envpkt 0.8.0 → 0.8.1

package/dist/cli.js

@@ -825,14 +825,14 @@ const extractFnoxKeys = (config) => new Set(Object.keys(config.secrets));
 //#region src/core/keygen.ts
 /** Resolve the age identity file path: ENVPKT_AGE_KEY_FILE env var > ~/.envpkt/age-key.txt */
 const resolveKeyPath = () => process.env["ENVPKT_AGE_KEY_FILE"] ?? join(homedir(), ".envpkt", "age-key.txt");
-/** Generate an age keypair and write to disk */
+/** Generate an age keypair and write to disk. Refuses to overwrite if the file already exists. */
 const generateKeypair = (options) => {
 	if (!ageAvailable()) return Left({
 		_tag: "AgeNotFound",
 		message: "age-keygen CLI not found on PATH. Install age: https://github.com/FiloSottile/age"
 	});
 	const outputPath = options?.outputPath ?? resolveKeyPath();
-	if (existsSync(outputPath) && !options?.force) return Left({
+	if (existsSync(outputPath)) return Left({
 		_tag: "KeyExists",
 		path: outputPath
 	});
@@ -2738,15 +2738,26 @@ const tildeShorten = (p) => {
 };
 /** Derive a default identity name from the config path's parent directory */
 const deriveIdentityName = (configPath) => basename(dirname(resolve(configPath)));
+/**
+* Derive a project-specific key path from the config path.
+* - `envpkt.toml` → `~/.envpkt/<dir>-key.txt`
+* - `prod.envpkt.toml` → `~/.envpkt/<dir>-prod-key.txt`
+* - `foo.envpkt.toml` → `~/.envpkt/<dir>-foo-key.txt`
+*/
+const deriveKeyPath = (configPath) => {
+	const abs = resolve(configPath);
+	const dir = basename(dirname(abs));
+	const stem = basename(abs).replace(/\.envpkt\.toml$/, "").replace(/\.toml$/, "");
+	const name = stem === "envpkt" || stem === "" ? dir : `${dir}-${stem}`;
+	return join(homedir(), ".envpkt", `${name}-key.txt`);
+};
 const runKeygen = (options) => {
-	const outputPath = options.output ?? resolveKeyPath();
-	generateKeypair({
-		force: options.force,
-		outputPath
-	}).fold((err) => {
+	const configPath = resolve(options.config ?? join(process.cwd(), "envpkt.toml"));
+	generateKeypair({ outputPath: options.output ?? (options.global ? resolveKeyPath() : deriveKeyPath(configPath)) }).fold((err) => {
 		if (err._tag === "KeyExists") {
 			console.error(`${YELLOW}Warning:${RESET} Identity file already exists: ${CYAN}${err.path}${RESET}`);
-			console.error(`${DIM}Use --force to overwrite.${RESET}`);
+			console.error(`${DIM}To replace it: remove the file first, then re-run keygen.${RESET}`);
+			console.error(`${DIM}To use a different path: pass -o <path>.${RESET}`);
 			process.exit(1);
 		}
 		console.error(formatError(err));
@@ -2755,7 +2766,6 @@ const runKeygen = (options) => {
 		console.log(`${GREEN}Generated${RESET} age identity: ${CYAN}${identityPath}${RESET}`);
 		console.log(`${BOLD}Recipient:${RESET} ${recipient}`);
 		console.log("");
-		const configPath = resolve(options.config ?? join(process.cwd(), "envpkt.toml"));
 		if (existsSync(configPath)) {
 			const name = deriveIdentityName(configPath);
 			const keyFile = tildeShorten(identityPath);
@@ -3661,7 +3671,7 @@ program.name("envpkt").description("Credential lifecycle and fleet management fo
 program.command("init").description("Initialize a new envpkt.toml in the current directory").option("--from-fnox [path]", "Scaffold from fnox.toml (optionally specify path)").option("--catalog <path>", "Path to shared secret catalog").option("--identity", "Include [identity] section").option("--name <name>", "Identity name (requires --identity)").option("--capabilities <caps>", "Comma-separated capabilities (requires --identity)").option("--expires <date>", "Credential expiration YYYY-MM-DD (requires --identity)").option("--force", "Overwrite existing envpkt.toml").action((options) => {
 	runInit(process.cwd(), options);
 });
-program.command("keygen").description("Generate an age keypair for sealing secrets — run this before `seal` if you don't have a key yet").option("-c, --config <path>", "Path to envpkt.toml (updates identity.recipient if found)").option("--force", "Overwrite existing identity file").option("-o, --output <path>", "Output path for identity file (default: ~/.envpkt/age-key.txt)").action((options) => {
+program.command("keygen").description("Generate an age keypair for sealing secrets — run this before `seal` if you don't have a key yet").option("-c, --config <path>", "Path to envpkt.toml (updates identity.recipient if found)").option("-o, --output <path>", "Output path for identity file (default: ~/.envpkt/<project>-key.txt)").option("--global", "Write key to the shared default path (~/.envpkt/age-key.txt) instead of a project-specific one").action((options) => {
 	runKeygen(options);
 });
 program.command("audit").description("Audit credential health from envpkt.toml (use --strict in CI pipelines to gate deploys)").option("-c, --config <path>", "Path to envpkt.toml").option("--format <format>", "Output format: table | json | minimal", "table").option("--expiring <days>", "Show secrets expiring within N days", parseInt).option("--status <status>", "Filter by status: healthy | expiring_soon | expired | stale | missing").option("--strict", "Exit non-zero on any non-healthy secret").option("--all", "Show both secrets and env defaults").option("--env-only", "Show only env defaults (drift detection)").option("--sealed", "Show only secrets with encrypted_value").option("--external", "Show only secrets without encrypted_value").action((options) => {

package/dist/index.d.ts

@@ -453,9 +453,8 @@ declare const unsealSecrets: (meta: Readonly<Record<string, SecretMeta>>, identi
 declare const resolveKeyPath: () => string;
 /** Resolve an inline age key from ENVPKT_AGE_KEY env var (for CI) */
 declare const resolveInlineKey: () => Option<string>;
-/** Generate an age keypair and write to disk */
+/** Generate an age keypair and write to disk. Refuses to overwrite if the file already exists. */
 declare const generateKeypair: (options?: {
-  readonly force?: boolean;
   readonly outputPath?: string;
 }) => Either<KeygenError, KeygenResult>;
 type UpdateIdentityOptions = {

package/dist/index.js

@@ -1429,14 +1429,14 @@ const resolveInlineKey = () => {
 	const key = process.env["ENVPKT_AGE_KEY"];
 	return key ? Some(key) : None();
 };
-/** Generate an age keypair and write to disk */
+/** Generate an age keypair and write to disk. Refuses to overwrite if the file already exists. */
 const generateKeypair = (options) => {
 	if (!ageAvailable()) return Left({
 		_tag: "AgeNotFound",
 		message: "age-keygen CLI not found on PATH. Install age: https://github.com/FiloSottile/age"
 	});
 	const outputPath = options?.outputPath ?? resolveKeyPath();
-	if (existsSync(outputPath) && !options?.force) return Left({
+	if (existsSync(outputPath)) return Left({
 		_tag: "KeyExists",
 		path: outputPath
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envpkt",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Credential lifecycle and fleet management for AI agents",
   "keywords": [
     "credentials",