(stdinText);
 				} else {
-					assertLoginFlags(localOpts, current);
+					assertTypeFlags(localOpts, current);
 					assertTotpIntent(localOpts);
+					assertCardIntent(localOpts);
 
 					assertSingleStdinSource(
 						listExplicitStdinInputs({
@@ -119,6 +133,10 @@ export function registerEdit(program: Command): void {
 						password: textInputs.password,
 						totp: localOpts.rmTotp ? null : textInputs.totp,
 						uris: localOpts.uri.length > 0 ? localOpts.uri : undefined,
+						card:
+							current.type === BwItemType.Card
+								? resolveCardPatch(localOpts, textInputs, current.card as BwCard | null)
+								: undefined,
 						addFields,
 						rmFields: localOpts.rmField,
 						folderId: localOpts.folder
@@ -162,24 +180,29 @@ function assertTotpIntent(localOpts: EditOptions): void {
 }
 
 /**
- * Same trap as `create`: only a login item has somewhere to put a password, so
- * setting one on a note would be accepted and then quietly lost.
+ * Same trap as `create`: only a login has somewhere to put a password and only a
+ * card somewhere to put a card number, so setting either on another type would
+ * be accepted and then quietly lost.
  */
-function assertLoginFlags(
+function assertTypeFlags(
 	localOpts: EditOptions,
 	current: Record<string, unknown>,
 ): void {
-	if (current.type === BwItemType.Login) return;
-
-	const used = LOGIN_ONLY_FLAGS.filter(([key]) => Boolean(localOpts[key])).map(
+	const login = LOGIN_ONLY_FLAGS.filter(([key]) => Boolean(localOpts[key])).map(
 		([, flag]) => flag,
 	);
-	if (localOpts.uri.length > 0) used.push("--uri");
+	if (localOpts.uri.length > 0) login.push("--uri");
 
-	if (used.length === 0) return;
+	const required: Array<[number, string[]]> = [
+		[BwItemType.Login, login],
+		[BwItemType.Card, usedCardOnlyFlags(localOpts)],
+	];
 
-	throw new CliError(
-		`${used.join(", ")} ${used.length > 1 ? "need" : "needs"} a login item, but "${String(current.name)}" is not one.`,
-		ExitCode.BadArgs,
-	);
+	for (const [needed, used] of required) {
+		if (needed === current.type || used.length === 0) continue;
+		throw new CliError(
+			`${used.join(", ")} ${used.length > 1 ? "need" : "needs"} a ${itemTypeLabel(needed)} item, but "${String(current.name)}" is a ${itemTypeLabel(Number(current.type))}.`,
+			ExitCode.BadArgs,
+		);
+	}
 }

package/src/cli/commands/get.ts

@@ -1,9 +1,12 @@
 import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
 import { emitData, emitLog, emitRaw } from "../io.ts";
-import { BUILTIN_FIELDS, readItemField, readTotp, readTotpSecret } from "../../bw/fields.ts";
+import {
+	BUILTIN_FIELDS, readItemField, readTotp, readTotpSecret, type FieldRequest,
+} from "../../bw/fields.ts";
 import { CARD_FIELDS } from "../../bw/cards.ts";
 import { CliError, ExitCode } from "../errors.ts";
+import { parseFieldReference, REFERENCE_PREFIX } from "../../bw/references.ts";
 import type { GlobalOptions } from "../types.ts";
 
 /** Seconds left below which `--fresh` waits, when the flag is given bare. */
@@ -22,12 +25,12 @@ interface GetOptions {
 export function registerGet(program: Command): void {
 	program
 		.command("get")
-		.description("Get a field from a vault item (built-in or custom)")
+		.description("Get a field from a vault item or a discovered bwx:// reference")
 		.argument(
 			"<field>",
-			`Field: ${BUILTIN_FIELDS.join(" | ")} | <custom>. Card items also take: ${CARD_FIELDS.join(" | ")}`,
+			`Field or bwx:// ref: ${BUILTIN_FIELDS.join(" | ")} | <custom>. Card items also take: ${CARD_FIELDS.join(" | ")}`,
 		)
-		.argument("<item>", "Item name or ID")
+		.argument("[item]", "Item name or ID (omit when the field is a bwx:// reference)")
 		.option(
 			"--fresh [seconds]",
 			`Wait for the next TOTP window if fewer than N seconds remain (default ${DEFAULT_FRESH_SECONDS})`,
@@ -37,26 +40,28 @@ export function registerGet(program: Command): void {
 		.action(async function (
 			this: Command,
 			field: string,
-			item: string,
+			item: string | undefined,
 			localOpts: GetOptions,
 		) {
 			const opts = getGlobalOpts(this);
 			assertRawUsable(localOpts, opts);
+			const request = parseGetRequest(field, item);
 
-			if (field === "totp") {
-				await emitTotp(item, localOpts, opts);
+			if (request.field === "totp" && !request.options?.customOnly) {
+				await emitTotp(request.item, localOpts, opts, request.options?.exactItemId);
 				return;
 			}
 
-			assertTotpOnlyFlags(field, localOpts);
+			assertTotpOnlyFlags(request.field, localOpts);
 
-			const value = await readItemField(field, item, opts, {
+			const value = await readItemField(request.field, request.item, opts, {
+				...request.options,
 				verbatim: localOpts.raw,
 			});
 
 			// `item` is the one field that is itself JSON, so it is emitted as
 			// structure — except under `--raw`, which promised the bytes `bw` gave us.
-			if (field === "item" && !localOpts.raw) {
+			if (request.field === "item" && !request.options?.customOnly && !localOpts.raw) {
 				emitData(JSON.parse(value), opts);
 				return;
 			}
@@ -90,6 +95,20 @@ export function registerGet(program: Command): void {
 		});
 }
 
+function parseGetRequest(field: string, item: string | undefined): FieldRequest {
+	if (field.startsWith(REFERENCE_PREFIX)) {
+		const reference = parseFieldReference(field);
+		if (item !== undefined) {
+			throw new CliError("A field reference already contains the item ID; omit <item>.", ExitCode.BadArgs);
+		}
+		return reference;
+	}
+	if (item === undefined) {
+		throw new CliError("Expected get <field> <item> or get <ref>.", ExitCode.BadArgs);
+	}
+	return { field, item };
+}
+
 /**
  * Emits one field value. `--raw` writes it alone, so piping a secret into a
  * consumer that reads stdin literally does not append bwx's newline to it;
@@ -131,6 +150,7 @@ async function emitTotp(
 	item: string,
 	localOpts: GetOptions,
 	opts: GlobalOptions,
+	exactItemId = false,
 ): Promise<void> {
 	if (localOpts.seed) {
 		if (localOpts.fresh !== undefined) {
@@ -139,11 +159,12 @@ async function emitTotp(
 				ExitCode.BadArgs,
 			);
 		}
-		emitValue(await readTotpSecret(item, opts), localOpts, opts);
+		emitValue(await readTotpSecret(item, opts, exactItemId), localOpts, opts);
 		return;
 	}
 
 	const totp = await readTotp(item, opts, {
+		exactItemId,
 		minSecondsRemaining: parseFreshSeconds(localOpts.fresh),
 		onWait: (seconds) =>
 			emitLog(`Waiting ${seconds}s for a fresh code…`, opts),

package/src/cli/commands/run.ts

@@ -1,22 +1,21 @@
 import type { Command } from "commander";
 import { constants } from "node:os";
-import { readFields } from "../../bw/fields.ts";
+import { readFields, type FieldRequest } from "../../bw/fields.ts";
+import { parseFieldReference, REFERENCE_PREFIX } from "../../bw/references.ts";
 import { CliError, ExitCode } from "../errors.ts";
 import { collect } from "../input.ts";
 import { emitLog } from "../io.ts";
 import { getGlobalOpts } from "../program.ts";
 import type { GlobalOptions } from "../types.ts";
 
-/** `NAME=<field>:<item>` — one secret to place in the child's environment. */
-export interface EnvSpec {
+/** `NAME=<field>:<item>` or `NAME=<ref>` — one secret for the child's environment. */
+export interface EnvSpec extends FieldRequest {
 	name: string;
-	field: string;
-	item: string;
 }
 
 const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
-const SPEC_HINT = "Expected --env NAME=<field>:<item>, e.g. --env DB_PASS=password:'Prod DB'";
+const SPEC_HINT = "Expected --env NAME=<field>:<item> or NAME=<ref>, e.g. --env DB_PASS=password:'Prod DB'";
 
 export function registerRun(program: Command): void {
 	program
@@ -25,7 +24,7 @@ export function registerRun(program: Command): void {
 		.argument("<command...>", "Command to run — use -- before it if it takes its own flags")
 		.option(
 			"--env <spec>",
-			"Inject a secret as NAME=<field>:<item> (repeatable)",
+			"Inject a secret as NAME=<field>:<item> or NAME=<ref> (repeatable)",
 			collect,
 			[],
 		)
@@ -71,7 +70,8 @@ export function parseEnvSpecs(raws: string[]): EnvSpec[] {
  * Splits `NAME=<field>:<item>` on the first `=` and then the first `:`, so item
  * names may contain colons (`password:http://my.router`) while field names may not.
  * Fields resolve exactly as in `bwx get`: built-ins first, then card fields on a card
- * item, otherwise custom fields.
+ * item, otherwise custom fields. A bwx:// reference supplies an exact ID and an
+ * explicit field kind, bypassing the legacy colon-separated grammar.
  */
 export function parseEnvSpec(raw: string): EnvSpec {
 	const eq = raw.indexOf("=");
@@ -88,6 +88,9 @@ export function parseEnvSpec(raw: string): EnvSpec {
 	}
 
 	const ref = raw.slice(eq + 1);
+	if (ref.startsWith(REFERENCE_PREFIX)) {
+		return { name, ...parseFieldReference(ref) };
+	}
 	const colon = ref.indexOf(":");
 	if (colon <= 0 || colon === ref.length - 1) {
 		throw new CliError(`Invalid --env "${raw}". ${SPEC_HINT}`, ExitCode.BadArgs);
@@ -105,10 +108,7 @@ async function resolveSecrets(
 	specs: EnvSpec[],
 	opts: GlobalOptions,
 ): Promise<Record<string, string>> {
-	const values = await readFields(
-		specs.map((spec) => ({ field: spec.field, item: spec.item })),
-		opts,
-	);
+	const values = await readFields(specs, opts);
 
 	return Object.fromEntries(
 		specs.map((spec, index) => [spec.name, values[index]!]),
@@ -131,9 +131,10 @@ async function spawnChild(
 			stderr: "inherit",
 			env: { ...process.env, ...secrets },
 		});
-	} catch (err) {
+	} catch {
+		// Spawn diagnostics may quote the environment that already holds secrets.
 		throw new CliError(
-			`Failed to run "${command[0]}": ${err instanceof Error ? err.message : String(err)}`,
+			"Failed to run requested command. Check the executable and environment.",
 			ExitCode.BadArgs,
 		);
 	}

package/src/cli/commands/search.ts

@@ -10,6 +10,12 @@ import {
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
 import { resolveFolderFilter } from "../../bw/folders.ts";
+import { withSafeVaultErrors } from "../../bw/safe-errors.ts";
+import type { GlobalOptions } from "../types.ts";
+
+interface SearchOptions extends ItemListOptions {
+	folder?: string;
+}
 
 export function registerSearch(program: Command): void {
 	program
@@ -20,26 +26,37 @@ export function registerSearch(program: Command): void {
 		.option("--type <type>", "Filter by type: login|note|card|identity")
 		.option("--folder <name|id>", "Filter by folder name or ID ('none' for unfiled)")
 		.option("--limit <n>", "Limit results (0 for no limit)", parseLimit)
+		.option("--fields", "Discover available fields and reusable references (no values)")
 		.option("--full-items", "Emit complete item objects (includes secrets)")
 		.action(async function (
 			this: Command,
 			query: string,
-			localOpts: ItemListOptions & { folder?: string },
+			localOpts: SearchOptions,
 		) {
 			const opts = getGlobalOpts(this);
-
-			const args = ["list", "items", "--search", query];
-			if (localOpts.folder) {
-				args.push("--folderid", await resolveFolderFilter(localOpts.folder, opts));
+			if (localOpts.fields && localOpts.fullItems) {
+				throw new CliError("--fields and --full-items cannot be combined.", ExitCode.BadArgs);
 			}
+			const search = () => searchItems(query, localOpts, opts);
+			if (localOpts.fields) await withSafeVaultErrors("Could not discover fields", search);
+			else await search();
+		});
+}
 
-			const json = await withSession(opts, () => runBwOrThrow(args));
-			const filtered = filterItems(JSON.parse(json), localOpts);
-
-			if (filtered.total === 0) {
-				throw new CliError(`No items matching "${query}"`, ExitCode.NotFound);
-			}
+async function searchItems(
+	query: string,
+	localOpts: SearchOptions,
+	opts: GlobalOptions,
+): Promise<void> {
+	const args = ["list", "items", "--search", query];
+	if (localOpts.folder) {
+		args.push("--folderid", await resolveFolderFilter(localOpts.folder, opts));
+	}
 
-			writeItems(filtered, opts, localOpts);
-		});
+	const json = await withSession(opts, () => runBwOrThrow(args));
+	const filtered = filterItems(JSON.parse(json), localOpts);
+	if (filtered.total === 0) {
+		throw new CliError(`No items matching "${query}"`, ExitCode.NotFound);
+	}
+	writeItems(filtered, opts, localOpts);
 }

package/src/cli/input.ts

@@ -1,6 +1,7 @@
 import type { Command } from "commander";
 import { parseFieldFlag, type ParsedField } from "../bw/encoding.ts";
 import { normalizeTotpInput } from "../bw/totp.ts";
+import { normalizeCardNumber, normalizeCvv } from "../bw/card-input.ts";
 import { CliError, ExitCode } from "./errors.ts";
 
 export function collect(val: string, prev: string[]): string[] {
@@ -65,6 +66,16 @@ export interface ItemTextInputs {
 	totpStdin?: boolean;
 	totpFile?: string;
 	totpEnv?: string;
+	number?: string;
+	numberStdin?: boolean;
+	numberFile?: string;
+	numberEnv?: string;
+	cvv?: string;
+	cvvStdin?: boolean;
+	cvvFile?: string;
+	cvvEnv?: string;
+	/** `--no-validate` sets this false, skipping the card number's Luhn check. */
+	validate?: boolean;
 }
 
 export interface ResolvedItemTextInputs {
@@ -74,6 +85,9 @@ export interface ResolvedItemTextInputs {
 	passwordGenerated?: boolean;
 	/** Normalized and validated by {@link normalizeTotpInput} before it is stored. */
 	totp?: string;
+	/** Digits only, checked by {@link normalizeCardNumber}. */
+	number?: string;
+	cvv?: string;
 }
 
 export interface ExplicitStdinInputs extends ItemTextInputs {
@@ -81,6 +95,9 @@ export interface ExplicitStdinInputs extends ItemTextInputs {
 	fieldFiles?: string[];
 }
 
+/** The item type a value can only be stored on. */
+export type ItemTypeName = "login" | "card";
+
 /** Which slot of a {@link TextSource} a flag fills. */
 type TextSourceKind = "inline" | "stdin" | "file" | "env" | "generate";
 
@@ -89,29 +106,28 @@ interface TextInputFlag {
 	spec: string;
 	description: string;
 	/** The property commander derives from `spec`. */
-	key: keyof ItemTextInputs;
+	key: Exclude<keyof ItemTextInputs, "validate">;
 	kind: TextSourceKind;
 }
 
 /**
  * One value a caller can supply, and every flag that can supply it. Option
  * registration, the "choose only one source" error, the stdin-conflict check and
- * the login-only guard all read from here, so adding a source touches one table
+ * the item-type guards all read from here, so adding a source touches one table
  * rather than both write commands and three hand-kept lists.
  */
 export interface TextInputFamily {
 	/** Names the value in error messages. */
 	label: string;
 	flags: TextInputFlag[];
-	/** True when only a login item has anywhere to store the value. */
-	loginOnly: boolean;
+	/** The only item type with anywhere to store the value; unset means any. */
+	itemType?: ItemTypeName;
 	/** Whether empty is a legitimate value — it is, for notes. */
 	allowEmpty?: boolean;
 }
 
 const NOTES_FAMILY: TextInputFamily = {
 	label: "notes",
-	loginOnly: false,
 	allowEmpty: true,
 	flags: [
 		{
@@ -131,7 +147,7 @@ const NOTES_FAMILY: TextInputFamily = {
 
 const PASSWORD_FAMILY: TextInputFamily = {
 	label: "password",
-	loginOnly: true,
+	itemType: "login",
 	flags: [
 		{
 			spec: "--password <pass>",
@@ -168,7 +184,7 @@ const PASSWORD_FAMILY: TextInputFamily = {
 
 export const TOTP_FAMILY: TextInputFamily = {
 	label: "TOTP secret",
-	loginOnly: true,
+	itemType: "login",
 	flags: [
 		{
 			spec: "--totp <secret>",
@@ -197,7 +213,75 @@ export const TOTP_FAMILY: TextInputFamily = {
 	],
 };
 
-const ITEM_TEXT_FAMILIES = [NOTES_FAMILY, PASSWORD_FAMILY, TOTP_FAMILY];
+export const CARD_NUMBER_FAMILY: TextInputFamily = {
+	label: "card number",
+	itemType: "card",
+	flags: [
+		{
+			spec: "--number <number>",
+			description: "Card number (card items only)",
+			key: "number",
+			kind: "inline",
+		},
+		{
+			spec: "--number-stdin",
+			description: "Read the card number from stdin",
+			key: "numberStdin",
+			kind: "stdin",
+		},
+		{
+			spec: "--number-file <path>",
+			description: "Read the card number from file (use - for stdin)",
+			key: "numberFile",
+			kind: "file",
+		},
+		{
+			spec: "--number-env <name>",
+			description: "Read the card number from environment variable",
+			key: "numberEnv",
+			kind: "env",
+		},
+	],
+};
+
+export const CVV_FAMILY: TextInputFamily = {
+	label: "CVV",
+	itemType: "card",
+	flags: [
+		{
+			spec: "--cvv <cvv>",
+			description: "Card security code (card items only)",
+			key: "cvv",
+			kind: "inline",
+		},
+		{
+			spec: "--cvv-stdin",
+			description: "Read the CVV from stdin",
+			key: "cvvStdin",
+			kind: "stdin",
+		},
+		{
+			spec: "--cvv-file <path>",
+			description: "Read the CVV from file (use - for stdin)",
+			key: "cvvFile",
+			kind: "file",
+		},
+		{
+			spec: "--cvv-env <name>",
+			description: "Read the CVV from environment variable",
+			key: "cvvEnv",
+			kind: "env",
+		},
+	],
+};
+
+const ITEM_TEXT_FAMILIES = [
+	NOTES_FAMILY,
+	PASSWORD_FAMILY,
+	TOTP_FAMILY,
+	CARD_NUMBER_FAMILY,
+	CVV_FAMILY,
+];
 
 function flagName(spec: string): string {
 	return spec.split(" ")[0]!;
@@ -208,8 +292,8 @@ function sourceFlagNames(family: TextInputFamily): string[] {
 }
 
 /**
- * Registers every flag that can supply notes, a password, or a TOTP secret, plus
- * the length modifier `--password-generate` takes. `create` and `edit` accept the
+ * Registers every flag that can supply notes, a password, a TOTP secret, a card
+ * number, or a CVV, plus the length modifier `--password-generate` takes. `create` and `edit` accept the
  * identical set and {@link resolveItemTextInputs} is their only reader, so the
  * set is declared once here instead of per command.
  */
@@ -220,20 +304,24 @@ export function registerItemTextOptions(command: Command): Command {
 		}
 	}
 
-	return command.option(
-		"--generate-length <n>",
-		"Length for --password-generate",
-		(value) => Number.parseInt(value, 10),
-	);
+	return command
+		.option(
+			"--generate-length <n>",
+			"Length for --password-generate",
+			(value) => Number.parseInt(value, 10),
+		)
+		.option("--no-validate", "Skip the card number's Luhn check");
 }
 
 /**
- * The `[key, flag]` pairs a command must reject on a non-login item, because
- * `buildNewItem` and `patchItem` have nowhere to put them and would accept the
- * value only to drop it.
+ * The `[key, flag]` pairs a command must reject on an item of any other type,
+ * because `buildNewItem` and `patchItem` have nowhere to put them and would
+ * accept the value only to drop it.
  */
-export function loginOnlyTextInputFlags(): Array<[keyof ItemTextInputs, string]> {
-	return ITEM_TEXT_FAMILIES.filter((family) => family.loginOnly).flatMap(
+export function typeOnlyTextInputFlags(
+	itemType: ItemTypeName,
+): Array<[keyof ItemTextInputs, string]> {
+	return ITEM_TEXT_FAMILIES.filter((family) => family.itemType === itemType).flatMap(
 		(family) =>
 			family.flags.map(
 				(flag) =>
@@ -242,6 +330,10 @@ export function loginOnlyTextInputFlags(): Array<[keyof ItemTextInputs, string]>
 	);
 }
 
+export function loginOnlyTextInputFlags(): Array<[keyof ItemTextInputs, string]> {
+	return typeOnlyTextInputFlags("login");
+}
+
 /** The flags a caller actually used to supply this family's value. */
 export function listUsedSourceFlags(
 	family: TextInputFamily,
@@ -259,43 +351,15 @@ export async function resolveItemTextInputs(
 ): Promise<ResolvedItemTextInputs> {
 	assertSingleStdinSource(listExplicitStdinInputs(inputs));
 
-	const [notes, password, totp] = await Promise.all([
-		resolveOptionalTextSource(
-			{
-				label: NOTES_FAMILY.label,
-				inline: inputs.notes,
-				file: inputs.notesFile,
-				flagNames: sourceFlagNames(NOTES_FAMILY),
-				allowEmpty: NOTES_FAMILY.allowEmpty,
-			},
-			stdin,
-		),
-		resolveOptionalTextSource(
-			{
-				label: PASSWORD_FAMILY.label,
-				inline: inputs.password,
-				stdin: inputs.passwordStdin,
-				file: inputs.passwordFile,
-				env: inputs.passwordEnv,
-				generate:
-					inputs.passwordGenerate && generatePassword
-						? generatePassword
-						: undefined,
-				flagNames: sourceFlagNames(PASSWORD_FAMILY),
-			},
-			stdin,
-		),
+	const [notes, password, totp, number, cvv] = await Promise.all([
+		resolveOptionalTextSource(familySource(NOTES_FAMILY, inputs), stdin),
 		resolveOptionalTextSource(
-			{
-				label: TOTP_FAMILY.label,
-				inline: inputs.totp,
-				stdin: inputs.totpStdin,
-				file: inputs.totpFile,
-				env: inputs.totpEnv,
-				flagNames: sourceFlagNames(TOTP_FAMILY),
-			},
+			familySource(PASSWORD_FAMILY, inputs, generatePassword),
 			stdin,
 		),
+		resolveOptionalTextSource(familySource(TOTP_FAMILY, inputs), stdin),
+		resolveOptionalTextSource(familySource(CARD_NUMBER_FAMILY, inputs), stdin),
+		resolveOptionalTextSource(familySource(CVV_FAMILY, inputs), stdin),
 	]);
 
 	return {
@@ -305,9 +369,50 @@ export async function resolveItemTextInputs(
 		// Validated here rather than at the call sites so every write path gets
 		// the check: a malformed seed is only ever noticed at the login it breaks.
 		totp: totp === undefined ? undefined : normalizeTotpInput(totp),
+		number:
+			number === undefined
+				? undefined
+				: normalizeCardNumber(number, { luhn: inputs.validate !== false }),
+		cvv: cvv === undefined ? undefined : normalizeCvv(cvv),
 	};
 }
 
+/** The {@link TextSource} a family's flags describe, filled from parsed options. */
+function familySource(
+	family: TextInputFamily,
+	inputs: ItemTextInputs,
+	generate?: () => Promise<string>,
+): TextSource {
+	const source: TextSource = {
+		label: family.label,
+		flagNames: sourceFlagNames(family),
+		allowEmpty: family.allowEmpty,
+	};
+
+	for (const flag of family.flags) {
+		const value = inputs[flag.key];
+		switch (flag.kind) {
+			case "inline":
+				source.inline = value as string | undefined;
+				break;
+			case "stdin":
+				source.stdin = value as boolean | undefined;
+				break;
+			case "file":
+				source.file = value as string | undefined;
+				break;
+			case "env":
+				source.env = value as string | undefined;
+				break;
+			case "generate":
+				source.generate = value && generate ? generate : undefined;
+				break;
+		}
+	}
+
+	return source;
+}
+
 export function listExplicitStdinInputs(inputs: ExplicitStdinInputs): string[] {
 	const sources: string[] = [];