envpkt 0.13.0 → 0.13.1

package/dist/cli.js

@@ -662,6 +662,17 @@ const formatError = (error) => {
 		case "AgeNotFound": return `${RED}Error:${RESET} age CLI not found: ${error.message}`;
 		case "DecryptFailed": return `${RED}Error:${RESET} Decrypt failed: ${error.message}`;
 		case "IdentityNotFound": return `${RED}Error:${RESET} Identity file not found: ${error.path}`;
+		case "SealKeyUnavailable": {
+			const e = error;
+			return [
+				`${RED}Error:${RESET} ${e.sealedKeys.length} sealed secret(s) can't be decrypted — no age key found.`,
+				`${DIM}Searched (in order):${RESET}`,
+				e.searched.map((l) => `  • ${l}`).join("\n"),
+				`${DIM}Fix one:${RESET}`,
+				`  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`,
+				`  • Re-provision from source: envpkt seal --edit <KEY>`
+			].join("\n");
+		}
 		case "AuditFailed": return `${RED}Error:${RESET} Audit failed: ${error.message}`;
 		case "CatalogNotFound": return `${RED}Error:${RESET} Catalog not found: ${error.path}`;
 		case "CatalogLoadError": return `${RED}Error:${RESET} Catalog load error: ${error.message}`;
@@ -2886,12 +2897,11 @@ const runEnvExport = (options) => {
 		console.error(formatError(err));
 		process.exit(2);
 	}, (boot) => {
-		emitWarnings(boot);
+		if (!options.track) emitWarnings(boot);
 		const scope = loadConfig(boot.configPath).fold(() => "exec", (config) => config.scope ?? "exec");
+		const gateSecrets = options.track === true && scope !== "shell";
 		const entries = collectEmitEntries(boot);
-		const emit = scope === "shell" ? entries : entries.filter((e) => !e.secret);
-		const withheld = entries.length - emit.length;
-		if (withheld > 0) console.error(`${DIM}${withheld} secret(s) withheld (scope="${scope}") — use \`envpkt exec\` or set top-level scope="shell".${RESET}`);
+		const emit = gateSecrets ? entries.filter((e) => !e.secret) : entries;
 		emit.forEach(({ name, value }) => {
 			console.log(options.track ? `_ENVPKT_HAD_${name}=\${${name}+1}; _ENVPKT_PREV_${name}="\${${name}-}"; export ${name}='${shellEscape(value)}'` : `export ${name}='${shellEscape(value)}'`);
 		});
@@ -3291,6 +3301,8 @@ const runFleet = (options) => {
 //#endregion
 //#region src/cli/commands/init.ts
 const CONFIG_FILENAME = "envpkt.toml";
+/** Resolve the top-level `scope` to scaffold: explicit --scope wins; --global implies "shell". */
+const resolveInitScope = (options) => options.scope ?? (options.global ? "shell" : void 0);
 const todayIso = () => (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
 const generateSecretBlock = (key, service) => {
 	return `[secret.${key}]
@@ -3315,6 +3327,8 @@ const generateTemplate = (options, fnoxKeys) => {
 	lines.push(`#:schema https://raw.githubusercontent.com/jordanburke/envpkt/main/schemas/envpkt.schema.json`);
 	lines.push(``);
 	lines.push(`version = 1`);
+	const scope = resolveInitScope(options);
+	if (scope) lines.push(`scope = "${scope}"   # shell = secrets load ambiently on cd/eval; exec = only via envpkt exec`);
 	lines.push(``);
 	if (options.catalog) {
 		lines.push(`catalog = "${options.catalog}"`);
@@ -3373,6 +3387,10 @@ const formatConfigError = (err) => {
 };
 const runInit = (dir, options) => {
 	const outPath = join(dir, CONFIG_FILENAME);
+	if (options.scope !== void 0 && options.scope !== "shell" && options.scope !== "exec") {
+		console.error(`${RED}Error:${RESET} --scope must be "shell" or "exec" (got "${options.scope}")`);
+		process.exit(1);
+	}
 	if (existsSync(outPath) && !options.force) {
 		console.error(`${RED}Error:${RESET} ${CONFIG_FILENAME} already exists. Use --force to overwrite.`);
 		process.exit(1);
@@ -4636,85 +4654,96 @@ const registerSecretCommands = (program) => {
 };
 //#endregion
 //#region src/cli/commands/shell-hook.ts
-const ZSH_HOOK = `# envpkt shell hook — add to ~/.zshrc:  eval "$(envpkt shell-hook zsh)"
-# Loads a project envpkt.toml on cd (secrets only for scope="shell" packages), restores the
-# prior environment on leave, and warns on credential health. Use \`envpkt exec\` for scope="exec".
-_envpkt_restore() {
-  [[ -n "$_ENVPKT_INJECTED" ]] || return
-  local k had prev
-  for k in \${(s: :)_ENVPKT_INJECTED}; do
-    had="_ENVPKT_HAD_$k"
-    prev="_ENVPKT_PREV_$k"
-    if [[ -n "\${(P)had}" ]]; then
-      export "$k=\${(P)prev}"
-    else
-      unset "$k"
-    fi
-    unset "$had" "$prev"
-  done
-  unset _ENVPKT_INJECTED
-}
-
-_envpkt_chpwd() {
-  local cfg
-  cfg="$(envpkt config-path 2>/dev/null)"
-  [[ "$cfg" == "$_ENVPKT_DIR" ]] && return
-  _envpkt_restore
-  _ENVPKT_DIR="$cfg"
-  [[ -z "$cfg" ]] && return
-  eval "$(envpkt env export --track 2>/dev/null)"
-  envpkt audit --format minimal 2>/dev/null
-}
-
-autoload -Uz add-zsh-hook
-add-zsh-hook chpwd _envpkt_chpwd
-_envpkt_chpwd
-`;
-const BASH_HOOK = `# envpkt shell hook — add to ~/.bashrc:  eval "$(envpkt shell-hook bash)"
-# Loads a project envpkt.toml on cd (secrets only for scope="shell" packages), restores the
-# prior environment on leave, and warns on credential health. Use \`envpkt exec\` for scope="exec".
-_envpkt_restore() {
-  [ -n "$_ENVPKT_INJECTED" ] || return
-  local k had prev
-  for k in $_ENVPKT_INJECTED; do
-    had="_ENVPKT_HAD_$k"
-    prev="_ENVPKT_PREV_$k"
-    if [ -n "\${!had}" ]; then
-      export "$k=\${!prev}"
-    else
-      unset "$k"
-    fi
-    unset "$had" "$prev"
-  done
-  unset _ENVPKT_INJECTED
-}
-
-_envpkt_prompt() {
-  [ "$PWD" = "$_ENVPKT_PWD" ] && return
-  _ENVPKT_PWD="$PWD"
-  local cfg
-  cfg="$(envpkt config-path 2>/dev/null)"
-  [ "$cfg" = "$_ENVPKT_DIR" ] && return
-  _envpkt_restore
-  _ENVPKT_DIR="$cfg"
-  [ -z "$cfg" ] && return
-  eval "$(envpkt env export --track 2>/dev/null)"
-  envpkt audit --format minimal 2>/dev/null
-}
-
-case "$PROMPT_COMMAND" in
-  *_envpkt_prompt*) ;;
-  *) PROMPT_COMMAND="_envpkt_prompt\${PROMPT_COMMAND:+;$PROMPT_COMMAND}" ;;
-esac
-_envpkt_prompt
-`;
-const runShellHook = (shell) => {
+const zshHook = (audit) => [
+	"# envpkt shell hook — add to ~/.zshrc:  eval \"$(envpkt shell-hook zsh)\"",
+	"# Loads the current directory package on cd, restores the prior env on leave, warns on health.",
+	"_envpkt_restore() {",
+	"  [[ -n \"$_ENVPKT_INJECTED\" ]] || return",
+	"  local k had prev",
+	"  for k in ${(s: :)_ENVPKT_INJECTED}; do",
+	"    had=\"_ENVPKT_HAD_$k\"",
+	"    prev=\"_ENVPKT_PREV_$k\"",
+	"    if [[ -n \"${(P)had}\" ]]; then",
+	"      export \"$k=${(P)prev}\"",
+	"    else",
+	"      unset \"$k\"",
+	"    fi",
+	"    unset \"$had\" \"$prev\"",
+	"  done",
+	"  unset _ENVPKT_INJECTED",
+	"}",
+	"",
+	"_envpkt_chpwd() {",
+	"  local cfg",
+	"  cfg=\"$(envpkt config-path 2>/dev/null)\"",
+	"  [[ \"$cfg\" == \"$_ENVPKT_DIR\" ]] && return",
+	"  _envpkt_restore",
+	"  _ENVPKT_DIR=\"$cfg\"",
+	"  [[ -z \"$cfg\" ]] && return",
+	"  eval \"$(envpkt env export --track)\"",
+	...audit ? ["  envpkt audit --format minimal 2>/dev/null"] : [],
+	"}",
+	"",
+	"autoload -Uz add-zsh-hook",
+	"add-zsh-hook chpwd _envpkt_chpwd",
+	"_envpkt_chpwd",
+	""
+].join("\n");
+const bashHook = (audit) => [
+	"# envpkt shell hook — add to ~/.bashrc:  eval \"$(envpkt shell-hook bash)\"",
+	"# Loads the current directory package on cd, restores the prior env on leave, warns on health.",
+	"_envpkt_restore() {",
+	"  [ -n \"$_ENVPKT_INJECTED\" ] || return",
+	"  local k had prev",
+	"  for k in $_ENVPKT_INJECTED; do",
+	"    had=\"_ENVPKT_HAD_$k\"",
+	"    prev=\"_ENVPKT_PREV_$k\"",
+	"    if [ -n \"${!had}\" ]; then",
+	"      export \"$k=${!prev}\"",
+	"    else",
+	"      unset \"$k\"",
+	"    fi",
+	"    unset \"$had\" \"$prev\"",
+	"  done",
+	"  unset _ENVPKT_INJECTED",
+	"}",
+	"",
+	"_envpkt_prompt() {",
+	"  [ \"$PWD\" = \"$_ENVPKT_PWD\" ] && return",
+	"  _ENVPKT_PWD=\"$PWD\"",
+	"  local cfg",
+	"  cfg=\"$(envpkt config-path 2>/dev/null)\"",
+	"  [ \"$cfg\" = \"$_ENVPKT_DIR\" ] && return",
+	"  _envpkt_restore",
+	"  _ENVPKT_DIR=\"$cfg\"",
+	"  [ -z \"$cfg\" ] && return",
+	"  eval \"$(envpkt env export --track)\"",
+	...audit ? ["  envpkt audit --format minimal 2>/dev/null"] : [],
+	"}",
+	"",
+	"# Register on PROMPT_COMMAND, handling both the string and (bash 5.1+) array forms.",
+	"if [[ \"$(declare -p PROMPT_COMMAND 2>/dev/null)\" == \"declare -a\"* ]]; then",
+	"  case \" ${PROMPT_COMMAND[*]} \" in",
+	"    *\" _envpkt_prompt \"*) ;;",
+	"    *) PROMPT_COMMAND+=(_envpkt_prompt) ;;",
+	"  esac",
+	"else",
+	"  case \"$PROMPT_COMMAND\" in",
+	"    *_envpkt_prompt*) ;;",
+	"    *) PROMPT_COMMAND=\"_envpkt_prompt${PROMPT_COMMAND:+;$PROMPT_COMMAND}\" ;;",
+	"  esac",
+	"fi",
+	"_envpkt_prompt",
+	""
+].join("\n");
+const runShellHook = (shell, options) => {
+	const audit = options?.audit !== false;
 	switch (shell) {
 		case "zsh":
-			console.log(ZSH_HOOK);
+			console.log(zshHook(audit));
 			break;
 		case "bash":
-			console.log(BASH_HOOK);
+			console.log(bashHook(audit));
 			break;
 		default:
 			console.error(`${RED}Error:${RESET} Unsupported shell: ${shell}. Use "zsh" or "bash".`);
@@ -5011,7 +5040,7 @@ program.name("envpkt").description("Credential lifecycle and fleet management fo
 	const pkgPath = findPkgJson(dirname(fileURLToPath(import.meta.url)));
 	return pkgPath ? JSON.parse(readFileSync(pkgPath, "utf-8")).version : "0.0.0";
 })());
-program.command("init").description("Initialize a new envpkt.toml in the current directory").option("--from-fnox [path]", "Scaffold from fnox.toml (optionally specify path)").option("--catalog <path>", "Path to shared secret catalog").option("--identity", "Include [identity] section").option("--name <name>", "Identity name (requires --identity)").option("--capabilities <caps>", "Comma-separated capabilities (requires --identity)").option("--expires <date>", "Credential expiration YYYY-MM-DD (requires --identity)").option("--force", "Overwrite existing envpkt.toml").action((options) => {
+program.command("init").description("Initialize a new envpkt.toml in the current directory").option("--from-fnox [path]", "Scaffold from fnox.toml (optionally specify path)").option("--catalog <path>", "Path to shared secret catalog").option("--identity", "Include [identity] section").option("--name <name>", "Identity name (requires --identity)").option("--capabilities <caps>", "Comma-separated capabilities (requires --identity)").option("--expires <date>", "Credential expiration YYYY-MM-DD (requires --identity)").option("--scope <scope>", "Top-level scope: \"shell\" (secrets load ambiently) or \"exec\" (only via envpkt exec)").option("--global", "Scaffold a global/ambient package (implies scope = \"shell\")").option("--force", "Overwrite existing envpkt.toml").action((options) => {
 	runInit(process.cwd(), options);
 });
 program.command("keygen").description("Generate an age keypair for sealing secrets — run this before `seal` if you don't have a key yet").option("-c, --config <path>", "Path to envpkt.toml (updates identity.recipient if found)").option("-o, --output <path>", "Output path for identity file (default: ~/.envpkt/<project>-key.txt)").option("--global", "Write key to the shared default path (~/.envpkt/age-key.txt) instead of a project-specific one").action((options) => {
@@ -5052,8 +5081,8 @@ program.command("upgrade").description("Upgrade envpkt to the latest version (np
 program.command("config-path").description("Print the envpkt.toml path resolved for the current directory (empty if none). Resolve-only — no decryption.").option("-c, --config <path>", "Path to envpkt.toml").action((options) => {
 	runConfigPath(options);
 });
-program.command("shell-hook").description("Output shell function for ambient credential warnings on cd — combine with env export for full setup").argument("<shell>", "Shell type: zsh | bash").action((shell) => {
-	runShellHook(shell);
+program.command("shell-hook").description("Output a shell hook that loads a project's credentials on cd and restores them on leave").argument("<shell>", "Shell type: zsh | bash").option("--no-audit", "Omit the credential-health audit line from the emitted hook").action((shell, options) => {
+	runShellHook(shell, options);
 });
 program.parse();
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envpkt",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Credential lifecycle and fleet management for AI agents",
   "keywords": [
     "credentials",