envpkt 0.15.0 → 0.16.0

package/README.md

@@ -478,7 +478,7 @@ envpkt copy API_KEY --to b.toml --force          # overwrite if it already exist
 envpkt copy API_KEY --to b.toml --dry-run        # preview without writing
 ```
 
-`--from`/`--to` default to the config resolved for the current directory (and must already exist). On copy, `created` is reset to today and `last_rotated_at` is dropped (it's the source's rotation history). Copying a sealed secret needs the source key to unseal and the destination's `identity.recipient` to reseal.
+`--from`/`--to` default to the config resolved for the current directory (and must already exist). A copy into a new key gets today's `created`. With `--force` onto an existing entry, the entry is replaced in place and keeps the destination's `created`. Either way, `last_rotated_at` is dropped (it's the source's rotation history). Copying a sealed secret needs the source key to unseal and the destination's `identity.recipient` to reseal.
 
 ### `envpkt exec`
 
@@ -499,6 +499,8 @@ Encrypt secret values into `envpkt.toml` using [age](https://age-encryption.org/
 envpkt seal                            # Seal all secrets in envpkt.toml
 envpkt seal -c path/to/envpkt.toml     # Specify config path
 envpkt seal --profile staging          # Use a specific fnox profile for value resolution
+envpkt seal --edit OPENAI_API_KEY      # Re-seal one key with a new value (prompts in a terminal)
+pbpaste | envpkt seal --edit OPENAI_API_KEY   # No terminal (agent, CI): read the value from stdin
 ```
 
 Requires `identity.recipient` (age public key) in your config. Values are resolved via cascade:
@@ -507,6 +509,15 @@ Requires `identity.recipient` (age public key) in your config. Values are resolv
 2. **Environment variables** (e.g. `OPENAI_API_KEY` in your shell)
 3. **Interactive prompt** (asks you to paste each value)
 
+Plain `envpkt seal` skips keys that are already sealed, so it only covers a first seal. `OPENAI_API_KEY=... envpkt seal` works for that.
+
+To rotate one sealed value, use `--edit <key>`. In a terminal it prompts, and asks before replacing a sealed value. Without a terminal (an agent shell, CI, Claude Code's `!` prompt), it reads the value from stdin instead and replaces it without asking. Pass `--stdin` to read stdin on purpose, even in a terminal. Stdin rules:
+
+- It carries one value, so `--edit` takes exactly one key.
+- One trailing newline is stripped (`\n` or `\r\n`).
+- Empty or whitespace-only stdin is an error, and the file is left unchanged.
+- envpkt never prints the value.
+
 After sealing, each secret gets an `encrypted_value` field. At boot time, `envpkt exec` or `boot()` automatically decrypts sealed values using the `identity.key_file` path (or the default `~/.envpkt/age-key.txt`).
 
 See [`examples/sealed-agent.toml`](./examples/sealed-agent.toml) for a complete example.

package/dist/cli.js

@@ -15,6 +15,7 @@ import { randomBytes } from "node:crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { text } from "node:stream/consumers";
 import { createInterface } from "node:readline";
 //#region src/core/namespace.ts
 const DEFAULT_SEPARATOR = "__";
@@ -922,7 +923,7 @@ const runAuditOnConfig = (config, options) => {
 			secrets: audit.secrets.filter((s) => !!secretEntries[s.key].encrypted_value)
 		};
 	})() : audit;
-	const afterExternal = options.external ? (() => {
+	const afterUnsealed = options.unsealed ? (() => {
 		const secretEntries = config.secret ?? {};
 		return {
 			...afterSealed,
@@ -930,9 +931,9 @@ const runAuditOnConfig = (config, options) => {
 		};
 	})() : afterSealed;
 	const afterStatus = options.status ? {
-		...afterExternal,
-		secrets: afterExternal.secrets.filter((s) => s.status === options.status)
-	} : afterExternal;
+		...afterUnsealed,
+		secrets: afterUnsealed.secrets.filter((s) => s.status === options.status)
+	} : afterUnsealed;
 	const filtered = Option(options.expiring).fold(() => afterStatus, (expiring) => ({
 		...afterStatus,
 		secrets: afterStatus.secrets.filter((s) => s.days_remaining.fold(() => false, (d) => d >= 0 && d <= expiring))
@@ -1664,7 +1665,8 @@ const tomlInlineTable = (rec) => {
 };
 /**
 * The SecretMeta to write into the destination on copy.
-* - `created` is reset to today: the entry is new *here*, regardless of the source's age.
+* - `created` comes from the caller, never the source: today for an entry new to the
+*   destination, or the destination's own `created` when the copy overwrites it.
 * - `last_rotated_at` is dropped — it's the source's rotation history, not the copy's.
 * - `encryptedValue` re-derives the ciphertext: `Some(cipher)` sets the resealed value,
 *   `None` strips it entirely (a metadata-only copy of a secret with no sealed value).
@@ -1673,10 +1675,10 @@ const copyableSecretMeta = (meta, opts) => {
 	const { last_rotated_at: _lra, encrypted_value: _ev, ...rest } = meta;
 	return opts.encryptedValue.fold(() => ({
 		...rest,
-		created: opts.today
+		created: opts.created
 	}), (cipher) => ({
 		...rest,
-		created: opts.today,
+		created: opts.created,
 		encrypted_value: cipher
 	}));
 };
@@ -1751,11 +1753,28 @@ const findSectionRange = (lines, sectionHeader) => {
 		end: List(lines.slice(start + 1)).zipWithIndex().foldLeft(initial)((state, entry) => scanSectionBoundary(state, entry[0], start + 1 + entry[1])).end
 	};
 };
+/**
+* End (exclusive) of a section's own lines: through its last field, before the blank and
+* comment lines that run up to the next header. Those trailing lines separate it from its
+* neighbour (or are the neighbour's doc comment), so edits to this section leave them alone.
+*/
+const sectionBodyEnd = (lines, range) => {
+	const lastContent = lines.slice(range.start, range.end).findLastIndex((l) => {
+		const t = l.trim();
+		return t !== "" && !t.startsWith("#");
+	});
+	return range.start + lastContent + 1;
+};
+const dropTrailingBlanks = (xs) => xs.slice(0, xs.findLastIndex((l) => l.trim() !== "") + 1);
+const dropLeadingBlanks = (xs) => {
+	const first = xs.findIndex((l) => l.trim() !== "");
+	return first === -1 ? [] : xs.slice(first);
+};
 /** Check whether a section header exists in the raw TOML */
 const sectionExists = (lines, sectionHeader) => lines.some((l) => l.trim() === sectionHeader);
 /**
-* Remove a TOML section (e.g. `[secret.X]`) and all its fields through the next section or EOF.
-* Strips trailing blank lines left behind.
+* Remove a TOML section (e.g. `[secret.X]`) and all its fields. A comment above the next
+* section stays. The sections on either side end up one blank line apart.
 */
 const removeSection = (raw, sectionHeader) => {
 	const lines = raw.split("\n");
@@ -1764,11 +1783,33 @@ const removeSection = (raw, sectionHeader) => {
 		_tag: "SectionNotFound",
 		section: sectionHeader
 	});
-	const after = lines.slice(range.end);
-	const beforeAll = lines.slice(0, range.start);
-	const lastNonBlank = beforeAll.findLastIndex((l) => l.trim() !== "");
-	const result = [...lastNonBlank === -1 ? [] : beforeAll.slice(0, lastNonBlank + 1), ...after].join("\n");
-	return Either.right(result);
+	const before = dropTrailingBlanks(lines.slice(0, range.start));
+	const after = dropLeadingBlanks(lines.slice(sectionBodyEnd(lines, range)));
+	if (after.length === 0) return Either.right([...before, ...raw.endsWith("\n") ? [""] : []].join("\n"));
+	if (before.length === 0) return Either.right(after.join("\n"));
+	return Either.right([
+		...before,
+		"",
+		...after
+	].join("\n"));
+};
+/**
+* Replace a TOML section with `block`, in place. Lines outside the section, including the
+* blank and comment lines between it and the next header, are left as they were.
+*/
+const replaceSection = (raw, sectionHeader, block) => {
+	const lines = raw.split("\n");
+	const range = findSectionRange(lines, sectionHeader);
+	if (!range) return Either.left({
+		_tag: "SectionNotFound",
+		section: sectionHeader
+	});
+	const replaced = [
+		...lines.slice(0, range.start),
+		...block.trimEnd().split("\n"),
+		...lines.slice(sectionBodyEnd(lines, range))
+	];
+	return Either.right(replaced.join("\n"));
 };
 /**
 * Rename a TOML section header (e.g. `[secret.OLD]` → `[secret.NEW]`).
@@ -2173,14 +2214,15 @@ const todayIso$2 = () => (/* @__PURE__ */ new Date()).toISOString().split("T")[0
 * Build the `[secret.<destName>]` block for a copy: unseal the source value with the
 * source identity and reseal it for the destination recipient. Secrets with no sealed
 * value are copied as metadata only (with a warning) — there's nothing to reseal.
+* Overwriting an existing destination entry keeps its `created`; a new entry gets today.
 */
 const sealedSecretBlock = (key, destName, srcConfig, srcPath, destConfig) => {
 	const meta = srcConfig.secret[key];
-	const today = todayIso$2();
+	const created = destConfig.secret?.[destName]?.created ?? todayIso$2();
 	if (meta.encrypted_value === void 0 || meta.encrypted_value === "") {
 		console.error(`${YELLOW}Warning:${RESET} secret "${key}" has no sealed value — copying metadata only.`);
 		return serializeSecretBlock(destName, copyableSecretMeta(meta, {
-			today,
+			created,
 			encryptedValue: Option.none()
 		}));
 	}
@@ -2205,14 +2247,13 @@ const sealedSecretBlock = (key, destName, srcConfig, srcPath, destConfig) => {
 	}
 	const cipher = orExit(ageEncrypt(plaintext, recipient), (err) => `${RED}Error:${RESET} reseal failed for "${destName}": ${err.message}`, 2);
 	return serializeSecretBlock(destName, copyableSecretMeta(meta, {
-		today,
+		created,
 		encryptedValue: Option(cipher)
 	}));
 };
 const writeBlock = (destPath, header, block, overwrite, dryRun, successMsg) => {
 	const raw = readFileSync(destPath, "utf-8");
-	const baseRaw = overwrite ? orExit(removeSection(raw, header), (err) => `${RED}Error:${RESET} ${err._tag}: ${err.section}`, 2) : raw;
-	const updated = appendSection(baseRaw, block);
+	const updated = overwrite ? orExit(replaceSection(raw, header, block), (err) => `${RED}Error:${RESET} ${err._tag}: ${err.section}`, 2) : appendSection(raw, block);
 	if (dryRun) {
 		previewIfValid(updated, block);
 		return;
@@ -4593,13 +4634,18 @@ const applySealedToml = (raw, sealedMeta) => {
 	};
 	return flushPending(List(lines).zipWithIndex().foldLeft(initial)((state, entry) => step(state, entry[0], entry[1]))).output.join("\n");
 };
+/**
+* A value with no non-whitespace content. Unsealing trims, so such a value would come back as
+* `""` — it is treated as empty on both the prompt and stdin paths.
+*/
+const isBlank = (value) => value.trim() === "";
 /** Affirmative answer to a `[y/N]` confirm prompt. */
 const isAffirmative = (answer) => /^y(es)?$/i.test(answer.trim());
 /**
 * Collect new plaintext values for the `--edit`ed keys via the injected `prompt`. Before
 * overwriting an entry that is **already sealed** (`encrypted_value` present), require an
 * explicit confirmation — replacing it discards the only ciphertext, and the prior value
-* can't be recovered without the original key. Declined or empty entries are skipped (reported
+* can't be recovered without the original key. Declined or empty (whitespace-only) entries are skipped (reported
 * via `onSkip`). I/O flows only through `prompt`/`onSkip`, so the confirm/skip logic is
 * unit-testable without a TTY.
 */
@@ -4614,7 +4660,7 @@ const collectEditedValues = async (editKeys, entries, prompt, onSkip) => {
 			}
 		}
 		const value = await prompt(`Enter new value for ${key}: `);
-		if (value === "") {
+		if (isBlank(value)) {
 			onSkip?.(key, "empty");
 			continue;
 		}
@@ -4622,6 +4668,23 @@ const collectEditedValues = async (editKeys, entries, prompt, onSkip) => {
 	}
 	return values;
 };
+/**
+* Pick the `--edit` input source. Stdin is used when `--stdin` is passed or no terminal is
+* attached; it carries one value, so it needs exactly one key. Left holds the error message.
+*/
+const resolveEditInput = (keyCount, opts) => {
+	if (!opts.stdin && opts.isTTY) return Right("prompt");
+	if (keyCount !== 1) {
+		const why = opts.stdin ? "--stdin" : "Without an interactive terminal, --edit";
+		return Left(`${why} reads one value from stdin, so it takes exactly one key (got ${keyCount}). Seal one key at a time.`);
+	}
+	return Right("stdin");
+};
+/** Strip one trailing newline (`\n` or `\r\n`) from piped input. None when nothing but whitespace is left. */
+const parseStdinValue = (raw) => {
+	const value = raw.replace(/\r?\n$/, "");
+	return isBlank(value) ? Option.none() : Option(value);
+};
 /** Write sealed values back into the TOML file, preserving structure. */
 const writeSealedToml = (configPath, sealedMeta) => {
 	const raw = readFileSync(configPath, "utf-8");
@@ -4629,6 +4692,35 @@ const writeSealedToml = (configPath, sealedMeta) => {
 	validateOrExit(finalContent);
 	writeFileSync(configPath, finalContent);
 };
+/**
+* Read one `--edit` value from stdin. The value is never echoed or logged. Piping a value is
+* an explicit request to replace it, so a sealed entry is replaced without the confirm prompt.
+*/
+const readEditedValueFromStdin = async (key) => {
+	const endHint = process.stdin.isTTY ? " (end with Ctrl-D)" : "";
+	console.error(`${DIM}Reading the value for ${key} from stdin${endHint}${RESET}`);
+	return parseStdinValue(await text(process.stdin)).fold(() => {
+		console.error(`${RED}Error:${RESET} No value on stdin for ${key}`);
+		console.error(`${DIM}Pipe the value in, e.g. ${CYAN}pbpaste | envpkt seal --edit ${key}${RESET}${DIM}, or run in a terminal to be prompted.${RESET}`);
+		process.exit(2);
+		return {};
+	}, (value) => ({ [key]: value }));
+};
+/** Prompt for each `--edit` value on the terminal, confirming before replacing a sealed one. */
+const promptEditedValues = async (editKeys, secretEntries) => {
+	const rl = await import("node:readline").then((m) => m.createInterface({
+		input: process.stdin,
+		output: process.stderr
+	}));
+	const prompt = (question) => new Promise((resolve) => {
+		rl.question(question, (answer) => resolve(answer));
+	});
+	const values = await collectEditedValues(editKeys, secretEntries, prompt, (key, reason) => {
+		console.error(`${YELLOW}Skipped${RESET} ${key} (${reason === "empty" ? "empty value" : "kept existing sealed value"})`);
+	});
+	rl.close();
+	return values;
+};
 const runSeal = async (options) => {
 	const { path: configPath, source: configSource } = resolveConfigPath(options.config).fold((err) => {
 		console.error(formatError(err));
@@ -4672,6 +4764,10 @@ const runSeal = async (options) => {
 		}, (k) => Option(k));
 	});
 	const editKeys = options.edit ? options.edit.split(",").map((k) => k.trim()).filter((k) => k.length > 0) : [];
+	if (options.stdin && editKeys.length === 0) {
+		console.error(`${RED}Error:${RESET} --stdin needs --edit <key> to name the secret the value is for`);
+		process.exit(2);
+	}
 	if (editKeys.length > 0) {
 		const allSecretEntries = config.secret ?? {};
 		const unknownKeys = editKeys.filter((k) => !(k in allSecretEntries));
@@ -4692,24 +4788,18 @@ const runSeal = async (options) => {
 			console.error(`${DIM}external = true means the value is managed outside envpkt — set it in that store instead.${RESET}`);
 			process.exit(2);
 		}
-		if (!process.stdin.isTTY) {
-			console.error(`${RED}Error:${RESET} --edit requires an interactive terminal`);
+		const input = resolveEditInput(editKeys.length, {
+			stdin: options.stdin === true,
+			isTTY: process.stdin.isTTY === true
+		}).fold((msg) => {
+			console.error(`${RED}Error:${RESET} ${msg}`);
 			process.exit(2);
-		}
+			return "prompt";
+		}, (i) => i);
 		const secretEntries = Object.fromEntries(editKeys.map((k) => [k, allSecretEntries[k]]));
 		console.log(`${BOLD}Editing ${editKeys.length} secret(s)${RESET} with recipient ${CYAN}${recipient.slice(0, 20)}...${RESET}`);
 		console.log("");
-		const rl = await import("node:readline").then((m) => m.createInterface({
-			input: process.stdin,
-			output: process.stderr
-		}));
-		const prompt = (question) => new Promise((resolve) => {
-			rl.question(question, (answer) => resolve(answer));
-		});
-		const values = await collectEditedValues(editKeys, secretEntries, prompt, (key, reason) => {
-			console.error(`${YELLOW}Skipped${RESET} ${key} (${reason === "empty" ? "empty value" : "kept existing sealed value"})`);
-		});
-		rl.close();
+		const values = input === "stdin" ? await readEditedValueFromStdin(editKeys[0]) : await promptEditedValues(editKeys, secretEntries);
 		if (Object.keys(values).length === 0) {
 			console.error(`${RED}Error:${RESET} No values provided`);
 			process.exit(2);
@@ -5588,7 +5678,7 @@ program.command("init").description("Initialize a new envpkt.toml in the current
 program.command("keygen").description("Generate an age keypair for sealing secrets — run this before `seal` if you don't have a key yet").option("-c, --config <path>", "Path to envpkt.toml (updates identity.recipient if found)").option("-o, --output <path>", "Output path for identity file (default: ~/.envpkt/<project>-key.txt)").option("--global", "Write key to the shared default path (~/.envpkt/age-key.txt) instead of a project-specific one").action((options) => {
 	runKeygen(options);
 });
-program.command("audit").description("Audit credential health from envpkt.toml (use --strict in CI pipelines to gate deploys)").option("-c, --config <path>", "Path to envpkt.toml").option("--format <format>", "Output format: table | json | minimal", "table").option("--expiring <days>", "Show secrets expiring within N days", parseInt).option("--status <status>", "Filter by status: healthy | expiring_soon | expired | stale | missing").option("--strict", "Exit non-zero on any non-healthy secret").option("--all", "Show both secrets and env defaults").option("--env-only", "Show only env defaults (drift detection)").option("--sealed", "Show only secrets with encrypted_value").option("--external", "Show only secrets without encrypted_value").option("--sort", "Sort secrets alphabetically within each status bucket (no file mutation)").action((options) => {
+program.command("audit").description("Audit credential health from envpkt.toml (use --strict in CI pipelines to gate deploys)").option("-c, --config <path>", "Path to envpkt.toml").option("--format <format>", "Output format: table | json | minimal", "table").option("--expiring <days>", "Show secrets expiring within N days", parseInt).option("--status <status>", "Filter by status: healthy | expiring_soon | expired | stale | missing | missing_metadata | external").option("--strict", "Exit non-zero on any non-healthy secret").option("--all", "Show both secrets and env defaults").option("--env-only", "Show only env defaults (drift detection)").option("--sealed", "Show only secrets with encrypted_value").option("--unsealed", "Show only secrets without encrypted_value (resolved at runtime or external)").option("--sort", "Sort secrets alphabetically within each status bucket (no file mutation)").action((options) => {
 	runAudit(options);
 });
 program.command("fleet").description("Scan directory tree for envpkt.toml files and aggregate health (use in CI for fleet-wide monitoring)").option("-d, --dir <path>", "Root directory to scan", ".").option("--depth <n>", "Max directory depth", parseInt).option("--format <format>", "Output format: table | json", "table").option("--status <status>", "Filter agents by health status").action((options) => {
@@ -5609,7 +5699,7 @@ program.command("headers").description("Print HTTP headers for an MCP server as
 program.command("resolve").description("Resolve catalog references and output a flat, self-contained config").option("-c, --config <path>", "Path to envpkt.toml").option("-o, --output <path>", "Write resolved config to file (default: stdout)").option("--format <format>", "Output format: toml | json", "toml").option("--dry-run", "Show what would be resolved without writing").action((options) => {
 	runResolve(options);
 });
-program.command("seal").description("Encrypt secret values into envpkt.toml using age — sealed packets are safe to commit to git").option("-c, --config <path>", "Path to envpkt.toml").option("--profile <profile>", "fnox profile to use for value resolution").option("--reseal", "Re-encrypt all secrets, including already sealed (for key rotation)").option("--edit <keys>", "Re-seal specific keys with new values (comma-separated), always prompts interactively").action(async (options) => {
+program.command("seal").description("Encrypt secret values into envpkt.toml using age — sealed packets are safe to commit to git").option("-c, --config <path>", "Path to envpkt.toml").option("--profile <profile>", "fnox profile to use for value resolution").option("--reseal", "Re-encrypt all secrets, including already sealed (for key rotation)").option("--edit <keys>", "Re-seal specific keys with new values (comma-separated). Prompts in a terminal; without one, reads a single key's value from stdin").option("--stdin", "With --edit <key>, read the new value from stdin even in a terminal (one key; one trailing newline is stripped)").action(async (options) => {
 	await runSeal(options);
 });
 program.command("mcp").description("Start the envpkt MCP server (stdio transport)").option("-c, --config <path>", "Path to envpkt.toml").action((options) => {

package/dist/index.d.ts

@@ -680,13 +680,14 @@ declare const diffConfigs: (a: EnvpktConfig, b: EnvpktConfig) => ConfigDiff;
 //#region src/core/copy.d.ts
 /**
  * The SecretMeta to write into the destination on copy.
- * - `created` is reset to today: the entry is new *here*, regardless of the source's age.
+ * - `created` comes from the caller, never the source: today for an entry new to the
+ *   destination, or the destination's own `created` when the copy overwrites it.
  * - `last_rotated_at` is dropped — it's the source's rotation history, not the copy's.
  * - `encryptedValue` re-derives the ciphertext: `Some(cipher)` sets the resealed value,
  *   `None` strips it entirely (a metadata-only copy of a secret with no sealed value).
  */
 declare const copyableSecretMeta: (meta: SecretMeta, opts: {
-  readonly today: string;
+  readonly created: string;
   readonly encryptedValue: Option<string>;
 }) => SecretMeta;
 /** Serialize a `[secret.<name>]` block from its metadata, round-trippable by the TOML parser. */
@@ -696,10 +697,15 @@ declare const serializeEnvBlock: (name: string, meta: EnvMeta) => string;
 //#endregion
 //#region src/core/toml-edit.d.ts
 /**
- * Remove a TOML section (e.g. `[secret.X]`) and all its fields through the next section or EOF.
- * Strips trailing blank lines left behind.
+ * Remove a TOML section (e.g. `[secret.X]`) and all its fields. A comment above the next
+ * section stays. The sections on either side end up one blank line apart.
  */
 declare const removeSection: (raw: string, sectionHeader: string) => Either<TomlEditError, string>;
+/**
+ * Replace a TOML section with `block`, in place. Lines outside the section, including the
+ * blank and comment lines between it and the next header, are left as they were.
+ */
+declare const replaceSection: (raw: string, sectionHeader: string, block: string) => Either<TomlEditError, string>;
 /**
  * Rename a TOML section header (e.g. `[secret.OLD]` → `[secret.NEW]`).
  * Errors if old doesn't exist or new already exists.
@@ -779,4 +785,4 @@ type ToolDef = {
 declare const toolDefinitions: readonly ToolDef[];
 declare const callTool: (name: string, args: Record<string, unknown>) => CallToolResult;
 //#endregion
-export { type AgentIdentity, AgentIdentitySchema, type AliasError, type AliasTable, type AuditResult, type BootError, type BootOptions, type BootResult, type CallbackConfig, CallbackConfigSchema, type CatalogError, type ChangedEntry, type CheckResult, type ConfidenceLevel, type ConfigDiff, type ConfigError, type ConfigSource, ConsumerType, type CredentialPattern, type DirectLogger, type DirectTestLoggerHandle, type DotenvEntry, type DriftEntry, type DriftStatus, type EnvAuditResult, type EnvDriftEntry, type EnvDriftStatus, type EnvMeta, EnvMetaSchema, EnvpktBootError, type EnvpktConfig, EnvpktConfigSchema, type FieldChange, type FleetAgent, type FleetHealth, type FnoxConfig, type FnoxError, type FnoxSecret, type FormatDotenvOptions, type FormatPacketOptions, type HealthStatus, type Identity, type IdentityError, IdentitySchema, type KeygenError, type KeygenResult, type LifecycleConfig, LifecycleConfigSchema, type LogEntry, type LogLevel, type LogMetadata, type MatchResult, type McpConfigError, type McpHeader, McpHeaderSchema, type McpHeadersError, type ResolveOptions, type ResolveResult, type ResolvedPath, type ScanOptions, type ScanResult, type SealError, type SecretDisplay, type SecretHealth, type SecretMeta, SecretMetaSchema, type SecretStatus, type SectionDiff, type TomlEditError, type ToolsConfig, ToolsConfigSchema, ageAvailable, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, buildMcpHeaders, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, copyableSecretMeta, createDirectConsoleLogger, createDirectTestLogger, createServer, deriveServiceFromName, detectFnox, diffConfigs, directSilentLogger, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatDotenv, formatMcpHeadersError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, quoteDotenvValue, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, serializeEnvBlock, serializeSecretBlock, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig, validateMcpHeaders };
+export { type AgentIdentity, AgentIdentitySchema, type AliasError, type AliasTable, type AuditResult, type BootError, type BootOptions, type BootResult, type CallbackConfig, CallbackConfigSchema, type CatalogError, type ChangedEntry, type CheckResult, type ConfidenceLevel, type ConfigDiff, type ConfigError, type ConfigSource, ConsumerType, type CredentialPattern, type DirectLogger, type DirectTestLoggerHandle, type DotenvEntry, type DriftEntry, type DriftStatus, type EnvAuditResult, type EnvDriftEntry, type EnvDriftStatus, type EnvMeta, EnvMetaSchema, EnvpktBootError, type EnvpktConfig, EnvpktConfigSchema, type FieldChange, type FleetAgent, type FleetHealth, type FnoxConfig, type FnoxError, type FnoxSecret, type FormatDotenvOptions, type FormatPacketOptions, type HealthStatus, type Identity, type IdentityError, IdentitySchema, type KeygenError, type KeygenResult, type LifecycleConfig, LifecycleConfigSchema, type LogEntry, type LogLevel, type LogMetadata, type MatchResult, type McpConfigError, type McpHeader, McpHeaderSchema, type McpHeadersError, type ResolveOptions, type ResolveResult, type ResolvedPath, type ScanOptions, type ScanResult, type SealError, type SecretDisplay, type SecretHealth, type SecretMeta, SecretMetaSchema, type SecretStatus, type SectionDiff, type TomlEditError, type ToolsConfig, ToolsConfigSchema, ageAvailable, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, buildMcpHeaders, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, copyableSecretMeta, createDirectConsoleLogger, createDirectTestLogger, createServer, deriveServiceFromName, detectFnox, diffConfigs, directSilentLogger, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatDotenv, formatMcpHeadersError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, quoteDotenvValue, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, replaceSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, serializeEnvBlock, serializeSecretBlock, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig, validateMcpHeaders };

package/dist/index.js

@@ -2507,7 +2507,8 @@ const tomlInlineTable = (rec) => {
 };
 /**
 * The SecretMeta to write into the destination on copy.
-* - `created` is reset to today: the entry is new *here*, regardless of the source's age.
+* - `created` comes from the caller, never the source: today for an entry new to the
+*   destination, or the destination's own `created` when the copy overwrites it.
 * - `last_rotated_at` is dropped — it's the source's rotation history, not the copy's.
 * - `encryptedValue` re-derives the ciphertext: `Some(cipher)` sets the resealed value,
 *   `None` strips it entirely (a metadata-only copy of a secret with no sealed value).
@@ -2516,10 +2517,10 @@ const copyableSecretMeta = (meta, opts) => {
 	const { last_rotated_at: _lra, encrypted_value: _ev, ...rest } = meta;
 	return opts.encryptedValue.fold(() => ({
 		...rest,
-		created: opts.today
+		created: opts.created
 	}), (cipher) => ({
 		...rest,
-		created: opts.today,
+		created: opts.created,
 		encrypted_value: cipher
 	}));
 };
@@ -2594,11 +2595,28 @@ const findSectionRange = (lines, sectionHeader) => {
 		end: List(lines.slice(start + 1)).zipWithIndex().foldLeft(initial)((state, entry) => scanSectionBoundary(state, entry[0], start + 1 + entry[1])).end
 	};
 };
+/**
+* End (exclusive) of a section's own lines: through its last field, before the blank and
+* comment lines that run up to the next header. Those trailing lines separate it from its
+* neighbour (or are the neighbour's doc comment), so edits to this section leave them alone.
+*/
+const sectionBodyEnd = (lines, range) => {
+	const lastContent = lines.slice(range.start, range.end).findLastIndex((l) => {
+		const t = l.trim();
+		return t !== "" && !t.startsWith("#");
+	});
+	return range.start + lastContent + 1;
+};
+const dropTrailingBlanks = (xs) => xs.slice(0, xs.findLastIndex((l) => l.trim() !== "") + 1);
+const dropLeadingBlanks = (xs) => {
+	const first = xs.findIndex((l) => l.trim() !== "");
+	return first === -1 ? [] : xs.slice(first);
+};
 /** Check whether a section header exists in the raw TOML */
 const sectionExists = (lines, sectionHeader) => lines.some((l) => l.trim() === sectionHeader);
 /**
-* Remove a TOML section (e.g. `[secret.X]`) and all its fields through the next section or EOF.
-* Strips trailing blank lines left behind.
+* Remove a TOML section (e.g. `[secret.X]`) and all its fields. A comment above the next
+* section stays. The sections on either side end up one blank line apart.
 */
 const removeSection = (raw, sectionHeader) => {
 	const lines = raw.split("\n");
@@ -2607,11 +2625,33 @@ const removeSection = (raw, sectionHeader) => {
 		_tag: "SectionNotFound",
 		section: sectionHeader
 	});
-	const after = lines.slice(range.end);
-	const beforeAll = lines.slice(0, range.start);
-	const lastNonBlank = beforeAll.findLastIndex((l) => l.trim() !== "");
-	const result = [...lastNonBlank === -1 ? [] : beforeAll.slice(0, lastNonBlank + 1), ...after].join("\n");
-	return Either.right(result);
+	const before = dropTrailingBlanks(lines.slice(0, range.start));
+	const after = dropLeadingBlanks(lines.slice(sectionBodyEnd(lines, range)));
+	if (after.length === 0) return Either.right([...before, ...raw.endsWith("\n") ? [""] : []].join("\n"));
+	if (before.length === 0) return Either.right(after.join("\n"));
+	return Either.right([
+		...before,
+		"",
+		...after
+	].join("\n"));
+};
+/**
+* Replace a TOML section with `block`, in place. Lines outside the section, including the
+* blank and comment lines between it and the next header, are left as they were.
+*/
+const replaceSection = (raw, sectionHeader, block) => {
+	const lines = raw.split("\n");
+	const range = findSectionRange(lines, sectionHeader);
+	if (!range) return Either.left({
+		_tag: "SectionNotFound",
+		section: sectionHeader
+	});
+	const replaced = [
+		...lines.slice(0, range.start),
+		...block.trimEnd().split("\n"),
+		...lines.slice(sectionBodyEnd(lines, range))
+	];
+	return Either.right(replaced.join("\n"));
 };
 /**
 * Rename a TOML section header (e.g. `[secret.OLD]` → `[secret.NEW]`).
@@ -3056,4 +3096,4 @@ const startServer = async () => {
 	await server.connect(transport);
 };
 //#endregion
-export { AgentIdentitySchema, CallbackConfigSchema, ConsumerType, EnvMetaSchema, EnvpktBootError, EnvpktConfigSchema, IdentitySchema, LifecycleConfigSchema, McpHeaderSchema, SecretMetaSchema, ToolsConfigSchema, ageAvailable, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, buildMcpHeaders, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, copyableSecretMeta, createDirectConsoleLogger, createDirectTestLogger, createServer, deriveServiceFromName, detectFnox, diffConfigs, directSilentLogger, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatDotenv, formatMcpHeadersError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, quoteDotenvValue, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, serializeEnvBlock, serializeSecretBlock, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig, validateMcpHeaders };
+export { AgentIdentitySchema, CallbackConfigSchema, ConsumerType, EnvMetaSchema, EnvpktBootError, EnvpktConfigSchema, IdentitySchema, LifecycleConfigSchema, McpHeaderSchema, SecretMetaSchema, ToolsConfigSchema, ageAvailable, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, buildMcpHeaders, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, copyableSecretMeta, createDirectConsoleLogger, createDirectTestLogger, createServer, deriveServiceFromName, detectFnox, diffConfigs, directSilentLogger, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatDotenv, formatMcpHeadersError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, quoteDotenvValue, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, replaceSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, serializeEnvBlock, serializeSecretBlock, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig, validateMcpHeaders };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envpkt",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Credential lifecycle and fleet management for AI agents",
   "keywords": [
     "credentials",
@@ -39,16 +39,16 @@
     "prepublishOnly": "pnpm validate"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.32.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@sinclair/typebox": "^0.34.52",
     "commander": "^15.0.0",
-    "functype": "^1.13.0",
-    "functype-log": "^1.13.0",
-    "functype-os": "^1.13.0",
-    "smol-toml": "^1.9.0"
+    "functype": "^1.15.0",
+    "functype-log": "^1.15.0",
+    "functype-os": "^1.15.0",
+    "smol-toml": "^1.9.1"
   },
   "devDependencies": {
-    "@types/node": "^24.19.1",
+    "@types/node": "^24.19.2",
     "ts-builds": "^3.4.3",
     "tsdown": "^0.22.14",
     "tsx": "^4.23.15"