envpkt 0.14.1 → 0.16.0

package/dist/cli.js

@@ -15,6 +15,7 @@ import { randomBytes } from "node:crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { text } from "node:stream/consumers";
 import { createInterface } from "node:readline";
 //#region src/core/namespace.ts
 const DEFAULT_SEPARATOR = "__";
@@ -123,14 +124,15 @@ const computeAudit = (config, fnoxKeys, today, aliasTable) => {
 	const staleWarningDays = lifecycle.stale_warning_days ?? 90;
 	const requireExpiration = lifecycle.require_expiration ?? false;
 	const requireService = lifecycle.require_service ?? false;
-	const keys = fnoxKeys ?? /* @__PURE__ */ new Set();
+	const keys = fnoxKeys ?? Set$1.empty();
 	const secretEntries = config.secret ?? {};
 	const nonAliasEntries = Object.entries(secretEntries).filter(([, meta]) => meta.from_key === void 0);
 	const aliasEntries = Object.entries(secretEntries).filter(([, meta]) => meta.from_key !== void 0);
 	const nonAliasHealth = nonAliasEntries.map(([key, meta]) => classifySecret(key, meta, keys, staleWarningDays, requireExpiration, requireService, now));
 	const healthByKey = Map$1(nonAliasHealth.map((h) => [h.key, h]));
 	const parseTargetKey = (from_key) => {
-		return Option(from_key.match(/^secret\.(.+)$/)?.[1]);
+		const match = from_key.match(/^secret\.(.+)$/);
+		return Option(match?.[1]);
 	};
 	const aliasHealth = aliasEntries.map(([key, meta]) => {
 		const tableEntry = aliasTable?.entries.get(`secret.${key}`);
@@ -184,8 +186,10 @@ const computeEnvAudit = (config, env = process.env) => {
 	const envWire = (key) => namer(key, envEntries[key]?.namespace);
 	const resolveEffectiveDefault = (entry) => {
 		return Do(function* () {
-			const targetKey = yield* $(Option((yield* $(Option(entry.from_key))).match(/^env\.(.+)$/)?.[1]));
-			return yield* $(Option((yield* $(Option(envEntries[targetKey]))).value));
+			const fk = yield* $(Option(entry.from_key));
+			const targetKey = yield* $(Option(fk.match(/^env\.(.+)$/)?.[1]));
+			const targetEntry = yield* $(Option(envEntries[targetKey]));
+			return yield* $(Option(targetEntry.value));
 		}).orElse(entry.value ?? "");
 	};
 	const entries = Object.entries(envEntries).map(([key, entry]) => {
@@ -241,6 +245,21 @@ const NamespaceSchema = Type.Object({
 		description: "Separator between prefix and key. Default '__' (shell-safe). Note: '.' and ':' are not valid in shell identifiers."
 	}))
 }, { description: "Optional namespace/package prefix for injected environment variable names" });
+const McpHeaderSchema = Type.Object({
+	server: Type.String({
+		minLength: 1,
+		description: "MCP server name, as keyed in .mcp.json"
+	}),
+	header: Type.Optional(Type.String({
+		default: "Authorization",
+		minLength: 1,
+		description: "HTTP header name to send the secret in"
+	})),
+	scheme: Type.Optional(Type.String({
+		default: "Bearer",
+		description: "Prefix placed before the value (e.g. 'Bearer'). Empty string sends the raw value."
+	}))
+}, { description: "Send this secret as an HTTP header to an MCP server" });
 const SecretMetaSchema = Type.Object({
 	service: Type.Optional(Type.String({ description: "Service or system this secret authenticates to" })),
 	expires: Type.Optional(Type.String({
@@ -271,7 +290,8 @@ const SecretMetaSchema = Type.Object({
 	required: Type.Optional(Type.Boolean({ description: "Whether this secret is required for operation" })),
 	external: Type.Optional(Type.Boolean({ description: "Value is managed outside envpkt (e.g. a Cloudflare/Vault secret). The entry registers the name for inventory and dev/prod parity only: seal never touches it, and audit reports it as 'external' rather than 'missing'." })),
 	tags: Type.Optional(Type.Record(Type.String(), Type.String(), { description: "Key-value tags for grouping and filtering" })),
-	namespace: Type.Optional(Type.String({ description: "Override the file-level namespace for this entry's injected name. Empty string opts out of any prefix." }))
+	namespace: Type.Optional(Type.String({ description: "Override the file-level namespace for this entry's injected name. Empty string opts out of any prefix." })),
+	mcp: Type.Optional(Type.Array(McpHeaderSchema, { description: "MCP servers this secret authenticates to. Read by `envpkt headers` (Claude Code headersHelper)." }))
 }, { description: "Metadata about a single secret" });
 const LifecycleConfigSchema = Type.Object({
 	stale_warning_days: Type.Optional(Type.Number({
@@ -399,10 +419,13 @@ const discoverConfig = (cwd) => {
 		template,
 		expanded: expandPath(template)
 	})).filter(({ expanded }) => expanded !== "" && !expanded.startsWith("/.envpkt")).map(({ expanded }) => expandGlobPath(expanded)).find((matches) => matches.length > 0);
-	if (customMatch) return Option({
-		path: customMatch[0],
-		source: "search"
-	});
+	if (customMatch) {
+		const found = {
+			path: customMatch[0],
+			source: "search"
+		};
+		return Option(found);
+	}
 	const platformMatch = buildSearchPaths().find((p) => Fs.existsSync(p));
 	if (platformMatch) return Option({
 		path: platformMatch,
@@ -444,9 +467,10 @@ const parseToml = (raw) => Try(() => parse(raw)).fold((err) => Left({
 /** Validate parsed data against the TypeBox schema */
 const validateConfig = (data) => {
 	if (compiledSchema.Check(data)) return Right(data);
+	const errors = List([...compiledSchema.Errors(data)].map((e) => `${e.path}: ${e.message}`));
 	return Left({
 		_tag: "ValidationError",
-		errors: List([...compiledSchema.Errors(data)].map((e) => `${e.path}: ${e.message}`))
+		errors
 	});
 };
 /** Load and validate an envpkt.toml from a file path */
@@ -856,7 +880,8 @@ const runAudit = (options) => {
 			console.error(formatError(err));
 			process.exit(2);
 		}, (rawConfig) => {
-			resolveConfig(rawConfig, dirname(path)).fold((err) => {
+			const configDir = dirname(path);
+			resolveConfig(rawConfig, configDir).fold((err) => {
 				console.error(formatError(err));
 				process.exit(2);
 			}, (resolveResult) => {
@@ -898,7 +923,7 @@ const runAuditOnConfig = (config, options) => {
 			secrets: audit.secrets.filter((s) => !!secretEntries[s.key].encrypted_value)
 		};
 	})() : audit;
-	const afterExternal = options.external ? (() => {
+	const afterUnsealed = options.unsealed ? (() => {
 		const secretEntries = config.secret ?? {};
 		return {
 			...afterSealed,
@@ -906,9 +931,9 @@ const runAuditOnConfig = (config, options) => {
 		};
 	})() : afterSealed;
 	const afterStatus = options.status ? {
-		...afterExternal,
-		secrets: afterExternal.secrets.filter((s) => s.status === options.status)
-	} : afterExternal;
+		...afterUnsealed,
+		secrets: afterUnsealed.secrets.filter((s) => s.status === options.status)
+	} : afterUnsealed;
 	const filtered = Option(options.expiring).fold(() => afterStatus, (expiring) => ({
 		...afterStatus,
 		secrets: afterStatus.secrets.filter((s) => s.days_remaining.fold(() => false, (d) => d >= 0 && d <= expiring))
@@ -920,8 +945,10 @@ const runAuditOnConfig = (config, options) => {
 	if (options.format === "json") console.log(formatAuditJson(sorted));
 	else if (options.format === "minimal") console.log(formatAuditMinimal(sorted));
 	else console.log(formatAudit(sorted));
-	if (options.all) if (options.format === "json") console.log(formatEnvAuditJson(config));
-	else formatEnvAuditTable(config);
+	if (options.all) {
+		if (options.format === "json") console.log(formatEnvAuditJson(config));
+		else formatEnvAuditTable(config);
+	}
 	const code = options.strict ? exitCodeForAudit(audit) : audit.status === "critical" ? 2 : 0;
 	process.exit(code);
 };
@@ -1497,7 +1524,8 @@ const bootSafe = (options) => {
 			_tag: "ReadError",
 			message: "unexpected"
 		}));
-		const audit = computeAudit(config, detectFnoxKeys(configDir), void 0, aliasTable);
+		const fnoxKeys = detectFnoxKeys(configDir);
+		const audit = computeAudit(config, fnoxKeys, void 0, aliasTable);
 		const sealIdentity = hasSealedValues ? resolveSealIdentity(config, configDir) : Option(void 0);
 		if (hasSealedValues && sealIdentity.isEmpty) return Left({
 			_tag: "SealKeyUnavailable",
@@ -1539,37 +1567,39 @@ const bootSafe = (options) => {
 				}
 			});
 			const remainingKeys = nonAliasMetaKeys.filter((k) => !sealedKeys.has(k));
-			if (remainingKeys.length > 0) if (fnoxAvailable()) fnoxExport(opts.profile, identityKey.orUndefined()).fold((err) => {
-				log.warn("phase.fnox.export_failed", {
-					message: err.message,
-					skipped: remainingKeys.length
-				});
-				warnings.push(`fnox export failed: ${err.message}`);
-				skipped.push(...remainingKeys);
-			}, (exported) => {
-				const found = remainingKeys.filter((key) => key in exported);
-				const notFound = remainingKeys.filter((key) => !(key in exported));
-				found.forEach((key) => {
-					secrets[key] = exported[key];
-					log.debug("phase.fnox.resolved", {
-						key,
-						profile: opts.profile
+			if (remainingKeys.length > 0) {
+				if (fnoxAvailable()) fnoxExport(opts.profile, identityKey.orUndefined()).fold((err) => {
+					log.warn("phase.fnox.export_failed", {
+						message: err.message,
+						skipped: remainingKeys.length
 					});
-				});
-				notFound.forEach((key) => {
-					log.debug("phase.fnox.not_in_export", {
-						key,
-						profile: opts.profile
+					warnings.push(`fnox export failed: ${err.message}`);
+					skipped.push(...remainingKeys);
+				}, (exported) => {
+					const found = remainingKeys.filter((key) => key in exported);
+					const notFound = remainingKeys.filter((key) => !(key in exported));
+					found.forEach((key) => {
+						secrets[key] = exported[key];
+						log.debug("phase.fnox.resolved", {
+							key,
+							profile: opts.profile
+						});
 					});
+					notFound.forEach((key) => {
+						log.debug("phase.fnox.not_in_export", {
+							key,
+							profile: opts.profile
+						});
+					});
+					injected.push(...found);
+					skipped.push(...notFound);
 				});
-				injected.push(...found);
-				skipped.push(...notFound);
-			});
-			else {
-				log.debug("phase.fnox.unavailable", { skipped: remainingKeys.length });
-				if (!hasSealedValues) warnings.push("fnox not available — no secrets injected");
-				else warnings.push("fnox not available — unsealed secrets could not be resolved");
-				skipped.push(...remainingKeys);
+				else {
+					log.debug("phase.fnox.unavailable", { skipped: remainingKeys.length });
+					if (!hasSealedValues) warnings.push("fnox not available — no secrets injected");
+					else warnings.push("fnox not available — unsealed secrets could not be resolved");
+					skipped.push(...remainingKeys);
+				}
 			}
 			aliasSecretKeys.forEach((aliasKey) => {
 				const entry = aliasTable.entries.get(`secret.${aliasKey}`);
@@ -1635,7 +1665,8 @@ const tomlInlineTable = (rec) => {
 };
 /**
 * The SecretMeta to write into the destination on copy.
-* - `created` is reset to today: the entry is new *here*, regardless of the source's age.
+* - `created` comes from the caller, never the source: today for an entry new to the
+*   destination, or the destination's own `created` when the copy overwrites it.
 * - `last_rotated_at` is dropped — it's the source's rotation history, not the copy's.
 * - `encryptedValue` re-derives the ciphertext: `Some(cipher)` sets the resealed value,
 *   `None` strips it entirely (a metadata-only copy of a secret with no sealed value).
@@ -1644,10 +1675,10 @@ const copyableSecretMeta = (meta, opts) => {
 	const { last_rotated_at: _lra, encrypted_value: _ev, ...rest } = meta;
 	return opts.encryptedValue.fold(() => ({
 		...rest,
-		created: opts.today
+		created: opts.created
 	}), (cipher) => ({
 		...rest,
-		created: opts.today,
+		created: opts.created,
 		encrypted_value: cipher
 	}));
 };
@@ -1722,11 +1753,28 @@ const findSectionRange = (lines, sectionHeader) => {
 		end: List(lines.slice(start + 1)).zipWithIndex().foldLeft(initial)((state, entry) => scanSectionBoundary(state, entry[0], start + 1 + entry[1])).end
 	};
 };
+/**
+* End (exclusive) of a section's own lines: through its last field, before the blank and
+* comment lines that run up to the next header. Those trailing lines separate it from its
+* neighbour (or are the neighbour's doc comment), so edits to this section leave them alone.
+*/
+const sectionBodyEnd = (lines, range) => {
+	const lastContent = lines.slice(range.start, range.end).findLastIndex((l) => {
+		const t = l.trim();
+		return t !== "" && !t.startsWith("#");
+	});
+	return range.start + lastContent + 1;
+};
+const dropTrailingBlanks = (xs) => xs.slice(0, xs.findLastIndex((l) => l.trim() !== "") + 1);
+const dropLeadingBlanks = (xs) => {
+	const first = xs.findIndex((l) => l.trim() !== "");
+	return first === -1 ? [] : xs.slice(first);
+};
 /** Check whether a section header exists in the raw TOML */
 const sectionExists = (lines, sectionHeader) => lines.some((l) => l.trim() === sectionHeader);
 /**
-* Remove a TOML section (e.g. `[secret.X]`) and all its fields through the next section or EOF.
-* Strips trailing blank lines left behind.
+* Remove a TOML section (e.g. `[secret.X]`) and all its fields. A comment above the next
+* section stays. The sections on either side end up one blank line apart.
 */
 const removeSection = (raw, sectionHeader) => {
 	const lines = raw.split("\n");
@@ -1735,11 +1783,33 @@ const removeSection = (raw, sectionHeader) => {
 		_tag: "SectionNotFound",
 		section: sectionHeader
 	});
-	const after = lines.slice(range.end);
-	const beforeAll = lines.slice(0, range.start);
-	const lastNonBlank = beforeAll.findLastIndex((l) => l.trim() !== "");
-	const result = [...lastNonBlank === -1 ? [] : beforeAll.slice(0, lastNonBlank + 1), ...after].join("\n");
-	return Either.right(result);
+	const before = dropTrailingBlanks(lines.slice(0, range.start));
+	const after = dropLeadingBlanks(lines.slice(sectionBodyEnd(lines, range)));
+	if (after.length === 0) return Either.right([...before, ...raw.endsWith("\n") ? [""] : []].join("\n"));
+	if (before.length === 0) return Either.right(after.join("\n"));
+	return Either.right([
+		...before,
+		"",
+		...after
+	].join("\n"));
+};
+/**
+* Replace a TOML section with `block`, in place. Lines outside the section, including the
+* blank and comment lines between it and the next header, are left as they were.
+*/
+const replaceSection = (raw, sectionHeader, block) => {
+	const lines = raw.split("\n");
+	const range = findSectionRange(lines, sectionHeader);
+	if (!range) return Either.left({
+		_tag: "SectionNotFound",
+		section: sectionHeader
+	});
+	const replaced = [
+		...lines.slice(0, range.start),
+		...block.trimEnd().split("\n"),
+		...lines.slice(sectionBodyEnd(lines, range))
+	];
+	return Either.right(replaced.join("\n"));
 };
 /**
 * Rename a TOML section header (e.g. `[secret.OLD]` → `[secret.NEW]`).
@@ -1964,16 +2034,114 @@ const sortConfigToml = (raw) => {
 	return `${parts.join("\n\n")}\n`;
 };
 //#endregion
+//#region src/core/mcp-headers.ts
+const DEFAULT_HEADER = "Authorization";
+const DEFAULT_SCHEME = "Bearer";
+/** RFC 9110 `token`: the legal characters of a header name (and of an auth scheme). */
+const TOKEN_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+/** Characters that would split or corrupt an HTTP header value. */
+const UNSAFE_VALUE_RE = /[\r\n\0]/;
+/** Flatten every `[secret.*].mcp` entry into one binding per (secret, server), with defaults applied. */
+const collectBindings = (config) => Object.entries(config.secret ?? {}).flatMap(([key, meta]) => (meta.mcp ?? []).map((m) => ({
+	key,
+	server: m.server,
+	header: m.header ?? DEFAULT_HEADER,
+	scheme: m.scheme ?? DEFAULT_SCHEME
+})));
+/**
+* Check bindings for structural problems: header names and schemes that are not HTTP
+* tokens, and two bindings claiming the same (server, header) pair. Header names compare
+* case-insensitively, as HTTP does.
+*/
+const validateBindings = (bindings) => {
+	const badHeader = bindings.find((b) => !TOKEN_RE.test(b.header));
+	if (badHeader) return Left({
+		_tag: "McpHeaderInvalid",
+		key: badHeader.key,
+		server: badHeader.server,
+		header: badHeader.header
+	});
+	const badScheme = bindings.find((b) => b.scheme !== "" && !TOKEN_RE.test(b.scheme));
+	if (badScheme) return Left({
+		_tag: "McpSchemeInvalid",
+		key: badScheme.key,
+		server: badScheme.server,
+		scheme: badScheme.scheme
+	});
+	const claims = bindings.reduce((acc, b) => {
+		const id = `${b.server}\u0000${b.header.toLowerCase()}`;
+		return {
+			...acc,
+			[id]: [...acc[id] ?? [], b]
+		};
+	}, {});
+	const clash = Object.values(claims).find((group) => group.length > 1);
+	if (clash) {
+		const first = clash[0];
+		return Left({
+			_tag: "McpHeaderDuplicate",
+			server: first.server,
+			header: first.header,
+			keys: Set$1(clash.map((b) => b.key)).toArray()
+		});
+	}
+	return Right(void 0);
+};
+/** Check every `mcp` binding in a config. Used by `envpkt validate` and the write gate. */
+const validateMcpHeaders = (config) => validateBindings(collectBindings(config));
+/**
+* Build the HTTP header object for one MCP server: every secret whose `mcp` list names
+* `server`, merged into one object. `values` is keyed by logical secret name (as in
+* `BootResult.secrets`), so namespaces and aliases are already resolved by the caller.
+* Only this server's bindings are checked, so a problem on another server never blocks it.
+*/
+const buildMcpHeaders = (config, values, server) => {
+	const matches = collectBindings(config).filter((b) => b.server === server);
+	if (matches.length === 0) return Left({
+		_tag: "McpServerUnknown",
+		server
+	});
+	return validateBindings(matches).flatMap(() => {
+		const unresolved = matches.filter((b) => !values[b.key]).map((b) => b.key);
+		if (unresolved.length > 0) return Left({
+			_tag: "McpValueUnresolved",
+			server,
+			keys: unresolved
+		});
+		const unsafe = matches.filter((b) => UNSAFE_VALUE_RE.test(values[b.key])).map((b) => b.key);
+		if (unsafe.length > 0) return Left({
+			_tag: "McpValueInvalid",
+			server,
+			keys: unsafe
+		});
+		return Right(Object.fromEntries(matches.map((b) => {
+			const value = values[b.key];
+			return [b.header, b.scheme === "" ? value : `${b.scheme} ${value}`];
+		})));
+	});
+};
+/** Human-readable one-liner for any McpHeadersError tag. Never includes a secret value. */
+const formatMcpHeadersError = (error) => {
+	switch (error._tag) {
+		case "McpHeaderInvalid": return `[secret.${error.key}] mcp server "${error.server}": header "${error.header}" is not a valid HTTP header name`;
+		case "McpSchemeInvalid": return `[secret.${error.key}] mcp server "${error.server}": scheme "${error.scheme}" must be a single word or ""`;
+		case "McpHeaderDuplicate": return `MCP server "${error.server}": header "${error.header}" is claimed by more than one binding: ${error.keys.join(", ")}`;
+		case "McpServerUnknown": return `No secret declares mcp server "${error.server}"`;
+		case "McpValueUnresolved": return `MCP server "${error.server}": no value resolved for ${error.keys.join(", ")}`;
+		case "McpValueInvalid": return `MCP server "${error.server}": value of ${error.keys.join(", ")} contains a line break or NUL and cannot be sent as a header`;
+	}
+};
+//#endregion
 //#region src/core/validate.ts
 /**
-* Validate a raw TOML string as a complete envpkt config: parse → schema → aliases.
+* Validate a raw TOML string as a complete envpkt config: parse → schema → aliases → mcp.
 *
 * Used by write-path CLI commands to verify the post-edit file would still be
 * structurally valid before persisting. Catalog resolution is intentionally
 * excluded — catalog issues depend on external files, not on the local edit,
 * and `envpkt validate` covers them as a separate explicit check.
 */
-const validateRawConfig = (raw) => parseToml(raw).flatMap(validateConfig).flatMap((config) => validateAliases(config).map(() => config));
+const validateRawConfig = (raw) => parseToml(raw).flatMap(validateConfig).flatMap((config) => validateAliases(config).map(() => config)).flatMap((config) => validateMcpHeaders(config).map(() => config));
 /** Human-readable one-liner for any ValidationError tag. */
 const formatValidationError = (err) => {
 	switch (err._tag) {
@@ -1987,6 +2155,9 @@ const formatValidationError = (err) => {
 		case "AliasChained":
 		case "AliasCrossType":
 		case "AliasValueConflict": return formatAliasError(err);
+		case "McpHeaderInvalid":
+		case "McpSchemeInvalid":
+		case "McpHeaderDuplicate": return formatMcpHeadersError(err);
 	}
 };
 //#endregion
@@ -2043,14 +2214,15 @@ const todayIso$2 = () => (/* @__PURE__ */ new Date()).toISOString().split("T")[0
 * Build the `[secret.<destName>]` block for a copy: unseal the source value with the
 * source identity and reseal it for the destination recipient. Secrets with no sealed
 * value are copied as metadata only (with a warning) — there's nothing to reseal.
+* Overwriting an existing destination entry keeps its `created`; a new entry gets today.
 */
 const sealedSecretBlock = (key, destName, srcConfig, srcPath, destConfig) => {
 	const meta = srcConfig.secret[key];
-	const today = todayIso$2();
+	const created = destConfig.secret?.[destName]?.created ?? todayIso$2();
 	if (meta.encrypted_value === void 0 || meta.encrypted_value === "") {
 		console.error(`${YELLOW}Warning:${RESET} secret "${key}" has no sealed value — copying metadata only.`);
 		return serializeSecretBlock(destName, copyableSecretMeta(meta, {
-			today,
+			created,
 			encryptedValue: Option.none()
 		}));
 	}
@@ -2073,14 +2245,15 @@ const sealedSecretBlock = (key, destName, srcConfig, srcPath, destConfig) => {
 		console.error(`${RED}Error:${RESET} "${key}" produced no plaintext on unseal.`);
 		return process.exit(2);
 	}
+	const cipher = orExit(ageEncrypt(plaintext, recipient), (err) => `${RED}Error:${RESET} reseal failed for "${destName}": ${err.message}`, 2);
 	return serializeSecretBlock(destName, copyableSecretMeta(meta, {
-		today,
-		encryptedValue: Option(orExit(ageEncrypt(plaintext, recipient), (err) => `${RED}Error:${RESET} reseal failed for "${destName}": ${err.message}`, 2))
+		created,
+		encryptedValue: Option(cipher)
 	}));
 };
 const writeBlock = (destPath, header, block, overwrite, dryRun, successMsg) => {
 	const raw = readFileSync(destPath, "utf-8");
-	const updated = appendSection(overwrite ? orExit(removeSection(raw, header), (err) => `${RED}Error:${RESET} ${err._tag}: ${err.section}`, 2) : raw, block);
+	const updated = overwrite ? orExit(replaceSection(raw, header, block), (err) => `${RED}Error:${RESET} ${err._tag}: ${err.section}`, 2) : appendSection(raw, block);
 	if (dryRun) {
 		previewIfValid(updated, block);
 		return;
@@ -2121,7 +2294,8 @@ const runCopy = (key, options) => {
 		process.exit(1);
 	}
 	const block = inSecret ? sealedSecretBlock(key, destName, srcConfig, src.path, destConfig) : serializeEnvBlock(destName, srcConfig.env[key]);
-	const successMsg = `${GREEN}✓${RESET} Copied ${kindWord} ${BOLD}${key}${RESET}${destName !== key ? ` → ${BOLD}${destName}${RESET}` : ""} to ${CYAN}${dest.path}${RESET}`;
+	const renamed = destName !== key ? ` → ${BOLD}${destName}${RESET}` : "";
+	const successMsg = `${GREEN}✓${RESET} Copied ${kindWord} ${BOLD}${key}${RESET}${renamed} to ${CYAN}${dest.path}${RESET}`;
 	writeBlock(dest.path, `[${kindWord}.${destName}]`, block, existsInDest, options.dryRun === true, successMsg);
 };
 //#endregion
@@ -2906,7 +3080,8 @@ const VALUE_SHAPE_PATTERNS = [
 ];
 /** Detect service from value prefix/shape */
 const matchValueShape = (value) => {
-	return Option(VALUE_SHAPE_PATTERNS.find((vp) => value.startsWith(vp.prefix))).map((vp) => ({
+	const match = VALUE_SHAPE_PATTERNS.find((vp) => value.startsWith(vp.prefix));
+	return Option(match).map((vp) => ({
 		service: vp.service,
 		description: vp.description
 	}));
@@ -2946,7 +3121,8 @@ const matchEnvVar = (name, value) => {
 		matchedBy: `exact:${exactMatch.pattern}`
 	});
 	return matchValueShape(value).fold(() => {
-		return Option(SUFFIX_PATTERNS.find((sp) => name.endsWith(sp.suffix))).map((sp) => ({
+		const suffixMatch = SUFFIX_PATTERNS.find((sp) => name.endsWith(sp.suffix));
+		return Option(suffixMatch).map((sp) => ({
 			envVar: name,
 			value,
 			service: Option(deriveServiceFromName(name)),
@@ -3148,7 +3324,8 @@ const runEnvCheck = (options) => {
 			console.error(formatError(err));
 			process.exit(2);
 		}, (rawConfig) => {
-			resolveConfig(rawConfig, dirname(path)).fold((err) => {
+			const configDir = dirname(path);
+			resolveConfig(rawConfig, configDir).fold((err) => {
 				console.error(formatError(err));
 				process.exit(2);
 			}, (resolveResult) => {
@@ -3319,7 +3496,9 @@ const runEnvAdd = (name, value, options) => {
 				console.log(block);
 				return;
 			}
-			writeIfValid(configPath, appendSection(readFileSync(configPath, "utf-8"), block), `${GREEN}✓${RESET} Added ${BOLD}${name}${RESET} to ${CYAN}${configPath}${RESET}`);
+			const raw = readFileSync(configPath, "utf-8");
+			const updated = appendSection(raw, block);
+			writeIfValid(configPath, updated, `${GREEN}✓${RESET} Added ${BOLD}${name}${RESET} to ${CYAN}${configPath}${RESET}`);
 		});
 	});
 };
@@ -3440,7 +3619,9 @@ const runEnvAlias = (name, options) => {
 				return;
 			}
 			const raw = readFileSync(configPath, "utf-8");
-			writeIfValid(configPath, appendSection(existing ? removeSection(raw, `[env.${name}]`).fold(() => raw, (r) => r) : raw, block), `${GREEN}✓${RESET} Aliased ${BOLD}${name}${RESET} → ${BOLD}${options.from}${RESET} in ${CYAN}${configPath}${RESET}`);
+			const base = existing ? removeSection(raw, `[env.${name}]`).fold(() => raw, (r) => r) : raw;
+			const updated = appendSection(base, block);
+			writeIfValid(configPath, updated, `${GREEN}✓${RESET} Aliased ${BOLD}${name}${RESET} → ${BOLD}${options.from}${RESET} in ${CYAN}${configPath}${RESET}`);
 		});
 	});
 };
@@ -3565,7 +3746,7 @@ function* findEnvpktFiles(dir, maxDepth, currentDepth = 0) {
 }
 const scanFleet = (rootDir, options) => {
 	const maxDepth = options?.maxDepth ?? 3;
-	const agentList = List(Array.from(findEnvpktFiles(rootDir, maxDepth)).flatMap((configPath) => loadConfig(configPath).fold(() => [], (config) => {
+	const agents = Array.from(findEnvpktFiles(rootDir, maxDepth)).flatMap((configPath) => loadConfig(configPath).fold(() => [], (config) => {
 		const audit = computeAudit(config);
 		return [{
 			path: configPath,
@@ -3573,7 +3754,8 @@ const scanFleet = (rootDir, options) => {
 			min_expiry_days: audit.secrets.toArray().reduce((min, s) => s.days_remaining.fold(() => min, (d) => min.fold(() => Option(d), (m) => Option(Math.min(m, d)))), Option(void 0)).orUndefined(),
 			audit
 		}];
-	})));
+	}));
+	const agentList = List(agents);
 	const total_agents = agentList.size;
 	const total_secrets = agentList.toArray().reduce((acc, a) => acc + a.audit.total, 0);
 	const expired = agentList.toArray().reduce((acc, a) => acc + a.audit.expired, 0);
@@ -3599,7 +3781,8 @@ const statusIcon = (status) => {
 	}
 };
 const runFleet = (options) => {
-	const fleet = scanFleet(resolve(options.dir ?? "."), { maxDepth: options.depth });
+	const rootDir = resolve(options.dir ?? ".");
+	const fleet = scanFleet(rootDir, { maxDepth: options.depth });
 	if (options.format === "json") {
 		console.log(formatFleetJson(fleet));
 		process.exit(fleet.status === "critical" ? 2 : 0);
@@ -3618,6 +3801,36 @@ const runFleet = (options) => {
 	process.exit(fleet.status === "critical" ? 2 : 0);
 };
 //#endregion
+//#region src/cli/commands/headers.ts
+const SERVER_ENV = "CLAUDE_CODE_MCP_SERVER_NAME";
+/**
+* Claude Code `headersHelper` entry point: print the HTTP headers for one MCP server as a
+* JSON object. stdout carries the JSON and nothing else; every diagnostic goes to stderr,
+* because Claude parses stdout verbatim.
+*/
+const runHeaders = (serverArg, options) => {
+	const server = serverArg ?? process.env[SERVER_ENV];
+	if (!server) {
+		console.error(`${RED}Error:${RESET} No MCP server named. Pass [server] or set ${SERVER_ENV}.`);
+		process.exit(2);
+	}
+	resolveForEmit(options).fold((err) => {
+		console.error(`MCP server "${server}":\n${formatError(err)}`);
+		process.exit(2);
+	}, (boot) => {
+		emitWarnings(boot);
+		loadConfig(boot.configPath).flatMap((config) => resolveConfig(config, dirname(boot.configPath)).map((r) => r.config)).fold((err) => {
+			console.error(`MCP server "${server}":\n${formatError(err)}`);
+			return process.exit(2);
+		}, (config) => buildMcpHeaders(config, boot.secrets, server)).fold((err) => {
+			console.error(`${RED}Error:${RESET} ${formatMcpHeadersError(err)}`);
+			process.exit(1);
+		}, (map) => {
+			process.stdout.write(`${JSON.stringify(map)}\n`);
+		});
+	});
+};
+//#endregion
 //#region src/cli/commands/init.ts
 const CONFIG_FILENAME = "envpkt.toml";
 /** Resolve the top-level `scope` to scaffold: explicit --scope wins; --global implies "shell". */
@@ -3893,7 +4106,8 @@ const deriveKeyPath = (configPath) => {
 };
 const runKeygen = (options) => {
 	const configPath = resolve(options.config ?? join(process.cwd(), "envpkt.toml"));
-	generateKeypair({ outputPath: options.output ?? (options.global ? resolveKeyPath() : deriveKeyPath(configPath)) }).fold((err) => {
+	const outputPath = options.output ?? (options.global ? resolveKeyPath() : deriveKeyPath(configPath));
+	generateKeypair({ outputPath }).fold((err) => {
 		if (err._tag === "KeyExists") {
 			console.error(`${YELLOW}Warning:${RESET} Identity file already exists: ${CYAN}${err.path}${RESET}`);
 			console.error(`${DIM}To replace it: remove the file first, then re-run keygen.${RESET}`);
@@ -4263,7 +4477,8 @@ const runResolve = (options) => {
 			console.error(formatError(err));
 			process.exit(2);
 		}, (config) => {
-			resolveConfig(config, dirname(configPath)).fold((err) => {
+			const configDir = dirname(configPath);
+			resolveConfig(config, configDir).fold((err) => {
 				console.error(formatError(err));
 				process.exit(2);
 			}, (result) => {
@@ -4419,13 +4634,18 @@ const applySealedToml = (raw, sealedMeta) => {
 	};
 	return flushPending(List(lines).zipWithIndex().foldLeft(initial)((state, entry) => step(state, entry[0], entry[1]))).output.join("\n");
 };
+/**
+* A value with no non-whitespace content. Unsealing trims, so such a value would come back as
+* `""` — it is treated as empty on both the prompt and stdin paths.
+*/
+const isBlank = (value) => value.trim() === "";
 /** Affirmative answer to a `[y/N]` confirm prompt. */
 const isAffirmative = (answer) => /^y(es)?$/i.test(answer.trim());
 /**
 * Collect new plaintext values for the `--edit`ed keys via the injected `prompt`. Before
 * overwriting an entry that is **already sealed** (`encrypted_value` present), require an
 * explicit confirmation — replacing it discards the only ciphertext, and the prior value
-* can't be recovered without the original key. Declined or empty entries are skipped (reported
+* can't be recovered without the original key. Declined or empty (whitespace-only) entries are skipped (reported
 * via `onSkip`). I/O flows only through `prompt`/`onSkip`, so the confirm/skip logic is
 * unit-testable without a TTY.
 */
@@ -4440,7 +4660,7 @@ const collectEditedValues = async (editKeys, entries, prompt, onSkip) => {
 			}
 		}
 		const value = await prompt(`Enter new value for ${key}: `);
-		if (value === "") {
+		if (isBlank(value)) {
 			onSkip?.(key, "empty");
 			continue;
 		}
@@ -4448,6 +4668,23 @@ const collectEditedValues = async (editKeys, entries, prompt, onSkip) => {
 	}
 	return values;
 };
+/**
+* Pick the `--edit` input source. Stdin is used when `--stdin` is passed or no terminal is
+* attached; it carries one value, so it needs exactly one key. Left holds the error message.
+*/
+const resolveEditInput = (keyCount, opts) => {
+	if (!opts.stdin && opts.isTTY) return Right("prompt");
+	if (keyCount !== 1) {
+		const why = opts.stdin ? "--stdin" : "Without an interactive terminal, --edit";
+		return Left(`${why} reads one value from stdin, so it takes exactly one key (got ${keyCount}). Seal one key at a time.`);
+	}
+	return Right("stdin");
+};
+/** Strip one trailing newline (`\n` or `\r\n`) from piped input. None when nothing but whitespace is left. */
+const parseStdinValue = (raw) => {
+	const value = raw.replace(/\r?\n$/, "");
+	return isBlank(value) ? Option.none() : Option(value);
+};
 /** Write sealed values back into the TOML file, preserving structure. */
 const writeSealedToml = (configPath, sealedMeta) => {
 	const raw = readFileSync(configPath, "utf-8");
@@ -4455,6 +4692,35 @@ const writeSealedToml = (configPath, sealedMeta) => {
 	validateOrExit(finalContent);
 	writeFileSync(configPath, finalContent);
 };
+/**
+* Read one `--edit` value from stdin. The value is never echoed or logged. Piping a value is
+* an explicit request to replace it, so a sealed entry is replaced without the confirm prompt.
+*/
+const readEditedValueFromStdin = async (key) => {
+	const endHint = process.stdin.isTTY ? " (end with Ctrl-D)" : "";
+	console.error(`${DIM}Reading the value for ${key} from stdin${endHint}${RESET}`);
+	return parseStdinValue(await text(process.stdin)).fold(() => {
+		console.error(`${RED}Error:${RESET} No value on stdin for ${key}`);
+		console.error(`${DIM}Pipe the value in, e.g. ${CYAN}pbpaste | envpkt seal --edit ${key}${RESET}${DIM}, or run in a terminal to be prompted.${RESET}`);
+		process.exit(2);
+		return {};
+	}, (value) => ({ [key]: value }));
+};
+/** Prompt for each `--edit` value on the terminal, confirming before replacing a sealed one. */
+const promptEditedValues = async (editKeys, secretEntries) => {
+	const rl = await import("node:readline").then((m) => m.createInterface({
+		input: process.stdin,
+		output: process.stderr
+	}));
+	const prompt = (question) => new Promise((resolve) => {
+		rl.question(question, (answer) => resolve(answer));
+	});
+	const values = await collectEditedValues(editKeys, secretEntries, prompt, (key, reason) => {
+		console.error(`${YELLOW}Skipped${RESET} ${key} (${reason === "empty" ? "empty value" : "kept existing sealed value"})`);
+	});
+	rl.close();
+	return values;
+};
 const runSeal = async (options) => {
 	const { path: configPath, source: configSource } = resolveConfigPath(options.config).fold((err) => {
 		console.error(formatError(err));
@@ -4490,13 +4756,18 @@ const runSeal = async (options) => {
 		process.exit(2);
 	}
 	const identityKey = Option(config.identity.key_file).flatMap((keyFile) => {
-		return unwrapAgentKey(resolve(configDir, expandPath(keyFile))).fold((err) => {
+		const identityPath = resolve(configDir, expandPath(keyFile));
+		return unwrapAgentKey(identityPath).fold((err) => {
 			const msg = err._tag === "IdentityNotFound" ? `not found: ${err.path}` : err.message;
 			console.error(`${YELLOW}Warning:${RESET} Could not unwrap agent key: ${msg}`);
 			return Option.none();
 		}, (k) => Option(k));
 	});
 	const editKeys = options.edit ? options.edit.split(",").map((k) => k.trim()).filter((k) => k.length > 0) : [];
+	if (options.stdin && editKeys.length === 0) {
+		console.error(`${RED}Error:${RESET} --stdin needs --edit <key> to name the secret the value is for`);
+		process.exit(2);
+	}
 	if (editKeys.length > 0) {
 		const allSecretEntries = config.secret ?? {};
 		const unknownKeys = editKeys.filter((k) => !(k in allSecretEntries));
@@ -4517,24 +4788,18 @@ const runSeal = async (options) => {
 			console.error(`${DIM}external = true means the value is managed outside envpkt — set it in that store instead.${RESET}`);
 			process.exit(2);
 		}
-		if (!process.stdin.isTTY) {
-			console.error(`${RED}Error:${RESET} --edit requires an interactive terminal`);
+		const input = resolveEditInput(editKeys.length, {
+			stdin: options.stdin === true,
+			isTTY: process.stdin.isTTY === true
+		}).fold((msg) => {
+			console.error(`${RED}Error:${RESET} ${msg}`);
 			process.exit(2);
-		}
+			return "prompt";
+		}, (i) => i);
 		const secretEntries = Object.fromEntries(editKeys.map((k) => [k, allSecretEntries[k]]));
 		console.log(`${BOLD}Editing ${editKeys.length} secret(s)${RESET} with recipient ${CYAN}${recipient.slice(0, 20)}...${RESET}`);
 		console.log("");
-		const rl = await import("node:readline").then((m) => m.createInterface({
-			input: process.stdin,
-			output: process.stderr
-		}));
-		const prompt = (question) => new Promise((resolve) => {
-			rl.question(question, (answer) => resolve(answer));
-		});
-		const values = await collectEditedValues(editKeys, secretEntries, prompt, (key, reason) => {
-			console.error(`${YELLOW}Skipped${RESET} ${key} (${reason === "empty" ? "empty value" : "kept existing sealed value"})`);
-		});
-		rl.close();
+		const values = input === "stdin" ? await readEditedValueFromStdin(editKeys[0]) : await promptEditedValues(editKeys, secretEntries);
 		if (Object.keys(values).length === 0) {
 			console.error(`${RED}Error:${RESET} No values provided`);
 			process.exit(2);
@@ -4586,7 +4851,8 @@ const runSeal = async (options) => {
 				console.error(`${DIM}  3. ~/.envpkt/age-key.txt${RESET}`);
 				process.exit(2);
 			}
-			const decrypted = unsealSecrets(Object.fromEntries(alreadySealed.map((k) => [k, allSecretEntries[k]])), identityPath).fold((err) => {
+			const sealedEntries = Object.fromEntries(alreadySealed.map((k) => [k, allSecretEntries[k]]));
+			const decrypted = unsealSecrets(sealedEntries, identityPath).fold((err) => {
 				console.error(`${RED}Error:${RESET} Failed to decrypt existing secrets: ${err.message}`);
 				process.exit(2);
 				return {};
@@ -4723,7 +4989,8 @@ const runSecretAdd = (name, options) => {
 				process.exit(1);
 			}
 			const block = buildSecretBlock(name, options);
-			const updated = appendSection(readFileSync(configPath, "utf-8"), block);
+			const raw = readFileSync(configPath, "utf-8");
+			const updated = appendSection(raw, block);
 			if (options.dryRun) {
 				previewIfValid(updated, block);
 				return;
@@ -4864,7 +5131,9 @@ const runSecretAlias = (name, options) => {
 				return;
 			}
 			const raw = readFileSync(configPath, "utf-8");
-			writeIfValid(configPath, appendSection(existing ? removeSection(raw, `[secret.${name}]`).fold(() => raw, (r) => r) : raw, block), `${GREEN}✓${RESET} Aliased ${BOLD}${name}${RESET} → ${BOLD}${options.from}${RESET} in ${CYAN}${configPath}${RESET}`);
+			const base = existing ? removeSection(raw, `[secret.${name}]`).fold(() => raw, (r) => r) : raw;
+			const updated = appendSection(base, block);
+			writeIfValid(configPath, updated, `${GREEN}✓${RESET} Aliased ${BOLD}${name}${RESET} → ${BOLD}${options.from}${RESET} in ${CYAN}${configPath}${RESET}`);
 		});
 	});
 };
@@ -4947,7 +5216,8 @@ const runSecretRotate = async (name, options) => {
 		process.exit(2);
 		return "";
 	}, (ct) => ct);
-	updateSectionFields(applySealedToml(raw, { [name]: { encrypted_value: ciphertext } }), `[secret.${name}]`, { last_rotated_at: `"${today}"` }).fold((err) => {
+	const withSealed = applySealedToml(raw, { [name]: { encrypted_value: ciphertext } });
+	updateSectionFields(withSealed, `[secret.${name}]`, { last_rotated_at: `"${today}"` }).fold((err) => {
 		console.error(`${RED}Error:${RESET} ${err._tag}: ${err.section}`);
 		process.exit(2);
 	}, (result) => {
@@ -5182,6 +5452,7 @@ const CHECK_NAMES = {
 	schema: "Schema",
 	catalog: "Catalog",
 	aliases: "Aliases",
+	mcp: "MCP headers",
 	sealed: "Sealed blocks"
 };
 /** Structural sanity scan over each [secret.*].encrypted_value PEM block. No decryption. */
@@ -5210,6 +5481,24 @@ const checkSealedBlocks = (config) => {
 		error: broken.join("; ")
 	};
 };
+/** `mcp` bindings: valid header names and schemes, no (server, header) pair claimed twice. */
+const checkMcpHeaders = (config) => {
+	const count = Object.values(config.secret ?? {}).reduce((n, meta) => n + (meta.mcp?.length ?? 0), 0);
+	if (count === 0) return {
+		name: CHECK_NAMES.mcp,
+		status: "na",
+		detail: "no mcp bindings"
+	};
+	return validateMcpHeaders(config).fold((err) => ({
+		name: CHECK_NAMES.mcp,
+		status: "failed",
+		error: formatValidationError(err)
+	}), () => ({
+		name: CHECK_NAMES.mcp,
+		status: "ok",
+		detail: `${count} binding(s)`
+	}));
+};
 const skipped = (name) => ({
 	name,
 	status: "skipped"
@@ -5227,6 +5516,7 @@ const buildReport = (path, raw) => {
 			skipped(CHECK_NAMES.schema),
 			skipped(CHECK_NAMES.catalog),
 			skipped(CHECK_NAMES.aliases),
+			skipped(CHECK_NAMES.mcp),
 			skipped(CHECK_NAMES.sealed)
 		]
 	}), (data) => {
@@ -5246,6 +5536,7 @@ const buildReport = (path, raw) => {
 				},
 				skipped(CHECK_NAMES.catalog),
 				skipped(CHECK_NAMES.aliases),
+				skipped(CHECK_NAMES.mcp),
 				skipped(CHECK_NAMES.sealed)
 			]
 		}), (config) => {
@@ -5275,12 +5566,15 @@ const buildReport = (path, raw) => {
 				status: "ok",
 				detail: `${table.entries.size} alias(es)`
 			}));
+			const merged = config.catalog ? resolveConfig(config, dirname(path)).fold(() => config, (r) => r.config) : config;
+			const mcpCheck = checkMcpHeaders(merged);
 			const sealedCheck = checkSealedBlocks(config);
 			const checks = [
 				tomlOk,
 				schemaOk,
 				catalogCheck,
 				aliasCheck,
+				mcpCheck,
 				sealedCheck
 			];
 			return {
@@ -5303,7 +5597,9 @@ const renderCheckLines = (check) => {
 	}
 };
 const formatTextReport = (report, sourceMsg) => {
-	const header = `${report.ok ? `${GREEN}✓${RESET}` : `${RED}✗${RESET}`} ${BOLD}${report.ok ? `${GREEN}VALID${RESET}` : `${RED}INVALID${RESET}`}${RESET} — ${CYAN}${report.configPath}${RESET}`;
+	const headerIcon = report.ok ? `${GREEN}✓${RESET}` : `${RED}✗${RESET}`;
+	const headerLabel = report.ok ? `${GREEN}VALID${RESET}` : `${RED}INVALID${RESET}`;
+	const header = `${headerIcon} ${BOLD}${headerLabel}${RESET} — ${CYAN}${report.configPath}${RESET}`;
 	const checkLines = report.checks.flatMap((c) => [...renderCheckLines(c)]);
 	return [
 		...sourceMsg ? [sourceMsg] : [],
@@ -5382,13 +5678,13 @@ program.command("init").description("Initialize a new envpkt.toml in the current
 program.command("keygen").description("Generate an age keypair for sealing secrets — run this before `seal` if you don't have a key yet").option("-c, --config <path>", "Path to envpkt.toml (updates identity.recipient if found)").option("-o, --output <path>", "Output path for identity file (default: ~/.envpkt/<project>-key.txt)").option("--global", "Write key to the shared default path (~/.envpkt/age-key.txt) instead of a project-specific one").action((options) => {
 	runKeygen(options);
 });
-program.command("audit").description("Audit credential health from envpkt.toml (use --strict in CI pipelines to gate deploys)").option("-c, --config <path>", "Path to envpkt.toml").option("--format <format>", "Output format: table | json | minimal", "table").option("--expiring <days>", "Show secrets expiring within N days", parseInt).option("--status <status>", "Filter by status: healthy | expiring_soon | expired | stale | missing").option("--strict", "Exit non-zero on any non-healthy secret").option("--all", "Show both secrets and env defaults").option("--env-only", "Show only env defaults (drift detection)").option("--sealed", "Show only secrets with encrypted_value").option("--external", "Show only secrets without encrypted_value").option("--sort", "Sort secrets alphabetically within each status bucket (no file mutation)").action((options) => {
+program.command("audit").description("Audit credential health from envpkt.toml (use --strict in CI pipelines to gate deploys)").option("-c, --config <path>", "Path to envpkt.toml").option("--format <format>", "Output format: table | json | minimal", "table").option("--expiring <days>", "Show secrets expiring within N days", parseInt).option("--status <status>", "Filter by status: healthy | expiring_soon | expired | stale | missing | missing_metadata | external").option("--strict", "Exit non-zero on any non-healthy secret").option("--all", "Show both secrets and env defaults").option("--env-only", "Show only env defaults (drift detection)").option("--sealed", "Show only secrets with encrypted_value").option("--unsealed", "Show only secrets without encrypted_value (resolved at runtime or external)").option("--sort", "Sort secrets alphabetically within each status bucket (no file mutation)").action((options) => {
 	runAudit(options);
 });
 program.command("fleet").description("Scan directory tree for envpkt.toml files and aggregate health (use in CI for fleet-wide monitoring)").option("-d, --dir <path>", "Root directory to scan", ".").option("--depth <n>", "Max directory depth", parseInt).option("--format <format>", "Output format: table | json", "table").option("--status <status>", "Filter agents by health status").action((options) => {
 	runFleet(options);
 });
-program.command("validate").description("Verify envpkt.toml integrity — runs TOML syntax, schema, catalog, alias, and sealed-block structural checks").option("-c, --config <path>", "Path to envpkt.toml").option("--json", "Output structured JSON instead of human-readable text").action((options) => {
+program.command("validate").description("Verify envpkt.toml integrity — runs TOML syntax, schema, catalog, alias, MCP header, and sealed-block structural checks").option("-c, --config <path>", "Path to envpkt.toml").option("--json", "Output structured JSON instead of human-readable text").action((options) => {
 	runValidate(options);
 });
 program.command("inspect").description("Display structured view of envpkt.toml").option("-c, --config <path>", "Path to envpkt.toml").option("--format <format>", "Output format: table | json", "table").option("--resolved", "Show resolved view (catalog merged)").option("--secrets", "Show secret values from environment (masked by default)").option("--plaintext", "Show secret values in plaintext (requires --secrets)").option("--sort", "Display secrets and env entries in alphabetical order (no file mutation)").action((options) => {
@@ -5397,10 +5693,13 @@ program.command("inspect").description("Display structured view of envpkt.toml")
 program.command("exec").description("Run pre-flight audit then execute a command with injected secrets (sealed → fnox → env cascade)").argument("<command...>", "Command to execute").option("-c, --config <path>", "Path to envpkt.toml").option("--profile <profile>", "fnox profile to use").option("--skip-audit", "Skip the pre-flight audit (alias: --no-check)").option("--no-check", "Skip the pre-flight audit").option("--warn-only", "Warn on critical audit but do not abort").option("--strict", "Abort on any non-healthy secret").action((args, options) => {
 	runExec(args, options);
 });
+program.command("headers").description("Print HTTP headers for an MCP server as JSON — for Claude Code's headersHelper in .mcp.json").argument("[server]", "MCP server name (default: $CLAUDE_CODE_MCP_SERVER_NAME)").option("-c, --config <path>", "Path to envpkt.toml").option("--profile <profile>", "fnox profile to use").action((server, options) => {
+	runHeaders(server, options);
+});
 program.command("resolve").description("Resolve catalog references and output a flat, self-contained config").option("-c, --config <path>", "Path to envpkt.toml").option("-o, --output <path>", "Write resolved config to file (default: stdout)").option("--format <format>", "Output format: toml | json", "toml").option("--dry-run", "Show what would be resolved without writing").action((options) => {
 	runResolve(options);
 });
-program.command("seal").description("Encrypt secret values into envpkt.toml using age — sealed packets are safe to commit to git").option("-c, --config <path>", "Path to envpkt.toml").option("--profile <profile>", "fnox profile to use for value resolution").option("--reseal", "Re-encrypt all secrets, including already sealed (for key rotation)").option("--edit <keys>", "Re-seal specific keys with new values (comma-separated), always prompts interactively").action(async (options) => {
+program.command("seal").description("Encrypt secret values into envpkt.toml using age — sealed packets are safe to commit to git").option("-c, --config <path>", "Path to envpkt.toml").option("--profile <profile>", "fnox profile to use for value resolution").option("--reseal", "Re-encrypt all secrets, including already sealed (for key rotation)").option("--edit <keys>", "Re-seal specific keys with new values (comma-separated). Prompts in a terminal; without one, reads a single key's value from stdin").option("--stdin", "With --edit <key>, read the new value from stdin even in a terminal (one key; one trailing newline is stripped)").action(async (options) => {
 	await runSeal(options);
 });
 program.command("mcp").description("Start the envpkt MCP server (stdio transport)").option("-c, --config <path>", "Path to envpkt.toml").action((options) => {