snowflake-cli-labs 2.8.1__py3-none-any.whl → 3.0.0__py3-none-any.whl

snowflake/cli/__about__.py

@@ -14,4 +14,4 @@
 
 from __future__ import annotations
 
-VERSION = "2.8.1"
+VERSION = "3.0.0"

snowflake/cli/{app → _app}/__main__.py

@@ -16,7 +16,7 @@ from __future__ import annotations
 
 import sys
 
-from snowflake.cli.app.cli_app import app_factory
+from snowflake.cli._app.cli_app import app_factory
 
 
 def main(*args):

snowflake/cli/{app → _app}/cli_app.py

@@ -25,24 +25,28 @@ import click
 import typer
 from click import Context
 from snowflake.cli import __about__
-from snowflake.cli.api import Api, api_provider
-from snowflake.cli.api.config import config_init
-from snowflake.cli.api.output.formats import OutputFormat
-from snowflake.cli.api.output.types import CollectionResult
-from snowflake.cli.api.secure_path import SecurePath
-from snowflake.cli.app.api_impl.plugin.plugin_config_provider_impl import (
+from snowflake.cli._app.api_impl.plugin.plugin_config_provider_impl import (
     PluginConfigProviderImpl,
 )
-from snowflake.cli.app.commands_registration.commands_registration_with_callbacks import (
+from snowflake.cli._app.commands_registration.commands_registration_with_callbacks import (
     CommandsRegistrationWithCallbacks,
 )
-from snowflake.cli.app.dev.commands_structure import generate_commands_structure
-from snowflake.cli.app.dev.docs.generator import generate_docs
-from snowflake.cli.app.dev.pycharm_remote_debug import (
+from snowflake.cli._app.dev.commands_structure import generate_commands_structure
+from snowflake.cli._app.dev.docs.generator import generate_docs
+from snowflake.cli._app.dev.pycharm_remote_debug import (
     setup_pycharm_remote_debugger_if_provided,
 )
-from snowflake.cli.app.main_typer import SnowCliMainTyper
-from snowflake.cli.app.printing import MessageResult, print_result
+from snowflake.cli._app.main_typer import SnowCliMainTyper
+from snowflake.cli._app.printing import MessageResult, print_result
+from snowflake.cli._app.version_check import (
+    get_new_version_msg,
+    show_new_version_banner_callback,
+)
+from snowflake.cli.api import Api, api_provider
+from snowflake.cli.api.config import config_init
+from snowflake.cli.api.output.formats import OutputFormat
+from snowflake.cli.api.output.types import CollectionResult
+from snowflake.cli.api.secure_path import SecurePath
 from snowflake.connector.config_manager import CONFIG_MANAGER
 
 log = logging.getLogger(__name__)
@@ -145,8 +149,13 @@ def _info_callback(value: bool):
 
 def app_factory() -> SnowCliMainTyper:
     app = SnowCliMainTyper()
+    new_version_msg = get_new_version_msg()
 
-    @app.callback(invoke_without_command=True)
+    @app.callback(
+        invoke_without_command=True,
+        epilog=new_version_msg,
+        result_callback=show_new_version_banner_callback(new_version_msg),
+    )
     def default(
         ctx: typer.Context,
         version: bool = typer.Option(

snowflake/cli/{app → _app}/commands_registration/builtin_plugins.py

@@ -12,30 +12,27 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from snowflake.cli.plugins.connection import plugin_spec as connection_plugin_spec
-from snowflake.cli.plugins.cortex import plugin_spec as cortex_plugin_spec
-from snowflake.cli.plugins.git import plugin_spec as git_plugin_spec
-from snowflake.cli.plugins.init import plugin_spec as init_plugin_spec
-from snowflake.cli.plugins.nativeapp import plugin_spec as nativeapp_plugin_spec
-from snowflake.cli.plugins.notebook import plugin_spec as notebook_plugin_spec
-from snowflake.cli.plugins.object import plugin_spec as object_plugin_spec
-
-# TODO 3.0: remove this import
-from snowflake.cli.plugins.object_stage_deprecated import (
-    plugin_spec as object_stage_deprecated_plugin_spec,
-)
-from snowflake.cli.plugins.snowpark import plugin_spec as snowpark_plugin_spec
-from snowflake.cli.plugins.spcs import plugin_spec as spcs_plugin_spec
-from snowflake.cli.plugins.sql import plugin_spec as sql_plugin_spec
-from snowflake.cli.plugins.stage import plugin_spec as stage_plugin_spec
-from snowflake.cli.plugins.streamlit import plugin_spec as streamlit_plugin_spec
-from snowflake.cli.plugins.workspace import plugin_spec as workspace_plugin_spec
+from snowflake.cli._plugins.connection import plugin_spec as connection_plugin_spec
+from snowflake.cli._plugins.cortex import plugin_spec as cortex_plugin_spec
+from snowflake.cli._plugins.git import plugin_spec as git_plugin_spec
+from snowflake.cli._plugins.helpers import plugin_spec as migrate_plugin_spec
+from snowflake.cli._plugins.init import plugin_spec as init_plugin_spec
+from snowflake.cli._plugins.nativeapp import plugin_spec as nativeapp_plugin_spec
+from snowflake.cli._plugins.notebook import plugin_spec as notebook_plugin_spec
+from snowflake.cli._plugins.object import plugin_spec as object_plugin_spec
+from snowflake.cli._plugins.snowpark import plugin_spec as snowpark_plugin_spec
+from snowflake.cli._plugins.spcs import plugin_spec as spcs_plugin_spec
+from snowflake.cli._plugins.sql import plugin_spec as sql_plugin_spec
+from snowflake.cli._plugins.stage import plugin_spec as stage_plugin_spec
+from snowflake.cli._plugins.streamlit import plugin_spec as streamlit_plugin_spec
+from snowflake.cli._plugins.workspace import plugin_spec as workspace_plugin_spec
 
 
 # plugin name to plugin spec
 def get_builtin_plugin_name_to_plugin_spec():
     plugin_specs = {
         "connection": connection_plugin_spec,
+        "helpers": migrate_plugin_spec,
         "spcs": spcs_plugin_spec,
         "nativeapp": nativeapp_plugin_spec,
         "object": object_plugin_spec,
@@ -45,7 +42,6 @@ def get_builtin_plugin_name_to_plugin_spec():
         "streamlit": streamlit_plugin_spec,
         "git": git_plugin_spec,
         "notebook": notebook_plugin_spec,
-        "object-stage-deprecated": object_stage_deprecated_plugin_spec,
         "cortex": cortex_plugin_spec,
         "init": init_plugin_spec,
         "workspace": workspace_plugin_spec,

snowflake/cli/{app → _app}/commands_registration/command_plugins_loader.py

@@ -18,21 +18,21 @@ import logging
 from typing import Dict, List, Optional
 
 import pluggy
-from snowflake.cli.api.plugins.command import (
-    SNOWCLI_COMMAND_PLUGIN_NAMESPACE,
-    CommandPath,
-    CommandSpec,
-    plugin_hook_specs,
-)
-from snowflake.cli.app.commands_registration import (
+from snowflake.cli._app.commands_registration import (
     LoadedBuiltInCommandPlugin,
     LoadedCommandPlugin,
     LoadedExternalCommandPlugin,
 )
-from snowflake.cli.app.commands_registration.builtin_plugins import (
+from snowflake.cli._app.commands_registration.builtin_plugins import (
     get_builtin_plugin_name_to_plugin_spec,
 )
-from snowflake.cli.app.commands_registration.exception_logging import exception_logging
+from snowflake.cli._app.commands_registration.exception_logging import exception_logging
+from snowflake.cli.api.plugins.command import (
+    SNOWCLI_COMMAND_PLUGIN_NAMESPACE,
+    CommandPath,
+    CommandSpec,
+    plugin_hook_specs,
+)
 
 log = logging.getLogger(__name__)
 log_exception = exception_logging(log)

snowflake/cli/{app → _app}/commands_registration/commands_registration_with_callbacks.py

@@ -17,15 +17,15 @@ from __future__ import annotations
 from dataclasses import dataclass
 from typing import Callable, List
 
-from snowflake.cli.api.plugins.plugin_config import PluginConfigProvider
-from snowflake.cli.app.commands_registration.command_plugins_loader import (
+from snowflake.cli._app.commands_registration.command_plugins_loader import (
     load_builtin_and_external_command_plugins,
     load_only_builtin_command_plugins,
 )
-from snowflake.cli.app.commands_registration.threadsafe import ThreadsafeCounter
-from snowflake.cli.app.commands_registration.typer_registration import (
+from snowflake.cli._app.commands_registration.threadsafe import ThreadsafeCounter
+from snowflake.cli._app.commands_registration.typer_registration import (
     register_commands_from_plugins,
 )
+from snowflake.cli.api.plugins.plugin_config import PluginConfigProvider
 
 
 @dataclass

snowflake/cli/{app → _app}/commands_registration/exception_logging.py

@@ -15,12 +15,12 @@
 from logging import Logger
 from typing import Callable
 
-from snowflake.cli.api.cli_global_context import cli_context
+from snowflake.cli.api.cli_global_context import get_cli_context
 
 
 def exception_logging(logger: Logger) -> Callable[[str, Exception], None]:
     def log_error(msg: str, exception: Exception) -> None:
-        exc_info = exception if cli_context.enable_tracebacks else None
+        exc_info = exception if get_cli_context().enable_tracebacks else None
         logger.error(msg=msg, exc_info=exc_info)
 
     return log_error

snowflake/cli/{app → _app}/commands_registration/typer_registration.py

@@ -18,9 +18,9 @@ import logging
 from typing import List
 
 import click
+from snowflake.cli._app.commands_registration import LoadedCommandPlugin
+from snowflake.cli._app.commands_registration.exception_logging import exception_logging
 from snowflake.cli.api.plugins.command import CommandSpec, CommandType
-from snowflake.cli.app.commands_registration import LoadedCommandPlugin
-from snowflake.cli.app.commands_registration.exception_logging import exception_logging
 from typer.core import TyperGroup
 
 log = logging.getLogger(__name__)

snowflake/cli/{app → _app}/dev/docs/commands_docs_generator.py

@@ -15,11 +15,11 @@
 from __future__ import annotations
 
 import logging
-from typing import List, Optional
+from typing import Any, List, Optional
 
 from click import Command
+from snowflake.cli._app.dev.docs.template_utils import get_template_environment
 from snowflake.cli.api.secure_path import SecurePath
-from snowflake.cli.app.dev.docs.template_utils import get_template_environment
 from typer.core import TyperArgument
 
 log = logging.getLogger(__name__)
@@ -86,15 +86,33 @@ def _render_command_usage(
     # Included files, which these are, need to use the .txt extension.
     file_path = root / f"usage-{command_name}.txt"
     log.info("Creating %s", file_path)
+    command_help_params = _split_docstring(command.help)
+    template_params = {
+        "name": command_name,
+        "options": options,
+        "arguments": arguments,
+        "path": path,
+    }
     with file_path.open("w+") as fh:
-        fh.write(
-            template.render(
-                {
-                    "help": command.help,
-                    "name": command_name,
-                    "options": options,
-                    "arguments": arguments,
-                    "path": path,
-                }
-            )
+        fh.write(template.render(command_help_params | template_params))
+
+
+def _split_docstring(command_help: Optional[str]) -> dict[str, Any]:
+    if command_help is None:
+        return {}
+
+    split_command_help = command_help.split("## ")
+
+    if len(split_command_help) == 1:
+        return {"help": split_command_help[0]}
+
+    additional_sections = []
+    for section in split_command_help[1:]:
+        lines = section.split("\n")
+        additional_sections.append(
+            {"title": lines[0], "content": "\n".join(lines[1:]).strip()}
         )
+    return {
+        "help": split_command_help[0],
+        "additional_sections": additional_sections,
+    }

snowflake/cli/{app → _app}/dev/docs/generator.py

@@ -17,11 +17,11 @@ from __future__ import annotations
 import logging
 
 from click import Command
-from snowflake.cli.api.secure_path import SecurePath
-from snowflake.cli.app.dev.docs.commands_docs_generator import generate_command_docs
-from snowflake.cli.app.dev.docs.project_definition_docs_generator import (
+from snowflake.cli._app.dev.docs.commands_docs_generator import generate_command_docs
+from snowflake.cli._app.dev.docs.project_definition_docs_generator import (
     generate_project_definition_docs,
 )
+from snowflake.cli.api.secure_path import SecurePath
 
 log = logging.getLogger(__name__)
 

snowflake/cli/{app → _app}/dev/docs/project_definition_docs_generator.py

@@ -18,12 +18,12 @@ import logging
 from typing import Any, Dict
 
 from pydantic.json_schema import model_json_schema
-from snowflake.cli.api.project.schemas.project_definition import DefinitionV11
-from snowflake.cli.api.secure_path import SecurePath
-from snowflake.cli.app.dev.docs.project_definition_generate_json_schema import (
+from snowflake.cli._app.dev.docs.project_definition_generate_json_schema import (
     ProjectDefinitionGenerateJsonSchema,
 )
-from snowflake.cli.app.dev.docs.template_utils import get_template_environment
+from snowflake.cli._app.dev.docs.template_utils import get_template_environment
+from snowflake.cli.api.project.schemas.project_definition import DefinitionV11
+from snowflake.cli.api.secure_path import SecurePath
 
 log = logging.getLogger(__name__)
 

snowflake/cli/{app → _app}/dev/docs/templates/usage.rst.jinja2

@@ -1,4 +1,4 @@
-{{ help | replace("`", "``") }}
+{{ help | replace("`", "``") | replace("\n", " ") }}
 
 Syntax
 ===============================================================================
@@ -26,7 +26,7 @@ Arguments
         {{ param.make_metavar().replace("[", "").replace("]", "").lower() }}
     {%- endif -%}
     {{ '}' }}`
-{% if param.help %}{{ "  " + param.help | replace("`", "``") }}{% if param.help[-1] != '.' %}.{% endif %}{% else %}  TBD{% endif %}
+{% if param.help %}{{ "  " + param.help | replace("`", "``") | replace("\n", " ") }}{% if param.help[-1] != '.' %}.{% endif %}{% if param.default %} Default: {{ param.default }}.{% endif %}{% else %}  TBD{% endif %}
 {% endfor %}
 {% else %}
 
@@ -48,10 +48,20 @@ Options
         {%- if param.type.name != "choice" %}{{ ' {' }}{% else %} {% endif %}{{ param.make_metavar() }}{% if param.type.name != "choice" %}{{ '}' }}
         {%- endif %}
     {%- endif %}`
-{% if param.help %}{{ "  " + param.help | replace("`", "``") }}{% if param.help[-1] != '.' %}.{% endif %}{% else %}  TBD{% endif %}
-{% endfor %}
+{% if param.help %}{{ "  " + param.help | replace("`", "``") | replace("\n", " ") }}{% if param.help[-1] != '.' %}.{% endif %}{% if param.default is not none %} Default: {{ param.default }}.{% endif %}{% else %}  TBD{% endif %}
+{% endfor -%}
 {% else %}
 
 None
 
 {% endif -%}
+
+{%- if additional_sections %}
+..
+{%- for section in additional_sections %}
+  {{ section.title }}
+  ===============================================================================
+
+  {{ section.content | indent(2) }}
+{% endfor %}
+{% endif %}

snowflake/cli/{app → _app}/main_typer.py

@@ -17,13 +17,13 @@ from __future__ import annotations
 import sys
 
 import typer
-from snowflake.cli.api.cli_global_context import cli_context
+from snowflake.cli.api.cli_global_context import get_cli_context
 from snowflake.cli.api.commands.flags import DEFAULT_CONTEXT_SETTINGS, DebugOption
 from snowflake.cli.api.console import cli_console
 
 
 def _handle_exception(exception: Exception):
-    if cli_context.enable_tracebacks:
+    if get_cli_context().enable_tracebacks:
         raise exception
     else:
         cli_console.warning(

snowflake/cli/{app → _app}/printing.py

@@ -26,7 +26,7 @@ from rich import box, get_console
 from rich import print as rich_print
 from rich.live import Live
 from rich.table import Table
-from snowflake.cli.api.cli_global_context import cli_context
+from snowflake.cli.api.cli_global_context import get_cli_context
 from snowflake.cli.api.output.formats import OutputFormat
 from snowflake.cli.api.output.types import (
     CollectionResult,
@@ -65,7 +65,7 @@ class CustomJSONEncoder(JSONEncoder):
 
 
 def _get_format_type() -> OutputFormat:
-    output_format = cli_context.output_format
+    output_format = get_cli_context().output_format
     if output_format:
         return output_format
     return OutputFormat.TABLE

snowflake/cli/_app/secret.py

@@ -0,0 +1,9 @@
+class SecretType:
+    def __init__(self, value):
+        self.value = value
+
+    def __repr__(self):
+        return "SecretType(***)"
+
+    def __str___(self):
+        return "***"

snowflake/cli/{app → _app}/snow_connector.py

@@ -21,11 +21,14 @@ from typing import Dict, Optional
 
 import snowflake.connector
 from click.exceptions import ClickException
-from snowflake.cli.api.cli_global_context import cli_context
+from snowflake.cli._app.constants import (
+    PARAM_APPLICATION_NAME,
+)
+from snowflake.cli._app.secret import SecretType
+from snowflake.cli._app.telemetry import command_info
 from snowflake.cli.api.config import (
     get_connection_dict,
-    get_default_connection_dict,
-    get_default_connection_name,
+    get_env_value,
 )
 from snowflake.cli.api.constants import DEFAULT_SIZE_LIMIT_MB
 from snowflake.cli.api.exceptions import (
@@ -33,10 +36,6 @@ from snowflake.cli.api.exceptions import (
     SnowflakeConnectionError,
 )
 from snowflake.cli.api.secure_path import SecurePath
-from snowflake.cli.app.constants import (
-    PARAM_APPLICATION_NAME,
-)
-from snowflake.cli.app.telemetry import command_info
 from snowflake.connector import SnowflakeConnection
 from snowflake.connector.errors import DatabaseError, ForbiddenError
 
@@ -46,6 +45,33 @@ log = logging.getLogger(__name__)
 ENCRYPTED_PKCS8_PK_HEADER = b"-----BEGIN ENCRYPTED PRIVATE KEY-----"
 UNENCRYPTED_PKCS8_PK_HEADER = b"-----BEGIN PRIVATE KEY-----"
 
+# connection keys that can be set using SNOWFLAKE_* env vars
+SUPPORTED_ENV_OVERRIDES = [
+    "account",
+    "user",
+    "password",
+    "authenticator",
+    "private_key_file",
+    "private_key_path",
+    "database",
+    "schema",
+    "role",
+    "warehouse",
+    "session_token",
+    "master_token",
+    "token_file_path",
+]
+
+# mapping of found key -> key to set
+CONNECTION_KEY_ALIASES = {"private_key_path": "private_key_file"}
+
+
+def _resolve_alias(key_or_alias: str):
+    """
+    Given the key of an override / env var, what key should it be set as in the connection parameters?
+    """
+    return CONNECTION_KEY_ALIASES.get(key_or_alias, key_or_alias)
+
 
 def connect_to_snowflake(
     temporary_connection: bool = False,
@@ -58,6 +84,10 @@ def connect_to_snowflake(
 ) -> SnowflakeConnection:
     if temporary_connection and connection_name:
         raise ClickException("Can't use connection name and temporary connection.")
+    elif not temporary_connection and not connection_name:
+        raise ClickException(
+            "One of connection name or temporary connection is required."
+        )
 
     using_session_token = (
         "session_token" in overrides and overrides["session_token"] is not None
@@ -70,36 +100,33 @@ def connect_to_snowflake(
     )
 
     if connection_name:
-        connection_parameters = get_connection_dict(connection_name)
+        connection_parameters = {
+            _resolve_alias(k): v
+            for k, v in get_connection_dict(connection_name).items()
+        }
     elif temporary_connection:
         connection_parameters = {}  # we will apply overrides in next step
-    else:
-        connection_parameters = get_default_connection_dict()
-        cli_context.connection_context.set_connection_name(
-            get_default_connection_name()
-        )
 
     # Apply overrides to connection details
+    # (1) Command line override case
     for key, value in overrides.items():
-        # Command line override case
-        if value:
-            connection_parameters[key] = value
-            continue
+        if value is not None:
+            connection_parameters[_resolve_alias(key)] = value
 
-        # Generic environment variable case, apply only if value not passed via flag or connection variable
-        generic_env_value = os.environ.get(f"SNOWFLAKE_{key}".upper())
-        if key not in connection_parameters and generic_env_value:
-            connection_parameters[key] = generic_env_value
-            continue
+    # (2) Generic environment variable case
+    # ... apply only if value not passed via flag or connection variable
+    for key in SUPPORTED_ENV_OVERRIDES:
+        generic_env_value = get_env_value(key=key)
+        connection_key = _resolve_alias(key)
+        if connection_key not in connection_parameters and generic_env_value:
+            connection_parameters[connection_key] = generic_env_value
 
     # Clean up connection params
     connection_parameters = {
         k: v for k, v in connection_parameters.items() if v is not None
     }
 
-    connection_parameters = update_connection_details_with_private_key(
-        connection_parameters
-    )
+    update_connection_details_with_private_key(connection_parameters)
 
     if mfa_passcode:
         connection_parameters["passcode"] = mfa_passcode
@@ -164,18 +191,45 @@ def _raise_errors_related_to_session_token(
 
 
 def update_connection_details_with_private_key(connection_parameters: Dict):
-    if "private_key_path" in connection_parameters:
-        if connection_parameters.get("authenticator") == "SNOWFLAKE_JWT":
-            private_key = _load_pem_to_der(connection_parameters["private_key_path"])
-            connection_parameters["private_key"] = private_key
-            del connection_parameters["private_key_path"]
-        else:
-            raise ClickException(
-                "Private Key authentication requires authenticator set to SNOWFLAKE_JWT"
-            )
+    if "private_key_file" in connection_parameters:
+        _load_private_key(connection_parameters, "private_key_file")
+    elif "private_key_path" in connection_parameters:
+        _load_private_key(connection_parameters, "private_key_path")
+    elif "private_key_raw" in connection_parameters:
+        _load_private_key_from_parameters(connection_parameters, "private_key_raw")
     return connection_parameters
 
 
+def _load_private_key(connection_parameters: Dict, private_key_var_name: str) -> None:
+    if connection_parameters.get("authenticator") == "SNOWFLAKE_JWT":
+        private_key_pem = _load_pem_from_file(
+            connection_parameters[private_key_var_name]
+        )
+        private_key = _load_pem_to_der(private_key_pem)
+        connection_parameters["private_key"] = private_key.value
+        del connection_parameters[private_key_var_name]
+    else:
+        raise ClickException(
+            "Private Key authentication requires authenticator set to SNOWFLAKE_JWT"
+        )
+
+
+def _load_private_key_from_parameters(
+    connection_parameters: Dict, private_key_var_name: str
+) -> None:
+    if connection_parameters.get("authenticator") == "SNOWFLAKE_JWT":
+        private_key_pem = _load_pem_from_parameters(
+            connection_parameters[private_key_var_name]
+        )
+        private_key = _load_pem_to_der(private_key_pem)
+        connection_parameters["private_key"] = private_key.value
+        del connection_parameters[private_key_var_name]
+    else:
+        raise ClickException(
+            "Private Key authentication requires authenticator set to SNOWFLAKE_JWT"
+        )
+
+
 def _update_connection_application_name(connection_parameters: Dict):
     """Update version and name of app handling connection."""
     connection_application_params = {
@@ -184,41 +238,49 @@ def _update_connection_application_name(connection_parameters: Dict):
     connection_parameters.update(connection_application_params)
 
 
-def _load_pem_to_der(private_key_path: str) -> bytes:
+def _load_pem_from_file(private_key_file: str) -> SecretType:
+    with SecurePath(private_key_file).open(
+        "rb", read_file_limit_mb=DEFAULT_SIZE_LIMIT_MB
+    ) as f:
+        private_key_pem = SecretType(f.read())
+    return private_key_pem
+
+
+def _load_pem_from_parameters(private_key_raw: str) -> SecretType:
+    return SecretType(private_key_raw.encode("utf-8"))
+
+
+def _load_pem_to_der(private_key_pem: SecretType) -> SecretType:
     """
     Given a private key file path (in PEM format), decode key data into DER
     format
     """
-
-    with SecurePath(private_key_path).open(
-        "rb", read_file_limit_mb=DEFAULT_SIZE_LIMIT_MB
-    ) as f:
-        private_key_pem = f.read()
-
-    private_key_passphrase = os.getenv("PRIVATE_KEY_PASSPHRASE", None)
+    private_key_passphrase = SecretType(os.getenv("PRIVATE_KEY_PASSPHRASE", None))
     if (
-        private_key_pem.startswith(ENCRYPTED_PKCS8_PK_HEADER)
-        and private_key_passphrase is None
+        private_key_pem.value.startswith(ENCRYPTED_PKCS8_PK_HEADER)
+        and private_key_passphrase.value is None
     ):
         raise ClickException(
             "Encrypted private key, you must provide the"
             "passphrase in the environment variable PRIVATE_KEY_PASSPHRASE"
         )
 
-    if not private_key_pem.startswith(
+    if not private_key_pem.value.startswith(
         ENCRYPTED_PKCS8_PK_HEADER
-    ) and not private_key_pem.startswith(UNENCRYPTED_PKCS8_PK_HEADER):
+    ) and not private_key_pem.value.startswith(UNENCRYPTED_PKCS8_PK_HEADER):
         raise ClickException(
             "Private key provided is not in PKCS#8 format. Please use correct format."
         )
 
-    if private_key_pem.startswith(UNENCRYPTED_PKCS8_PK_HEADER):
-        private_key_passphrase = None
+    if private_key_pem.value.startswith(UNENCRYPTED_PKCS8_PK_HEADER):
+        private_key_passphrase = SecretType(None)
 
     return prepare_private_key(private_key_pem, private_key_passphrase)
 
 
-def prepare_private_key(private_key_pem, private_key_passphrase=None):
+def prepare_private_key(
+    private_key_pem: SecretType, private_key_passphrase: SecretType = SecretType(None)
+):
     from cryptography.hazmat.backends import default_backend
     from cryptography.hazmat.primitives.serialization import (
         Encoding,
@@ -227,17 +289,21 @@ def prepare_private_key(private_key_pem, private_key_passphrase=None):
         load_pem_private_key,
     )
 
-    private_key = load_pem_private_key(
-        private_key_pem,
-        (
-            str.encode(private_key_passphrase)
-            if private_key_passphrase is not None
-            else private_key_passphrase
-        ),
-        default_backend(),
+    private_key = SecretType(
+        load_pem_private_key(
+            private_key_pem.value,
+            (
+                str.encode(private_key_passphrase.value)
+                if private_key_passphrase.value is not None
+                else private_key_passphrase.value
+            ),
+            default_backend(),
+        )
     )
-    return private_key.private_bytes(
-        encoding=Encoding.DER,
-        format=PrivateFormat.PKCS8,
-        encryption_algorithm=NoEncryption(),
+    return SecretType(
+        private_key.value.private_bytes(
+            encoding=Encoding.DER,
+            format=PrivateFormat.PKCS8,
+            encryption_algorithm=NoEncryption(),
+        )
     )