envpkt 0.13.6 → 0.14.1

package/README.md

@@ -141,6 +141,10 @@ See [`examples/`](./examples/) for more configurations.
 
 Sealed packets embed age-encrypted secret values directly in `envpkt.toml`. This makes your config fully self-contained — no external secrets backend needed at runtime.
 
+> **Requires the [`age`](https://github.com/FiloSottile/age) CLI.** envpkt shells out to `age` to seal and unseal `encrypted_value` — it's a runtime dependency, not bundled, and there is **no built-in / JS fallback**. Every path that decrypts a sealed value (`boot()`, `exec`, `env export`, `env github`, the GitHub Action) needs `age` on `PATH` plus the private key.
+>
+> **Gotcha — partial resolution hides a missing `age`.** Plaintext `[env.*]` defaults and fnox-backed values resolve _without_ `age`, so a config can look like it's working while every sealed secret silently fails to decrypt. If sealed values aren't showing up, confirm `age` is installed — `envpkt doctor` reports its presence.
+
 ### Setup
 
 ```bash
@@ -214,7 +218,7 @@ A composite action resolves the credentials in `envpkt.toml` into the CI job —
 
 **Inputs:** `config`, `version` (npm version to run, default `latest`), `strict`, `profile`.
 
-> Decrypting sealed packets requires the [`age`](https://github.com/FiloSottile/age) CLI on the runner (install it first, as above) — not needed if you only inject plaintext `[env.*]` defaults or resolve via fnox. Reference `@v0` for the moving major tag (re-pointed to each `0.x` release), or pin an exact release like `@v0.13.4` for immutability. `@v1` ships when envpkt reaches 1.0. Node is assumed present; add `actions/setup-node` first to pin a version.
+> **The [`age`](https://github.com/FiloSottile/age) CLI is required on the runner to unseal `encrypted_value` packets** (install it first, as above) — envpkt shells out to `age`, with no bundled/JS fallback. Without it, sealed secrets won't decrypt or be injected, even though plaintext `[env.*]` defaults and fnox-backed values still resolve — which can mask the missing dependency until a sealed value turns up empty downstream. Reference `@v0` for the moving major tag (re-pointed to each `0.x` release), or pin an exact release like `@v0.13.6` for immutability. `@v1` ships when envpkt reaches 1.0. Node is assumed present; add `actions/setup-node` first to pin a version.
 
 ### Anti-rot CI gate
 

package/dist/cli.js

@@ -70,7 +70,8 @@ const classifySecret = (key, meta, fnoxKeys, staleWarningDays, requireExpiration
 	const isExpiringSoon = daysRemaining.fold(() => false, (d) => d >= 0 && d <= WARN_BEFORE_DAYS);
 	const isStale = daysSinceRotation.fold(() => false, (d) => d > staleWarningDays);
 	const hasSealed = !!meta.encrypted_value;
-	const isMissing = fnoxKeys.size > 0 && !fnoxKeys.has(key) && !hasSealed;
+	const isExternal = meta.external === true;
+	const isMissing = !isExternal && fnoxKeys.size > 0 && !fnoxKeys.has(key) && !hasSealed;
 	const isMissingMetadata = requireExpiration && expires.isNone() || requireService && service.isNone();
 	if (isExpired) issues.push("Secret has expired");
 	if (isExpiringSoon) issues.push(`Expires in ${daysRemaining.fold(() => "?", (d) => String(d))} days`);
@@ -87,7 +88,7 @@ const classifySecret = (key, meta, fnoxKeys, staleWarningDays, requireExpiration
 	return {
 		key,
 		service,
-		status: Cond.of().when(isExpired, "expired").elseWhen(isMissing, "missing").elseWhen(isMissingMetadata, "missing_metadata").elseWhen(isExpiringSoon, "expiring_soon").elseWhen(isStale, "stale").else("healthy"),
+		status: Cond.of().when(isExpired, "expired").elseWhen(isMissing, "missing").elseWhen(isMissingMetadata, "missing_metadata").elseWhen(isExpiringSoon, "expiring_soon").elseWhen(isStale, "stale").elseWhen(isExternal, "external").else("healthy"),
 		days_remaining: daysRemaining,
 		rotation_url: rotationUrl,
 		purpose,
@@ -126,7 +127,6 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 	const secretEntries = config.secret ?? {};
 	const nonAliasEntries = Object.entries(secretEntries).filter(([, meta]) => meta.from_key === void 0);
 	const aliasEntries = Object.entries(secretEntries).filter(([, meta]) => meta.from_key !== void 0);
-	const nonAliasMetaKeys = Set$1(nonAliasEntries.map(([k]) => k));
 	const nonAliasHealth = nonAliasEntries.map(([key, meta]) => classifySecret(key, meta, keys, staleWarningDays, requireExpiration, requireService, now));
 	const healthByKey = Map$1(nonAliasHealth.map((h) => [h.key, h]));
 	const parseTargetKey = (from_key) => {
@@ -152,13 +152,14 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 		}), (health) => classifyAlias(key, meta, health, targetRef));
 	});
 	const secrets = List([...nonAliasHealth, ...aliasHealth]);
-	const orphaned = keys.size > 0 ? nonAliasMetaKeys.toArray().filter((k) => !keys.has(k)).length : 0;
+	const orphaned = keys.size > 0 ? nonAliasEntries.filter(([k, meta]) => !keys.has(k) && meta.external !== true).length : 0;
 	const total = secrets.size;
 	const expired = secrets.count((s) => s.status === "expired");
 	const missing = secrets.count((s) => s.status === "missing");
 	const missing_metadata = secrets.count((s) => s.status === "missing_metadata");
 	const expiring_soon = secrets.count((s) => s.status === "expiring_soon");
 	const stale = secrets.count((s) => s.status === "stale");
+	const external = secrets.count((s) => s.status === "external");
 	const healthy = secrets.count((s) => s.status === "healthy");
 	const aliases = aliasHealth.length;
 	return {
@@ -171,6 +172,7 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 		stale,
 		missing,
 		missing_metadata,
+		external,
 		orphaned,
 		aliases,
 		identity: config.identity
@@ -182,7 +184,8 @@ const computeEnvAudit = (config, env = process.env) => {
 	const envWire = (key) => namer(key, envEntries[key]?.namespace);
 	const resolveEffectiveDefault = (entry) => {
 		return Do(function* () {
-			return yield* $(Option((yield* $(Option(envEntries[yield* $(Option((yield* $(Option(entry.from_key))).match(/^env\.(.+)$/)?.[1]))]))).value));
+			const targetKey = yield* $(Option((yield* $(Option(entry.from_key))).match(/^env\.(.+)$/)?.[1]));
+			return yield* $(Option((yield* $(Option(envEntries[targetKey]))).value));
 		}).orElse(entry.value ?? "");
 	};
 	const entries = Object.entries(envEntries).map(([key, entry]) => {
@@ -266,6 +269,7 @@ const SecretMetaSchema = Type.Object({
 	encrypted_value: Type.Optional(Type.String({ description: "Age-encrypted secret value (armored ciphertext, safe to commit)" })),
 	from_key: Type.Optional(Type.String({ description: "Reference another entry (format: 'secret.<KEY>') whose resolved value this alias reuses. Mutually exclusive with encrypted_value." })),
 	required: Type.Optional(Type.Boolean({ description: "Whether this secret is required for operation" })),
+	external: Type.Optional(Type.Boolean({ description: "Value is managed outside envpkt (e.g. a Cloudflare/Vault secret). The entry registers the name for inventory and dev/prod parity only: seal never touches it, and audit reports it as 'external' rather than 'missing'." })),
 	tags: Type.Optional(Type.Record(Type.String(), Type.String(), { description: "Key-value tags for grouping and filtering" })),
 	namespace: Type.Optional(Type.String({ description: "Override the file-level namespace for this entry's injected name. Empty string opts out of any prefix." }))
 }, { description: "Metadata about a single secret" });
@@ -385,7 +389,8 @@ const walkUpForConfig = (dir) => {
 };
 /** Discover config by walking up from CWD, then ENVPKT_SEARCH_PATH, then dynamic Platform paths */
 const discoverConfig = (cwd) => {
-	const walked = walkUpForConfig(cwd ?? process.cwd()).orUndefined();
+	const dir = cwd ?? process.cwd();
+	const walked = walkUpForConfig(dir).orUndefined();
 	if (walked) return Option({
 		path: walked,
 		source: "cwd"
@@ -646,6 +651,7 @@ const secretStatusIcon = (status) => {
 		case "stale": return `${YELLOW}○${RESET}`;
 		case "missing": return `${RED}?${RESET}`;
 		case "missing_metadata": return `${YELLOW}!${RESET}`;
+		case "external": return `${CYAN}↗${RESET}`;
 		default: return " ";
 	}
 };
@@ -667,9 +673,10 @@ const formatAudit = (audit) => {
 			audit.stale > 0 ? `  ${YELLOW}${audit.stale}${RESET} stale` : null,
 			audit.missing > 0 ? `  ${RED}${audit.missing}${RESET} missing` : null,
 			audit.missing_metadata > 0 ? `  ${YELLOW}${audit.missing_metadata}${RESET} missing metadata` : null,
+			audit.external > 0 ? `  ${CYAN}${audit.external}${RESET} external` : null,
 			audit.orphaned > 0 ? `  ${YELLOW}${audit.orphaned}${RESET} orphaned` : null
 		].filter(Boolean).join("\n"),
-		audit.secrets.filter((s) => s.status !== "healthy").map(formatSecretRow).toArray().join("\n")
+		audit.secrets.filter((s) => s.status !== "healthy" && s.status !== "external").map(formatSecretRow).toArray().join("\n")
 	].filter((s) => s.length > 0).join("\n\n");
 };
 const formatAuditJson = (audit) => JSON.stringify({
@@ -721,12 +728,13 @@ const formatError = (error) => {
 		case "IdentityNotFound": return `${RED}Error:${RESET} Identity file not found: ${error.path}`;
 		case "SealKeyUnavailable": {
 			const e = error;
+			const restoreLine = e.configuredKeyFile ? `  • Restore the configured key to ${e.configuredKeyFile} (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)` : `  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`;
 			return [
 				`${RED}Error:${RESET} ${e.sealedKeys.length} sealed secret(s) can't be decrypted — no age key found.`,
 				`${DIM}Searched (in order):${RESET}`,
 				e.searched.map((l) => `  • ${l}`).join("\n"),
 				`${DIM}Fix one:${RESET}`,
-				`  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`,
+				restoreLine,
 				`  • Re-provision from source: envpkt seal --edit <KEY>`
 			].join("\n");
 		}
@@ -757,8 +765,9 @@ const confidenceIcon = (confidence) => {
 	}
 };
 const formatScanTable = (scan) => {
+	const total = scan.discovered.size;
 	return [
-		`${BOLD}Scan Results${RESET} — ${scan.discovered.size} credential(s) found in ${scan.total_scanned} env vars`,
+		`${BOLD}Scan Results${RESET} — ${total} credential(s) found in ${scan.total_scanned} env vars`,
 		[
 			scan.high_confidence > 0 ? `  ${GREEN}${scan.high_confidence}${RESET} high confidence` : null,
 			scan.medium_confidence > 0 ? `  ${YELLOW}${scan.medium_confidence}${RESET} medium confidence` : null,
@@ -955,7 +964,8 @@ const fnoxExport = (profile, agentKey) => {
 			const eq = line.indexOf("=");
 			if (eq > 0) {
 				const key = line.slice(0, eq).trim();
-				entries[key] = line.slice(eq + 1).trim();
+				const value = line.slice(eq + 1).trim();
+				entries[key] = value;
 			}
 		});
 		return Right(entries);
@@ -1395,11 +1405,13 @@ const resolveSealIdentity = (config, configDir) => {
 	});
 	const inlineKey = resolveInlineKey().orUndefined();
 	if (inlineKey) return Option(materializeInlineKey(inlineKey));
-	const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
-	if (existsSync(defaultPath)) return Option({
-		path: defaultPath,
-		dispose: noop
-	});
+	if (!config.identity?.key_file) {
+		const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
+		if (existsSync(defaultPath)) return Option({
+			path: defaultPath,
+			dispose: noop
+		});
+	}
 	return Option(void 0);
 };
 /** Describe the seal-identity precedence chain with per-entry status, for a clear no-key error. */
@@ -1414,7 +1426,7 @@ const describeSealKeySearch = (config, configDir) => {
 		keyFileLine,
 		envFileLine,
 		inlineLine,
-		`${defaultPath} (${existsSync(defaultPath) ? "found" : "missing"})`
+		keyFile ? `${defaultPath} (skipped — identity.key_file is set)` : `${defaultPath} (${existsSync(defaultPath) ? "found" : "missing"})`
 	];
 };
 const resolveIdentityKey = (config, configDir) => {
@@ -1490,7 +1502,8 @@ const bootSafe = (options) => {
 		if (hasSealedValues && sealIdentity.isEmpty) return Left({
 			_tag: "SealKeyUnavailable",
 			sealedKeys: nonAliasMetaKeys.filter((k) => !!nonAliasSecretEntries[k]?.encrypted_value),
-			searched: describeSealKeySearch(config, configDir)
+			searched: describeSealKeySearch(config, configDir),
+			configuredKeyFile: config.identity?.key_file ? resolve(configDir, expandPath(config.identity.key_file)) : void 0
 		});
 		return checkExpiration(audit, failOnExpired, warnOnly).map((warnings) => {
 			const secrets = {};
@@ -1585,7 +1598,8 @@ const bootSafe = (options) => {
 				}
 				const targetEntry = envEntries[entry.targetKey];
 				if (targetEntry?.value === void 0) return;
-				envDefaults[aliasKey] = process.env[envEnv(entry.targetKey)] ?? targetEntry.value;
+				const resolvedTarget = process.env[envEnv(entry.targetKey)] ?? targetEntry.value;
+				envDefaults[aliasKey] = resolvedTarget;
 			});
 			if (inject) {
 				Object.entries(envDefaults).forEach(([key, value]) => {
@@ -4419,7 +4433,8 @@ const collectEditedValues = async (editKeys, entries, prompt, onSkip) => {
 	const values = {};
 	for (const key of editKeys) {
 		if (entries[key]?.encrypted_value) {
-			if (!isAffirmative(await prompt(`Replace the sealed value for ${key}? The previous value can't be recovered without the original key. [y/N] `))) {
+			const confirm = await prompt(`Replace the sealed value for ${key}? The previous value can't be recovered without the original key. [y/N] `);
+			if (!isAffirmative(confirm)) {
 				onSkip?.(key, "declined");
 				continue;
 			}
@@ -4435,7 +4450,8 @@ const collectEditedValues = async (editKeys, entries, prompt, onSkip) => {
 };
 /** Write sealed values back into the TOML file, preserving structure. */
 const writeSealedToml = (configPath, sealedMeta) => {
-	const finalContent = applySealedToml(readFileSync(configPath, "utf-8"), sealedMeta);
+	const raw = readFileSync(configPath, "utf-8");
+	const finalContent = applySealedToml(raw, sealedMeta);
 	validateOrExit(finalContent);
 	writeFileSync(configPath, finalContent);
 };
@@ -4495,6 +4511,12 @@ const runSeal = async (options) => {
 			console.error(`${DIM}Aliases reference another secret's value via from_key — seal the target instead.${RESET}`);
 			process.exit(2);
 		}
+		const externalKeys = editKeys.filter((k) => allSecretEntries[k].external === true);
+		if (externalKeys.length > 0) {
+			console.error(`${RED}Error:${RESET} Cannot seal external entries: ${externalKeys.join(", ")}`);
+			console.error(`${DIM}external = true means the value is managed outside envpkt — set it in that store instead.${RESET}`);
+			process.exit(2);
+		}
 		if (!process.stdin.isTTY) {
 			console.error(`${RED}Error:${RESET} --edit requires an interactive terminal`);
 			process.exit(2);
@@ -4527,14 +4549,16 @@ const runSeal = async (options) => {
 		return;
 	}
 	const allSecretEntries = config.secret ?? {};
-	const allKeys = Object.keys(allSecretEntries).filter((k) => allSecretEntries[k].from_key === void 0);
+	const allKeys = Object.keys(allSecretEntries).filter((k) => allSecretEntries[k].from_key === void 0 && allSecretEntries[k].external !== true);
 	const skippedAliases = Object.keys(allSecretEntries).filter((k) => allSecretEntries[k].from_key !== void 0);
+	const skippedExternal = Object.keys(allSecretEntries).filter((k) => allSecretEntries[k].from_key === void 0 && allSecretEntries[k].external === true);
 	const alreadySealed = allKeys.filter((k) => allSecretEntries[k].encrypted_value);
 	const unsealed = allKeys.filter((k) => !allSecretEntries[k].encrypted_value);
 	if (skippedAliases.length > 0) {
 		const noun = skippedAliases.length === 1 ? "alias" : "aliases";
 		console.error(`${DIM}Skipping ${skippedAliases.length} ${noun}: ${skippedAliases.join(", ")}${RESET}`);
 	}
+	if (skippedExternal.length > 0) console.error(`${DIM}Skipping ${skippedExternal.length} external (value managed outside envpkt): ${skippedExternal.join(", ")}${RESET}`);
 	if (!options.reseal && alreadySealed.length > 0) {
 		if (unsealed.length === 0) {
 			console.log(`${GREEN}✓${RESET} All ${BOLD}${alreadySealed.length}${RESET} secret(s) already sealed. Use ${CYAN}--reseal${RESET} to re-encrypt.`);
@@ -4937,11 +4961,13 @@ const runSecretRotate = async (name, options) => {
 const addSecretFlags = (cmd) => cmd.option("--service <service>", "Service this secret authenticates to").option("--purpose <purpose>", "Why this secret exists").option("--comment <comment>", "Free-form annotation").option("--expires <date>", "Expiration date (YYYY-MM-DD)").option("--capabilities <caps>", "Comma-separated capabilities (e.g. read,write)").option("--rotates <schedule>", "Rotation schedule (e.g. 90d, quarterly)").option("--rate-limit <limit>", "Rate limit info (e.g. 1000/min)").option("--model-hint <hint>", "Suggested model or tier").option("--source <source>", "Where the value originates (e.g. vault, ci)").option("--rotation-url <url>", "URL for secret rotation procedure").option("--tags <tags>", "Comma-separated key=value tags (e.g. env=prod,team=payments)");
 const registerSecretCommands = (program) => {
 	const secret = program.command("secret").description("Manage secret entries in envpkt.toml");
-	addSecretFlags(secret.command("add").description("Add a new secret entry to envpkt.toml").argument("<name>", "Secret name (becomes the env var key)").option("-c, --config <path>", "Path to envpkt.toml").option("--required", "Mark this secret as required").option("--dry-run", "Preview the TOML block without writing")).action((name, options) => {
+	const addCmd = secret.command("add").description("Add a new secret entry to envpkt.toml").argument("<name>", "Secret name (becomes the env var key)").option("-c, --config <path>", "Path to envpkt.toml").option("--required", "Mark this secret as required").option("--dry-run", "Preview the TOML block without writing");
+	addSecretFlags(addCmd).action((name, options) => {
 		runSecretAdd(name, options);
 	});
 	const collect = (value, previous) => [...previous, value];
-	addSecretFlags(secret.command("edit").description("Update metadata fields on an existing secret").argument("<name>", "Secret name to edit").option("-c, --config <path>", "Path to envpkt.toml").option("--required", "Mark this secret as required").option("--no-required", "Mark this secret as not required").option("--unset <field>", "Remove an optional field (repeatable). Field names match TOML keys, e.g. expires, rate_limit", collect, []).option("--dry-run", "Preview the changes without writing")).action((name, options) => {
+	const editCmd = secret.command("edit").description("Update metadata fields on an existing secret").argument("<name>", "Secret name to edit").option("-c, --config <path>", "Path to envpkt.toml").option("--required", "Mark this secret as required").option("--no-required", "Mark this secret as not required").option("--unset <field>", "Remove an optional field (repeatable). Field names match TOML keys, e.g. expires, rate_limit", collect, []).option("--dry-run", "Preview the changes without writing");
+	addSecretFlags(editCmd).action((name, options) => {
 		runSecretEdit(name, options);
 	});
 	secret.command("rm").description("Remove a secret entry from envpkt.toml").argument("<name>", "Secret name to remove").option("-c, --config <path>", "Path to envpkt.toml").option("--dry-run", "Preview the result without writing").action((name, options) => {
@@ -5223,35 +5249,39 @@ const buildReport = (path, raw) => {
 				skipped(CHECK_NAMES.sealed)
 			]
 		}), (config) => {
+			const schemaOk = {
+				name: CHECK_NAMES.schema,
+				status: "ok"
+			};
+			const catalogCheck = config.catalog ? resolveConfig(config, dirname(path)).fold((err) => ({
+				name: CHECK_NAMES.catalog,
+				status: "failed",
+				error: formatError(err)
+			}), () => ({
+				name: CHECK_NAMES.catalog,
+				status: "ok",
+				detail: config.catalog
+			})) : {
+				name: CHECK_NAMES.catalog,
+				status: "na",
+				detail: "no catalog declared"
+			};
+			const aliasCheck = validateAliases(config).fold((err) => ({
+				name: CHECK_NAMES.aliases,
+				status: "failed",
+				error: formatValidationError(err)
+			}), (table) => ({
+				name: CHECK_NAMES.aliases,
+				status: "ok",
+				detail: `${table.entries.size} alias(es)`
+			}));
+			const sealedCheck = checkSealedBlocks(config);
 			const checks = [
 				tomlOk,
-				{
-					name: CHECK_NAMES.schema,
-					status: "ok"
-				},
-				config.catalog ? resolveConfig(config, dirname(path)).fold((err) => ({
-					name: CHECK_NAMES.catalog,
-					status: "failed",
-					error: formatError(err)
-				}), () => ({
-					name: CHECK_NAMES.catalog,
-					status: "ok",
-					detail: config.catalog
-				})) : {
-					name: CHECK_NAMES.catalog,
-					status: "na",
-					detail: "no catalog declared"
-				},
-				validateAliases(config).fold((err) => ({
-					name: CHECK_NAMES.aliases,
-					status: "failed",
-					error: formatValidationError(err)
-				}), (table) => ({
-					name: CHECK_NAMES.aliases,
-					status: "ok",
-					detail: `${table.entries.size} alias(es)`
-				})),
-				checkSealedBlocks(config)
+				schemaOk,
+				catalogCheck,
+				aliasCheck,
+				sealedCheck
 			];
 			return {
 				ok: checks.every((c) => c.status === "ok" || c.status === "na"),
@@ -5316,7 +5346,7 @@ const runValidate = (options) => {
 	}, ({ path, source }) => {
 		const sourceMsg = formatConfigSource(path, source);
 		Try(() => readFileSync(path, "utf-8")).fold((e) => {
-			emit({
+			const report = {
 				ok: false,
 				configPath: path,
 				checks: [{
@@ -5324,7 +5354,8 @@ const runValidate = (options) => {
 					status: "failed",
 					error: e.message
 				}]
-			}, sourceMsg, options.json === true);
+			};
+			emit(report, sourceMsg, options.json === true);
 			process.exit(2);
 		}, (raw) => {
 			const report = buildReport(path, raw);

package/dist/index.d.ts

@@ -4,7 +4,6 @@ import { DirectLogger, DirectTestLoggerHandle, createDirectConsoleLogger, create
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { CallToolResult, ReadResourceResult, Resource } from "@modelcontextprotocol/sdk/types.js";
 import { DirectLogger as DirectLogger$1, LogEntry, LogLevel, LogMetadata } from "functype-log";
-
 //#region src/core/schema.d.ts
 declare const ConsumerType: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"agent">, import("@sinclair/typebox").TLiteral<"service">, import("@sinclair/typebox").TLiteral<"developer">, import("@sinclair/typebox").TLiteral<"ci">]>;
 type ConsumerType = Static<typeof ConsumerType>;
@@ -48,6 +47,7 @@ declare const SecretMetaSchema: import("@sinclair/typebox").TObject<{
   encrypted_value: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
   from_key: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
   required: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+  external: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
   tags: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>>;
   namespace: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 }>;
@@ -110,6 +110,7 @@ declare const EnvpktConfigSchema: import("@sinclair/typebox").TObject<{
     encrypted_value: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     from_key: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     required: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    external: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
     tags: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>>;
     namespace: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
   }>>>;
@@ -139,7 +140,7 @@ type EnvpktConfig = Static<typeof EnvpktConfigSchema>;
 /** @deprecated Use `Identity` instead */
 type AgentIdentity = Identity;
 type HealthStatus = "healthy" | "degraded" | "critical";
-type SecretStatus = "healthy" | "expiring_soon" | "expired" | "stale" | "missing" | "missing_metadata";
+type SecretStatus = "healthy" | "expiring_soon" | "expired" | "stale" | "missing" | "missing_metadata" | "external";
 type SecretHealth = {
   readonly key: string;
   readonly service: Option<string>;
@@ -150,7 +151,8 @@ type SecretHealth = {
   readonly created: Option<string>;
   readonly expires: Option<string>;
   readonly last_rotated_at: Option<string>;
-  readonly issues: List<string>; /** If this entry is an alias (from_key), the reference it points at (e.g. "secret.X") */
+  readonly issues: List<string>;
+  /** If this entry is an alias (from_key), the reference it points at (e.g. "secret.X") */
   readonly alias_of: Option<string>;
 };
 type AuditResult = {
@@ -163,7 +165,10 @@ type AuditResult = {
   readonly stale: number;
   readonly missing: number;
   readonly missing_metadata: number;
-  readonly orphaned: number; /** Count of entries that are aliases (from_key). Included in `secrets` but reported separately for visibility. */
+  /** Count of entries whose value is managed outside envpkt (external = true). Reported, not a health problem. */
+  readonly external: number;
+  readonly orphaned: number;
+  /** Count of entries that are aliases (from_key). Included in `secrets` but reported separately for visibility. */
   readonly aliases: number;
   readonly identity?: Identity;
 };
@@ -173,7 +178,8 @@ type EnvDriftEntry = {
   readonly defaultValue: string;
   readonly currentValue: string | undefined;
   readonly status: EnvDriftStatus;
-  readonly purpose: string | undefined; /** If this entry is an alias (from_key), the reference it points at (e.g. "env.X") */
+  readonly purpose: string | undefined;
+  /** If this entry is an alias (from_key), the reference it points at (e.g. "env.X") */
   readonly alias_of: Option<string>;
 };
 type EnvAuditResult = {
@@ -259,7 +265,8 @@ type CatalogError = {
   readonly message: string;
 };
 type AliasTable = {
-  /** key → { type: "secret"|"env", targetType, targetKey } for every alias entry */readonly entries: ReadonlyMap<string, {
+  /** key → { type: "secret"|"env", targetType, targetKey } for every alias entry */
+  readonly entries: ReadonlyMap<string, {
     readonly kind: "secret" | "env";
     readonly targetKind: "secret" | "env";
     readonly targetKey: string;
@@ -332,6 +339,7 @@ type BootError = ConfigError | FnoxError | CatalogError | AliasError | {
   readonly _tag: "SealKeyUnavailable";
   readonly sealedKeys: ReadonlyArray<string>;
   readonly searched: ReadonlyArray<string>;
+  readonly configuredKeyFile?: string;
 } | IdentityError;
 type IdentityError = {
   readonly _tag: "AgeNotFound";
@@ -571,7 +579,9 @@ type DotenvEntry = {
   readonly secret: boolean;
 };
 type FormatDotenvOptions = {
-  /** Write secret values into the output. Default true (matches `env export`/`env github`). */readonly includeSecrets?: boolean; /** A pre-formatted comment block (each line `#`-prefixed) placed at the top. */
+  /** Write secret values into the output. Default true (matches `env export`/`env github`). */
+  readonly includeSecrets?: boolean;
+  /** A pre-formatted comment block (each line `#`-prefixed) placed at the top. */
   readonly header?: string;
 };
 /**

package/dist/index.js

@@ -74,6 +74,7 @@ const SecretMetaSchema = Type.Object({
 	encrypted_value: Type.Optional(Type.String({ description: "Age-encrypted secret value (armored ciphertext, safe to commit)" })),
 	from_key: Type.Optional(Type.String({ description: "Reference another entry (format: 'secret.<KEY>') whose resolved value this alias reuses. Mutually exclusive with encrypted_value." })),
 	required: Type.Optional(Type.Boolean({ description: "Whether this secret is required for operation" })),
+	external: Type.Optional(Type.Boolean({ description: "Value is managed outside envpkt (e.g. a Cloudflare/Vault secret). The entry registers the name for inventory and dev/prod parity only: seal never touches it, and audit reports it as 'external' rather than 'missing'." })),
 	tags: Type.Optional(Type.Record(Type.String(), Type.String(), { description: "Key-value tags for grouping and filtering" })),
 	namespace: Type.Optional(Type.String({ description: "Override the file-level namespace for this entry's injected name. Empty string opts out of any prefix." }))
 }, { description: "Metadata about a single secret" });
@@ -198,7 +199,8 @@ const walkUpForConfig = (dir) => {
 };
 /** Discover config by walking up from CWD, then ENVPKT_SEARCH_PATH, then dynamic Platform paths */
 const discoverConfig = (cwd) => {
-	const walked = walkUpForConfig(cwd ?? process.cwd()).orUndefined();
+	const dir = cwd ?? process.cwd();
+	const walked = walkUpForConfig(dir).orUndefined();
 	if (walked) return Option({
 		path: walked,
 		source: "cwd"
@@ -635,7 +637,8 @@ const classifySecret = (key, meta, fnoxKeys, staleWarningDays, requireExpiration
 	const isExpiringSoon = daysRemaining.fold(() => false, (d) => d >= 0 && d <= WARN_BEFORE_DAYS);
 	const isStale = daysSinceRotation.fold(() => false, (d) => d > staleWarningDays);
 	const hasSealed = !!meta.encrypted_value;
-	const isMissing = fnoxKeys.size > 0 && !fnoxKeys.has(key) && !hasSealed;
+	const isExternal = meta.external === true;
+	const isMissing = !isExternal && fnoxKeys.size > 0 && !fnoxKeys.has(key) && !hasSealed;
 	const isMissingMetadata = requireExpiration && expires.isNone() || requireService && service.isNone();
 	if (isExpired) issues.push("Secret has expired");
 	if (isExpiringSoon) issues.push(`Expires in ${daysRemaining.fold(() => "?", (d) => String(d))} days`);
@@ -652,7 +655,7 @@ const classifySecret = (key, meta, fnoxKeys, staleWarningDays, requireExpiration
 	return {
 		key,
 		service,
-		status: Cond.of().when(isExpired, "expired").elseWhen(isMissing, "missing").elseWhen(isMissingMetadata, "missing_metadata").elseWhen(isExpiringSoon, "expiring_soon").elseWhen(isStale, "stale").else("healthy"),
+		status: Cond.of().when(isExpired, "expired").elseWhen(isMissing, "missing").elseWhen(isMissingMetadata, "missing_metadata").elseWhen(isExpiringSoon, "expiring_soon").elseWhen(isStale, "stale").elseWhen(isExternal, "external").else("healthy"),
 		days_remaining: daysRemaining,
 		rotation_url: rotationUrl,
 		purpose,
@@ -691,7 +694,6 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 	const secretEntries = config.secret ?? {};
 	const nonAliasEntries = Object.entries(secretEntries).filter(([, meta]) => meta.from_key === void 0);
 	const aliasEntries = Object.entries(secretEntries).filter(([, meta]) => meta.from_key !== void 0);
-	const nonAliasMetaKeys = Set$1(nonAliasEntries.map(([k]) => k));
 	const nonAliasHealth = nonAliasEntries.map(([key, meta]) => classifySecret(key, meta, keys, staleWarningDays, requireExpiration, requireService, now));
 	const healthByKey = Map$1(nonAliasHealth.map((h) => [h.key, h]));
 	const parseTargetKey = (from_key) => {
@@ -717,13 +719,14 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 		}), (health) => classifyAlias(key, meta, health, targetRef));
 	});
 	const secrets = List([...nonAliasHealth, ...aliasHealth]);
-	const orphaned = keys.size > 0 ? nonAliasMetaKeys.toArray().filter((k) => !keys.has(k)).length : 0;
+	const orphaned = keys.size > 0 ? nonAliasEntries.filter(([k, meta]) => !keys.has(k) && meta.external !== true).length : 0;
 	const total = secrets.size;
 	const expired = secrets.count((s) => s.status === "expired");
 	const missing = secrets.count((s) => s.status === "missing");
 	const missing_metadata = secrets.count((s) => s.status === "missing_metadata");
 	const expiring_soon = secrets.count((s) => s.status === "expiring_soon");
 	const stale = secrets.count((s) => s.status === "stale");
+	const external = secrets.count((s) => s.status === "external");
 	const healthy = secrets.count((s) => s.status === "healthy");
 	const aliases = aliasHealth.length;
 	return {
@@ -736,6 +739,7 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 		stale,
 		missing,
 		missing_metadata,
+		external,
 		orphaned,
 		aliases,
 		identity: config.identity
@@ -747,7 +751,8 @@ const computeEnvAudit = (config, env = process.env) => {
 	const envWire = (key) => namer(key, envEntries[key]?.namespace);
 	const resolveEffectiveDefault = (entry) => {
 		return Do(function* () {
-			return yield* $(Option((yield* $(Option(envEntries[yield* $(Option((yield* $(Option(entry.from_key))).match(/^env\.(.+)$/)?.[1]))]))).value));
+			const targetKey = yield* $(Option((yield* $(Option(entry.from_key))).match(/^env\.(.+)$/)?.[1]));
+			return yield* $(Option((yield* $(Option(envEntries[targetKey]))).value));
 		}).orElse(entry.value ?? "");
 	};
 	const entries = Object.entries(envEntries).map(([key, entry]) => {
@@ -1596,7 +1601,8 @@ const fnoxExport = (profile, agentKey) => {
 			const eq = line.indexOf("=");
 			if (eq > 0) {
 				const key = line.slice(0, eq).trim();
-				entries[key] = line.slice(eq + 1).trim();
+				const value = line.slice(eq + 1).trim();
+				entries[key] = value;
 			}
 		});
 		return Right(entries);
@@ -1977,11 +1983,13 @@ const resolveSealIdentity = (config, configDir) => {
 	});
 	const inlineKey = resolveInlineKey().orUndefined();
 	if (inlineKey) return Option(materializeInlineKey(inlineKey));
-	const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
-	if (existsSync(defaultPath)) return Option({
-		path: defaultPath,
-		dispose: noop
-	});
+	if (!config.identity?.key_file) {
+		const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
+		if (existsSync(defaultPath)) return Option({
+			path: defaultPath,
+			dispose: noop
+		});
+	}
 	return Option(void 0);
 };
 /** Describe the seal-identity precedence chain with per-entry status, for a clear no-key error. */
@@ -1996,7 +2004,7 @@ const describeSealKeySearch = (config, configDir) => {
 		keyFileLine,
 		envFileLine,
 		inlineLine,
-		`${defaultPath} (${existsSync(defaultPath) ? "found" : "missing"})`
+		keyFile ? `${defaultPath} (skipped — identity.key_file is set)` : `${defaultPath} (${existsSync(defaultPath) ? "found" : "missing"})`
 	];
 };
 const resolveIdentityKey = (config, configDir) => {
@@ -2072,7 +2080,8 @@ const bootSafe = (options) => {
 		if (hasSealedValues && sealIdentity.isEmpty) return Left({
 			_tag: "SealKeyUnavailable",
 			sealedKeys: nonAliasMetaKeys.filter((k) => !!nonAliasSecretEntries[k]?.encrypted_value),
-			searched: describeSealKeySearch(config, configDir)
+			searched: describeSealKeySearch(config, configDir),
+			configuredKeyFile: config.identity?.key_file ? resolve(configDir, expandPath(config.identity.key_file)) : void 0
 		});
 		return checkExpiration(audit, failOnExpired, warnOnly).map((warnings) => {
 			const secrets = {};
@@ -2167,7 +2176,8 @@ const bootSafe = (options) => {
 				}
 				const targetEntry = envEntries[entry.targetKey];
 				if (targetEntry?.value === void 0) return;
-				envDefaults[aliasKey] = process.env[envEnv(entry.targetKey)] ?? targetEntry.value;
+				const resolvedTarget = process.env[envEnv(entry.targetKey)] ?? targetEntry.value;
+				envDefaults[aliasKey] = resolvedTarget;
 			});
 			if (inject) {
 				Object.entries(envDefaults).forEach(([key, value]) => {
@@ -2225,12 +2235,13 @@ const formatBootError = (error) => {
 		case "SealKeyUnavailable": {
 			const keys = error.sealedKeys.length;
 			const searched = error.searched.map((line) => `  • ${line}`).join("\n");
+			const restoreLine = error.configuredKeyFile ? `  • Restore the configured key to ${error.configuredKeyFile} (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)` : `  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`;
 			return [
 				`${keys} sealed secret(s) can't be decrypted — no age key found.`,
 				`Searched (in order):`,
 				searched,
 				`Fix one:`,
-				`  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`,
+				restoreLine,
 				`  • Re-provision from source: envpkt seal --edit <KEY>`,
 				`Refusing to inject empty values for sealed secrets.`
 			].join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envpkt",
-  "version": "0.13.6",
+  "version": "0.14.1",
   "description": "Credential lifecycle and fleet management for AI agents",
   "keywords": [
     "credentials",
@@ -39,19 +39,19 @@
     "prepublishOnly": "pnpm validate"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@sinclair/typebox": "^0.34.49",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@sinclair/typebox": "^0.34.52",
     "commander": "^15.0.0",
-    "functype": "^1.5.0",
-    "functype-log": "^1.5.0",
-    "functype-os": "^1.5.0",
-    "smol-toml": "^1.7.0"
+    "functype": "^1.8.0",
+    "functype-log": "^1.8.0",
+    "functype-os": "^1.8.0",
+    "smol-toml": "^1.7.1"
   },
   "devDependencies": {
-    "@types/node": "^24.13.2",
-    "ts-builds": "^3.2.1",
-    "tsdown": "^0.22.3",
-    "tsx": "^4.22.4"
+    "@types/node": "^24.13.3",
+    "ts-builds": "^3.2.3",
+    "tsdown": "^0.22.14",
+    "tsx": "^4.23.1"
   },
   "type": "module",
   "main": "./dist/index.js",
@@ -71,5 +71,5 @@
     "schemas"
   ],
   "prettier": "ts-builds/prettier",
-  "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b"
+  "packageManager": "pnpm@11.18.0+sha512.33d83c77da82f49fba836925c6f1b841181ec3132b670639bd012f7075f5c7cf634c5f870147c19aae7478fac01df09d8892e880454896edd23ee9b33757563c"
 }

package/schemas/envpkt.schema.json

@@ -195,6 +195,10 @@
               "description": "Whether this secret is required for operation",
               "type": "boolean"
             },
+            "external": {
+              "description": "Value is managed outside envpkt (e.g. a Cloudflare/Vault secret). The entry registers the name for inventory and dev/prod parity only: seal never touches it, and audit reports it as 'external' rather than 'missing'.",
+              "type": "boolean"
+            },
             "tags": {
               "description": "Key-value tags for grouping and filtering",
               "type": "object",