@seekrit/cli 0.0.1

package/dist/index.js

@@ -0,0 +1,921 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { spawn } from "child_process";
+
+// ../../packages/crypto/src/encoding.ts
+var CHUNK = 32768;
+function toBase64Url(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+  const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function utf8Encode(text) {
+  return new TextEncoder().encode(text);
+}
+function utf8Decode(bytes) {
+  return new TextDecoder().decode(bytes);
+}
+
+// ../../packages/crypto/src/errors.ts
+var SeekritCryptoError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "SeekritCryptoError";
+    this.code = code;
+  }
+};
+function splitBlob(blob, prefix, segments) {
+  const parts = blob.split(".");
+  if (parts[0] !== prefix) {
+    throw new SeekritCryptoError(
+      "UNSUPPORTED_VERSION",
+      `expected a "${prefix}" blob, got "${parts[0] ?? ""}"`
+    );
+  }
+  if (parts.length !== segments + 1 || parts.some((p) => p.length === 0)) {
+    throw new SeekritCryptoError("MALFORMED_BLOB", `malformed "${prefix}" blob`);
+  }
+  return parts.slice(1);
+}
+
+// ../../packages/crypto/src/aes.ts
+var SECRET_PREFIX = "sc1";
+var IV_LENGTH = 12;
+function generateDek() {
+  return crypto.getRandomValues(new Uint8Array(32));
+}
+async function importDek(dek, usage) {
+  return crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, [usage]);
+}
+async function encryptSecret(dek, plaintext, aad) {
+  const key = await importDek(dek, "encrypt");
+  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: utf8Encode(aad) },
+    key,
+    utf8Encode(plaintext)
+  );
+  return `${SECRET_PREFIX}.${toBase64Url(iv)}.${toBase64Url(new Uint8Array(ciphertext))}`;
+}
+async function decryptSecret(dek, blob, aad) {
+  const [ivB64, ctB64] = splitBlob(blob, SECRET_PREFIX, 2);
+  const key = await importDek(dek, "decrypt");
+  try {
+    const plaintext = await crypto.subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv: fromBase64Url(ivB64),
+        additionalData: utf8Encode(aad)
+      },
+      key,
+      fromBase64Url(ctB64)
+    );
+    return utf8Decode(new Uint8Array(plaintext));
+  } catch {
+    throw new SeekritCryptoError(
+      "DECRYPT_FAILED",
+      "secret decryption failed: wrong key, tampered data, or mismatched context"
+    );
+  }
+}
+function secretAad(environmentId, secretName) {
+  return `${environmentId}/${secretName}`;
+}
+
+// ../../packages/crypto/src/keys.ts
+async function generateKeyPair() {
+  const pair = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, [
+    "deriveBits"
+  ]);
+  const [publicJwk, privateJwk] = await Promise.all([
+    crypto.subtle.exportKey("jwk", pair.publicKey),
+    crypto.subtle.exportKey("jwk", pair.privateKey)
+  ]);
+  return {
+    publicKeyJwk: JSON.stringify(publicJwk),
+    privateKeyJwk: JSON.stringify(privateJwk)
+  };
+}
+async function importPublicKey(publicKeyJwk) {
+  return crypto.subtle.importKey(
+    "jwk",
+    JSON.parse(publicKeyJwk),
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    []
+  );
+}
+async function importPrivateKey(privateKeyJwk) {
+  return crypto.subtle.importKey(
+    "jwk",
+    JSON.parse(privateKeyJwk),
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    ["deriveBits"]
+  );
+}
+async function exportPrivateKeyPkcs8(key) {
+  return new Uint8Array(await crypto.subtle.exportKey("pkcs8", key));
+}
+async function importPrivateKeyPkcs8(pkcs8) {
+  return crypto.subtle.importKey(
+    "pkcs8",
+    pkcs8,
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    ["deriveBits"]
+  );
+}
+
+// ../../packages/crypto/src/passphrase.ts
+var PK_PREFIX = "pk1";
+var PBKDF2_ITERATIONS = 6e5;
+async function deriveKek(passphrase, salt, iterations, usage) {
+  const material = await crypto.subtle.importKey(
+    "raw",
+    utf8Encode(passphrase),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return crypto.subtle.deriveKey(
+    { name: "PBKDF2", hash: "SHA-256", salt, iterations },
+    material,
+    { name: "AES-GCM", length: 256 },
+    false,
+    [usage]
+  );
+}
+async function encryptPrivateKey(passphrase, privateKeyJwk) {
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const kek = await deriveKek(passphrase, salt, PBKDF2_ITERATIONS, "encrypt");
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    kek,
+    utf8Encode(privateKeyJwk)
+  );
+  return [
+    PK_PREFIX,
+    String(PBKDF2_ITERATIONS),
+    toBase64Url(salt),
+    toBase64Url(iv),
+    toBase64Url(new Uint8Array(ciphertext))
+  ].join(".");
+}
+async function decryptPrivateKey(passphrase, blob) {
+  const [iterStr, saltB64, ivB64, ctB64] = splitBlob(blob, PK_PREFIX, 4);
+  const iterations = Number.parseInt(iterStr, 10);
+  if (!Number.isFinite(iterations) || iterations < 1) {
+    throw new SeekritCryptoError("MALFORMED_BLOB", "invalid PBKDF2 iteration count");
+  }
+  const kek = await deriveKek(passphrase, fromBase64Url(saltB64), iterations, "decrypt");
+  try {
+    const plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: fromBase64Url(ivB64) },
+      kek,
+      fromBase64Url(ctB64)
+    );
+    return utf8Decode(new Uint8Array(plaintext));
+  } catch {
+    throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
+  }
+}
+
+// ../../packages/crypto/src/token.ts
+var TOKEN_PREFIX = "skt";
+var TOKEN_ID_LENGTH = 22;
+var ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+function randomTokenId() {
+  let out = "";
+  while (out.length < TOKEN_ID_LENGTH) {
+    const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
+    for (const byte of bytes) {
+      if (byte < 248) out += ID_ALPHABET[byte % 62];
+      if (out.length === TOKEN_ID_LENGTH) break;
+    }
+  }
+  return `${TOKEN_PREFIX}_${out}`;
+}
+async function hashToken(token2) {
+  const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token2));
+  return toBase64Url(new Uint8Array(digest));
+}
+async function createServiceToken() {
+  const { publicKeyJwk, privateKeyJwk } = await generateKeyPair();
+  const privateKey = await importPrivateKey(privateKeyJwk);
+  const pkcs8 = await exportPrivateKeyPkcs8(privateKey);
+  const tokenId = randomTokenId();
+  const token2 = `${tokenId}_${toBase64Url(pkcs8)}`;
+  return { token: token2, tokenId, tokenHash: await hashToken(token2), publicKeyJwk };
+}
+async function parseServiceToken(token2) {
+  const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token2);
+  if (!match) {
+    throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
+  }
+  const [, tokenId, keyB64] = match;
+  try {
+    const privateKey = await importPrivateKeyPkcs8(fromBase64Url(keyB64));
+    return { tokenId, privateKey };
+  } catch {
+    throw new SeekritCryptoError("MALFORMED_TOKEN", "service token private key is corrupted");
+  }
+}
+function isServiceToken(value) {
+  return value.startsWith(`${TOKEN_PREFIX}_`);
+}
+
+// ../../packages/crypto/src/wrap.ts
+var WRAP_PREFIX = "wd1";
+var HKDF_INFO = "seekrit/wrap-dek/v1";
+async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
+  const ecdh = { name: "ECDH", public: peerPublicKey };
+  const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
+  const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt,
+      info: utf8Encode(HKDF_INFO)
+    },
+    hkdfKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    [usage]
+  );
+}
+async function wrapDek(dek, recipientPublicKeyJwk) {
+  const recipientKey = await importPublicKey(recipientPublicKeyJwk);
+  const ephemeral = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, [
+    "deriveBits"
+  ]);
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    wrappingKey,
+    dek
+  );
+  const ephemeralRaw = new Uint8Array(
+    await crypto.subtle.exportKey("raw", ephemeral.publicKey)
+  );
+  return [
+    WRAP_PREFIX,
+    toBase64Url(ephemeralRaw),
+    toBase64Url(salt),
+    toBase64Url(iv),
+    toBase64Url(new Uint8Array(ciphertext))
+  ].join(".");
+}
+async function unwrapDek(wrapped, privateKey) {
+  const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
+  const ephemeralKey = await crypto.subtle.importKey(
+    "raw",
+    fromBase64Url(ephB64),
+    { name: "ECDH", namedCurve: "P-256" },
+    false,
+    []
+  );
+  const wrappingKey = await deriveWrappingKey(
+    privateKey,
+    ephemeralKey,
+    fromBase64Url(saltB64),
+    "decrypt"
+  );
+  try {
+    const dek = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: fromBase64Url(ivB64) },
+      wrappingKey,
+      fromBase64Url(ctB64)
+    );
+    return new Uint8Array(dek);
+  } catch {
+    throw new SeekritCryptoError(
+      "DECRYPT_FAILED",
+      "DEK unwrap failed: wrong private key or tampered grant"
+    );
+  }
+}
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, parse } from "path";
+var DEFAULT_API_URL = "http://localhost:8787";
+var PROJECT_FILE = "seekrit.json";
+function globalConfigPath() {
+  return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
+}
+function readGlobalConfig() {
+  const path = globalConfigPath();
+  if (!existsSync(path)) return {};
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+function writeGlobalConfig(update) {
+  const path = globalConfigPath();
+  const merged = { ...readGlobalConfig(), ...update };
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(merged, null, 2)}
+`, { mode: 384 });
+}
+function findProjectConfig(startDir = process.cwd()) {
+  let dir = startDir;
+  const { root } = parse(dir);
+  while (true) {
+    const candidate = join(dir, PROJECT_FILE);
+    if (existsSync(candidate)) {
+      return JSON.parse(readFileSync(candidate, "utf8"));
+    }
+    if (dir === root) return null;
+    dir = dirname(dir);
+  }
+}
+function writeProjectConfig(config, dir = process.cwd()) {
+  const path = join(dir, PROJECT_FILE);
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`);
+  return path;
+}
+
+// ../../packages/api-client/src/index.ts
+var SeekritApiError = class extends Error {
+  status;
+  code;
+  constructor(status, code, message) {
+    super(message);
+    this.name = "SeekritApiError";
+    this.status = status;
+    this.code = code;
+  }
+};
+var SeekritClient = class {
+  baseUrl;
+  auth;
+  fetchImpl;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/$/, "");
+    this.auth = options.auth;
+    this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+  }
+  async request(method, path, body) {
+    const headers = { accept: "application/json" };
+    if (this.auth.type === "bearer") {
+      headers.authorization = `Bearer ${this.auth.token}`;
+    } else if (this.auth.type === "dynamic") {
+      const token2 = await this.auth.getToken();
+      if (!token2) throw new SeekritApiError(401, "unauthorized", "session expired");
+      headers.authorization = `Bearer ${token2}`;
+    } else {
+      headers["x-seekrit-dev-user"] = this.auth.email;
+    }
+    if (body !== void 0) headers["content-type"] = "application/json";
+    const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      method,
+      headers,
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    if (!res.ok) {
+      const fallback = { error: { code: "internal", message: `HTTP ${res.status}` } };
+      const payload = await res.json().catch(() => fallback);
+      throw new SeekritApiError(
+        res.status,
+        payload.error?.code ?? "internal",
+        payload.error?.message ?? `HTTP ${res.status}`
+      );
+    }
+    return await res.json();
+  }
+  // ── identity ────────────────────────────────────────────────────────────
+  me() {
+    return this.request("GET", "/v1/me");
+  }
+  getMyKeys() {
+    return this.request("GET", "/v1/me/keys");
+  }
+  setMyKeys(input) {
+    return this.request("PUT", "/v1/me/keys", input);
+  }
+  // ── organizations ───────────────────────────────────────────────────────
+  listOrgs() {
+    return this.request("GET", "/v1/orgs");
+  }
+  createOrg(input) {
+    return this.request("POST", "/v1/orgs", input);
+  }
+  getOrg(orgId) {
+    return this.request("GET", `/v1/orgs/${orgId}`);
+  }
+  listMembers(orgId) {
+    return this.request("GET", `/v1/orgs/${orgId}/members`);
+  }
+  // ── applications ────────────────────────────────────────────────────────
+  listApps(orgId) {
+    return this.request("GET", `/v1/orgs/${orgId}/apps`);
+  }
+  createApp(orgId, input) {
+    return this.request("POST", `/v1/orgs/${orgId}/apps`, input);
+  }
+  getApp(orgId, appId) {
+    return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}`);
+  }
+  deleteApp(orgId, appId) {
+    return this.request("DELETE", `/v1/orgs/${orgId}/apps/${appId}`);
+  }
+  // ── environments ────────────────────────────────────────────────────────
+  listEnvs(orgId, appId) {
+    return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/envs`);
+  }
+  createEnv(orgId, appId, input) {
+    return this.request("POST", `/v1/orgs/${orgId}/apps/${appId}/envs`, input);
+  }
+  getEnv(orgId, envId) {
+    return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
+  }
+  deleteEnv(orgId, envId) {
+    return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
+  }
+  // ── secrets (ciphertext only — encrypt/decrypt happens in the caller) ───
+  listSecrets(orgId, envId) {
+    return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/secrets`);
+  }
+  setSecret(orgId, envId, name, ciphertext) {
+    return this.request("PUT", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`, { ciphertext });
+  }
+  deleteSecret(orgId, envId, name) {
+    return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`);
+  }
+  // ── environment key grants ──────────────────────────────────────────────
+  /** The calling principal's wrapped DEK for this environment. */
+  getMyEnvKey(orgId, envId) {
+    return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
+  }
+  listEnvKeys(orgId, envId) {
+    return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/keys`);
+  }
+  grantEnvKey(orgId, envId, input) {
+    return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/keys`, input);
+  }
+  revokeEnvKey(orgId, envId, grantId) {
+    return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/keys/${grantId}`);
+  }
+  // ── service tokens ──────────────────────────────────────────────────────
+  listTokens(orgId) {
+    return this.request("GET", `/v1/orgs/${orgId}/tokens`);
+  }
+  createToken(orgId, input) {
+    return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
+  }
+  revokeToken(orgId, tokenId) {
+    return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
+  }
+  // ── audit ───────────────────────────────────────────────────────────────
+  listAudit(orgId, query = {}) {
+    const params = new URLSearchParams();
+    if (query.cursor) params.set("cursor", query.cursor);
+    if (query.limit) params.set("limit", String(query.limit));
+    if (query.action) params.set("action", query.action);
+    if (query.resourceType) params.set("resourceType", query.resourceType);
+    const qs = params.size > 0 ? `?${params}` : "";
+    return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
+  }
+};
+
+// src/io.ts
+import { createInterface } from "readline";
+import { Writable } from "stream";
+function fail(message) {
+  console.error(`error: ${message}`);
+  process.exit(1);
+}
+function promptHidden(question) {
+  const muted = new Writable({
+    write(_chunk, _encoding, callback) {
+      callback();
+    }
+  });
+  process.stderr.write(question);
+  const rl = createInterface({ input: process.stdin, output: muted, terminal: true });
+  return new Promise((resolve) => {
+    rl.question("", (answer) => {
+      rl.close();
+      process.stderr.write("\n");
+      resolve(answer);
+    });
+  });
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/context.ts
+function buildContext() {
+  const config = readGlobalConfig();
+  const apiUrl = process.env.SEEKRIT_API_URL ?? config.apiUrl ?? DEFAULT_API_URL;
+  const token2 = process.env.SEEKRIT_TOKEN ?? config.token;
+  const devUser = process.env.SEEKRIT_DEV_USER ?? config.devUser;
+  let auth;
+  if (token2) auth = { type: "bearer", token: token2 };
+  else if (devUser) auth = { type: "dev", email: devUser };
+  else {
+    fail(
+      "no credentials found \u2014 run `seekrit login --token skt_\u2026`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER"
+    );
+  }
+  return { client: new SeekritClient({ baseUrl: apiUrl, auth }), auth };
+}
+function requireProject() {
+  const project = findProjectConfig();
+  if (!project) {
+    fail("no seekrit.json found \u2014 run `seekrit init` in your project directory");
+  }
+  return project;
+}
+async function getDek(ctx, orgId, envId) {
+  const { wrappedDek } = await ctx.client.getMyEnvKey(orgId, envId);
+  if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+    const { privateKey } = await parseServiceToken(ctx.auth.token);
+    return unwrapDek(wrappedDek, privateKey);
+  }
+  const { encryptedPrivateKey } = await ctx.client.getMyKeys();
+  const passphrase = process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: ");
+  const privateKeyJwk = await decryptPrivateKey(passphrase, encryptedPrivateKey);
+  return unwrapDek(wrappedDek, await importPrivateKey(privateKeyJwk));
+}
+
+// src/format.ts
+function needsQuoting(value) {
+  return /[\s"'`$\\#]/.test(value) || value === "";
+}
+function dotenvQuote(value) {
+  if (!needsQuoting(value)) return value;
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\n", "\\n")}"`;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function formatSecrets(values, format) {
+  const names = Object.keys(values).sort();
+  switch (format) {
+    case "json":
+      return JSON.stringify(values, names, 2);
+    case "shell":
+      return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
+    case "dotenv":
+      return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+  }
+}
+
+// src/secrets.ts
+async function fetchDecryptedSecrets(ctx, orgId, envId) {
+  const [dek, { secrets: secrets2 }] = await Promise.all([
+    getDek(ctx, orgId, envId),
+    ctx.client.listSecrets(orgId, envId)
+  ]);
+  const entries = await Promise.all(
+    secrets2.map(
+      async (secret) => [
+        secret.name,
+        await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))
+      ]
+    )
+  );
+  return Object.fromEntries(entries);
+}
+async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
+  const dek = await getDek(ctx, orgId, envId);
+  const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
+  await ctx.client.setSecret(orgId, envId, name, ciphertext);
+}
+
+// package.json
+var version = "0.0.1";
+
+// src/index.ts
+var program = new Command("seekrit").description("End-to-end encrypted secrets manager").version(version).enablePositionalOptions();
+program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_\u2026)").option(
+  "--dev-user <email>",
+  "dev-mode identity (local API with AUTH_MODE=dev)"
+).option("--api-url <url>", "API base URL").action((options) => {
+  if (options.token && !isServiceToken(options.token))
+    fail("token must start with skt_");
+  writeGlobalConfig({
+    ...options.token ? { token: options.token } : {},
+    ...options.devUser ? { devUser: options.devUser } : {},
+    ...options.apiUrl ? { apiUrl: options.apiUrl } : {}
+  });
+  console.error("credentials saved");
+});
+program.command("whoami").description("show the authenticated identity").action(async () => {
+  const ctx = buildContext();
+  if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+    const { tokenId } = await parseServiceToken(ctx.auth.token);
+    const { orgs: orgs2 } = await ctx.client.listOrgs();
+    console.log(
+      `service token ${tokenId} (org: ${orgs2[0]?.slug ?? "unknown"})`
+    );
+    return;
+  }
+  const { user, orgs } = await ctx.client.me();
+  console.log(
+    `${user.email}${user.hasKeys ? "" : "  (key setup pending \u2014 run `seekrit keys setup`)"}`
+  );
+  for (const org2 of orgs) console.log(`  ${org2.slug} (${org2.role})`);
+});
+var keys = program.command("keys").description("manage your encryption keys");
+keys.command("setup").description("generate your keypair and protect it with a passphrase").action(async () => {
+  const ctx = buildContext();
+  const passphrase = process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("New passphrase: ");
+  if (!process.env.SEEKRIT_PASSPHRASE) {
+    const confirm = await promptHidden("Confirm passphrase: ");
+    if (confirm !== passphrase) fail("passphrases do not match");
+  }
+  if (passphrase.length < 8) fail("passphrase must be at least 8 characters");
+  const pair = await generateKeyPair();
+  const encryptedPrivateKey = await encryptPrivateKey(
+    passphrase,
+    pair.privateKeyJwk
+  );
+  await ctx.client.setMyKeys({
+    publicKeyJwk: pair.publicKeyJwk,
+    encryptedPrivateKey
+  });
+  console.error(
+    "keys generated and uploaded \u2014 your passphrase never leaves this machine"
+  );
+});
+program.command("init").description("link this directory to an org/app/environment").requiredOption("--org <slug>", "organization slug").requiredOption("--app <slug>", "application slug").requiredOption("--env <slug>", "environment slug").action(async (options) => {
+  const ctx = buildContext();
+  const { orgs } = await ctx.client.listOrgs();
+  const org2 = orgs.find(
+    (o) => o.slug === options.org || o.id === options.org
+  );
+  if (!org2) fail(`no accessible org "${options.org}"`);
+  const { apps } = await ctx.client.listApps(org2.id);
+  const app2 = apps.find(
+    (a) => a.slug === options.app || a.id === options.app
+  );
+  if (!app2) fail(`no app "${options.app}" in ${org2.slug}`);
+  const { environments } = await ctx.client.listEnvs(org2.id, app2.id);
+  const env2 = environments.find(
+    (e) => e.slug === options.env || e.id === options.env
+  );
+  if (!env2) fail(`no environment "${options.env}" in ${app2.slug}`);
+  const path = writeProjectConfig({
+    orgId: org2.id,
+    appId: app2.id,
+    envId: env2.id,
+    org: org2.slug,
+    app: app2.slug,
+    env: env2.slug
+  });
+  console.error(`linked ${org2.slug}/${app2.slug}/${env2.slug} \u2192 ${path}`);
+});
+var org = program.command("org").description("manage organizations");
+org.command("create").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+  const ctx = buildContext();
+  const created = await ctx.client.createOrg({
+    name: options.name,
+    slug: options.slug
+  });
+  console.error(`created org ${created.org.slug} (${created.org.id})`);
+});
+var app = program.command("app").description("manage applications");
+app.command("create").requiredOption("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+  const ctx = buildContext();
+  const { orgs } = await ctx.client.listOrgs();
+  const orgRow = orgs.find(
+    (o) => o.slug === options.org || o.id === options.org
+  );
+  if (!orgRow) fail(`no accessible org "${options.org}"`);
+  const created = await ctx.client.createApp(orgRow.id, {
+    name: options.name,
+    slug: options.slug
+  });
+  console.error(`created app ${created.app.slug} (${created.app.id})`);
+});
+var env = program.command("env").description("manage environments");
+env.command("create").description("create an environment (generates its data key locally)").requiredOption("--org <slug>").requiredOption("--app <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(
+  async (options) => {
+    const ctx = buildContext();
+    const { orgs } = await ctx.client.listOrgs();
+    const orgRow = orgs.find(
+      (o) => o.slug === options.org || o.id === options.org
+    );
+    if (!orgRow) fail(`no accessible org "${options.org}"`);
+    const { apps } = await ctx.client.listApps(orgRow.id);
+    const appRow = apps.find(
+      (a) => a.slug === options.app || a.id === options.app
+    );
+    if (!appRow) fail(`no app "${options.app}" in ${orgRow.slug}`);
+    const { user } = await ctx.client.me();
+    if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+    const dek = generateDek();
+    const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
+    const created = await ctx.client.createEnv(orgRow.id, appRow.id, {
+      name: options.name,
+      slug: options.slug,
+      wrappedDek
+    });
+    console.error(
+      `created environment ${created.environment.slug} (${created.environment.id})`
+    );
+  }
+);
+var secrets = program.command("secrets").description("manage secrets in the linked environment");
+secrets.command("list").description("list secret names (no values)").action(async () => {
+  const ctx = buildContext();
+  const project = requireProject();
+  const { secrets: rows } = await ctx.client.listSecrets(
+    project.orgId,
+    project.envId
+  );
+  for (const row of rows)
+    console.log(`${row.name}	v${row.version}	${row.updatedAt}`);
+});
+secrets.command("get <name>").description("decrypt and print one secret value").action(async (name) => {
+  const ctx = buildContext();
+  const project = requireProject();
+  const values = await fetchDecryptedSecrets(
+    ctx,
+    project.orgId,
+    project.envId
+  );
+  const value = values[name];
+  if (value === void 0) fail(`no secret named ${name}`);
+  process.stdout.write(value);
+  if (process.stdout.isTTY) process.stdout.write("\n");
+});
+secrets.command("set <name> [value]").description(
+  "encrypt and store a secret (reads stdin when value is omitted or '-')"
+).action(async (name, value) => {
+  const ctx = buildContext();
+  const project = requireProject();
+  const plaintext = value === void 0 || value === "-" ? (await readStdin()).replace(/\n$/, "") : value;
+  await encryptAndSetSecret(
+    ctx,
+    project.orgId,
+    project.envId,
+    name,
+    plaintext
+  );
+  console.error(`${name} saved`);
+});
+secrets.command("rm <name>").description("delete a secret").action(async (name) => {
+  const ctx = buildContext();
+  const project = requireProject();
+  await ctx.client.deleteSecret(project.orgId, project.envId, name);
+  console.error(`${name} deleted`);
+});
+program.command("run").description(
+  "run a command with decrypted secrets injected into its environment"
+).passThroughOptions().argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts) => {
+  const ctx = buildContext();
+  const project = requireProject();
+  const values = await fetchDecryptedSecrets(
+    ctx,
+    project.orgId,
+    project.envId
+  );
+  const [cmd, ...args] = commandParts;
+  if (!cmd) fail("no command given");
+  const child = spawn(cmd, args, {
+    stdio: "inherit",
+    env: { ...process.env, ...values }
+  });
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    process.exit(code ?? 1);
+  });
+  child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
+});
+program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
+  if (!["dotenv", "json", "shell"].includes(options.format)) {
+    fail("format must be dotenv, json, or shell");
+  }
+  const ctx = buildContext();
+  const project = requireProject();
+  const values = await fetchDecryptedSecrets(
+    ctx,
+    project.orgId,
+    project.envId
+  );
+  console.log(formatSecrets(values, options.format));
+});
+program.command("grant").description(
+  "give a member or service token access to the linked environment's key"
+).option("--user <email>", "grant to an org member by email").option("--token <tokenId>", "grant to a service token by id (skt_\u2026)").action(async (options) => {
+  if (!options.user === !options.token)
+    fail("pass exactly one of --user or --token");
+  const ctx = buildContext();
+  const project = requireProject();
+  const dek = await getDek(ctx, project.orgId, project.envId);
+  let principalType;
+  let principalId;
+  let publicKeyJwk;
+  if (options.user) {
+    const { members } = await ctx.client.listMembers(project.orgId);
+    const member = members.find((m) => m.email === options.user);
+    if (!member) fail(`no member ${options.user}`);
+    if (!member.publicKeyJwk)
+      fail(`${options.user} has not completed key setup`);
+    [principalType, principalId, publicKeyJwk] = [
+      "user",
+      member.userId,
+      member.publicKeyJwk
+    ];
+  } else {
+    const { tokens } = await ctx.client.listTokens(project.orgId);
+    const token2 = tokens.find((t) => t.id === options.token);
+    if (!token2) fail(`no service token ${options.token}`);
+    [principalType, principalId, publicKeyJwk] = [
+      "service_token",
+      token2.id,
+      token2.publicKeyJwk
+    ];
+  }
+  const wrappedDek = await wrapDek(dek, publicKeyJwk);
+  await ctx.client.grantEnvKey(project.orgId, project.envId, {
+    principalType,
+    principalId,
+    wrappedDek
+  });
+  console.error(
+    `granted ${project.env ?? project.envId} access to ${principalId}`
+  );
+});
+var token = program.command("token").description("manage service tokens (CI, docker, agents)");
+token.command("create").description("create a service token; prints the token once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--grant", "also grant access to the linked environment").action(async (options) => {
+  const ctx = buildContext();
+  const project = requireProject();
+  const created = await createServiceToken();
+  await ctx.client.createToken(project.orgId, {
+    name: options.name,
+    tokenId: created.tokenId,
+    tokenHash: created.tokenHash,
+    publicKeyJwk: created.publicKeyJwk
+  });
+  if (options.grant) {
+    const dek = await getDek(ctx, project.orgId, project.envId);
+    const wrappedDek = await wrapDek(dek, created.publicKeyJwk);
+    await ctx.client.grantEnvKey(project.orgId, project.envId, {
+      principalType: "service_token",
+      principalId: created.tokenId,
+      wrappedDek
+    });
+  }
+  console.error(
+    `token created${options.grant ? " and granted" : ""} \u2014 save it now, it is not stored:`
+  );
+  console.log(created.token);
+});
+token.command("list").description("list service tokens").action(async () => {
+  const ctx = buildContext();
+  const project = requireProject();
+  const { tokens } = await ctx.client.listTokens(project.orgId);
+  for (const t of tokens) {
+    const status = t.revokedAt ? "revoked" : t.expiresAt && Date.parse(t.expiresAt) < Date.now() ? "expired" : "active";
+    console.log(
+      `${t.id}	${t.name}	${status}	last used: ${t.lastUsedAt ?? "never"}`
+    );
+  }
+});
+token.command("revoke <tokenId>").description("revoke a service token").action(async (tokenId) => {
+  const ctx = buildContext();
+  const project = requireProject();
+  await ctx.client.revokeToken(project.orgId, tokenId);
+  console.error(`${tokenId} revoked`);
+});
+program.command("audit").description("show the org audit trail").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
+  const ctx = buildContext();
+  const project = requireProject();
+  const { entries } = await ctx.client.listAudit(project.orgId, {
+    limit: Number.parseInt(options.limit, 10) || 50
+  });
+  for (const entry of entries) {
+    console.log(
+      `${entry.createdAt}	${entry.action}	${entry.actorType}:${entry.actorId}	${entry.resourceType}${entry.resourceId ? `:${entry.resourceId}` : ""}`
+    );
+  }
+});
+program.parseAsync().catch((err) => {
+  fail(err instanceof Error ? err.message : String(err));
+});

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@seekrit/cli",
+  "version": "0.0.1",
+  "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "seekrit": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "commander": "^15.0.0"
+  },
+  "devDependencies": {
+    "@seekrit/api-client": "workspace:*",
+    "@seekrit/core": "workspace:*",
+    "@seekrit/crypto": "workspace:*",
+    "@types/node": "^26.1.0",
+    "tsup": "^8.5.1"
+  }
+}