envpkt 0.14.0 → 0.14.1

package/dist/cli.js

@@ -728,12 +728,13 @@ const formatError = (error) => {
 		case "IdentityNotFound": return `${RED}Error:${RESET} Identity file not found: ${error.path}`;
 		case "SealKeyUnavailable": {
 			const e = error;
+			const restoreLine = e.configuredKeyFile ? `  • Restore the configured key to ${e.configuredKeyFile} (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)` : `  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`;
 			return [
 				`${RED}Error:${RESET} ${e.sealedKeys.length} sealed secret(s) can't be decrypted — no age key found.`,
 				`${DIM}Searched (in order):${RESET}`,
 				e.searched.map((l) => `  • ${l}`).join("\n"),
 				`${DIM}Fix one:${RESET}`,
-				`  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`,
+				restoreLine,
 				`  • Re-provision from source: envpkt seal --edit <KEY>`
 			].join("\n");
 		}
@@ -1404,11 +1405,13 @@ const resolveSealIdentity = (config, configDir) => {
 	});
 	const inlineKey = resolveInlineKey().orUndefined();
 	if (inlineKey) return Option(materializeInlineKey(inlineKey));
-	const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
-	if (existsSync(defaultPath)) return Option({
-		path: defaultPath,
-		dispose: noop
-	});
+	if (!config.identity?.key_file) {
+		const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
+		if (existsSync(defaultPath)) return Option({
+			path: defaultPath,
+			dispose: noop
+		});
+	}
 	return Option(void 0);
 };
 /** Describe the seal-identity precedence chain with per-entry status, for a clear no-key error. */
@@ -1423,7 +1426,7 @@ const describeSealKeySearch = (config, configDir) => {
 		keyFileLine,
 		envFileLine,
 		inlineLine,
-		`${defaultPath} (${existsSync(defaultPath) ? "found" : "missing"})`
+		keyFile ? `${defaultPath} (skipped — identity.key_file is set)` : `${defaultPath} (${existsSync(defaultPath) ? "found" : "missing"})`
 	];
 };
 const resolveIdentityKey = (config, configDir) => {
@@ -1499,7 +1502,8 @@ const bootSafe = (options) => {
 		if (hasSealedValues && sealIdentity.isEmpty) return Left({
 			_tag: "SealKeyUnavailable",
 			sealedKeys: nonAliasMetaKeys.filter((k) => !!nonAliasSecretEntries[k]?.encrypted_value),
-			searched: describeSealKeySearch(config, configDir)
+			searched: describeSealKeySearch(config, configDir),
+			configuredKeyFile: config.identity?.key_file ? resolve(configDir, expandPath(config.identity.key_file)) : void 0
 		});
 		return checkExpiration(audit, failOnExpired, warnOnly).map((warnings) => {
 			const secrets = {};

package/dist/index.d.ts

@@ -339,6 +339,7 @@ type BootError = ConfigError | FnoxError | CatalogError | AliasError | {
   readonly _tag: "SealKeyUnavailable";
   readonly sealedKeys: ReadonlyArray<string>;
   readonly searched: ReadonlyArray<string>;
+  readonly configuredKeyFile?: string;
 } | IdentityError;
 type IdentityError = {
   readonly _tag: "AgeNotFound";

package/dist/index.js

@@ -1983,11 +1983,13 @@ const resolveSealIdentity = (config, configDir) => {
 	});
 	const inlineKey = resolveInlineKey().orUndefined();
 	if (inlineKey) return Option(materializeInlineKey(inlineKey));
-	const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
-	if (existsSync(defaultPath)) return Option({
-		path: defaultPath,
-		dispose: noop
-	});
+	if (!config.identity?.key_file) {
+		const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
+		if (existsSync(defaultPath)) return Option({
+			path: defaultPath,
+			dispose: noop
+		});
+	}
 	return Option(void 0);
 };
 /** Describe the seal-identity precedence chain with per-entry status, for a clear no-key error. */
@@ -2002,7 +2004,7 @@ const describeSealKeySearch = (config, configDir) => {
 		keyFileLine,
 		envFileLine,
 		inlineLine,
-		`${defaultPath} (${existsSync(defaultPath) ? "found" : "missing"})`
+		keyFile ? `${defaultPath} (skipped — identity.key_file is set)` : `${defaultPath} (${existsSync(defaultPath) ? "found" : "missing"})`
 	];
 };
 const resolveIdentityKey = (config, configDir) => {
@@ -2078,7 +2080,8 @@ const bootSafe = (options) => {
 		if (hasSealedValues && sealIdentity.isEmpty) return Left({
 			_tag: "SealKeyUnavailable",
 			sealedKeys: nonAliasMetaKeys.filter((k) => !!nonAliasSecretEntries[k]?.encrypted_value),
-			searched: describeSealKeySearch(config, configDir)
+			searched: describeSealKeySearch(config, configDir),
+			configuredKeyFile: config.identity?.key_file ? resolve(configDir, expandPath(config.identity.key_file)) : void 0
 		});
 		return checkExpiration(audit, failOnExpired, warnOnly).map((warnings) => {
 			const secrets = {};
@@ -2232,12 +2235,13 @@ const formatBootError = (error) => {
 		case "SealKeyUnavailable": {
 			const keys = error.sealedKeys.length;
 			const searched = error.searched.map((line) => `  • ${line}`).join("\n");
+			const restoreLine = error.configuredKeyFile ? `  • Restore the configured key to ${error.configuredKeyFile} (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)` : `  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`;
 			return [
 				`${keys} sealed secret(s) can't be decrypted — no age key found.`,
 				`Searched (in order):`,
 				searched,
 				`Fix one:`,
-				`  • Restore your key to ~/.envpkt/age-key.txt (or set ENVPKT_AGE_KEY_FILE / ENVPKT_AGE_KEY)`,
+				restoreLine,
 				`  • Re-provision from source: envpkt seal --edit <KEY>`,
 				`Refusing to inject empty values for sealed secrets.`
 			].join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envpkt",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Credential lifecycle and fleet management for AI agents",
   "keywords": [
     "credentials",
@@ -39,18 +39,18 @@
     "prepublishOnly": "pnpm validate"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@sinclair/typebox": "^0.34.52",
     "commander": "^15.0.0",
-    "functype": "^1.6.3",
-    "functype-log": "^1.6.3",
-    "functype-os": "^1.6.3",
-    "smol-toml": "^1.7.0"
+    "functype": "^1.8.0",
+    "functype-log": "^1.8.0",
+    "functype-os": "^1.8.0",
+    "smol-toml": "^1.7.1"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
-    "ts-builds": "^3.2.2",
-    "tsdown": "^0.22.9",
+    "ts-builds": "^3.2.3",
+    "tsdown": "^0.22.14",
     "tsx": "^4.23.1"
   },
   "type": "module",
@@ -71,5 +71,5 @@
     "schemas"
   ],
   "prettier": "ts-builds/prettier",
-  "packageManager": "pnpm@11.15.0+sha512.266f8957a30d2be6e9468e5e66bcdedd35a794175f71b067ba8504d686cce1d0c0f429b33c323c3c569ad4891e667574a49ff71d1b89a22cc66f13c65818c578"
+  "packageManager": "pnpm@11.18.0+sha512.33d83c77da82f49fba836925c6f1b841181ec3132b670639bd012f7075f5c7cf634c5f870147c19aae7478fac01df09d8892e880454896edd23ee9b33757563c"
 }