Program Provisioners

Program provisioners run a local command and validate its output. Use them when you already have a script that can mint credentials.

Example:

{
  "kind": "program",
  "name": "stripe-keys",
  "label": "Stripe Keys (local script)",
  "provides": ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"],
  "command": "node",
  "args": ["scripts/provision/stripe.mjs"],
  "input": {
    "account": { "prompt": "Stripe account name", "default": "dev" }
  }
}

Input fields

Program provisioners can declare input fields. lazyenv resolves them before running your command:

1. Environment variable (env)
2. Global provisioner credentials
3. Interactive prompt (or default)

Example:

{
  "kind": "program",
  "name": "cloudflare-api-token",
  "label": "Cloudflare API Token",
  "provides": ["CLOUDFLARE_API_TOKEN"],
  "command": "node",
  "args": ["scripts/cloudflare-create-api-token.mjs"],
  "input": {
    "accountId": {
      "prompt": "Cloudflare account",
      "type": "select",
      "env": "CLOUDFLARE_ACCOUNT_ID"
    },
    "scopes": {
      "prompt": "Token scopes",
      "type": "multiselect",
      "default": ["Zone:Read", "Zone Settings:Edit"]
    },
    "tokenName": {
      "prompt": "Token name",
      "default": "lazyenv-token"
    }
  }
}

Dynamic inputs (optionsFrom)

For select and multiselect, you can load options by running a command that prints a JSON array. Entries can be strings or { value, label, description?, disabled? }. args supports {{inputName}} interpolation.

Program Contract

lazyenv passes resolved inputs to your command on stdin as JSON:

{ "input": { "...": "..." } }

Your command must output JSON with secret values for declared provides keys.