envpkt 0.6.6 → 0.6.8

package/dist/cli.js

@@ -5,7 +5,7 @@ import { fileURLToPath } from "node:url";
 import { Command } from "commander";
 import { TypeCompiler } from "@sinclair/typebox/compiler";
 import { Cond, Left, List, Option, Right, Try } from "functype";
-import { Env, Fs, Path } from "functype-os";
+import { Env, Fs, Path, Platform } from "functype-os";
 import { TomlDate, parse, stringify } from "smol-toml";
 import { FormatRegistry, Type } from "@sinclair/typebox";
 import { execFileSync } from "node:child_process";
@@ -145,28 +145,26 @@ const expandGlobPath = (expanded) => {
 	const prefix = globSegment.replace(/\*.*$/, "");
 	return Fs.readdirSync(parentDir).fold(() => [], (entries) => entries.filter((entry) => entry.startsWith(prefix)).map((entry) => join(parentDir, entry, suffix)).filter((p) => Fs.existsSync(p)).toArray());
 };
-/** Ordered candidate paths for config discovery beyond CWD */
-const CONFIG_SEARCH_PATHS = [
-	"~/.envpkt/envpkt.toml",
-	"~/OneDrive/.envpkt/envpkt.toml",
-	"~/Library/CloudStorage/OneDrive-Personal/.envpkt/envpkt.toml",
-	"~/Library/CloudStorage/OneDrive-SharedLibraries-*/.envpkt/envpkt.toml",
+/** Env-var fallback paths for cases where Platform detection misses */
+const ENV_FALLBACK_PATHS = [
 	"$WINHOME/OneDrive/.envpkt/envpkt.toml",
 	"$USERPROFILE/OneDrive/.envpkt/envpkt.toml",
 	"$OneDrive/.envpkt/envpkt.toml",
 	"$OneDriveConsumer/.envpkt/envpkt.toml",
 	"$OneDriveCommercial/.envpkt/envpkt.toml",
-	"/mnt/c/Users/$USER/OneDrive/.envpkt/envpkt.toml",
-	"~/Library/Mobile Documents/com~apple~CloudDocs/.envpkt/envpkt.toml",
-	"~/Dropbox/.envpkt/envpkt.toml",
 	"$DROPBOX_PATH/.envpkt/envpkt.toml",
-	"~/Google Drive/My Drive/.envpkt/envpkt.toml",
-	"~/Library/CloudStorage/GoogleDrive-*/.envpkt/envpkt.toml",
 	"$GOOGLE_DRIVE/.envpkt/envpkt.toml",
 	"$WINHOME/.envpkt/envpkt.toml",
 	"$USERPROFILE/.envpkt/envpkt.toml"
 ];
-/** Discover config by checking CWD, then ENVPKT_SEARCH_PATH, then built-in candidate paths */
+/** Build discovery paths dynamically from Platform home and cloud storage detection */
+const buildSearchPaths = () => {
+	const paths = [];
+	for (const home of Platform.homeDirs().toArray()) paths.push(join(home, ".envpkt", CONFIG_FILENAME$2));
+	for (const cloud of Platform.cloudStorageDirs().toArray()) paths.push(join(cloud.path, ".envpkt", CONFIG_FILENAME$2));
+	return paths;
+};
+/** Discover config by checking CWD, then ENVPKT_SEARCH_PATH, then dynamic Platform paths */
 const discoverConfig = (cwd) => {
 	const cwdCandidate = join(cwd ?? process.cwd(), CONFIG_FILENAME$2);
 	if (Fs.existsSync(cwdCandidate)) return Option({
@@ -174,7 +172,7 @@ const discoverConfig = (cwd) => {
 		source: "cwd"
 	});
 	const customPaths = Env.get("ENVPKT_SEARCH_PATH").fold(() => [], (v) => v.split(":").filter(Boolean));
-	for (const template of [...customPaths, ...CONFIG_SEARCH_PATHS]) {
+	for (const template of customPaths) {
 		const expanded = expandPath(template);
 		if (!expanded || expanded.startsWith("/.envpkt")) continue;
 		const matches = expandGlobPath(expanded);
@@ -183,6 +181,18 @@ const discoverConfig = (cwd) => {
 			source: "search"
 		});
 	}
+	for (const p of buildSearchPaths()) if (Fs.existsSync(p)) return Option({
+		path: p,
+		source: "search"
+	});
+	for (const template of ENV_FALLBACK_PATHS) {
+		const expanded = expandPath(template);
+		if (!expanded || expanded.startsWith("/.envpkt")) continue;
+		if (Fs.existsSync(expanded)) return Option({
+			path: expanded,
+			source: "search"
+		});
+	}
 	return Option(void 0);
 };
 /** Read a config file, returning Either<ConfigError, string> */
@@ -1215,6 +1225,7 @@ const bootSafe = (options) => {
 					sealedKeys.add(key);
 				}
 			});
+			else if (hasSealedValues && !identityFilePath) warnings.push("Sealed values found but no identity file available for decryption");
 			const remainingKeys = metaKeys.filter((k) => !sealedKeys.has(k));
 			if (remainingKeys.length > 0) if (fnoxAvailable()) fnoxExport(opts.profile, identityKey).fold((err) => {
 				warnings.push(`fnox export failed: ${err.message}`);
@@ -1227,6 +1238,7 @@ const bootSafe = (options) => {
 			});
 			else {
 				if (!hasSealedValues) warnings.push("fnox not available — no secrets injected");
+				else warnings.push("fnox not available — unsealed secrets could not be resolved");
 				for (const key of remainingKeys) skipped.push(key);
 			}
 			if (inject) for (const [key, value] of Object.entries(secrets)) process.env[key] = value;

package/dist/index.d.ts

@@ -315,7 +315,7 @@ type DiscoveredConfig = {
   readonly path: string;
   readonly source: "cwd" | "search";
 };
-/** Discover config by checking CWD, then ENVPKT_SEARCH_PATH, then built-in candidate paths */
+/** Discover config by checking CWD, then ENVPKT_SEARCH_PATH, then dynamic Platform paths */
 declare const discoverConfig: (cwd?: string) => Option<DiscoveredConfig>;
 /** Read a config file, returning Either<ConfigError, string> */
 declare const readConfigFile: (path: string) => Either<ConfigError, string>;

package/dist/index.js

@@ -2,7 +2,7 @@ import { FormatRegistry, Type } from "@sinclair/typebox";
 import { dirname, join, resolve } from "node:path";
 import { TypeCompiler } from "@sinclair/typebox/compiler";
 import { Cond, Left, List, None, Option, Right, Some, Try } from "functype";
-import { Env, Fs, Path } from "functype-os";
+import { Env, Fs, Path, Platform } from "functype-os";
 import { TomlDate, parse } from "smol-toml";
 import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
@@ -149,28 +149,26 @@ const expandGlobPath = (expanded) => {
 	const prefix = globSegment.replace(/\*.*$/, "");
 	return Fs.readdirSync(parentDir).fold(() => [], (entries) => entries.filter((entry) => entry.startsWith(prefix)).map((entry) => join(parentDir, entry, suffix)).filter((p) => Fs.existsSync(p)).toArray());
 };
-/** Ordered candidate paths for config discovery beyond CWD */
-const CONFIG_SEARCH_PATHS = [
-	"~/.envpkt/envpkt.toml",
-	"~/OneDrive/.envpkt/envpkt.toml",
-	"~/Library/CloudStorage/OneDrive-Personal/.envpkt/envpkt.toml",
-	"~/Library/CloudStorage/OneDrive-SharedLibraries-*/.envpkt/envpkt.toml",
+/** Env-var fallback paths for cases where Platform detection misses */
+const ENV_FALLBACK_PATHS = [
 	"$WINHOME/OneDrive/.envpkt/envpkt.toml",
 	"$USERPROFILE/OneDrive/.envpkt/envpkt.toml",
 	"$OneDrive/.envpkt/envpkt.toml",
 	"$OneDriveConsumer/.envpkt/envpkt.toml",
 	"$OneDriveCommercial/.envpkt/envpkt.toml",
-	"/mnt/c/Users/$USER/OneDrive/.envpkt/envpkt.toml",
-	"~/Library/Mobile Documents/com~apple~CloudDocs/.envpkt/envpkt.toml",
-	"~/Dropbox/.envpkt/envpkt.toml",
 	"$DROPBOX_PATH/.envpkt/envpkt.toml",
-	"~/Google Drive/My Drive/.envpkt/envpkt.toml",
-	"~/Library/CloudStorage/GoogleDrive-*/.envpkt/envpkt.toml",
 	"$GOOGLE_DRIVE/.envpkt/envpkt.toml",
 	"$WINHOME/.envpkt/envpkt.toml",
 	"$USERPROFILE/.envpkt/envpkt.toml"
 ];
-/** Discover config by checking CWD, then ENVPKT_SEARCH_PATH, then built-in candidate paths */
+/** Build discovery paths dynamically from Platform home and cloud storage detection */
+const buildSearchPaths = () => {
+	const paths = [];
+	for (const home of Platform.homeDirs().toArray()) paths.push(join(home, ".envpkt", CONFIG_FILENAME$1));
+	for (const cloud of Platform.cloudStorageDirs().toArray()) paths.push(join(cloud.path, ".envpkt", CONFIG_FILENAME$1));
+	return paths;
+};
+/** Discover config by checking CWD, then ENVPKT_SEARCH_PATH, then dynamic Platform paths */
 const discoverConfig = (cwd) => {
 	const cwdCandidate = join(cwd ?? process.cwd(), CONFIG_FILENAME$1);
 	if (Fs.existsSync(cwdCandidate)) return Option({
@@ -178,7 +176,7 @@ const discoverConfig = (cwd) => {
 		source: "cwd"
 	});
 	const customPaths = Env.get("ENVPKT_SEARCH_PATH").fold(() => [], (v) => v.split(":").filter(Boolean));
-	for (const template of [...customPaths, ...CONFIG_SEARCH_PATHS]) {
+	for (const template of customPaths) {
 		const expanded = expandPath(template);
 		if (!expanded || expanded.startsWith("/.envpkt")) continue;
 		const matches = expandGlobPath(expanded);
@@ -187,6 +185,18 @@ const discoverConfig = (cwd) => {
 			source: "search"
 		});
 	}
+	for (const p of buildSearchPaths()) if (Fs.existsSync(p)) return Option({
+		path: p,
+		source: "search"
+	});
+	for (const template of ENV_FALLBACK_PATHS) {
+		const expanded = expandPath(template);
+		if (!expanded || expanded.startsWith("/.envpkt")) continue;
+		if (Fs.existsSync(expanded)) return Option({
+			path: expanded,
+			source: "search"
+		});
+	}
 	return Option(void 0);
 };
 /** Read a config file, returning Either<ConfigError, string> */
@@ -1720,6 +1730,7 @@ const bootSafe = (options) => {
 					sealedKeys.add(key);
 				}
 			});
+			else if (hasSealedValues && !identityFilePath) warnings.push("Sealed values found but no identity file available for decryption");
 			const remainingKeys = metaKeys.filter((k) => !sealedKeys.has(k));
 			if (remainingKeys.length > 0) if (fnoxAvailable()) fnoxExport(opts.profile, identityKey).fold((err) => {
 				warnings.push(`fnox export failed: ${err.message}`);
@@ -1732,6 +1743,7 @@ const bootSafe = (options) => {
 			});
 			else {
 				if (!hasSealedValues) warnings.push("fnox not available — no secrets injected");
+				else warnings.push("fnox not available — unsealed secrets could not be resolved");
 				for (const key of remainingKeys) skipped.push(key);
 			}
 			if (inject) for (const [key, value] of Object.entries(secrets)) process.env[key] = value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envpkt",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Credential lifecycle and fleet management for AI agents",
   "keywords": [
     "credentials",
@@ -43,11 +43,11 @@
     "@sinclair/typebox": "^0.34.48",
     "commander": "^14.0.3",
     "functype": "^0.49.0",
-    "functype-os": "^0.2.0",
+    "functype-os": "^0.3.0",
     "smol-toml": "^1.6.0"
   },
   "devDependencies": {
-    "@types/node": "^24.11.0",
+    "@types/node": "^24.12.0",
     "ts-builds": "^2.5.0",
     "tsdown": "^0.20.3",
     "tsx": "^4.21.0"