envpkt 0.17.0 → 0.18.0

package/dist/index.js

@@ -1,13 +1,14 @@
 import { FormatRegistry, Type } from "@sinclair/typebox";
 import { dirname, join, resolve } from "node:path";
 import { TypeCompiler } from "@sinclair/typebox/compiler";
-import { $, Cond, Do, Either, Left, List, Map as Map$1, None, Option, Right, Set as Set$1, Some, Try } from "functype";
+import { $, Cond, Do, Either, Left, List, Map as Map$1, None, Option, Right, Set as Set$1, Some, Try, tryCatch, tryCatchAsync } from "functype";
 import { Env, Fs, Path, Platform } from "functype-os";
 import { TomlDate, parse } from "smol-toml";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { createDirectConsoleLogger, createDirectTestLogger, directSilentLogger, directSilentLogger as directSilentLogger$1 } from "functype-log/direct";
 import { execFileSync } from "node:child_process";
+import { Decrypter, Encrypter, armor, generateX25519Identity, identityToRecipient } from "age-encryption";
 import { createInterface } from "node:readline";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -1766,16 +1767,104 @@ const fnoxAvailable = () => Try(() => {
 	return true;
 }).fold(() => false, (v) => v);
 //#endregion
+//#region src/core/age.ts
+/**
+* In-process age encryption via typage (`age-encryption`). This is the only module that imports
+* it. Ciphertext is age's ASCII armor, interoperable with the `age` CLI in both directions.
+*/
+/** Encrypt `plaintext` to an age recipient (`age1…`), returning armored text without a trailing newline. */
+const encryptArmored = (plaintext, recipient) => tryCatchAsync(async () => {
+	const encrypter = new Encrypter();
+	encrypter.addRecipient(recipient);
+	return armor.encode(await encrypter.encrypt(plaintext)).trim();
+}, (err) => ({
+	_tag: "EncryptFailed",
+	key: "",
+	message: `age encrypt failed: ${String(err)}`
+}));
+const decryptFailed = (message) => ({
+	_tag: "DecryptFailed",
+	key: "",
+	message: `age decrypt failed: ${message}`
+});
+/** Mask any age secret key in an error message. typage's bech32 errors quote the key they rejected. */
+const redactKeys = (message) => message.replace(/AGE-SECRET-KEY-[0-9A-Z-]+/gi, "AGE-SECRET-KEY-…");
+/** Add each identity to a fresh Decrypter. A malformed key fails with its position, never its text. */
+const toDecrypter = (identities) => identities.reduce((acc, identity, i) => acc.flatMap((decrypter) => tryCatch(() => {
+	decrypter.addIdentity(identity);
+	return decrypter;
+}, () => decryptFailed(`identity ${i + 1} is not a valid age secret key`))), Right(new Decrypter()));
+const utf8 = new TextDecoder("utf-8", { ignoreBOM: true });
+/**
+* Decrypt armored age ciphertext with any of `identities` (`AGE-SECRET-KEY-…`). The plaintext is
+* returned as-is: byte for byte when it is valid UTF-8.
+*/
+const decryptArmored = (armored, identities) => {
+	if (identities.length === 0) return Promise.resolve(Left(decryptFailed("no identity provided")));
+	return toDecrypter(identities).fold((err) => Promise.resolve(Left(err)), (decrypter) => tryCatchAsync(async () => utf8.decode(await decrypter.decrypt(armor.decode(armored))), (err) => decryptFailed(redactKeys(String(err)))));
+};
+/** Generate an X25519 age keypair: the secret identity and its public recipient. */
+const generateAgeKeypair = () => tryCatchAsync(async () => {
+	const identity = await generateX25519Identity();
+	return {
+		identity,
+		recipient: await identityToRecipient(identity)
+	};
+}, (err) => ({
+	_tag: "KeygenFailed",
+	message: `age keygen failed: ${String(err)}`
+}));
+const SECRET_KEY_PREFIX = "AGE-SECRET-KEY-";
+/** Classify a non-key line, so the error can name what it is without echoing its content. */
+const unsupportedLine = (line, lineNumber) => {
+	if (line.startsWith("-----BEGIN AGE ENCRYPTED FILE-----") || line.startsWith("age-encryption.org/")) return { _tag: "PassphraseProtectedIdentity" };
+	if (line.startsWith("AGE-PLUGIN-")) return {
+		_tag: "UnsupportedIdentity",
+		kind: "plugin",
+		line: lineNumber
+	};
+	if (line.startsWith("-----BEGIN") || line.startsWith("ssh-")) return {
+		_tag: "UnsupportedIdentity",
+		kind: "ssh",
+		line: lineNumber
+	};
+	return {
+		_tag: "UnsupportedIdentity",
+		kind: "unknown",
+		line: lineNumber
+	};
+};
+/**
+* Read every `AGE-SECRET-KEY-…` line from an age identity file, as the `age` CLI does. Blank lines
+* and `#` comments are skipped. Any other line — a plugin or SSH key, or a passphrase-protected
+* (age-encrypted) key file — is an error, since in-process decryption can't use it.
+*/
+const parseIdentityFile = (content) => {
+	const significant = content.split("\n").map((line, i) => ({
+		text: line.trim(),
+		number: i + 1
+	})).filter(({ text }) => text !== "" && !text.startsWith("#"));
+	const firstUnsupported = significant.find(({ text }) => !text.startsWith(SECRET_KEY_PREFIX));
+	if (firstUnsupported) return Left(unsupportedLine(firstUnsupported.text, firstUnsupported.number));
+	if (significant.length === 0) return Left({ _tag: "NoIdentityKey" });
+	return Right(significant.map(({ text }) => text));
+};
+//#endregion
 //#region src/fnox/identity.ts
-/** Check if the age CLI is available on PATH */
-const ageAvailable = () => Try(() => {
-	execFileSync("age", ["--version"], { stdio: "pipe" });
-	return true;
-}).fold(() => false, (v) => v);
+/** The `source` name for the inline key in identity errors. */
+const INLINE_KEY_SOURCE = "ENVPKT_AGE_KEY";
+/**
+* Read the age secret keys (`AGE-SECRET-KEY-…`) from identity text, such as a key file's content
+* or the inline `ENVPKT_AGE_KEY`. `source` names it in errors.
+*/
+const parseIdentityKeys = (content, source) => parseIdentityFile(content).mapLeft((err) => ({
+	...err,
+	source
+}));
 /**
-* Extract the secret key from an age identity file (plain or encrypted).
-* - Plain identity files (from `age-keygen`) contain `AGE-SECRET-KEY-*` lines directly
-* - Encrypted identity files need `age --decrypt` to unwrap
+* Read every secret key from a plain age identity file (as written by `envpkt keygen` or
+* `age-keygen`). A missing or unreadable file, and passphrase-protected, plugin and SSH key files,
+* are rejected with a typed error.
 */
 const unwrapAgentKey = (identityPath) => {
 	if (!existsSync(identityPath)) return Left({
@@ -1783,27 +1872,32 @@ const unwrapAgentKey = (identityPath) => {
 		path: identityPath
 	});
 	return Try(() => readFileSync(identityPath, "utf-8")).fold((err) => Left({
-		_tag: "DecryptFailed",
-		message: `Failed to read identity file: ${err}`
-	}), (content) => {
-		const secretKeyLine = content.split("\n").find((l) => l.startsWith("AGE-SECRET-KEY-"));
-		if (secretKeyLine) return Right(secretKeyLine.trim());
-		if (!ageAvailable()) return Left({
-			_tag: "AgeNotFound",
-			message: "age CLI not found on PATH"
-		});
-		return Try(() => execFileSync("age", ["--decrypt", identityPath], {
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			encoding: "utf-8"
-		})).fold((err) => Left({
-			_tag: "DecryptFailed",
-			message: `age decrypt failed: ${err}`
-		}), (output) => Right(output.trim()));
-	});
+		_tag: "IdentityUnreadable",
+		path: identityPath,
+		message: err.message
+	}), (content) => parseIdentityKeys(content, identityPath));
+};
+new Set(Object.keys({
+	IdentityNotFound: true,
+	IdentityUnreadable: true,
+	NoIdentityKey: true,
+	PassphraseProtectedIdentity: true,
+	UnsupportedIdentity: true
+}));
+const UNSUPPORTED_KIND = {
+	plugin: "an age plugin key",
+	ssh: "an SSH key",
+	unknown: "not an age secret key"
+};
+/** Explain an identity error. Never includes key material. */
+const describeIdentityError = (err) => {
+	switch (err._tag) {
+		case "IdentityNotFound": return `Identity file not found: ${err.path}`;
+		case "IdentityUnreadable": return `Can't read key file ${err.path}: ${err.message}`;
+		case "NoIdentityKey": return `${err.source} has no age secret key (AGE-SECRET-KEY-…)`;
+		case "PassphraseProtectedIdentity": return err.source === "ENVPKT_AGE_KEY" ? `${INLINE_KEY_SOURCE} holds a passphrase-protected key, which envpkt can't read. Set it to the plain key file's content (its AGE-SECRET-KEY-… line).` : `${err.source} is a passphrase-protected key file, which envpkt can't read. Unwrap it once with \`age -d -o <plain-key-file> ${err.source}\` and point envpkt at the plain file.`;
+		case "UnsupportedIdentity": return `${err.source} line ${err.line} is ${UNSUPPORTED_KIND[err.kind]}; envpkt reads plain age secret keys (AGE-SECRET-KEY-…) only`;
+	}
 };
 //#endregion
 //#region src/fnox/parse.ts
@@ -1834,54 +1928,32 @@ const resolveInlineKey = () => {
 	const key = process.env["ENVPKT_AGE_KEY"];
 	return key ? Some(key) : None();
 };
-/** Generate an age keypair and write to disk. Refuses to overwrite if the file already exists. */
-const generateKeypair = (options) => {
-	if (!ageAvailable()) return Left({
-		_tag: "AgeNotFound",
-		message: "age-keygen CLI not found on PATH. Install age: https://github.com/FiloSottile/age"
+/** The identity file `age-keygen` writes: creation time, public key, secret key. */
+const identityFileContent = (identity, recipient) => `# created: ${(/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z")}\n# public key: ${recipient}\n${identity}\n`;
+/** Write the identity file (0600), creating its directory if needed. Never overwrites a file. */
+const writeIdentityFile = (outputPath, content) => Try(() => {
+	mkdirSync(dirname(outputPath), { recursive: true });
+	writeFileSync(outputPath, content, {
+		mode: 384,
+		flag: "wx"
 	});
+	chmodSync(outputPath, 384);
+}).fold((err) => Left({
+	_tag: "WriteError",
+	message: `Failed to write identity file: ${err}`
+}), () => Right(void 0));
+/** Generate an age keypair and write to disk. Refuses to overwrite if the file already exists. */
+const generateKeypair = async (options) => {
 	const outputPath = options?.outputPath ?? resolveKeyPath();
 	if (existsSync(outputPath)) return Left({
 		_tag: "KeyExists",
 		path: outputPath
 	});
-	return Try(() => execFileSync("age-keygen", [], {
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		],
-		encoding: "utf-8"
-	})).fold((err) => Left({
-		_tag: "KeygenFailed",
-		message: `age-keygen failed: ${err}`
-	}), (output) => {
-		const recipientLine = output.split("\n").find((l) => l.startsWith("# public key:"));
-		if (!recipientLine) return Left({
-			_tag: "KeygenFailed",
-			message: "Could not parse public key from age-keygen output"
-		});
-		const recipient = recipientLine.replace("# public key: ", "").trim();
-		const dir = dirname(outputPath);
-		const mkdirFailed = Try(() => {
-			if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-		}).fold((err) => ({
-			_tag: "WriteError",
-			message: `Failed to create directory ${dir}: ${err}`
-		}), () => void 0);
-		if (mkdirFailed) return Left(mkdirFailed);
-		return Try(() => {
-			writeFileSync(outputPath, output, { mode: 384 });
-			chmodSync(outputPath, 384);
-		}).fold((err) => Left({
-			_tag: "WriteError",
-			message: `Failed to write identity file: ${err}`
-		}), () => Right({
-			recipient,
-			identityPath: outputPath,
-			configUpdated: false
-		}));
-	});
+	return (await generateAgeKeypair()).flatMap(({ identity, recipient }) => writeIdentityFile(outputPath, identityFileContent(identity, recipient)).map(() => ({
+		recipient,
+		identityPath: outputPath,
+		configUpdated: false
+	})));
 };
 /** Update identity fields (recipient, key_file, name) in an envpkt.toml file, preserving structure */
 const updateConfigIdentity = (configPath, options) => {
@@ -1962,94 +2034,36 @@ const updateConfigIdentity = (configPath, options) => {
 };
 //#endregion
 //#region src/core/seal.ts
-/** Encrypt a plaintext string using age with the given recipient public key (armored output) */
-const ageEncrypt = (plaintext, recipient) => {
-	if (!ageAvailable()) return Left({
-		_tag: "AgeNotFound",
-		message: "age CLI not found on PATH"
-	});
-	return Try(() => execFileSync("age", [
-		"--encrypt",
-		"--recipient",
-		recipient,
-		"--armor"
-	], {
-		input: plaintext,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		],
-		encoding: "utf-8"
-	})).fold((err) => Left({
-		_tag: "EncryptFailed",
-		key: "",
-		message: `age encrypt failed: ${err}`
-	}), (output) => Right(output.trim()));
-};
-/** Decrypt an age-armored ciphertext using the given identity file. The plaintext is returned as-is, untrimmed. */
-const ageDecrypt = (ciphertext, identityPath) => {
-	if (!ageAvailable()) return Left({
-		_tag: "AgeNotFound",
-		message: "age CLI not found on PATH"
-	});
-	return Try(() => execFileSync("age", [
-		"--decrypt",
-		"--identity",
-		identityPath
-	], {
-		input: ciphertext,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		],
-		encoding: "utf-8"
-	})).fold((err) => Left({
-		_tag: "DecryptFailed",
-		key: "",
-		message: `age decrypt failed: ${err}`
-	}), (output) => Right(output));
-};
+/** Encrypt a plaintext string to an age recipient public key (armored output) */
+const ageEncrypt = (plaintext, recipient) => encryptArmored(plaintext, recipient);
+/**
+* Decrypt an age-armored ciphertext with any of the given secret keys (`AGE-SECRET-KEY-…`, as
+* returned by `unwrapAgentKey`). The plaintext is returned as-is, untrimmed.
+*/
+const ageDecrypt = (ciphertext, identities) => decryptArmored(ciphertext, identities);
 /** Seal multiple secrets: encrypt each value with the recipient key and set encrypted_value on meta */
-const sealSecrets = (meta, values, recipient) => {
-	if (!ageAvailable()) return Left({
-		_tag: "AgeNotFound",
-		message: "age CLI not found on PATH"
-	});
-	return Object.entries(meta).reduce((acc, [key, secretMeta]) => acc.flatMap((result) => {
+const sealSecrets = async (meta, values, recipient) => {
+	return (await Either.traverseAsync(Object.entries(meta), async ([key, secretMeta]) => {
 		const value = values[key];
-		if (value === void 0) return Right({
-			...result,
-			[key]: secretMeta
-		});
-		return ageEncrypt(value, recipient).mapLeft((err) => ({
+		if (value === void 0) return Right([key, secretMeta]);
+		return (await ageEncrypt(value, recipient)).mapLeft((err) => ({
 			_tag: "EncryptFailed",
 			key,
 			message: err.message
-		})).map((ciphertext) => ({
-			...result,
-			[key]: {
-				...secretMeta,
-				encrypted_value: ciphertext
-			}
-		}));
-	}), Right({}));
-};
-/** Unseal secrets: decrypt encrypted_value for each meta entry that has one */
-const unsealSecrets = (meta, identityPath) => {
-	if (!ageAvailable()) return Left({
-		_tag: "AgeNotFound",
-		message: "age CLI not found on PATH"
-	});
-	return Object.entries(meta).filter(([, secretMeta]) => secretMeta.encrypted_value !== void 0 && secretMeta.encrypted_value !== "").reduce((acc, [key, secretMeta]) => acc.flatMap((result) => ageDecrypt(secretMeta.encrypted_value, identityPath).mapLeft((err) => ({
+		})).map((ciphertext) => [key, {
+			...secretMeta,
+			encrypted_value: ciphertext
+		}]);
+	})).map((entries) => Object.fromEntries(entries));
+};
+/** Unseal secrets: decrypt encrypted_value for each meta entry that has one, with any of `identities` */
+const unsealSecrets = async (meta, identities) => {
+	const sealedEntries = Object.entries(meta).filter(([, secretMeta]) => secretMeta.encrypted_value !== void 0 && secretMeta.encrypted_value !== "");
+	return (await Either.traverseAsync(sealedEntries, async ([key, secretMeta]) => (await ageDecrypt(secretMeta.encrypted_value, identities)).mapLeft((err) => ({
 		_tag: "DecryptFailed",
 		key,
 		message: err.message
-	})).map((plaintext) => ({
-		...result,
-		[key]: plaintext
-	}))), Right({}));
+	})).map((plaintext) => [key, plaintext]))).map((entries) => Object.fromEntries(entries));
 };
 //#endregion
 //#region src/core/boot.ts
@@ -2069,51 +2083,27 @@ const resolveIdentityFilePath = (config, configDir, useDefaultFallback) => {
 	const defaultPath = resolveKeyPath();
 	return existsSync(defaultPath) ? Option(defaultPath) : Option(void 0);
 };
-const noop = () => {};
-/** Write an inline age key to a private temp file so the `age` CLI (file-based) can use it. */
-const materializeInlineKey = (key) => {
-	const dir = mkdtempSync(join(tmpdir(), "envpkt-age-"));
-	const keyPath = join(dir, "age-key.txt");
-	writeFileSync(keyPath, key.endsWith("\n") ? key : `${key}\n`);
-	chmodSync(keyPath, 384);
-	return {
-		path: keyPath,
-		dispose: () => rmSync(dir, {
-			recursive: true,
-			force: true
-		})
-	};
-};
+const keysFrom = (keys) => keys.map((k) => Option(k));
 /**
-* Resolve an age identity for unsealing sealed packets. Precedence:
+* Resolve the age secret keys for unsealing sealed packets. Precedence:
 *   config.identity.key_file > ENVPKT_AGE_KEY_FILE > ENVPKT_AGE_KEY (inline) > ~/.envpkt/age-key.txt
 * The inline key (CI secret) ranks above the homedir default so an explicit
-* env var beats a stray local key. Inline keys are written to a 0600 temp file
-* the caller must dispose().
+* env var beats a stray local key. It is parsed in memory and never written to disk.
 */
 const resolveSealIdentity = (config, configDir) => {
 	if (config.identity?.key_file) {
 		const keyFilePath = resolve(configDir, expandPath(config.identity.key_file));
-		if (existsSync(keyFilePath)) return Option({
-			path: keyFilePath,
-			dispose: noop
-		});
+		if (existsSync(keyFilePath)) return keysFrom(unwrapAgentKey(keyFilePath));
 	}
 	const envFile = process.env["ENVPKT_AGE_KEY_FILE"];
-	if (envFile && existsSync(envFile)) return Option({
-		path: envFile,
-		dispose: noop
-	});
+	if (envFile && existsSync(envFile)) return keysFrom(unwrapAgentKey(envFile));
 	const inlineKey = resolveInlineKey().orUndefined();
-	if (inlineKey) return Option(materializeInlineKey(inlineKey));
+	if (inlineKey) return keysFrom(parseIdentityKeys(inlineKey, INLINE_KEY_SOURCE));
 	if (!config.identity?.key_file) {
 		const defaultPath = join(homedir(), ".envpkt", "age-key.txt");
-		if (existsSync(defaultPath)) return Option({
-			path: defaultPath,
-			dispose: noop
-		});
+		if (existsSync(defaultPath)) return keysFrom(unwrapAgentKey(defaultPath));
 	}
-	return Option(void 0);
+	return Right(Option(void 0));
 };
 /** Describe the seal-identity precedence chain with per-entry status, for a clear no-key error. */
 const describeSealKeySearch = (config, configDir) => {
@@ -2131,7 +2121,7 @@ const describeSealKeySearch = (config, configDir) => {
 	];
 };
 const resolveIdentityKey = (config, configDir) => {
-	return resolveIdentityFilePath(config, configDir, false).fold(() => Right(Option(void 0)), (path) => unwrapAgentKey(path).fold((err) => Left(err), (key) => Right(Option(key))));
+	return resolveIdentityFilePath(config, configDir, false).fold(() => Right(Option(void 0)), (path) => unwrapAgentKey(path).fold((err) => Left(err), (keys) => Right(Option(keys[0]))));
 };
 const detectFnoxKeys = (configDir) => detectFnox(configDir).fold(() => /* @__PURE__ */ new Set(), (fnoxPath) => readFnoxConfig(fnoxPath).fold(() => /* @__PURE__ */ new Set(), (fnoxConfig) => extractFnoxKeys(fnoxConfig)));
 const checkExpiration = (audit, failOnExpired, warnOnly) => {
@@ -2144,6 +2134,19 @@ const checkExpiration = (audit, failOnExpired, warnOnly) => {
 	if (audit.expired > 0 && warnOnly) warnings.push(`${audit.expired} secret(s) have expired (warn-only mode)`);
 	return Right(warnings);
 };
+/**
+* Sealed values are declared, so a usable key is required. No key anywhere → SealKeyUnavailable;
+* a key that can't be used (an unreadable file, or a passphrase-protected, plugin or SSH key) → its
+* IdentityError. Either way
+* boot refuses rather than inject empty values — even under warnOnly, which governs soft issues
+* like expiry, not an absent key.
+*/
+const requireSealKeys = (config, configDir, entries) => resolveSealIdentity(config, configDir).flatMap((keys) => keys.fold(() => Left({
+	_tag: "SealKeyUnavailable",
+	sealedKeys: Object.keys(entries).filter((k) => !!entries[k]?.encrypted_value),
+	searched: describeSealKeySearch(config, configDir),
+	configuredKeyFile: config.identity?.key_file ? resolve(configDir, expandPath(config.identity.key_file)) : void 0
+}), (k) => Right(k)));
 const SECRET_PATTERNS = [
 	/^sk-/,
 	/^ghp_/,
@@ -2162,174 +2165,165 @@ const checkEnvMisclassification = (config) => {
 	const envEntries = config.env ?? {};
 	return Object.entries(envEntries).filter(([, entry]) => entry.value !== void 0 && looksLikeSecret(entry.value)).map(([key]) => `[env.${key}] value looks like a secret — consider moving to [secret.${key}]`);
 };
-/** Programmatic boot — returns Either<BootError, BootResult> */
-const bootSafe = (options) => {
+/** Programmatic boot — resolves to Either<BootError, BootResult> */
+const bootSafe = async (options) => {
 	const opts = options ?? {};
 	const inject = opts.inject !== false;
 	const failOnExpired = opts.failOnExpired !== false;
 	const warnOnly = opts.warnOnly ?? false;
 	const log = (opts.logger ?? directSilentLogger$1).withContext({ component: "envpkt.boot" });
-	return resolveAndLoad(opts).flatMap(({ config, configPath, configDir, configSource }) => validateAliases(config).fold((err) => {
+	const loaded = resolveAndLoad(opts);
+	if (loaded.isLeft()) return Left(loaded.value);
+	const { config, configPath, configDir, configSource } = loaded.value;
+	const aliases = validateAliases(config);
+	if (aliases.isLeft()) {
+		const err = aliases.value;
 		log.warn("alias.validate.failed", {
 			tag: err._tag,
 			key: "key" in err ? err.key : void 0
 		});
 		return Left(err);
-	}, (aliasTable) => {
-		log.debug("alias.validate.success", { aliases: aliasTable.entries.size });
-		const secretEntries = config.secret ?? {};
-		const envEntries = config.env ?? {};
-		const namer = makeEnvNamer(config);
-		const secretEnv = (key) => namer(key, secretEntries[key]?.namespace);
-		const envEnv = (key) => namer(key, envEntries[key]?.namespace);
-		const envNames = {
-			...Object.fromEntries(Object.keys(envEntries).map((k) => [k, envEnv(k)])),
-			...Object.fromEntries(Object.keys(secretEntries).map((k) => [k, secretEnv(k)]))
-		};
-		const nonAliasSecretEntries = Object.fromEntries(Object.entries(secretEntries).filter(([, meta]) => meta.from_key === void 0));
-		const aliasSecretKeys = Object.entries(secretEntries).filter(([, meta]) => meta.from_key !== void 0).map(([k]) => k);
-		const nonAliasEnvEntries = Object.entries(envEntries).filter(([, meta]) => meta.from_key === void 0);
-		const aliasEnvKeys = Object.entries(envEntries).filter(([, meta]) => meta.from_key !== void 0).map(([k]) => k);
-		const nonAliasMetaKeys = Object.keys(nonAliasSecretEntries);
-		const hasSealedValues = Object.values(nonAliasSecretEntries).some((meta) => !!meta.encrypted_value);
-		const identityKeyResult = resolveIdentityKey(config, configDir);
-		const identityKey = identityKeyResult.fold(() => Option(void 0), (k) => k);
-		if (identityKeyResult.isLeft() && !hasSealedValues) return identityKeyResult.fold((err) => Left(err), () => Left({
-			_tag: "ReadError",
-			message: "unexpected"
-		}));
-		const fnoxKeys = detectFnoxKeys(configDir);
-		const audit = computeAudit(config, fnoxKeys, void 0, aliasTable);
-		const sealIdentity = hasSealedValues ? resolveSealIdentity(config, configDir) : Option(void 0);
-		if (hasSealedValues && sealIdentity.isEmpty) return Left({
-			_tag: "SealKeyUnavailable",
-			sealedKeys: nonAliasMetaKeys.filter((k) => !!nonAliasSecretEntries[k]?.encrypted_value),
-			searched: describeSealKeySearch(config, configDir),
-			configuredKeyFile: config.identity?.key_file ? resolve(configDir, expandPath(config.identity.key_file)) : void 0
+	}
+	const aliasTable = aliases.value;
+	log.debug("alias.validate.success", { aliases: aliasTable.entries.size });
+	const secretEntries = config.secret ?? {};
+	const envEntries = config.env ?? {};
+	const namer = makeEnvNamer(config);
+	const secretEnv = (key) => namer(key, secretEntries[key]?.namespace);
+	const envEnv = (key) => namer(key, envEntries[key]?.namespace);
+	const envNames = {
+		...Object.fromEntries(Object.keys(envEntries).map((k) => [k, envEnv(k)])),
+		...Object.fromEntries(Object.keys(secretEntries).map((k) => [k, secretEnv(k)]))
+	};
+	const nonAliasSecretEntries = Object.fromEntries(Object.entries(secretEntries).filter(([, meta]) => meta.from_key === void 0));
+	const aliasSecretKeys = Object.entries(secretEntries).filter(([, meta]) => meta.from_key !== void 0).map(([k]) => k);
+	const nonAliasEnvEntries = Object.entries(envEntries).filter(([, meta]) => meta.from_key === void 0);
+	const aliasEnvKeys = Object.entries(envEntries).filter(([, meta]) => meta.from_key !== void 0).map(([k]) => k);
+	const nonAliasMetaKeys = Object.keys(nonAliasSecretEntries);
+	const hasSealedValues = Object.values(nonAliasSecretEntries).some((meta) => !!meta.encrypted_value);
+	const identityKeyResult = resolveIdentityKey(config, configDir);
+	const identityKey = identityKeyResult.fold(() => Option(void 0), (k) => k);
+	if (identityKeyResult.isLeft() && !hasSealedValues) return Left(identityKeyResult.value);
+	const fnoxKeys = detectFnoxKeys(configDir);
+	const audit = computeAudit(config, fnoxKeys, void 0, aliasTable);
+	const sealKeys = hasSealedValues ? requireSealKeys(config, configDir, nonAliasSecretEntries) : Right([]);
+	if (sealKeys.isLeft()) return Left(sealKeys.value);
+	const unsealKeys = sealKeys.value;
+	const expiration = checkExpiration(audit, failOnExpired, warnOnly);
+	if (expiration.isLeft()) return Left(expiration.value);
+	const warnings = expiration.value;
+	const secrets = {};
+	const injected = [];
+	const skipped = [];
+	warnings.push(...checkEnvMisclassification(config));
+	const nsSeparator = config.namespace?.separator;
+	if (nsSeparator !== void 0 && !isShellSafeSeparator(nsSeparator)) warnings.push(`[namespace] separator "${nsSeparator}" is not shell-safe — injected names won't be usable via shell $VAR/export. Use '_' or '__'.`);
+	const envDefaults = Object.fromEntries(nonAliasEnvEntries.flatMap(([key, entry]) => Option(process.env[envEnv(key)]).fold(() => Option(entry.value).fold(() => [], (v) => [[key, v]]), () => [])));
+	const overridden = nonAliasEnvEntries.flatMap(([key]) => Option(process.env[envEnv(key)]).fold(() => [], () => [key]));
+	if (inject) Object.entries(envDefaults).forEach(([key, value]) => {
+		process.env[envEnv(key)] = value;
+	});
+	const sealedKeys = /* @__PURE__ */ new Set();
+	if (hasSealedValues) (await unsealSecrets(nonAliasSecretEntries, unsealKeys)).fold((err) => {
+		log.warn("phase.sealed.decrypt_failed", { message: err.message });
+		warnings.push(`Sealed value decryption failed: ${err.message}`);
+	}, (unsealed) => {
+		const unsealedEntries = Object.entries(unsealed);
+		Object.assign(secrets, unsealed);
+		injected.push(...unsealedEntries.map(([key]) => key));
+		unsealedEntries.forEach(([key]) => {
+			sealedKeys.add(key);
+			log.debug("phase.sealed.resolved", { key });
 		});
-		return checkExpiration(audit, failOnExpired, warnOnly).map((warnings) => {
-			const secrets = {};
-			const injected = [];
-			const skipped = [];
-			warnings.push(...checkEnvMisclassification(config));
-			const nsSeparator = config.namespace?.separator;
-			if (nsSeparator !== void 0 && !isShellSafeSeparator(nsSeparator)) warnings.push(`[namespace] separator "${nsSeparator}" is not shell-safe — injected names won't be usable via shell $VAR/export. Use '_' or '__'.`);
-			const envDefaults = Object.fromEntries(nonAliasEnvEntries.flatMap(([key, entry]) => Option(process.env[envEnv(key)]).fold(() => Option(entry.value).fold(() => [], (v) => [[key, v]]), () => [])));
-			const overridden = nonAliasEnvEntries.flatMap(([key]) => Option(process.env[envEnv(key)]).fold(() => [], () => [key]));
-			if (inject) Object.entries(envDefaults).forEach(([key, value]) => {
-				process.env[envEnv(key)] = value;
-			});
-			const sealedKeys = /* @__PURE__ */ new Set();
-			if (hasSealedValues) sealIdentity.fold(() => {
-				log.warn("phase.sealed.no_identity_file", { sealed_keys: nonAliasMetaKeys.filter((k) => !!nonAliasSecretEntries[k]?.encrypted_value).length });
-			}, ({ path: idPath, dispose }) => {
-				try {
-					unsealSecrets(nonAliasSecretEntries, idPath).fold((err) => {
-						log.warn("phase.sealed.decrypt_failed", { message: err.message });
-						warnings.push(`Sealed value decryption failed: ${err.message}`);
-					}, (unsealed) => {
-						const unsealedEntries = Object.entries(unsealed);
-						Object.assign(secrets, unsealed);
-						injected.push(...unsealedEntries.map(([key]) => key));
-						unsealedEntries.forEach(([key]) => {
-							sealedKeys.add(key);
-							log.debug("phase.sealed.resolved", { key });
-						});
-					});
-				} finally {
-					dispose();
-				}
+	});
+	const remainingKeys = nonAliasMetaKeys.filter((k) => !sealedKeys.has(k));
+	if (remainingKeys.length > 0) {
+		if (fnoxAvailable()) fnoxExport(opts.profile, identityKey.orUndefined()).fold((err) => {
+			log.warn("phase.fnox.export_failed", {
+				message: err.message,
+				skipped: remainingKeys.length
 			});
-			const remainingKeys = nonAliasMetaKeys.filter((k) => !sealedKeys.has(k));
-			if (remainingKeys.length > 0) {
-				if (fnoxAvailable()) fnoxExport(opts.profile, identityKey.orUndefined()).fold((err) => {
-					log.warn("phase.fnox.export_failed", {
-						message: err.message,
-						skipped: remainingKeys.length
-					});
-					warnings.push(`fnox export failed: ${err.message}`);
-					skipped.push(...remainingKeys);
-				}, (exported) => {
-					const found = remainingKeys.filter((key) => key in exported);
-					const notFound = remainingKeys.filter((key) => !(key in exported));
-					found.forEach((key) => {
-						secrets[key] = exported[key];
-						log.debug("phase.fnox.resolved", {
-							key,
-							profile: opts.profile
-						});
-					});
-					notFound.forEach((key) => {
-						log.debug("phase.fnox.not_in_export", {
-							key,
-							profile: opts.profile
-						});
-					});
-					injected.push(...found);
-					skipped.push(...notFound);
+			warnings.push(`fnox export failed: ${err.message}`);
+			skipped.push(...remainingKeys);
+		}, (exported) => {
+			const found = remainingKeys.filter((key) => key in exported);
+			const notFound = remainingKeys.filter((key) => !(key in exported));
+			found.forEach((key) => {
+				secrets[key] = exported[key];
+				log.debug("phase.fnox.resolved", {
+					key,
+					profile: opts.profile
 				});
-				else {
-					log.debug("phase.fnox.unavailable", { skipped: remainingKeys.length });
-					if (!hasSealedValues) warnings.push("fnox not available — no secrets injected");
-					else warnings.push("fnox not available — unsealed secrets could not be resolved");
-					skipped.push(...remainingKeys);
-				}
-			}
-			aliasSecretKeys.forEach((aliasKey) => {
-				const entry = aliasTable.entries.get(`secret.${aliasKey}`);
-				if (!entry) return;
-				Option(secrets[entry.targetKey]).fold(() => {
-					skipped.push(aliasKey);
-					log.debug("phase.alias.target_unresolved", {
-						alias: aliasKey,
-						target: entry.targetKey
-					});
-				}, (targetValue) => {
-					secrets[aliasKey] = targetValue;
-					injected.push(aliasKey);
-					log.debug("phase.alias.copied", {
-						alias: aliasKey,
-						target: entry.targetKey
-					});
+			});
+			notFound.forEach((key) => {
+				log.debug("phase.fnox.not_in_export", {
+					key,
+					profile: opts.profile
 				});
 			});
-			aliasEnvKeys.forEach((aliasKey) => {
-				const entry = aliasTable.entries.get(`env.${aliasKey}`);
-				if (!entry) return;
-				if (process.env[envEnv(aliasKey)] !== void 0) {
-					overridden.push(aliasKey);
-					return;
-				}
-				const targetEntry = envEntries[entry.targetKey];
-				if (targetEntry?.value === void 0) return;
-				const resolvedTarget = process.env[envEnv(entry.targetKey)] ?? targetEntry.value;
-				envDefaults[aliasKey] = resolvedTarget;
+			injected.push(...found);
+			skipped.push(...notFound);
+		});
+		else {
+			log.debug("phase.fnox.unavailable", { skipped: remainingKeys.length });
+			if (!hasSealedValues) warnings.push("fnox not available — no secrets injected");
+			else warnings.push("fnox not available — unsealed secrets could not be resolved");
+			skipped.push(...remainingKeys);
+		}
+	}
+	aliasSecretKeys.forEach((aliasKey) => {
+		const entry = aliasTable.entries.get(`secret.${aliasKey}`);
+		if (!entry) return;
+		Option(secrets[entry.targetKey]).fold(() => {
+			skipped.push(aliasKey);
+			log.debug("phase.alias.target_unresolved", {
+				alias: aliasKey,
+				target: entry.targetKey
+			});
+		}, (targetValue) => {
+			secrets[aliasKey] = targetValue;
+			injected.push(aliasKey);
+			log.debug("phase.alias.copied", {
+				alias: aliasKey,
+				target: entry.targetKey
 			});
-			if (inject) {
-				Object.entries(envDefaults).forEach(([key, value]) => {
-					process.env[envEnv(key)] ??= value;
-				});
-				Object.entries(secrets).forEach(([key, value]) => {
-					process.env[secretEnv(key)] = value;
-				});
-			}
-			return {
-				audit,
-				injected,
-				skipped,
-				secrets,
-				warnings,
-				envDefaults,
-				overridden,
-				envNames,
-				configPath,
-				configSource
-			};
 		});
-	}));
+	});
+	aliasEnvKeys.forEach((aliasKey) => {
+		const entry = aliasTable.entries.get(`env.${aliasKey}`);
+		if (!entry) return;
+		if (process.env[envEnv(aliasKey)] !== void 0) {
+			overridden.push(aliasKey);
+			return;
+		}
+		const targetEntry = envEntries[entry.targetKey];
+		if (targetEntry?.value === void 0) return;
+		const resolvedTarget = process.env[envEnv(entry.targetKey)] ?? targetEntry.value;
+		envDefaults[aliasKey] = resolvedTarget;
+	});
+	if (inject) {
+		Object.entries(envDefaults).forEach(([key, value]) => {
+			process.env[envEnv(key)] ??= value;
+		});
+		Object.entries(secrets).forEach(([key, value]) => {
+			process.env[secretEnv(key)] = value;
+		});
+	}
+	return Right({
+		audit,
+		injected,
+		skipped,
+		secrets,
+		warnings,
+		envDefaults,
+		overridden,
+		envNames,
+		configPath,
+		configSource
+	});
 };
-/** Programmatic boot — throws EnvpktBootError on failure (intentional throwing wrapper over bootSafe) */
-const boot = (options) => bootSafe(options).fold((err) => {
+/** Programmatic boot — rejects with EnvpktBootError on failure (intentional throwing wrapper over bootSafe) */
+const boot = async (options) => (await bootSafe(options)).fold((err) => {
 	throw new EnvpktBootError(err);
 }, (r) => r);
 /** Error class for boot() failures */
@@ -2355,9 +2349,11 @@ const formatBootError = (error) => {
 		case "CatalogLoadError": return `Catalog load error: ${error.message}`;
 		case "SecretNotInCatalog": return `Secret "${error.key}" not found in catalog: ${error.catalogPath}`;
 		case "MissingSecretsList": return `Missing secrets list: ${error.message}`;
-		case "AgeNotFound": return `age not found: ${error.message}`;
-		case "DecryptFailed": return `Decrypt failed: ${error.message}`;
-		case "IdentityNotFound": return `Identity file not found: ${error.path}`;
+		case "IdentityNotFound":
+		case "IdentityUnreadable":
+		case "NoIdentityKey":
+		case "PassphraseProtectedIdentity":
+		case "UnsupportedIdentity": return describeIdentityError(error);
 		case "SealKeyUnavailable": {
 			const keys = error.sealedKeys.length;
 			const searched = error.searched.map((line) => `  • ${line}`).join("\n");
@@ -3098,4 +3094,4 @@ const startServer = async () => {
 	await server.connect(transport);
 };
 //#endregion
-export { AgentIdentitySchema, CallbackConfigSchema, ConsumerType, EnvMetaSchema, EnvpktBootError, EnvpktConfigSchema, IdentitySchema, LifecycleConfigSchema, McpHeaderSchema, SecretMetaSchema, ToolsConfigSchema, ageAvailable, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, buildMcpHeaders, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, copyableSecretMeta, createDirectConsoleLogger, createDirectTestLogger, createServer, deriveServiceFromName, detectFnox, diffConfigs, directSilentLogger, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatDotenv, formatMcpHeadersError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, quoteDotenvValue, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, replaceSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, serializeEnvBlock, serializeSecretBlock, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig, validateMcpHeaders };
+export { AgentIdentitySchema, CallbackConfigSchema, ConsumerType, EnvMetaSchema, EnvpktBootError, EnvpktConfigSchema, IdentitySchema, LifecycleConfigSchema, McpHeaderSchema, SecretMetaSchema, ToolsConfigSchema, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, buildMcpHeaders, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, copyableSecretMeta, createDirectConsoleLogger, createDirectTestLogger, createServer, deriveServiceFromName, describeIdentityError, detectFnox, diffConfigs, directSilentLogger, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatDotenv, formatMcpHeadersError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, quoteDotenvValue, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, replaceSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, serializeEnvBlock, serializeSecretBlock, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig, validateMcpHeaders };