envpkt 0.11.2 → 0.11.3

package/dist/cli.js

@@ -27,20 +27,26 @@ const classifySecret = (key, meta, fnoxKeys, staleWarningDays, requireExpiration
 	const issues = [];
 	const created = Option(meta.created).flatMap(parseDate);
 	const expires = Option(meta.expires).flatMap(parseDate);
+	const lastRotated = Option(meta.last_rotated_at).flatMap(parseDate);
 	const rotationUrl = Option(meta.rotation_url);
 	const purpose = Option(meta.purpose);
 	const service = Option(meta.service);
 	const daysRemaining = expires.map((exp) => daysBetween(today, exp));
-	const daysSinceCreated = created.map((c) => daysBetween(c, today));
+	const staleFromRotation = lastRotated.isSome();
+	const daysSinceRotation = (staleFromRotation ? lastRotated : created).map((d) => daysBetween(d, today));
 	const isExpired = daysRemaining.fold(() => false, (d) => d < 0);
 	const isExpiringSoon = daysRemaining.fold(() => false, (d) => d >= 0 && d <= WARN_BEFORE_DAYS);
-	const isStale = daysSinceCreated.fold(() => false, (d) => d > staleWarningDays);
+	const isStale = daysSinceRotation.fold(() => false, (d) => d > staleWarningDays);
 	const hasSealed = !!meta.encrypted_value;
 	const isMissing = fnoxKeys.size > 0 && !fnoxKeys.has(key) && !hasSealed;
 	const isMissingMetadata = requireExpiration && expires.isNone() || requireService && service.isNone();
 	if (isExpired) issues.push("Secret has expired");
 	if (isExpiringSoon) issues.push(`Expires in ${daysRemaining.fold(() => "?", (d) => String(d))} days`);
-	if (isStale) issues.push("Secret is stale (no rotation detected)");
+	if (isStale) {
+		const since = daysSinceRotation.fold(() => "?", (d) => String(d));
+		const label = staleFromRotation ? "last rotated" : "created";
+		issues.push(`Secret is stale (${label} ${since} days ago)`);
+	}
 	if (isMissing) issues.push("Key not found in fnox");
 	if (isMissingMetadata) {
 		if (requireExpiration && expires.isNone()) issues.push("Missing required expiration date");
@@ -55,6 +61,7 @@ const classifySecret = (key, meta, fnoxKeys, staleWarningDays, requireExpiration
 		purpose,
 		created: Option(meta.created),
 		expires: Option(meta.expires),
+		last_rotated_at: Option(meta.last_rotated_at),
 		issues: List(issues),
 		alias_of: Option(void 0)
 	};
@@ -73,6 +80,7 @@ const classifyAlias = (key, meta, targetHealth, targetRef) => ({
 	purpose: Option(meta.purpose).fold(() => targetHealth.purpose, (v) => Option(v)),
 	created: targetHealth.created,
 	expires: targetHealth.expires,
+	last_rotated_at: targetHealth.last_rotated_at,
 	issues: List([]),
 	alias_of: Option(targetRef)
 });
@@ -106,6 +114,7 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 			purpose: Option(meta.purpose),
 			created: Option(meta.created),
 			expires: Option(meta.expires),
+			last_rotated_at: Option(meta.last_rotated_at),
 			issues: List(["Alias target not resolvable"]),
 			alias_of: Option(targetRef)
 		}), (health) => classifyAlias(key, meta, health, targetRef));
@@ -205,6 +214,10 @@ const SecretMetaSchema = Type.Object({
 		format: "date",
 		description: "Date the secret was provisioned (YYYY-MM-DD)"
 	})),
+	last_rotated_at: Type.Optional(Type.String({
+		format: "date",
+		description: "Date the secret value was most recently rotated (YYYY-MM-DD). Used by audit for staleness."
+	})),
 	rotates: Type.Optional(Type.String({ description: "Rotation schedule (e.g. '90d', 'quarterly')" })),
 	rate_limit: Type.Optional(Type.String({ description: "Rate limit or quota info (e.g. '1000/min')" })),
 	model_hint: Type.Optional(Type.String({ description: "Suggested model or tier for this credential" })),
@@ -3544,9 +3557,13 @@ const META_SECTION_RE = /^\[secret\.(.+)\]\s*$/;
 const ENCRYPTED_VALUE_RE = /^encrypted_value\s*=/;
 const NEW_SECTION_RE = /^\[/;
 const MULTILINE_DELIM = "\"\"\"";
-/** Write sealed values back into the TOML file, preserving structure. */
-const writeSealedToml = (configPath, sealedMeta) => {
-	const lines = readFileSync(configPath, "utf-8").split("\n");
+/**
+* In-memory transform: inject sealed encrypted_value blocks into raw TOML,
+* replacing existing encrypted_value lines (single or multiline) or appending
+* a new block at the end of the section. Pure — no I/O.
+*/
+const applySealedToml = (raw, sealedMeta) => {
+	const lines = raw.split("\n");
 	const getSeal = (key) => Option(sealedMeta[key]?.encrypted_value);
 	const isPending = (state, key) => !getSeal(key).isEmpty && !state.consumedKeys.has(key);
 	const sealLinesFor = (key) => getSeal(key).fold(() => [], (v) => [
@@ -3628,7 +3645,11 @@ const writeSealedToml = (configPath, sealedMeta) => {
 		consumedKeys: Set$1.empty(),
 		skipUntil: -1
 	};
-	const finalContent = flushPending(List(lines).zipWithIndex().foldLeft(initial)((state, entry) => step(state, entry[0], entry[1]))).output.join("\n");
+	return flushPending(List(lines).zipWithIndex().foldLeft(initial)((state, entry) => step(state, entry[0], entry[1]))).output.join("\n");
+};
+/** Write sealed values back into the TOML file, preserving structure. */
+const writeSealedToml = (configPath, sealedMeta) => {
+	const finalContent = applySealedToml(readFileSync(configPath, "utf-8"), sealedMeta);
 	validateOrExit(finalContent);
 	writeFileSync(configPath, finalContent);
 };
@@ -4005,6 +4026,98 @@ const runSecretAlias = (name, options) => {
 		});
 	});
 };
+const readNewValue = async (key) => {
+	if (!process.stdin.isTTY) {
+		const chunks = [];
+		return new Promise((resolveP, rejectP) => {
+			process.stdin.on("data", (c) => chunks.push(Buffer.from(c)));
+			process.stdin.on("end", () => resolveP(Buffer.concat(chunks).toString("utf-8").replace(/\r?\n$/, "")));
+			process.stdin.on("error", rejectP);
+		});
+	}
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+	return new Promise((resolveP) => {
+		rl.question(`Enter new value for ${key}: `, (answer) => {
+			rl.close();
+			resolveP(answer);
+		});
+	});
+};
+const runSecretRotate = async (name, options) => {
+	const { configPath, source } = resolveConfigPath(options.config).fold((err) => {
+		console.error(formatError(err));
+		process.exit(2);
+		return {
+			configPath: "",
+			source: "flag"
+		};
+	}, ({ path, source: s }) => ({
+		configPath: path,
+		source: s
+	}));
+	const sourceMsg = formatConfigSource(configPath, source);
+	if (sourceMsg) console.error(sourceMsg);
+	const config = loadConfig(configPath).fold((err) => {
+		console.error(formatError(err));
+		process.exit(2);
+	}, (c) => c);
+	const meta = config.secret?.[name];
+	if (!meta) {
+		console.error(`${RED}Error:${RESET} Secret "${name}" not found in ${configPath}`);
+		process.exit(1);
+	}
+	if (meta.from_key) {
+		console.error(`${RED}Error:${RESET} "${name}" is an alias (from_key = "${meta.from_key}"). Rotate the target secret instead.`);
+		process.exit(1);
+	}
+	const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+	const wasSealed = !!meta.encrypted_value;
+	const raw = readFileSync(configPath, "utf-8");
+	if (!wasSealed) {
+		updateSectionFields(raw, `[secret.${name}]`, { last_rotated_at: `"${today}"` }).fold((err) => {
+			console.error(`${RED}Error:${RESET} ${err._tag}: ${err.section}`);
+			process.exit(2);
+		}, (result) => {
+			if (options.dryRun) {
+				console.log(`${DIM}# Preview (--dry-run):${RESET}\n`);
+				console.log(result);
+				return;
+			}
+			writeIfValid(configPath, result, `${GREEN}✓${RESET} Stamped ${BOLD}last_rotated_at${RESET} on ${BOLD}${name}${RESET} (unsealed — no ciphertext to update)`);
+		});
+		return;
+	}
+	if (!config.identity?.recipient) {
+		console.error(`${RED}Error:${RESET} identity.recipient is required to rotate a sealed secret`);
+		console.error(`${DIM}Run ${CYAN}envpkt keygen${DIM} to configure one.${RESET}`);
+		process.exit(2);
+	}
+	const { recipient } = config.identity;
+	const value = await readNewValue(name);
+	if (value === "") {
+		console.error(`${YELLOW}Cancelled:${RESET} no value provided — ${BOLD}${name}${RESET} was not rotated.`);
+		process.exit(1);
+	}
+	const ciphertext = ageEncrypt(value, recipient).fold((err) => {
+		console.error(`${RED}Error:${RESET} Encryption failed: ${err.message}`);
+		process.exit(2);
+		return "";
+	}, (ct) => ct);
+	updateSectionFields(applySealedToml(raw, { [name]: { encrypted_value: ciphertext } }), `[secret.${name}]`, { last_rotated_at: `"${today}"` }).fold((err) => {
+		console.error(`${RED}Error:${RESET} ${err._tag}: ${err.section}`);
+		process.exit(2);
+	}, (result) => {
+		if (options.dryRun) {
+			console.log(`${DIM}# Preview (--dry-run):${RESET}\n`);
+			console.log(result);
+			return;
+		}
+		writeIfValid(configPath, result, `${GREEN}✓${RESET} Rotated ${BOLD}${name}${RESET} (resealed + stamped ${CYAN}${today}${RESET})`);
+	});
+};
 const addSecretFlags = (cmd) => cmd.option("--service <service>", "Service this secret authenticates to").option("--purpose <purpose>", "Why this secret exists").option("--comment <comment>", "Free-form annotation").option("--expires <date>", "Expiration date (YYYY-MM-DD)").option("--capabilities <caps>", "Comma-separated capabilities (e.g. read,write)").option("--rotates <schedule>", "Rotation schedule (e.g. 90d, quarterly)").option("--rate-limit <limit>", "Rate limit info (e.g. 1000/min)").option("--model-hint <hint>", "Suggested model or tier").option("--source <source>", "Where the value originates (e.g. vault, ci)").option("--rotation-url <url>", "URL for secret rotation procedure").option("--tags <tags>", "Comma-separated key=value tags (e.g. env=prod,team=payments)");
 const registerSecretCommands = (program) => {
 	const secret = program.command("secret").description("Manage secret entries in envpkt.toml");
@@ -4020,6 +4133,9 @@ const registerSecretCommands = (program) => {
 	secret.command("rename").description("Rename a secret entry, preserving all metadata").argument("<old>", "Current secret name").argument("<new>", "New secret name").option("-c, --config <path>", "Path to envpkt.toml").option("--dry-run", "Preview the result without writing").action((oldName, newName, options) => {
 		runSecretRename(oldName, newName, options);
 	});
+	secret.command("rotate").description("Rotate a secret's value (sealed: reseal + stamp; unsealed: stamp only)").argument("<name>", "Secret name to rotate").option("-c, --config <path>", "Path to envpkt.toml").option("--dry-run", "Preview the result without writing").action(async (name, options) => {
+		await runSecretRotate(name, options);
+	});
 	secret.command("alias").description("Create an alias entry that reuses another secret's resolved value").argument("<name>", "Alias name (becomes the env var key)").requiredOption("--from <ref>", "Target reference — must be \"secret.<KEY>\"").option("-c, --config <path>", "Path to envpkt.toml").option("--purpose <purpose>", "Why this alias exists (local metadata)").option("--comment <comment>", "Free-form annotation").option("--tags <tags>", "Comma-separated key=value tags (e.g. env=prod,team=payments)").option("--force", "Overwrite the entry if <name> already exists").option("--dry-run", "Preview the TOML block without writing").action((name, options) => {
 		runSecretAlias(name, options);
 	});

package/dist/index.d.ts

@@ -40,6 +40,7 @@ declare const SecretMetaSchema: import("@sinclair/typebox").TObject<{
   comment: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
   capabilities: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
   created: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+  last_rotated_at: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
   rotates: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
   rate_limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
   model_hint: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -94,6 +95,7 @@ declare const EnvpktConfigSchema: import("@sinclair/typebox").TObject<{
     comment: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     capabilities: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     created: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    last_rotated_at: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     rotates: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     rate_limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     model_hint: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -138,6 +140,7 @@ type SecretHealth = {
   readonly purpose: Option<string>;
   readonly created: Option<string>;
   readonly expires: Option<string>;
+  readonly last_rotated_at: Option<string>;
   readonly issues: List<string>; /** If this entry is an alias (from_key), the reference it points at (e.g. "secret.X") */
   readonly alias_of: Option<string>;
 };

package/dist/index.js

@@ -56,6 +56,10 @@ const SecretMetaSchema = Type.Object({
 		format: "date",
 		description: "Date the secret was provisioned (YYYY-MM-DD)"
 	})),
+	last_rotated_at: Type.Optional(Type.String({
+		format: "date",
+		description: "Date the secret value was most recently rotated (YYYY-MM-DD). Used by audit for staleness."
+	})),
 	rotates: Type.Optional(Type.String({ description: "Rotation schedule (e.g. '90d', 'quarterly')" })),
 	rate_limit: Type.Optional(Type.String({ description: "Rate limit or quota info (e.g. '1000/min')" })),
 	model_hint: Type.Optional(Type.String({ description: "Suggested model or tier for this credential" })),
@@ -565,20 +569,26 @@ const classifySecret = (key, meta, fnoxKeys, staleWarningDays, requireExpiration
 	const issues = [];
 	const created = Option(meta.created).flatMap(parseDate);
 	const expires = Option(meta.expires).flatMap(parseDate);
+	const lastRotated = Option(meta.last_rotated_at).flatMap(parseDate);
 	const rotationUrl = Option(meta.rotation_url);
 	const purpose = Option(meta.purpose);
 	const service = Option(meta.service);
 	const daysRemaining = expires.map((exp) => daysBetween(today, exp));
-	const daysSinceCreated = created.map((c) => daysBetween(c, today));
+	const staleFromRotation = lastRotated.isSome();
+	const daysSinceRotation = (staleFromRotation ? lastRotated : created).map((d) => daysBetween(d, today));
 	const isExpired = daysRemaining.fold(() => false, (d) => d < 0);
 	const isExpiringSoon = daysRemaining.fold(() => false, (d) => d >= 0 && d <= WARN_BEFORE_DAYS);
-	const isStale = daysSinceCreated.fold(() => false, (d) => d > staleWarningDays);
+	const isStale = daysSinceRotation.fold(() => false, (d) => d > staleWarningDays);
 	const hasSealed = !!meta.encrypted_value;
 	const isMissing = fnoxKeys.size > 0 && !fnoxKeys.has(key) && !hasSealed;
 	const isMissingMetadata = requireExpiration && expires.isNone() || requireService && service.isNone();
 	if (isExpired) issues.push("Secret has expired");
 	if (isExpiringSoon) issues.push(`Expires in ${daysRemaining.fold(() => "?", (d) => String(d))} days`);
-	if (isStale) issues.push("Secret is stale (no rotation detected)");
+	if (isStale) {
+		const since = daysSinceRotation.fold(() => "?", (d) => String(d));
+		const label = staleFromRotation ? "last rotated" : "created";
+		issues.push(`Secret is stale (${label} ${since} days ago)`);
+	}
 	if (isMissing) issues.push("Key not found in fnox");
 	if (isMissingMetadata) {
 		if (requireExpiration && expires.isNone()) issues.push("Missing required expiration date");
@@ -593,6 +603,7 @@ const classifySecret = (key, meta, fnoxKeys, staleWarningDays, requireExpiration
 		purpose,
 		created: Option(meta.created),
 		expires: Option(meta.expires),
+		last_rotated_at: Option(meta.last_rotated_at),
 		issues: List(issues),
 		alias_of: Option(void 0)
 	};
@@ -611,6 +622,7 @@ const classifyAlias = (key, meta, targetHealth, targetRef) => ({
 	purpose: Option(meta.purpose).fold(() => targetHealth.purpose, (v) => Option(v)),
 	created: targetHealth.created,
 	expires: targetHealth.expires,
+	last_rotated_at: targetHealth.last_rotated_at,
 	issues: List([]),
 	alias_of: Option(targetRef)
 });
@@ -644,6 +656,7 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 			purpose: Option(meta.purpose),
 			created: Option(meta.created),
 			expires: Option(meta.expires),
+			last_rotated_at: Option(meta.last_rotated_at),
 			issues: List(["Alias target not resolvable"]),
 			alias_of: Option(targetRef)
 		}), (health) => classifyAlias(key, meta, health, targetRef));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envpkt",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "Credential lifecycle and fleet management for AI agents",
   "keywords": [
     "credentials",

package/schemas/envpkt.schema.json

@@ -131,6 +131,11 @@
               "description": "Date the secret was provisioned (YYYY-MM-DD)",
               "type": "string"
             },
+            "last_rotated_at": {
+              "format": "date",
+              "description": "Date the secret value was most recently rotated (YYYY-MM-DD). Used by audit for staleness.",
+              "type": "string"
+            },
             "rotates": {
               "description": "Rotation schedule (e.g. '90d', 'quarterly')",
               "type": "string"