envpkt 0.8.1 → 0.10.1

package/dist/index.d.ts

@@ -44,6 +44,7 @@ declare const SecretMetaSchema: _$_sinclair_typebox0.TObject<{
   model_hint: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
   source: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
   encrypted_value: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
+  from_key: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
   required: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TBoolean>;
   tags: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TRecord<_$_sinclair_typebox0.TString, _$_sinclair_typebox0.TString>>;
 }>;
@@ -63,7 +64,8 @@ type CallbackConfig = Static<typeof CallbackConfigSchema>;
 declare const ToolsConfigSchema: _$_sinclair_typebox0.TRecord<_$_sinclair_typebox0.TString, _$_sinclair_typebox0.TUnknown>;
 type ToolsConfig = Static<typeof ToolsConfigSchema>;
 declare const EnvMetaSchema: _$_sinclair_typebox0.TObject<{
-  value: _$_sinclair_typebox0.TString;
+  value: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
+  from_key: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
   purpose: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
   comment: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
   tags: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TRecord<_$_sinclair_typebox0.TString, _$_sinclair_typebox0.TString>>;
@@ -96,11 +98,13 @@ declare const EnvpktConfigSchema: _$_sinclair_typebox0.TObject<{
     model_hint: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
     source: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
     encrypted_value: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
+    from_key: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
     required: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TBoolean>;
     tags: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TRecord<_$_sinclair_typebox0.TString, _$_sinclair_typebox0.TString>>;
   }>>>;
   env: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TRecord<_$_sinclair_typebox0.TString, _$_sinclair_typebox0.TObject<{
-    value: _$_sinclair_typebox0.TString;
+    value: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
+    from_key: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
     purpose: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
     comment: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TString>;
     tags: _$_sinclair_typebox0.TOptional<_$_sinclair_typebox0.TRecord<_$_sinclair_typebox0.TString, _$_sinclair_typebox0.TString>>;
@@ -133,7 +137,8 @@ type SecretHealth = {
   readonly purpose: Option<string>;
   readonly created: Option<string>;
   readonly expires: Option<string>;
-  readonly issues: List<string>;
+  readonly issues: List<string>; /** If this entry is an alias (from_key), the reference it points at (e.g. "secret.X") */
+  readonly alias_of: Option<string>;
 };
 type AuditResult = {
   readonly status: HealthStatus;
@@ -145,7 +150,8 @@ type AuditResult = {
   readonly stale: number;
   readonly missing: number;
   readonly missing_metadata: number;
-  readonly orphaned: number;
+  readonly orphaned: number; /** Count of entries that are aliases (from_key). Included in `secrets` but reported separately for visibility. */
+  readonly aliases: number;
   readonly identity?: Identity;
 };
 type EnvDriftStatus = "default" | "overridden" | "missing";
@@ -154,7 +160,8 @@ type EnvDriftEntry = {
   readonly defaultValue: string;
   readonly currentValue: string | undefined;
   readonly status: EnvDriftStatus;
-  readonly purpose: string | undefined;
+  readonly purpose: string | undefined; /** If this entry is an alias (from_key), the reference it points at (e.g. "env.X") */
+  readonly alias_of: Option<string>;
 };
 type EnvAuditResult = {
   readonly entries: ReadonlyArray<EnvDriftEntry>;
@@ -238,6 +245,40 @@ type CatalogError = {
   readonly _tag: "MissingSecretsList";
   readonly message: string;
 };
+type AliasTable = {
+  /** key → { type: "secret"|"env", targetType, targetKey } for every alias entry */readonly entries: ReadonlyMap<string, {
+    readonly kind: "secret" | "env";
+    readonly targetKind: "secret" | "env";
+    readonly targetKey: string;
+  }>;
+};
+type AliasError = {
+  readonly _tag: "AliasInvalidSyntax";
+  readonly key: string;
+  readonly kind: "secret" | "env";
+  readonly value: string;
+} | {
+  readonly _tag: "AliasTargetMissing";
+  readonly key: string;
+  readonly target: string;
+} | {
+  readonly _tag: "AliasSelfReference";
+  readonly key: string;
+} | {
+  readonly _tag: "AliasChained";
+  readonly key: string;
+  readonly target: string;
+} | {
+  readonly _tag: "AliasCrossType";
+  readonly key: string;
+  readonly kind: "secret" | "env";
+  readonly targetKind: "secret" | "env";
+} | {
+  readonly _tag: "AliasValueConflict";
+  readonly key: string;
+  readonly kind: "secret" | "env";
+  readonly field: string;
+};
 type BootOptions = {
   readonly configPath?: string;
   readonly profile?: string;
@@ -256,7 +297,7 @@ type BootResult = {
   readonly configPath: string;
   readonly configSource: ConfigSource;
 };
-type BootError = ConfigError | FnoxError | CatalogError | {
+type BootError = ConfigError | FnoxError | CatalogError | AliasError | {
   readonly _tag: "AuditFailed";
   readonly audit: AuditResult;
   readonly message: string;
@@ -354,6 +395,33 @@ declare const resolveSecrets: (agentMeta: Record<string, SecretMeta>, catalogMet
 /** Resolve an agent config against its catalog (if any), producing a flat self-contained config */
 declare const resolveConfig: (agentConfig: EnvpktConfig, agentConfigDir: string) => Either<CatalogError, ResolveResult>;
 //#endregion
+//#region src/core/alias.d.ts
+/**
+ * Validate all `from_key` references in a resolved config. Produces an
+ * AliasTable mapping each alias to its target, or an AliasError describing
+ * the first failure.
+ *
+ * Rules:
+ * - Ref must be "secret.<KEY>" or "env.<KEY>"
+ * - Target must exist in the same resolved config
+ * - Target must be the same type (secret→secret, env→env only)
+ * - Target must not itself be a from_key entry (single hop only)
+ * - Self-reference is rejected
+ * - An alias entry cannot also carry a value field (encrypted_value for
+ *   secrets, value for env)
+ */
+declare const validateAliases: (config: EnvpktConfig) => Either<AliasError, AliasTable>;
+/** Does this secret entry point at another entry? */
+declare const isSecretAlias: (meta: {
+  from_key?: string;
+} | undefined) => boolean;
+/** Does this env entry point at another entry? */
+declare const isEnvAlias: (meta: {
+  from_key?: string;
+} | undefined) => boolean;
+/** Format an alias error into a human-readable message */
+declare const formatAliasError: (error: AliasError) => string;
+//#endregion
 //#region src/core/format.d.ts
 type SecretDisplay = "encrypted" | "plaintext";
 type FormatPacketOptions = {
@@ -364,7 +432,7 @@ declare const maskValue: (value: string) => string;
 declare const formatPacket: (result: ResolveResult, options?: FormatPacketOptions) => string;
 //#endregion
 //#region src/core/audit.d.ts
-declare const computeAudit: (config: EnvpktConfig, fnoxKeys?: ReadonlySet<string>, today?: Date) => AuditResult;
+declare const computeAudit: (config: EnvpktConfig, fnoxKeys?: ReadonlySet<string>, today?: Date, aliasTable?: AliasTable) => AuditResult;
 declare const computeEnvAudit: (config: EnvpktConfig, env?: Readonly<Record<string, string | undefined>>) => EnvAuditResult;
 //#endregion
 //#region src/core/patterns.d.ts
@@ -554,4 +622,4 @@ type ToolDef = {
 declare const toolDefinitions: readonly ToolDef[];
 declare const callTool: (name: string, args: Record<string, unknown>) => CallToolResult;
 //#endregion
-export { type AgentIdentity, AgentIdentitySchema, type AuditResult, type BootError, type BootOptions, type BootResult, type CallbackConfig, CallbackConfigSchema, type CatalogError, type CheckResult, type ConfidenceLevel, type ConfigError, type ConfigSource, type ConsumerType, type CredentialPattern, type DriftEntry, type DriftStatus, type EnvAuditResult, type EnvDriftEntry, type EnvDriftStatus, type EnvMeta, EnvMetaSchema, EnvpktBootError, type EnvpktConfig, EnvpktConfigSchema, type FleetAgent, type FleetHealth, type FnoxConfig, type FnoxError, type FnoxSecret, type FormatPacketOptions, type HealthStatus, type Identity, type IdentityError, IdentitySchema, type KeygenError, type KeygenResult, type LifecycleConfig, LifecycleConfigSchema, type MatchResult, type ResolveOptions, type ResolveResult, type ResolvedPath, type ScanOptions, type ScanResult, type SealError, type SecretDisplay, type SecretHealth, type SecretMeta, SecretMetaSchema, type SecretStatus, type TomlEditError, type ToolsConfig, ToolsConfigSchema, ageAvailable, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, createServer, deriveServiceFromName, detectFnox, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatPacket, generateKeypair, generateTomlFromScan, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateConfig };
+export { type AgentIdentity, AgentIdentitySchema, type AliasError, type AliasTable, type AuditResult, type BootError, type BootOptions, type BootResult, type CallbackConfig, CallbackConfigSchema, type CatalogError, type CheckResult, type ConfidenceLevel, type ConfigError, type ConfigSource, type ConsumerType, type CredentialPattern, type DriftEntry, type DriftStatus, type EnvAuditResult, type EnvDriftEntry, type EnvDriftStatus, type EnvMeta, EnvMetaSchema, EnvpktBootError, type EnvpktConfig, EnvpktConfigSchema, type FleetAgent, type FleetHealth, type FnoxConfig, type FnoxError, type FnoxSecret, type FormatPacketOptions, type HealthStatus, type Identity, type IdentityError, IdentitySchema, type KeygenError, type KeygenResult, type LifecycleConfig, LifecycleConfigSchema, type MatchResult, type ResolveOptions, type ResolveResult, type ResolvedPath, type ScanOptions, type ScanResult, type SealError, type SecretDisplay, type SecretHealth, type SecretMeta, SecretMetaSchema, type SecretStatus, type TomlEditError, type ToolsConfig, ToolsConfigSchema, ageAvailable, ageDecrypt, ageEncrypt, appendSection, boot, bootSafe, callTool, compareFnoxAndEnvpkt, computeAudit, computeEnvAudit, createServer, deriveServiceFromName, detectFnox, discoverConfig, envCheck, envScan, extractFnoxKeys, findConfigPath, fnoxAvailable, fnoxExport, fnoxGet, formatAliasError, formatPacket, generateKeypair, generateTomlFromScan, isEnvAlias, isSecretAlias, loadCatalog, loadConfig, loadConfigFromCwd, maskValue, matchEnvVar, matchValueShape, parseToml, readConfigFile, readFnoxConfig, readResource, removeSection, renameSection, resolveConfig, resolveConfigPath, resolveInlineKey, resolveKeyPath, resolveSecrets, resolveValues, resourceDefinitions, scanEnv, scanFleet, sealSecrets, startServer, toolDefinitions, unsealSecrets, unwrapAgentKey, updateConfigIdentity, updateSectionFields, validateAliases, validateConfig };