# `jadpo config` Check and set local settings. Settings are what `config.jadpo` declares: values a deployment provides, each read from the environment variable named after it in capitals. `check` lists every setting as set, default, missing or invalid against this machine's values, the process's environment over `.env.local`, and shows each problem with the command that fixes it; it never prints a value. `set` asks for one setting's value at a prompt, hidden when it is secret, checks it against the setting's type and stores it in `.env.local`, which it keeps out of git. A value is never an argument, so it cannot reach a shell history, a log or a chat. `move` makes a constant a setting: a field of its name and type in `config { }` with its value as `default:`, the constant deleted and every read rewritten to `config.`; it refuses, changing nothing, a type a setting can't hold, a name a setting has, and a read in a query, an update by `id`, a backfill or another constant. `set --generate` stores a new key, 32 random bytes, in `.env.local` and prints nothing; `generate ` writes a new key into a pipe and refuses a terminal. `rotation` counts the sealed rows still under `FIELD_ENCRYPTION_KEY_PREVIOUS`, so you know when it can go. ```text jadpo config [field] ``` ## Arguments - `action`: What to do - `field` (optional): The setting to store a value for, or the constant to move ## Flags - `--generate`: With `set`, make a key, printing nothing - `--url `: With `rotation`, the database to read ## On every command - `--json`: Print data for tools instead of text - `--full`: Show everything a report shortens - `--help`: Show every flag, with examples - `--color `: Choose when to use colour `jadpo config --json` writes one JSON document to standard output instead of text, with the same exit code. The document has `schemaVersion`, `command` (`"config"`), `ok`, `data` (what the command produced, `null` when it failed) and `diagnostics` (each error with its `rule`, `reason`, `next` and `help`). A command that needs a terminal refuses `--json` and names the flags that do the same job. ## Examples ```text # See which settings still need a value jadpo config check # Make the key encrypted fields are sealed with, seen by no one jadpo config set field_encryption_key --generate # Send a new key straight to a secret manager jadpo config generate field_encryption_key | wrangler secret put FIELD_ENCRYPTION_KEY # See when the previous field key can be removed jadpo config rotation # Store a secret without typing it anywhere it is kept jadpo config set session_signing_key # List the settings as data for tools jadpo config check --json # Make a constant a value each deployment can set jadpo config move limits.max_retries ``` ## Errors - [`cli.config_arguments`](/docs/errors/cli.config_arguments.md): A `jadpo config` command names no action, an action it doesn't have, or a setting `config.jadpo` doesn't declare - [`configuration.move_type_unsupported`](/docs/errors/configuration.move_type_unsupported.md): A constant `jadpo config move` was asked to make a setting has a type one environment variable can't hold, such as a list or an object - [`configuration.move_name_taken`](/docs/errors/configuration.move_name_taken.md): A constant `jadpo config move` was asked to make a setting has the name of a setting `config { }` already declares - [`configuration.move_read_unsupported`](/docs/errors/configuration.move_read_unsupported.md): A constant `jadpo config move` was asked to make a setting is read where a setting can't be: in a query, an update by `id`, a backfill or another constant's value - [`toolchain.artifact_write_failed`](/docs/errors/toolchain.artifact_write_failed.md): A file Jadpo writes for you, such as a record, couldn't be written, usually because it or its folder is read-only - [`configuration.value_missing`](/docs/errors/configuration.value_missing.md): A setting `config.jadpo` declares without a `default:` has no value on this machine, in the environment or `.env.local` - [`configuration.value_invalid`](/docs/errors/configuration.value_invalid.md): A setting's value on this machine, from the environment or `.env.local`, doesn't fit the type `config.jadpo` gives it - [`cli.config_tty_required`](/docs/errors/cli.config_tty_required.md): You ran `jadpo config set` where there is no terminal to type the value at, such as from a coding agent or a script - [`cli.config_prompt_failed`](/docs/errors/cli.config_prompt_failed.md): Nothing was typed at the prompt of `jadpo config set`, or the terminal couldn't hide what you type there - [`configuration.local_read_failed`](/docs/errors/configuration.local_read_failed.md): The `.env.local` file is there, but it couldn't be read: it is a folder, or you aren't allowed to read it - [`configuration.local_invalid_encoding`](/docs/errors/configuration.local_invalid_encoding.md): The `.env.local` file holds bytes that aren't UTF-8 text - [`configuration.local_syntax`](/docs/errors/configuration.local_syntax.md): A line of `.env.local` isn't blank, a `#` comment or `NAME=value`, or it sets a variable a line above it already sets - [`configuration.local_unsafe_target`](/docs/errors/configuration.local_unsafe_target.md): The `.env.local` file that `jadpo config set` would save a value in is a link, not an ordinary file - [`configuration.local_changed`](/docs/errors/configuration.local_changed.md): Something else saved `.env.local` while `jadpo config set` was saving a value in it - [`configuration.local_write_failed`](/docs/errors/configuration.local_write_failed.md): Saving a value in `.env.local` failed, usually because the project's folder can't be written