envpkt 0.13.2 → 0.13.4

package/README.md

@@ -405,6 +405,39 @@ envpkt inspect --secrets --plaintext  # Show secret values in plaintext
 
 The `--secrets` flag reads values from environment variables matching each secret key. By default values are masked (`pos•••••yapp`). Add `--plaintext` to display full values.
 
+### `envpkt diff`
+
+Compare two configs — useful for spotting drift between environments (e.g. `dev.envpkt.toml` vs `prod.envpkt.toml`). Reports keys only in each side and field-level metadata changes for shared keys. Sealed ciphertext is ignored (the same secret re-encrypts differently); a sealed↔unsealed change is reported.
+
+```bash
+envpkt diff dev.envpkt.toml prod.envpkt.toml
+# - dev.envpkt.toml
+# + prod.envpkt.toml
+#
+# [secret]
+#   - OLD_KEY
+#   + NEW_KEY
+#   ~ API_KEY
+#       expires: 2026-01-01 → 2027-01-01
+
+envpkt diff a.toml b.toml --format json   # structured diff
+envpkt diff a.toml b.toml --exit-code     # exit non-zero on any difference (CI drift gate)
+```
+
+### `envpkt copy`
+
+Copy a secret or env entry from one config to another. For a sealed secret, the value is unsealed with the **source's** age key and resealed for the **destination's** `identity.recipient` automatically — so you can move a credential between configs that use different keys without ever handling the plaintext yourself. Env entries (and secrets with no sealed value) copy as metadata only. The kind (secret vs env) is detected from where the key lives in the source.
+
+```bash
+envpkt copy DATABASE_URL --from prod.envpkt.toml --to staging.envpkt.toml
+envpkt copy DATABASE_URL --from prod.envpkt.toml --to staging.envpkt.toml --as DB_URL  # rename on copy
+envpkt copy PORT --to other.envpkt.toml          # --from defaults to the resolved config here
+envpkt copy API_KEY --to b.toml --force          # overwrite if it already exists in the destination
+envpkt copy API_KEY --to b.toml --dry-run        # preview without writing
+```
+
+`--from`/`--to` default to the config resolved for the current directory (and must already exist). On copy, `created` is reset to today and `last_rotated_at` is dropped (it's the source's rotation history). Copying a sealed secret needs the source key to unseal and the destination's `identity.recipient` to reseal.
+
 ### `envpkt exec`
 
 Run a pre-flight audit, inject secrets from fnox into the environment, then execute a command.