@seekrit/cli 0.10.0 → 0.12.0

package/dist/index.js

@@ -1,1543 +1,1576 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
-import { Command } from "commander";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { z } from "zod";
+import { Command } from "commander";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
-import { z } from "zod";
-//#region ../../packages/crypto/src/encoding.ts
-const CHUNK = 32768;
-/** Base64url (no padding) — portable across browsers, Workers, and Node. */
-function toBase64Url(bytes) {
-	let binary = "";
-	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
-function fromBase64Url(text) {
-	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
-	const binary = atob(base64);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-/**
-* Standard base64 (with `+`, `/`, and `=` padding). Most seekrit blobs use
-* base64url, but some external wire formats mandate standard base64 — notably
-* PostgreSQL SCRAM-SHA-256 verifier strings (see scram.ts).
-*/
-function toBase64(bytes) {
-	let binary = "";
-	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
-	return btoa(binary);
-}
-function utf8Encode(text) {
-	return new TextEncoder().encode(text);
-}
-function utf8Decode(bytes) {
-	return new TextDecoder().decode(bytes);
-}
-//#endregion
-//#region ../../packages/crypto/src/errors.ts
-var SeekritCryptoError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "SeekritCryptoError";
-		this.code = code;
-	}
-};
-/**
-* Split a versioned blob like `sc1.<b64>.<b64>` and verify the prefix.
-* AES-GCM auth failure downstream surfaces as DECRYPT_FAILED — that is also
-* the "wrong passphrase" signal for passphrase-encrypted blobs.
-*/
-function splitBlob(blob, prefix, segments) {
-	const parts = blob.split(".");
-	if (parts[0] !== prefix) throw new SeekritCryptoError("UNSUPPORTED_VERSION", `expected a "${prefix}" blob, got "${parts[0] ?? ""}"`);
-	if (parts.length !== segments + 1 || parts.some((p) => p.length === 0)) throw new SeekritCryptoError("MALFORMED_BLOB", `malformed "${prefix}" blob`);
-	return parts.slice(1);
-}
-//#endregion
-//#region ../../packages/crypto/src/aes.ts
-const SECRET_PREFIX = "sc1";
-const IV_LENGTH = 12;
-/** Generate a fresh 256-bit data encryption key for an environment. */
-function generateDek() {
-	return crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
-}
-async function importDek(dek, usage) {
-	return crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, [usage]);
-}
+z.enum([
+	"postgres",
+	"mysql",
+	"ssh"
+]);
+const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
-* Encrypt a secret value with the environment DEK.
-*
-* @param aad Authenticated context binding the ciphertext to its location
-*   (e.g. `environmentId/SECRET_NAME`) so blobs cannot be swapped between
-*   secrets or environments without detection.
+* A Postgres role name we are willing to create. Deliberately strict — this
+* value is interpolated into a SQL template, so it must be a bare identifier
+* with no way to break out of quoting (no quotes, whitespace, or semicolons).
 */
-async function encryptSecret(dek, plaintext, aad) {
-	const key = await importDek(dek, "encrypt");
-	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
-	const ciphertext = await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv,
-		additionalData: utf8Encode(aad)
-	}, key, utf8Encode(plaintext));
-	return `${SECRET_PREFIX}.${toBase64Url(iv)}.${toBase64Url(new Uint8Array(ciphertext))}`;
-}
-async function decryptSecret(dek, blob, aad) {
-	const [ivB64, ctB64] = splitBlob(blob, SECRET_PREFIX, 2);
-	const key = await importDek(dek, "decrypt");
-	try {
-		const plaintext = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: fromBase64Url(ivB64),
-			additionalData: utf8Encode(aad)
-		}, key, fromBase64Url(ctB64));
-		return utf8Decode(new Uint8Array(plaintext));
-	} catch {
-		throw new SeekritCryptoError("DECRYPT_FAILED", "secret decryption failed: wrong key, tampered data, or mismatched context");
-	}
-}
-/** AAD binding a secret ciphertext to its environment + name. */
-function secretAad(environmentId, secretName) {
-	return `${environmentId}/${secretName}`;
-}
-//#endregion
-//#region ../../packages/crypto/src/keys.ts
-async function generateKeyPair() {
-	const pair = await crypto.subtle.generateKey({
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, true, ["deriveBits"]);
-	const [publicJwk, privateJwk] = await Promise.all([crypto.subtle.exportKey("jwk", pair.publicKey), crypto.subtle.exportKey("jwk", pair.privateKey)]);
-	return {
-		publicKeyJwk: JSON.stringify(publicJwk),
-		privateKeyJwk: JSON.stringify(privateJwk)
-	};
-}
-async function importPublicKey(publicKeyJwk) {
-	return crypto.subtle.importKey("jwk", JSON.parse(publicKeyJwk), {
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, true, []);
-}
-async function importPrivateKey(privateKeyJwk) {
-	return crypto.subtle.importKey("jwk", JSON.parse(privateKeyJwk), {
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, true, ["deriveBits"]);
-}
-async function exportPrivateKeyPkcs8(key) {
-	return new Uint8Array(await crypto.subtle.exportKey("pkcs8", key));
-}
-async function importPrivateKeyPkcs8(pkcs8) {
-	return crypto.subtle.importKey("pkcs8", pkcs8, {
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, true, ["deriveBits"]);
-}
-//#endregion
-//#region ../../packages/crypto/src/mysql.ts
+const postgresRoleNameSchema = z.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must be 3–63 chars, lowercase letters/digits/underscore, starting with a letter or underscore");
 /**
-* Client-side construction of a MySQL/MariaDB `mysql_native_password`
-* authentication string, for minting *temporary MySQL login credentials*
-* without the password plaintext ever reaching seekrit's control plane OR
-* MySQL itself.
-*
-* The trick mirrors the Postgres SCRAM one (scram.ts): the stored auth string
-* is `*<UPPER(HEX(SHA1(SHA1(password))))>`, and
-* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'` stores that
-* string verbatim — MySQL does NOT re-hash it. So the flow is:
-*
-*   1. the machine that will connect generates a random password locally,
-*   2. computes this hash locally,
-*   3. sends only the hash to the broker → `CREATE USER … AS '<hash>'`,
-*   4. connects directly to MySQL with the plaintext it never shared.
-*
-* Zero-knowledge at both layers: the control plane relays only the hash, and
-* the hash is NOT sufficient to authenticate. `mysql_native_password` login is
-* a challenge-response — the server proves knowledge of `SHA1(SHA1(password))`
-* against a fresh scramble, and verifying a client requires `SHA1(password)`
-* (the preimage of the first inner hash), which the stored double-SHA1 does not
-* reveal. A dump of `mysql.user` / the query log therefore cannot log in.
-*
-* SHA-1 is available via WebCrypto (`crypto.subtle.digest("SHA-1", …)`) in the
-* browser, the CLI, the MCP server, and Workers — so this runs everywhere the
-* SCRAM helper does, with no hand-rolled hash primitive.
+* A SCRAM-SHA-256 verifier string as produced by @seekrit/crypto. Validated so
+* it, too, is safe to interpolate into a quoted SQL literal (the alphabet is
+* base64 + the fixed structural characters, none of which is a single quote).
 */
-const DEFAULT_PASSWORD_LENGTH$1 = 32;
-const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-async function sha1(data) {
-	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
-}
-function toUpperHex(bytes) {
-	let hex = "";
-	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
-	return hex.toUpperCase();
-}
-function randomPassword$1(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
+const scramVerifierSchema = z.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
 /**
-* Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
-* for a known password. Pass the result straight to
-* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`.
+* An SSH login principal (a Unix-style username the certificate authorizes).
+* Bounded and restricted to a safe charset — principals are SSH-wire-encoded,
+* not shell-interpolated, so this is sanity/DoS hardening, not an injection gate.
 */
-async function mysqlNativePasswordVerifier(password) {
-	return `*${toUpperHex(await sha1(await sha1(utf8Encode(password))))}`;
-}
+const sshPrincipalSchema = z.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "must be 1–64 chars of letters, digits, dot, dash, underscore");
+/** An `ssh-ed25519 <base64> [comment]` public key line (deep-validated on sign). */
+const sshPublicKeySchema = z.string().max(2048).regex(/^ssh-ed25519 [A-Za-z0-9+/=]+( .*)?$/, "must be an ssh-ed25519 public key");
+/** An SSH certificate extension name, e.g. `permit-pty`. */
+const sshExtensionSchema = z.string().regex(/^[a-z0-9-]{1,64}$/);
 /**
-* Mint a fresh random password and its `mysql_native_password` hash in one step
-* — the client-side half of a Vault-style dynamic MySQL credential.
+* A MySQL/MariaDB user name we are willing to create. Interpolated into a
+* quoted SQL literal (`'{{name}}'@'%'`), so it is kept strict — plain
+* alphanumerics/underscore, no quotes/whitespace/semicolons to break out.
 */
-async function generateMysqlCredential(options = {}) {
-	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
-	return {
-		password,
-		verifier: await mysqlNativePasswordVerifier(password)
-	};
-}
-//#endregion
-//#region ../../packages/crypto/src/passphrase.ts
+const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
 /**
-* User private keys are stored server-side encrypted under a key derived from
-* the user's passphrase, so any browser or CLI session can fetch and unlock
-* them without the server ever seeing the passphrase or plaintext key.
-*
-* KDF is PBKDF2-HMAC-SHA256 (WebCrypto-native everywhere). The blob embeds
-* its own salt + iteration count for future agility; bumping ITERATIONS only
-* affects newly written blobs. TODO: revisit Argon2id via WASM later.
-*
-* Blob format: `pk1.<iterations>.<salt>.<iv>.<ciphertext>`
+* A `mysql_native_password` authentication string — `*` followed by 40 upper
+* hex chars (`UPPER(HEX(SHA1(SHA1(password))))`), as produced by
+* @seekrit/crypto `mysqlNativePasswordVerifier`. Stored verbatim by
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`, and its
+* alphabet contains no single quote, so it is safe in a quoted SQL literal.
 */
-const PK_PREFIX = "pk1";
-/** OWASP-recommended minimum for PBKDF2-HMAC-SHA256. */
-const PBKDF2_ITERATIONS = 6e5;
-async function deriveKek(passphrase, salt, iterations, usage) {
-	const material = await crypto.subtle.importKey("raw", utf8Encode(passphrase), "PBKDF2", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({
-		name: "PBKDF2",
-		hash: "SHA-256",
-		salt,
-		iterations
-	}, material, {
-		name: "AES-GCM",
-		length: 256
-	}, false, [usage]);
-}
-async function encryptPrivateKey(passphrase, privateKeyJwk) {
-	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
-	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	const kek = await deriveKek(passphrase, salt, PBKDF2_ITERATIONS, "encrypt");
-	const ciphertext = await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, kek, utf8Encode(privateKeyJwk));
-	return [
-		PK_PREFIX,
-		String(PBKDF2_ITERATIONS),
-		toBase64Url(salt),
-		toBase64Url(iv),
-		toBase64Url(new Uint8Array(ciphertext))
-	].join(".");
-}
-/** Wrong passphrase surfaces as SeekritCryptoError with code DECRYPT_FAILED. */
-async function decryptPrivateKey(passphrase, blob) {
-	const [iterStr, saltB64, ivB64, ctB64] = splitBlob(blob, PK_PREFIX, 4);
-	const iterations = Number.parseInt(iterStr, 10);
-	if (!Number.isFinite(iterations) || iterations < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid PBKDF2 iteration count");
-	const kek = await deriveKek(passphrase, fromBase64Url(saltB64), iterations, "decrypt");
-	try {
-		const plaintext = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: fromBase64Url(ivB64)
-		}, kek, fromBase64Url(ctB64));
-		return utf8Decode(new Uint8Array(plaintext));
-	} catch {
-		throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
-	}
-}
-const SALT_LENGTH = 16;
-const DEFAULT_PASSWORD_LENGTH = 32;
-const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-async function hmacSha256(key, message) {
-	const k = await crypto.subtle.importKey("raw", key, {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	return new Uint8Array(await crypto.subtle.sign("HMAC", k, message));
-}
-async function sha256(data) {
-	return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
-}
-async function saltPassword(password, salt, iterations) {
-	const material = await crypto.subtle.importKey("raw", utf8Encode(password), "PBKDF2", false, ["deriveBits"]);
-	const bits = await crypto.subtle.deriveBits({
-		name: "PBKDF2",
-		hash: "SHA-256",
-		salt,
-		iterations
-	}, material, 256);
-	return new Uint8Array(bits);
-}
-function randomPassword(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
+const mysqlNativeVerifierSchema = z.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
+const postgresAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
+/** The group role each preset's leased credentials inherit. */
+const POSTGRES_GROUP_ROLES = {
+	readonly: "seekrit_readonly",
+	readwrite: "seekrit_readwrite"
+};
+const mysqlAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
+const connectionSchema = z.object({
+	host: z.string().min(1),
+	port: z.number().int().min(1).max(65535),
+	database: z.string().min(1)
+});
+/** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
+const statementSchema = z.string().min(1).max(4e3);
+/** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
+const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
+const postgresTargetConfigSchema = z.object({
+	provider: z.literal("postgres"),
+	executor: executorModeSchema,
+	accessLevel: postgresAccessLevelSchema.optional(),
+	schema: identifierSchema.optional(),
+	connection: connectionSchema,
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema).max(16).optional(),
+	revokeStatements: z.array(statementSchema).max(16).optional()
+});
+/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
+const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const mysqlTargetConfigSchema = z.object({
+	provider: z.literal("mysql"),
+	executor: executorModeSchema,
+	accessLevel: mysqlAccessLevelSchema.optional(),
+	connection: connectionSchema,
+	userHost: mysqlHostSchema.optional(),
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema).max(16).optional(),
+	revokeStatements: z.array(statementSchema).max(16).optional()
+});
+const sshTargetConfigSchema = z.object({
+	provider: z.literal("ssh"),
+	executor: z.literal("in_do"),
+	caPublicKey: sshPublicKeySchema,
+	allowedPrincipals: z.array(sshPrincipalSchema).max(64).optional(),
+	extensions: z.array(sshExtensionSchema).max(16).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional(),
+	connection: z.object({
+		host: z.string().min(1).optional(),
+		user: sshPrincipalSchema.optional()
+	}).optional()
+});
+const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
+	postgresTargetConfigSchema,
+	mysqlTargetConfigSchema,
+	sshTargetConfigSchema
+]);
+z.object({
+	name: z.string().trim().min(1).max(128),
+	config: leaseTargetConfigSchema,
+	/**
+	* The admin/provisioning credential (e.g. a Postgres connection string),
+	* encrypted client-side to the broker's public key (a `wd1.` wrap). The
+	* control plane stores only this ciphertext — it never sees the plaintext.
+	*/
+	wrappedAdminSecret: z.string().min(1)
+});
+/** Requested lease lifetime, shared by all providers. */
+const ttlSecondsSchema = z.number().int().min(60).max(3600 * 24 * 7);
 /**
-* Compute the `SCRAM-SHA-256$<i>:<salt>$<StoredKey>:<ServerKey>` verifier for a
-* known password. Pass the result straight to `CREATE ROLE … PASSWORD`.
+* Client → API: mint a Postgres lease. The client generates the password and
+* its SCRAM verifier locally and sends only the verifier — the plaintext
+* password never leaves the requesting machine.
 */
-async function scramSha256Verifier(password, options = {}) {
-	const salt = options.salt ?? crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
-	const iterations = options.iterations ?? 4096;
-	const saltedPassword = await saltPassword(password, salt, iterations);
-	const storedKey = await sha256(await hmacSha256(saltedPassword, utf8Encode("Client Key")));
-	const serverKey = await hmacSha256(saltedPassword, utf8Encode("Server Key"));
-	return `SCRAM-SHA-256$${iterations}:${toBase64(salt)}$${toBase64(storedKey)}:${toBase64(serverKey)}`;
-}
+const mintPostgresLeaseSchema = z.object({
+	provider: z.literal("postgres"),
+	targetId: z.string().min(1),
+	roleName: postgresRoleNameSchema,
+	verifier: scramVerifierSchema,
+	ttlSeconds: ttlSecondsSchema
+});
 /**
-* Mint a fresh random password and its SCRAM verifier in one step — the
-* client-side half of a Vault-style dynamic Postgres credential.
+* Client → API: mint a MySQL/MariaDB lease. The client generates the password
+* and its `mysql_native_password` hash locally and sends only the hash — the
+* plaintext password never leaves the requesting machine.
 */
-async function generatePostgresCredential(options = {}) {
-	const password = randomPassword(options.length ?? DEFAULT_PASSWORD_LENGTH);
-	const iterations = options.iterations ?? 4096;
-	return {
-		password,
-		verifier: await scramSha256Verifier(password, { iterations }),
-		iterations
-	};
-}
+const mintMysqlLeaseSchema = z.object({
+	provider: z.literal("mysql"),
+	targetId: z.string().min(1),
+	roleName: mysqlUserNameSchema,
+	verifier: mysqlNativeVerifierSchema,
+	ttlSeconds: ttlSecondsSchema
+});
+/**
+* Client → API: mint an SSH lease. The client generates an ephemeral keypair
+* locally and sends only the public key; the signed certificate comes back in
+* the response. The private key never leaves the requesting machine.
+*/
+const mintSshLeaseSchema = z.object({
+	provider: z.literal("ssh"),
+	targetId: z.string().min(1),
+	publicKey: sshPublicKeySchema,
+	principals: z.array(sshPrincipalSchema).min(1).max(32),
+	ttlSeconds: ttlSecondsSchema
+});
+z.discriminatedUnion("provider", [
+	mintPostgresLeaseSchema,
+	mintMysqlLeaseSchema,
+	mintSshLeaseSchema
+]);
 //#endregion
-//#region ../../packages/crypto/src/ssh.ts
+//#region ../../packages/core/src/providers/postgres.ts
 /**
-* Client-side SSH certificate authority for minting *temporary SSH access*
-* without any private key ever reaching seekrit's control plane.
-*
-* The model (Vault-style, tier-1 verifier injection — see the `ZkTier` doc in
-* @seekrit/core leases.ts):
-*
-*   1. the machine that will connect generates an ephemeral Ed25519 keypair
-*      locally ({@link generateSshKeyPair}),
-*   2. it sends only the *public* key to the broker,
-*   3. the broker signs a short-lived OpenSSH user *certificate* over that
-*      public key ({@link signSshUserCertificate}) using the CA private key,
-*   4. the consumer connects with `ssh -i <key> -o CertificateFile=<cert>`; the
-*      host trusts the CA (`TrustedUserCAKeys`) and never needs the key on disk.
-*
-* Zero-knowledge end to end: the user private key exists only on the consumer,
-* and a certificate is a public artifact (it authorizes but cannot authenticate
-* without the matching private key). The only secret seekrit stores is the CA
-* private key — wrapped to the broker DO's public key, decrypted transiently in
-* the DO to sign (the same in-DO trade the Postgres admin credential makes).
+* The one-time setup SQL an admin runs to create the shared group role that a
+* read-only / read-write target's leased credentials inherit. Idempotent (safe
+* to re-run). Returns null for custom targets (the admin owns their own SQL).
 *
-* Everything here is WebCrypto Ed25519 + hand-rolled SSH wire encoding, so it
-* runs unchanged in the browser, the CLI, and Workers. No Node-specific crypto.
+* Identifiers are interpolated from admin-supplied config (database/schema) and
+* fixed group-role constants — this SQL is displayed for the admin to run in
+* their own database, not executed by seekrit.
 */
-const ED25519 = { name: "Ed25519" };
+function postgresGroupBootstrapSql(config) {
+	if (config.accessLevel !== "readonly" && config.accessLevel !== "readwrite") return null;
+	const group = POSTGRES_GROUP_ROLES[config.accessLevel];
+	const schema = config.schema ?? "public";
+	const db = config.connection.database;
+	const privileges = config.accessLevel === "readonly" ? "SELECT" : "SELECT, INSERT, UPDATE, DELETE";
+	const lines = [
+		`-- Run once as an admin on "${db}". Temporary ${config.accessLevel} credentials inherit this role.`,
+		"DO $$ BEGIN",
+		`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${group}') THEN`,
+		`    CREATE ROLE ${group} NOLOGIN;`,
+		"  END IF;",
+		"END $$;",
+		`GRANT CONNECT ON DATABASE "${db}" TO ${group};`,
+		`GRANT USAGE ON SCHEMA "${schema}" TO ${group};`,
+		`GRANT ${privileges} ON ALL TABLES IN SCHEMA "${schema}" TO ${group};`,
+		`ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT ${privileges} ON TABLES TO ${group};`
+	];
+	if (config.accessLevel === "readwrite") lines.push(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO ${group};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE, SELECT ON SEQUENCES TO ${group};`);
+	return lines.join("\n");
+}
+//#endregion
+//#region ../../packages/core/src/providers/ssh.ts
 /**
-* Serializer for the SSH binary wire types. `string` is a uint32 length prefix
-* followed by that many bytes (a length-delimited byte blob, not text); ints
-* are big-endian. This is the encoding used by public keys, certificates, and
-* the OpenSSH private key container alike.
-*/
-var SshWriter = class {
-	chunks = [];
-	len = 0;
-	bytes(b) {
-		this.chunks.push(b);
-		this.len += b.length;
-		return this;
-	}
-	byte(n) {
-		return this.bytes(new Uint8Array([n & 255]));
-	}
-	uint32(n) {
-		const b = /* @__PURE__ */ new Uint8Array(4);
-		new DataView(b.buffer).setUint32(0, n >>> 0, false);
-		return this.bytes(b);
-	}
-	uint64(n) {
-		const b = /* @__PURE__ */ new Uint8Array(8);
-		new DataView(b.buffer).setBigUint64(0, BigInt(n), false);
-		return this.bytes(b);
-	}
-	string(s) {
-		const b = typeof s === "string" ? utf8Encode(s) : s;
-		return this.uint32(b.length).bytes(b);
-	}
-	build() {
-		const out = new Uint8Array(this.len);
-		let o = 0;
-		for (const c of this.chunks) {
-			out.set(c, o);
-			o += c.length;
-		}
-		return out;
-	}
-};
-function concat(...arrays) {
-	const total = arrays.reduce((n, a) => n + a.length, 0);
-	const out = new Uint8Array(total);
-	let o = 0;
-	for (const a of arrays) {
-		out.set(a, o);
-		o += a.length;
-	}
-	return out;
-}
-/** The `ssh-ed25519` public-key blob: string "ssh-ed25519" ‖ string <32 bytes>. */
-function ed25519PublicKeyBlob(pub) {
-	return new SshWriter().string("ssh-ed25519").string(pub).build();
-}
-function encodeSshPublicKey(pub, comment) {
-	const b64 = toBase64(ed25519PublicKeyBlob(pub));
-	return comment ? `ssh-ed25519 ${b64} ${comment}` : `ssh-ed25519 ${b64}`;
-}
-/**
-* Generate an ephemeral client keypair. The private key is serialized in the
-* `openssh-key-v1` format so `ssh -i` accepts it directly; the public key is
-* what gets certified. Nothing here is ever sent to the control plane except
-* the public key.
+* The one-time host setup an admin runs so a target's certificates are accepted.
+* Analogue of `postgresGroupBootstrapSql` — displayed for the admin to run, not
+* executed by seekrit. Embeds the CA public key so it's copy-paste runnable.
 */
-async function generateSshKeyPair(comment = "seekrit") {
-	const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
-	const pub = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
-	const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey));
-	const seed = pkcs8.subarray(pkcs8.length - 32);
-	return {
-		publicKeyOpenssh: encodeSshPublicKey(pub, comment),
-		privateKeyOpenssh: encodeOpensshPrivateKey(seed, pub, comment)
-	};
+function sshHostSetupInstructions(config) {
+	const principals = config.allowedPrincipals?.length ? config.allowedPrincipals : ["<login-user>"];
+	return [
+		"# Run once on each target host so it trusts seekrit-issued certificates.",
+		"# 1. Install the CA public key and trust it for user authentication:",
+		`echo '${config.caPublicKey}' | sudo tee /etc/ssh/seekrit_ca.pub`,
+		"sudo sh -c 'echo \"TrustedUserCAKeys /etc/ssh/seekrit_ca.pub\" >> /etc/ssh/sshd_config'",
+		"# 2. (optional) Restrict which cert principals may log in as which users via",
+		"#    AuthorizedPrincipalsFile, e.g. /etc/ssh/auth_principals/<user> listing:",
+		...principals.map((p) => `#      ${p}`),
+		"# 3. Reload sshd:",
+		"sudo systemctl reload sshd"
+	].join("\n");
 }
+//#endregion
+//#region ../../packages/core/src/types.ts
 /**
-* Generate a certificate-authority keypair. The private half is exported as a
-* JWK (so the broker can re-import it to sign); the public half is printed for
-* admins to install on their hosts.
+* Transactional notification emails seekrit can send. Each id is one
+* user-facing on/off toggle (see `NOTIFICATION_TYPE_META`). These carry only
+* audit-grade metadata — never secret material — and every one is opt-out
+* (defaults on). Kept as a const array so the API, api-client, and dashboard
+* share a single source of truth (mirrors `AUDIT_ACTIONS`).
 */
-async function generateSshCaKeyPair(comment = "seekrit-ca") {
-	const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
-	const pub = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
-	const jwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
-	return {
-		privateKeyJwk: JSON.stringify(jwk),
-		publicKeyOpenssh: encodeSshPublicKey(pub, comment)
-	};
+const NOTIFICATION_TYPES = [
+	"token_created",
+	"token_revoked",
+	"env_access_granted",
+	"env_access_revoked",
+	"resolve_denied",
+	"org_welcome",
+	"token_expiring",
+	"lease_expired"
+];
+//#endregion
+//#region ../../packages/core/src/schemas.ts
+/** URL-safe identifier segment: `my-app`, `production`, … */
+const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
+const nameSchema = z.string().trim().min(1).max(128);
+/** Env-var style secret name: FOO, DATABASE_URL, apiKey2 … */
+const secretNameSchema = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
+z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+const principalTypeSchema = z.enum(["user", "service_token"]);
+/** Org-level capability a service token can hold (never `owner`). */
+const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	groupId: z.string().min(1),
+	/** Precedence among an env's groups (higher wins). Appended if omitted. */
+	position: z.number().int().min(0).optional()
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema,
+	/** Environment DEK wrapped to the creator's public key — created client-side. */
+	wrappedDek: z.string().min(1)
+});
+z.object({ 
+/** Opaque versioned ciphertext blob from @seekrit/crypto. */
+ciphertext: z.string().min(1).max(65536) });
+z.object({
+	publicKeyJwk: z.string().min(1),
+	/**
+	* Private key encrypted with a passphrase-derived KEK; opaque to the
+	* server. Self-contained blob (embeds KDF salt + iterations).
+	*/
+	encryptedPrivateKey: z.string().min(1)
+});
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	wrappedDek: z.string().min(1)
+});
+z.object({
+	name: nameSchema,
+	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full token string. */
+	tokenHash: z.string().min(1),
+	publicKeyJwk: z.string().min(1),
+	/**
+	* Org-level capability. Defaults to `member` (a runtime credential); pass
+	* `admin` to mint a headless provisioning token. Only an admin caller may
+	* create an `admin` token, so capability cannot escalate itself.
+	*/
+	role: serviceTokenRoleSchema.default("member"),
+	/**
+	* The application environment this token is bound to (org + app + env).
+	* Optional so org-admin tokens can exist, but required for runtime tokens
+	* that resolve secrets via `GET /v1/resolve`.
+	*/
+	environmentId: z.string().min(1).nullish(),
+	expiresAt: z.iso.datetime().nullish()
+});
+z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
+z.object({
+	endpoint: z.url().max(2048),
+	headers: z.record(z.string().min(1).max(256), z.string().max(4096)).optional(),
+	enabled: z.boolean().default(true)
+});
+z.object({
+	cursor: z.string().optional(),
+	limit: z.coerce.number().int().min(1).max(200).default(50),
+	action: z.string().optional(),
+	resourceType: z.string().optional()
+});
+//#endregion
+//#region ../../packages/crypto/src/encoding.ts
+const CHUNK = 32768;
+/** Base64url (no padding) — portable across browsers, Workers, and Node. */
+function toBase64Url(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
+	const binary = atob(base64);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
 }
 /**
-* Serialize an Ed25519 keypair as an unencrypted `openssh-key-v1` private key.
-* Format (PROTOCOL.key): magic ‖ ciphername "none" ‖ kdfname "none" ‖ empty
-* kdfoptions ‖ nkeys=1 ‖ public-key blob ‖ private section (wrapped as a
-* string). The private section is two equal check-ints, then the key, then the
-* comment, padded with 1,2,3,… to the "none" block size (8).
+* Standard base64 (with `+`, `/`, and `=` padding). Most seekrit blobs use
+* base64url, but some external wire formats mandate standard base64 — notably
+* PostgreSQL SCRAM-SHA-256 verifier strings (see scram.ts).
 */
-function encodeOpensshPrivateKey(seed, pub, comment) {
-	const check = new DataView(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(4)).buffer).getUint32(0, false);
-	const privSection = new SshWriter().uint32(check).uint32(check).string("ssh-ed25519").string(pub).string(concat(seed, pub)).string(comment).build();
-	const padLen = (8 - privSection.length % 8) % 8;
-	const pad = new Uint8Array(padLen);
-	for (let i = 0; i < padLen; i++) pad[i] = i + 1;
-	const b64 = toBase64(new SshWriter().bytes(utf8Encode("openssh-key-v1")).byte(0).string("none").string("none").string(/* @__PURE__ */ new Uint8Array(0)).uint32(1).string(ed25519PublicKeyBlob(pub)).string(concat(privSection, pad)).build());
-	return `-----BEGIN OPENSSH PRIVATE KEY-----\n${b64.match(/.{1,70}/g)?.join("\n") ?? b64}\n-----END OPENSSH PRIVATE KEY-----\n`;
+function toBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+	return btoa(binary);
+}
+function utf8Encode(text) {
+	return new TextEncoder().encode(text);
+}
+function utf8Decode(bytes) {
+	return new TextDecoder().decode(bytes);
 }
 //#endregion
-//#region ../../packages/crypto/src/token.ts
+//#region ../../packages/crypto/src/errors.ts
+var SeekritCryptoError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SeekritCryptoError";
+		this.code = code;
+	}
+};
 /**
-* Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
-* principals: the token string itself carries the private key, so the server
-* never holds it. The server stores only the SHA-256 hash of the full token
-* (for authentication) and the public key (for wrapping DEK grants).
-*
-* Format: `skt_<token id>_<private key pkcs8, base64url>`
+* Split a versioned blob like `sc1.<b64>.<b64>` and verify the prefix.
+* AES-GCM auth failure downstream surfaces as DECRYPT_FAILED — that is also
+* the "wrong passphrase" signal for passphrase-encrypted blobs.
 */
-const TOKEN_PREFIX = "skt";
-const TOKEN_ID_LENGTH = 22;
-const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-function randomTokenId() {
-	let out = "";
-	while (out.length < TOKEN_ID_LENGTH) {
-		const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += ID_ALPHABET[byte % 62];
-			if (out.length === TOKEN_ID_LENGTH) break;
-		}
-	}
-	return `${TOKEN_PREFIX}_${out}`;
+function splitBlob(blob, prefix, segments) {
+	const parts = blob.split(".");
+	if (parts[0] !== prefix) throw new SeekritCryptoError("UNSUPPORTED_VERSION", `expected a "${prefix}" blob, got "${parts[0] ?? ""}"`);
+	if (parts.length !== segments + 1 || parts.some((p) => p.length === 0)) throw new SeekritCryptoError("MALFORMED_BLOB", `malformed "${prefix}" blob`);
+	return parts.slice(1);
 }
-async function hashToken(token) {
-	const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token));
-	return toBase64Url(new Uint8Array(digest));
+//#endregion
+//#region ../../packages/crypto/src/aes.ts
+const SECRET_PREFIX = "sc1";
+const IV_LENGTH = 12;
+/** Generate a fresh 256-bit data encryption key for an environment. */
+function generateDek() {
+	return crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
 }
-async function createServiceToken() {
-	const { publicKeyJwk, privateKeyJwk } = await generateKeyPair();
-	const pkcs8 = await exportPrivateKeyPkcs8(await importPrivateKey(privateKeyJwk));
-	const tokenId = randomTokenId();
-	const token = `${tokenId}_${toBase64Url(pkcs8)}`;
-	return {
-		token,
-		tokenId,
-		tokenHash: await hashToken(token),
-		publicKeyJwk
-	};
+async function importDek(dek, usage) {
+	return crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, [usage]);
 }
-async function parseServiceToken(token) {
-	const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
-	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
-	const [, tokenId, keyB64] = match;
+/**
+* Encrypt a secret value with the environment DEK.
+*
+* @param aad Authenticated context binding the ciphertext to its location
+*   (e.g. `environmentId/SECRET_NAME`) so blobs cannot be swapped between
+*   secrets or environments without detection.
+*/
+async function encryptSecret(dek, plaintext, aad) {
+	const key = await importDek(dek, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(aad)
+	}, key, utf8Encode(plaintext));
+	return `${SECRET_PREFIX}.${toBase64Url(iv)}.${toBase64Url(new Uint8Array(ciphertext))}`;
+}
+async function decryptSecret(dek, blob, aad) {
+	const [ivB64, ctB64] = splitBlob(blob, SECRET_PREFIX, 2);
+	const key = await importDek(dek, "decrypt");
 	try {
-		return {
-			tokenId,
-			privateKey: await importPrivateKeyPkcs8(fromBase64Url(keyB64))
-		};
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64),
+			additionalData: utf8Encode(aad)
+		}, key, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
 	} catch {
-		throw new SeekritCryptoError("MALFORMED_TOKEN", "service token private key is corrupted");
+		throw new SeekritCryptoError("DECRYPT_FAILED", "secret decryption failed: wrong key, tampered data, or mismatched context");
 	}
 }
-function isServiceToken(value) {
-	return value.startsWith(`${TOKEN_PREFIX}_`);
+/** AAD binding a secret ciphertext to its environment + name. */
+function secretAad(environmentId, secretName) {
+	return `${environmentId}/${secretName}`;
 }
 //#endregion
-//#region ../../packages/crypto/src/wrap.ts
+//#region ../../packages/crypto/src/keys.ts
+async function generateKeyPair() {
+	const pair = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const [publicJwk, privateJwk] = await Promise.all([crypto.subtle.exportKey("jwk", pair.publicKey), crypto.subtle.exportKey("jwk", pair.privateKey)]);
+	return {
+		publicKeyJwk: JSON.stringify(publicJwk),
+		privateKeyJwk: JSON.stringify(privateJwk)
+	};
+}
+async function importPublicKey(publicKeyJwk) {
+	return crypto.subtle.importKey("jwk", JSON.parse(publicKeyJwk), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, []);
+}
+async function importPrivateKey(privateKeyJwk) {
+	return crypto.subtle.importKey("jwk", JSON.parse(privateKeyJwk), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+}
+async function exportPrivateKeyPkcs8(key) {
+	return new Uint8Array(await crypto.subtle.exportKey("pkcs8", key));
+}
+async function importPrivateKeyPkcs8(pkcs8) {
+	return crypto.subtle.importKey("pkcs8", pkcs8, {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+}
+//#endregion
+//#region ../../packages/crypto/src/mysql.ts
 /**
-* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
-* the recipient's public key; the shared secret is run through HKDF-SHA256 to
-* derive a one-time AES-256-GCM wrapping key. Only the holder of the
-* recipient private key can unwrap.
+* Client-side construction of a MySQL/MariaDB `mysql_native_password`
+* authentication string, for minting *temporary MySQL login credentials*
+* without the password plaintext ever reaching seekrit's control plane OR
+* MySQL itself.
 *
-* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
+* The trick mirrors the Postgres SCRAM one (scram.ts): the stored auth string
+* is `*<UPPER(HEX(SHA1(SHA1(password))))>`, and
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'` stores that
+* string verbatim — MySQL does NOT re-hash it. So the flow is:
+*
+*   1. the machine that will connect generates a random password locally,
+*   2. computes this hash locally,
+*   3. sends only the hash to the broker → `CREATE USER … AS '<hash>'`,
+*   4. connects directly to MySQL with the plaintext it never shared.
+*
+* Zero-knowledge at both layers: the control plane relays only the hash, and
+* the hash is NOT sufficient to authenticate. `mysql_native_password` login is
+* a challenge-response — the server proves knowledge of `SHA1(SHA1(password))`
+* against a fresh scramble, and verifying a client requires `SHA1(password)`
+* (the preimage of the first inner hash), which the stored double-SHA1 does not
+* reveal. A dump of `mysql.user` / the query log therefore cannot log in.
+*
+* SHA-1 is available via WebCrypto (`crypto.subtle.digest("SHA-1", …)`) in the
+* browser, the CLI, the MCP server, and Workers — so this runs everywhere the
+* SCRAM helper does, with no hand-rolled hash primitive.
 */
-const WRAP_PREFIX = "wd1";
-const HKDF_INFO = "seekrit/wrap-dek/v1";
-async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
-	const ecdh = {
-		name: "ECDH",
-		public: peerPublicKey
+const DEFAULT_PASSWORD_LENGTH$1 = 32;
+const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function sha1(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
+}
+function toUpperHex(bytes) {
+	let hex = "";
+	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+	return hex.toUpperCase();
+}
+function randomPassword$1(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+/**
+* Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
+* for a known password. Pass the result straight to
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`.
+*/
+async function mysqlNativePasswordVerifier(password) {
+	return `*${toUpperHex(await sha1(await sha1(utf8Encode(password))))}`;
+}
+/**
+* Mint a fresh random password and its `mysql_native_password` hash in one step
+* — the client-side half of a Vault-style dynamic MySQL credential.
+*/
+async function generateMysqlCredential(options = {}) {
+	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	return {
+		password,
+		verifier: await mysqlNativePasswordVerifier(password)
 	};
-	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
-	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
+}
+//#endregion
+//#region ../../packages/crypto/src/passphrase.ts
+/**
+* User private keys are stored server-side encrypted under a key derived from
+* the user's passphrase, so any browser or CLI session can fetch and unlock
+* them without the server ever seeing the passphrase or plaintext key.
+*
+* KDF is PBKDF2-HMAC-SHA256 (WebCrypto-native everywhere). The blob embeds
+* its own salt + iteration count for future agility; bumping ITERATIONS only
+* affects newly written blobs. TODO: revisit Argon2id via WASM later.
+*
+* Blob format: `pk1.<iterations>.<salt>.<iv>.<ciphertext>`
+*/
+const PK_PREFIX = "pk1";
+/** OWASP-recommended minimum for PBKDF2-HMAC-SHA256. */
+const PBKDF2_ITERATIONS = 6e5;
+async function deriveKek(passphrase, salt, iterations, usage) {
+	const material = await crypto.subtle.importKey("raw", utf8Encode(passphrase), "PBKDF2", false, ["deriveKey"]);
 	return crypto.subtle.deriveKey({
-		name: "HKDF",
+		name: "PBKDF2",
 		hash: "SHA-256",
 		salt,
-		info: utf8Encode(HKDF_INFO)
-	}, hkdfKey, {
+		iterations
+	}, material, {
 		name: "AES-GCM",
 		length: 256
 	}, false, [usage]);
 }
-/** Wrap an environment DEK to a principal's public key. */
-async function wrapDek(dek, recipientPublicKeyJwk) {
-	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
-	const ephemeral = await crypto.subtle.generateKey({
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, true, ["deriveBits"]);
+async function encryptPrivateKey(passphrase, privateKeyJwk) {
 	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
-	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
 	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const kek = await deriveKek(passphrase, salt, PBKDF2_ITERATIONS, "encrypt");
 	const ciphertext = await crypto.subtle.encrypt({
 		name: "AES-GCM",
 		iv
-	}, wrappingKey, dek);
-	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	}, kek, utf8Encode(privateKeyJwk));
 	return [
-		WRAP_PREFIX,
-		toBase64Url(ephemeralRaw),
+		PK_PREFIX,
+		String(PBKDF2_ITERATIONS),
 		toBase64Url(salt),
 		toBase64Url(iv),
 		toBase64Url(new Uint8Array(ciphertext))
 	].join(".");
 }
-/** Unwrap an environment DEK with the principal's private ECDH key. */
-async function unwrapDek(wrapped, privateKey) {
-	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
-	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, false, []), fromBase64Url(saltB64), "decrypt");
+/** Wrong passphrase surfaces as SeekritCryptoError with code DECRYPT_FAILED. */
+async function decryptPrivateKey(passphrase, blob) {
+	const [iterStr, saltB64, ivB64, ctB64] = splitBlob(blob, PK_PREFIX, 4);
+	const iterations = Number.parseInt(iterStr, 10);
+	if (!Number.isFinite(iterations) || iterations < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid PBKDF2 iteration count");
+	const kek = await deriveKek(passphrase, fromBase64Url(saltB64), iterations, "decrypt");
 	try {
-		const dek = await crypto.subtle.decrypt({
+		const plaintext = await crypto.subtle.decrypt({
 			name: "AES-GCM",
 			iv: fromBase64Url(ivB64)
-		}, wrappingKey, fromBase64Url(ctB64));
-		return new Uint8Array(dek);
+		}, kek, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
 	} catch {
-		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
+		throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
 	}
 }
-//#endregion
-//#region package.json
-var version = "0.10.0";
-const PROJECT_FILE = "seekrit.json";
-function globalConfigPath() {
-	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
+const SALT_LENGTH = 16;
+const DEFAULT_PASSWORD_LENGTH = 32;
+const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function hmacSha256(key, message) {
+	const k = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return new Uint8Array(await crypto.subtle.sign("HMAC", k, message));
 }
-function readGlobalConfig() {
-	const path = globalConfigPath();
-	if (!existsSync(path)) return {};
-	return JSON.parse(readFileSync(path, "utf8"));
+async function sha256(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
 }
-function writeGlobalConfig(update) {
-	const path = globalConfigPath();
-	const merged = {
-		...readGlobalConfig(),
-		...update
-	};
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+async function saltPassword(password, salt, iterations) {
+	const material = await crypto.subtle.importKey("raw", utf8Encode(password), "PBKDF2", false, ["deriveBits"]);
+	const bits = await crypto.subtle.deriveBits({
+		name: "PBKDF2",
+		hash: "SHA-256",
+		salt,
+		iterations
+	}, material, 256);
+	return new Uint8Array(bits);
 }
-/** Walk up from cwd looking for seekrit.json. */
-function findProjectConfig(startDir = process.cwd()) {
-	let dir = startDir;
-	const { root } = parse(dir);
-	while (true) {
-		const candidate = join(dir, PROJECT_FILE);
-		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
-		if (dir === root) return null;
-		dir = dirname(dir);
+function randomPassword(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET[byte % 62];
+			if (out.length === length) break;
+		}
 	}
+	return out;
 }
-function writeProjectConfig(config, dir = process.cwd()) {
-	const path = join(dir, PROJECT_FILE);
-	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
-	return path;
+/**
+* Compute the `SCRAM-SHA-256$<i>:<salt>$<StoredKey>:<ServerKey>` verifier for a
+* known password. Pass the result straight to `CREATE ROLE … PASSWORD`.
+*/
+async function scramSha256Verifier(password, options = {}) {
+	const salt = options.salt ?? crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+	const iterations = options.iterations ?? 4096;
+	const saltedPassword = await saltPassword(password, salt, iterations);
+	const storedKey = await sha256(await hmacSha256(saltedPassword, utf8Encode("Client Key")));
+	const serverKey = await hmacSha256(saltedPassword, utf8Encode("Server Key"));
+	return `SCRAM-SHA-256$${iterations}:${toBase64(salt)}$${toBase64(storedKey)}:${toBase64(serverKey)}`;
+}
+/**
+* Mint a fresh random password and its SCRAM verifier in one step — the
+* client-side half of a Vault-style dynamic Postgres credential.
+*/
+async function generatePostgresCredential(options = {}) {
+	const password = randomPassword(options.length ?? DEFAULT_PASSWORD_LENGTH);
+	const iterations = options.iterations ?? 4096;
+	return {
+		password,
+		verifier: await scramSha256Verifier(password, { iterations }),
+		iterations
+	};
 }
 //#endregion
-//#region ../../packages/api-client/src/index.ts
-var SeekritApiError = class extends Error {
-	status;
-	code;
-	constructor(status, code, message) {
-		super(message);
-		this.name = "SeekritApiError";
-		this.status = status;
-		this.code = code;
-	}
-};
-var SeekritClient = class {
-	baseUrl;
-	auth;
-	fetchImpl;
-	constructor(options) {
-		this.baseUrl = options.baseUrl.replace(/\/$/, "");
-		this.auth = options.auth;
-		this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
-	}
-	async request(method, path, body) {
-		const headers = { accept: "application/json" };
-		if (this.auth.type === "bearer") headers.authorization = `Bearer ${this.auth.token}`;
-		else if (this.auth.type === "dynamic") {
-			const token = await this.auth.getToken();
-			if (!token) throw new SeekritApiError(401, "unauthorized", "session expired");
-			headers.authorization = `Bearer ${token}`;
-		} else headers["x-seekrit-dev-user"] = this.auth.email;
-		if (body !== void 0) headers["content-type"] = "application/json";
-		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
-			method,
-			headers,
-			body: body === void 0 ? void 0 : JSON.stringify(body)
-		});
-		if (!res.ok) {
-			const fallback = { error: {
-				code: "internal",
-				message: `HTTP ${res.status}`
-			} };
-			const payload = await res.json().catch(() => fallback);
-			throw new SeekritApiError(res.status, payload.error?.code ?? "internal", payload.error?.message ?? `HTTP ${res.status}`);
-		}
-		return await res.json();
-	}
-	me() {
-		return this.request("GET", "/v1/me");
-	}
-	getMyKeys() {
-		return this.request("GET", "/v1/me/keys");
-	}
-	setMyKeys(input) {
-		return this.request("PUT", "/v1/me/keys", input);
-	}
-	getMyNotificationPrefs() {
-		return this.request("GET", "/v1/me/notifications");
-	}
-	setMyNotificationPrefs(input) {
-		return this.request("PUT", "/v1/me/notifications", input);
-	}
-	listOrgs() {
-		return this.request("GET", "/v1/orgs");
-	}
-	createOrg(input) {
-		return this.request("POST", "/v1/orgs", input);
-	}
-	getOrg(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}`);
-	}
-	listMembers(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}/members`);
-	}
-	listApps(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}/apps`);
-	}
-	createApp(orgId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/apps`, input);
-	}
-	getApp(orgId, appId) {
-		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}`);
-	}
-	deleteApp(orgId, appId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/apps/${appId}`);
-	}
-	listEnvs(orgId, appId) {
-		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/envs`);
-	}
-	createEnv(orgId, appId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/apps/${appId}/envs`, input);
-	}
-	getEnv(orgId, envId) {
-		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
-	}
-	deleteEnv(orgId, envId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
+//#region ../../packages/crypto/src/ssh.ts
+/**
+* Client-side SSH certificate authority for minting *temporary SSH access*
+* without any private key ever reaching seekrit's control plane.
+*
+* The model (Vault-style, tier-1 verifier injection — see the `ZkTier` doc in
+* @seekrit/core leases.ts):
+*
+*   1. the machine that will connect generates an ephemeral Ed25519 keypair
+*      locally ({@link generateSshKeyPair}),
+*   2. it sends only the *public* key to the broker,
+*   3. the broker signs a short-lived OpenSSH user *certificate* over that
+*      public key ({@link signSshUserCertificate}) using the CA private key,
+*   4. the consumer connects with `ssh -i <key> -o CertificateFile=<cert>`; the
+*      host trusts the CA (`TrustedUserCAKeys`) and never needs the key on disk.
+*
+* Zero-knowledge end to end: the user private key exists only on the consumer,
+* and a certificate is a public artifact (it authorizes but cannot authenticate
+* without the matching private key). The only secret seekrit stores is the CA
+* private key — wrapped to the broker DO's public key, decrypted transiently in
+* the DO to sign (the same in-DO trade the Postgres admin credential makes).
+*
+* Everything here is WebCrypto Ed25519 + hand-rolled SSH wire encoding, so it
+* runs unchanged in the browser, the CLI, and Workers. No Node-specific crypto.
+*/
+const ED25519 = { name: "Ed25519" };
+/**
+* Serializer for the SSH binary wire types. `string` is a uint32 length prefix
+* followed by that many bytes (a length-delimited byte blob, not text); ints
+* are big-endian. This is the encoding used by public keys, certificates, and
+* the OpenSSH private key container alike.
+*/
+var SshWriter = class {
+	chunks = [];
+	len = 0;
+	bytes(b) {
+		this.chunks.push(b);
+		this.len += b.length;
+		return this;
 	}
-	listGroups(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}/groups`);
+	byte(n) {
+		return this.bytes(new Uint8Array([n & 255]));
 	}
-	createGroup(orgId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/groups`, input);
+	uint32(n) {
+		const b = /* @__PURE__ */ new Uint8Array(4);
+		new DataView(b.buffer).setUint32(0, n >>> 0, false);
+		return this.bytes(b);
 	}
-	getGroup(orgId, groupId) {
-		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}`);
+	uint64(n) {
+		const b = /* @__PURE__ */ new Uint8Array(8);
+		new DataView(b.buffer).setBigUint64(0, BigInt(n), false);
+		return this.bytes(b);
 	}
-	deleteGroup(orgId, groupId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/groups/${groupId}`);
+	string(s) {
+		const b = typeof s === "string" ? utf8Encode(s) : s;
+		return this.uint32(b.length).bytes(b);
 	}
-	listGroupEnvs(orgId, groupId) {
-		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}/envs`);
+	build() {
+		const out = new Uint8Array(this.len);
+		let o = 0;
+		for (const c of this.chunks) {
+			out.set(c, o);
+			o += c.length;
+		}
+		return out;
 	}
-	createGroupEnv(orgId, groupId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/groups/${groupId}/envs`, input);
+};
+function concat(...arrays) {
+	const total = arrays.reduce((n, a) => n + a.length, 0);
+	const out = new Uint8Array(total);
+	let o = 0;
+	for (const a of arrays) {
+		out.set(a, o);
+		o += a.length;
 	}
-	listEnvGroups(orgId, envId) {
-		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/groups`);
-	}
-	linkEnvGroup(orgId, envId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/groups`, input);
-	}
-	unlinkEnvGroup(orgId, envId, groupId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/groups/${groupId}`);
-	}
-	/** Ordered ciphertext layers + wrapped DEKs for the calling principal. */
-	resolve(query = {}) {
-		const params = new URLSearchParams();
-		if (query.env) params.set("env", query.env);
-		for (const [group, slug] of Object.entries(query.with ?? {})) params.append("with", `${group}:${slug}`);
-		const qs = params.size > 0 ? `?${params}` : "";
-		return this.request("GET", `/v1/resolve${qs}`);
-	}
-	listSecrets(orgId, envId) {
-		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/secrets`);
-	}
-	setSecret(orgId, envId, name, ciphertext) {
-		return this.request("PUT", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`, { ciphertext });
-	}
-	deleteSecret(orgId, envId, name) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`);
-	}
-	/** The calling principal's wrapped DEK for this environment. */
-	getMyEnvKey(orgId, envId) {
-		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
-	}
-	listEnvKeys(orgId, envId) {
-		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/keys`);
-	}
-	grantEnvKey(orgId, envId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/keys`, input);
-	}
-	revokeEnvKey(orgId, envId, grantId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/keys/${grantId}`);
-	}
-	listTokens(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}/tokens`);
-	}
-	createToken(orgId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
-	}
-	revokeToken(orgId, tokenId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
-	}
-	/** The broker's public key — wrap the admin credential to it before registering a target. */
-	getLeaseBrokerKey(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
-	}
-	listLeaseTargets(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}/leases/targets`);
-	}
-	registerLeaseTarget(orgId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/leases/targets`, input);
-	}
-	deleteLeaseTarget(orgId, targetId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/leases/targets/${targetId}`);
-	}
-	listLeases(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}/leases`);
-	}
-	mintLease(orgId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/leases`, input);
-	}
-	revokeLease(orgId, leaseId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
-	}
-	listAudit(orgId, query = {}) {
-		const params = new URLSearchParams();
-		if (query.cursor) params.set("cursor", query.cursor);
-		if (query.limit) params.set("limit", String(query.limit));
-		if (query.action) params.set("action", query.action);
-		if (query.resourceType) params.set("resourceType", query.resourceType);
-		const qs = params.size > 0 ? `?${params}` : "";
-		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
-	}
-	getLogSink(orgId) {
-		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
-	}
-	setLogSink(orgId, input) {
-		return this.request("PUT", `/v1/orgs/${orgId}/log-sink`, input);
-	}
-	deleteLogSink(orgId) {
-		return this.request("DELETE", `/v1/orgs/${orgId}/log-sink`);
-	}
-	/** Send a synthetic record to the configured endpoint to verify connectivity. */
-	testLogSink(orgId) {
-		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
-	}
-};
-//#endregion
-//#region src/io.ts
-let failThrows = false;
-/**
-* In `seekrit mcp` the process is a long-lived stdio server, so a `fail()`
-* must surface as a catchable error (→ a tool error result) rather than
-* exiting and killing every other tool. Toggled on once at MCP startup.
-*/
-function setFailThrows(value) {
-	failThrows = value;
-}
-function fail(message) {
-	if (failThrows) throw new Error(message);
-	console.error(`error: ${message}`);
-	process.exit(1);
+	return out;
 }
-/** Prompt without echoing input (for passphrases). */
-function promptHidden(question) {
-	const muted = new Writable({ write(_chunk, _encoding, callback) {
-		callback();
-	} });
-	process.stderr.write(question);
-	const rl = createInterface({
-		input: process.stdin,
-		output: muted,
-		terminal: true
-	});
-	return new Promise((resolve) => {
-		rl.question("", (answer) => {
-			rl.close();
-			process.stderr.write("\n");
-			resolve(answer);
-		});
-	});
+/** The `ssh-ed25519` public-key blob: string "ssh-ed25519" ‖ string <32 bytes>. */
+function ed25519PublicKeyBlob(pub) {
+	return new SshWriter().string("ssh-ed25519").string(pub).build();
 }
-/** Read all of stdin (for `seekrit secrets set NAME -` piping). */
-async function readStdin() {
-	const chunks = [];
-	for await (const chunk of process.stdin) chunks.push(chunk);
-	return Buffer.concat(chunks).toString("utf8");
+function encodeSshPublicKey(pub, comment) {
+	const b64 = toBase64(ed25519PublicKeyBlob(pub));
+	return comment ? `ssh-ed25519 ${b64} ${comment}` : `ssh-ed25519 ${b64}`;
 }
-//#endregion
-//#region src/context.ts
 /**
-* Build the client context from configured credentials, or return null when
-* none are set. `seekrit run` uses this to degrade to a plain launcher instead
-* of exiting; every other command goes through `buildContext`, which fails.
-*
-* `dotenvVars` supplies `SEEKRIT_*` values read from a `.env` file. They sit
-* below the live `process.env` but above the saved config, so a project-local
-* `.env` can carry the token / API URL — matching `seekrit-run`'s
-* `flag > env > .env` credential resolution. Empty for every command but
-* `seekrit run`, which loads `.env` before authenticating.
+* Generate an ephemeral client keypair. The private key is serialized in the
+* `openssh-key-v1` format so `ssh -i` accepts it directly; the public key is
+* what gets certified. Nothing here is ever sent to the control plane except
+* the public key.
 */
-function tryBuildContext(dotenvVars = {}) {
-	const config = readGlobalConfig();
-	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
-	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
-	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token;
-	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
-	let auth;
-	if (token) auth = {
-		type: "bearer",
-		token
-	};
-	else if (devUser) auth = {
-		type: "dev",
-		email: devUser
-	};
-	else return null;
+async function generateSshKeyPair(comment = "seekrit") {
+	const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
+	const pub = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey));
+	const seed = pkcs8.subarray(pkcs8.length - 32);
 	return {
-		client: new SeekritClient({
-			baseUrl: apiUrl,
-			auth
-		}),
-		auth
+		publicKeyOpenssh: encodeSshPublicKey(pub, comment),
+		privateKeyOpenssh: encodeOpensshPrivateKey(seed, pub, comment)
 	};
 }
-function buildContext() {
-	const ctx = tryBuildContext();
-	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER");
-	return ctx;
+/**
+* Generate a certificate-authority keypair. The private half is exported as a
+* JWK (so the broker can re-import it to sign); the public half is printed for
+* admins to install on their hosts.
+*/
+async function generateSshCaKeyPair(comment = "seekrit-ca") {
+	const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
+	const pub = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const jwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+	return {
+		privateKeyJwk: JSON.stringify(jwk),
+		publicKeyOpenssh: encodeSshPublicKey(pub, comment)
+	};
 }
-function isTokenAuth(ctx) {
-	return ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token);
+/**
+* Serialize an Ed25519 keypair as an unencrypted `openssh-key-v1` private key.
+* Format (PROTOCOL.key): magic ‖ ciphername "none" ‖ kdfname "none" ‖ empty
+* kdfoptions ‖ nkeys=1 ‖ public-key blob ‖ private section (wrapped as a
+* string). The private section is two equal check-ints, then the key, then the
+* comment, padded with 1,2,3,… to the "none" block size (8).
+*/
+function encodeOpensshPrivateKey(seed, pub, comment) {
+	const check = new DataView(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(4)).buffer).getUint32(0, false);
+	const privSection = new SshWriter().uint32(check).uint32(check).string("ssh-ed25519").string(pub).string(concat(seed, pub)).string(comment).build();
+	const padLen = (8 - privSection.length % 8) % 8;
+	const pad = new Uint8Array(padLen);
+	for (let i = 0; i < padLen; i++) pad[i] = i + 1;
+	const b64 = toBase64(new SshWriter().bytes(utf8Encode("openssh-key-v1")).byte(0).string("none").string("none").string(/* @__PURE__ */ new Uint8Array(0)).uint32(1).string(ed25519PublicKeyBlob(pub)).string(concat(privSection, pad)).build());
+	return `-----BEGIN OPENSSH PRIVATE KEY-----\n${b64.match(/.{1,70}/g)?.join("\n") ?? b64}\n-----END OPENSSH PRIVATE KEY-----\n`;
 }
+//#endregion
+//#region ../../packages/crypto/src/token.ts
 /**
-* Recover the calling principal's private key:
-*  - service tokens carry their private key in the token string;
-*  - users fetch their passphrase-encrypted key from the API and unlock it.
+* Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
+* principals: the token string itself carries the private key, so the server
+* never holds it. The server stores only the SHA-256 hash of the full token
+* (for authentication) and the public key (for wrapping DEK grants).
+*
+* Format: `skt_<token id>_<private key pkcs8, base64url>`
 */
-async function getPrivateKey(ctx) {
-	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
-		const { privateKey } = await parseServiceToken(ctx.auth.token);
-		return privateKey;
+const TOKEN_PREFIX = "skt";
+const TOKEN_ID_LENGTH = 22;
+const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+function randomTokenId() {
+	let out = "";
+	while (out.length < TOKEN_ID_LENGTH) {
+		const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += ID_ALPHABET[byte % 62];
+			if (out.length === TOKEN_ID_LENGTH) break;
+		}
 	}
-	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
-	return importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey));
-}
-/** Recover one environment's DEK for the current principal. */
-async function getDek(ctx, orgId, envId) {
-	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
-	return unwrapDek(wrappedDek, privateKey);
+	return `${TOKEN_PREFIX}_${out}`;
 }
-//#endregion
-//#region src/format.ts
-function needsQuoting(value) {
-	return /[\s"'`$\\#]/.test(value) || value === "";
+async function hashToken(token) {
+	const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token));
+	return toBase64Url(new Uint8Array(digest));
 }
-function dotenvQuote(value) {
-	if (!needsQuoting(value)) return value;
-	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n")}"`;
-}
-function shellQuote(value) {
-	return `'${value.replaceAll("'", `'\\''`)}'`;
+async function createServiceToken() {
+	const { publicKeyJwk, privateKeyJwk } = await generateKeyPair();
+	const pkcs8 = await exportPrivateKeyPkcs8(await importPrivateKey(privateKeyJwk));
+	const tokenId = randomTokenId();
+	const token = `${tokenId}_${toBase64Url(pkcs8)}`;
+	return {
+		token,
+		tokenId,
+		tokenHash: await hashToken(token),
+		publicKeyJwk
+	};
 }
-function formatSecrets(values, format) {
-	const names = Object.keys(values).sort();
-	switch (format) {
-		case "json": return JSON.stringify(values, names, 2);
-		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
-		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+async function parseServiceToken(token) {
+	const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
+	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
+	const [, tokenId, keyB64] = match;
+	try {
+		return {
+			tokenId,
+			privateKey: await importPrivateKeyPkcs8(fromBase64Url(keyB64))
+		};
+	} catch {
+		throw new SeekritCryptoError("MALFORMED_TOKEN", "service token private key is corrupted");
 	}
 }
+function isServiceToken(value) {
+	return value.startsWith(`${TOKEN_PREFIX}_`);
+}
 //#endregion
-//#region src/provisioner.ts
+//#region ../../packages/crypto/src/wrap.ts
 /**
-* `seekrit provisioner` — helpers for the self-hosted **remote executor**
-* (`seekrit-provisioner`), the daemon that runs a target's provisioning SQL
-* inside the customer's own network so the control plane never sees the database
-* admin credential.
+* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
+* the recipient's public key; the shared secret is run through HKDF-SHA256 to
+* derive a one-time AES-256-GCM wrapping key. Only the holder of the
+* recipient private key can unwrap.
 *
-* The only stateful command is `keygen`: the shared HMAC key authenticates the
-* signed commands the broker sends the daemon. The same base64 value is given to
-* BOTH `--hmac-key` when registering a remote target AND the daemon's
-* `SEEKRIT_PROVISIONER_HMAC_KEY`.
+* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
 */
-function registerProvisionerCommands(program) {
-	program.command("provisioner").description("self-hosted remote executor (seekrit-provisioner) helpers").command("keygen").description("generate a shared HMAC key for a remote provisioning target").action(() => {
-		const key = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
-		console.log(toBase64(key));
-		console.error("Give this key to BOTH `--hmac-key` when registering a remote target AND the\ndaemon's SEEKRIT_PROVISIONER_HMAC_KEY. Keep it secret; it authenticates the\nbroker's commands to your provisioner.");
-	});
+const WRAP_PREFIX = "wd1";
+const HKDF_INFO = "seekrit/wrap-dek/v1";
+async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
+	const ecdh = {
+		name: "ECDH",
+		public: peerPublicKey
+	};
+	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
+	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt,
+		info: utf8Encode(HKDF_INFO)
+	}, hkdfKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
 }
-/**
-* Resolve the "admin secret" a lease target registration wraps to the broker.
-* Its meaning depends on the executor:
-*
-* - **remote** — the shared HMAC key (base64). The real database admin
-*   credential is NOT sent to seekrit; it is configured on the daemon instead.
-*   Preferred source is `--hmac-key` / `SEEKRIT_PROVISIONER_HMAC_KEY`, with the
-*   older `--admin-url` / provider admin-url env kept as a fallback.
-* - **in_do** — the database admin connection string, which the broker decrypts
-*   transiently to run the SQL itself.
-*
-* `fail()` never returns, so the result is always a non-empty string.
-*/
-function resolveLeaseAdminSecret(opts) {
-	if (opts.executor === "remote") {
-		const key = opts.hmacKey ?? process.env.SEEKRIT_PROVISIONER_HMAC_KEY ?? opts.adminUrl ?? process.env[opts.adminUrlEnv];
-		if (!key) fail("the remote executor needs the shared HMAC key — pass --hmac-key or set SEEKRIT_PROVISIONER_HMAC_KEY (mint one with `seekrit provisioner keygen`)");
-		return key.trim();
+/** Wrap an environment DEK to a principal's public key. */
+async function wrapDek(dek, recipientPublicKeyJwk) {
+	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
+	const ephemeral = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, wrappingKey, dek);
+	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	return [
+		WRAP_PREFIX,
+		toBase64Url(ephemeralRaw),
+		toBase64Url(salt),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
+}
+/** Unwrap an environment DEK with the principal's private ECDH key. */
+async function unwrapDek(wrapped, privateKey) {
+	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
+	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, false, []), fromBase64Url(saltB64), "decrypt");
+	try {
+		const dek = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64)
+		}, wrappingKey, fromBase64Url(ctB64));
+		return new Uint8Array(dek);
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
 	}
-	const adminUrl = opts.adminUrl ?? process.env[opts.adminUrlEnv];
-	if (!adminUrl) fail(`provide the admin connection string via --admin-url or ${opts.adminUrlEnv}`);
-	return adminUrl;
 }
 //#endregion
-//#region src/target.ts
-/** Resolve the target org from a flag, the committed config, or a lone org. */
-async function resolveOrg(ctx, orgSlug) {
-	const wanted = orgSlug ?? findProjectConfig()?.org;
-	const { orgs } = await ctx.client.listOrgs();
-	if (wanted) {
-		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
-		if (!org) fail(`no accessible org "${wanted}"`);
-		return {
-			id: org.id,
-			slug: org.slug
-		};
-	}
-	const only = orgs[0];
-	if (orgs.length === 1 && only) return {
-		id: only.id,
-		slug: only.slug
-	};
-	fail("specify --org (or run `seekrit init`)");
+//#region package.json
+var version = "0.12.0";
+const PROJECT_FILE = "seekrit.json";
+function globalConfigPath() {
+	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
 }
-/**
-* Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
-*/
-async function resolveEnvTarget(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.env) fail("specify --env");
-	if (opts.group) {
-		const { groups } = await ctx.client.listGroups(org.id);
-		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
-		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
-		return {
-			orgId: org.id,
-			envId: env.id,
-			label: `${group.slug}@${env.slug}`
-		};
-	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		envId: env.id,
-		label: `${app.slug}/${env.slug}`
-	};
+function readGlobalConfig() {
+	const path = globalConfigPath();
+	if (!existsSync(path)) return {};
+	return JSON.parse(readFileSync(path, "utf8"));
 }
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		appId: app.id,
-		appSlug: app.slug,
-		envId: env.id,
-		envSlug: env.slug
+function writeGlobalConfig(update) {
+	const path = globalConfigPath();
+	const merged = {
+		...readGlobalConfig(),
+		...update
 	};
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
 }
-/** Resolve a group by slug within the target org. */
-async function resolveGroup(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.group) fail("specify --group");
-	const { groups } = await ctx.client.listGroups(org.id);
-	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-	return {
-		orgId: org.id,
-		id: group.id,
-		slug: group.slug
-	};
+/** Walk up from cwd looking for seekrit.json. */
+function findProjectConfig(startDir = process.cwd()) {
+	let dir = startDir;
+	const { root } = parse(dir);
+	while (true) {
+		const candidate = join(dir, PROJECT_FILE);
+		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
+		if (dir === root) return null;
+		dir = dirname(dir);
+	}
+}
+function writeProjectConfig(config, dir = process.cwd()) {
+	const path = join(dir, PROJECT_FILE);
+	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
+	return path;
 }
 //#endregion
-//#region src/mysql.ts
-/**
-* `seekrit mysql` — temporary MySQL/MariaDB credentials (Vault-style dynamic
-* secrets).
-*
-* Zero-knowledge: minting generates the password and its
-* `mysql_native_password` hash on THIS machine and sends only the hash; the
-* plaintext password never reaches the API or gets stored. Registering a target
-* wraps the admin connection string to the broker's public key locally, so the
-* control plane only ever stores ciphertext.
-*/
-/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds$2(input) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
-}
-/** A fresh, valid MySQL user name: `tmp_` + lowercase alphanumerics. */
-function generateUserName(prefix = "tmp") {
-	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
-	let out = "";
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	for (const b of bytes) out += alphabet[b % 36];
-	return `${prefix}_${out}`;
-}
-function registerMysqlCommands(program) {
-	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
-	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const executor = options.executor === "remote" ? "remote" : "in_do";
-		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
-		if (![
-			"readonly",
-			"readwrite",
-			"custom"
-		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
-		const accessLevel = options.access;
-		const adminSecret = resolveLeaseAdminSecret({
-			executor,
-			hmacKey: options.hmacKey,
-			adminUrl: options.adminUrl,
-			adminUrlEnv: "SEEKRIT_MYSQL_ADMIN_URL"
-		});
-		const config = {
-			provider: "mysql",
-			executor,
-			accessLevel,
-			connection: {
-				host: options.host,
-				port: Number.parseInt(options.port, 10),
-				database: options.database
-			},
-			userHost: options.userHost,
-			...accessLevel === "custom" ? {
-				...options.createStatement.length ? { createStatements: options.createStatement } : {},
-				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
-			} : {},
-			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
-		};
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
-		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
-			name: options.name,
-			config,
-			wrappedAdminSecret
+//#region ../../packages/api-client/src/index.ts
+var SeekritApiError = class extends Error {
+	status;
+	code;
+	constructor(status, code, message) {
+		super(message);
+		this.name = "SeekritApiError";
+		this.status = status;
+		this.code = code;
+	}
+};
+var SeekritClient = class {
+	baseUrl;
+	auth;
+	fetchImpl;
+	constructor(options) {
+		this.baseUrl = options.baseUrl.replace(/\/$/, "");
+		this.auth = options.auth;
+		this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+	}
+	async request(method, path, body) {
+		const headers = { accept: "application/json" };
+		if (this.auth.type === "bearer") headers.authorization = `Bearer ${this.auth.token}`;
+		else if (this.auth.type === "dynamic") {
+			const token = await this.auth.getToken();
+			if (!token) throw new SeekritApiError(401, "unauthorized", "session expired");
+			headers.authorization = `Bearer ${token}`;
+		} else headers["x-seekrit-dev-user"] = this.auth.email;
+		if (body !== void 0) headers["content-type"] = "application/json";
+		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+			method,
+			headers,
+			body: body === void 0 ? void 0 : JSON.stringify(body)
 		});
-		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
-	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		for (const t of targets) {
-			if (t.provider !== "mysql") continue;
-			const cfg = t.config;
-			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		if (!res.ok) {
+			const fallback = { error: {
+				code: "internal",
+				message: `HTTP ${res.status}`
+			} };
+			const payload = await res.json().catch(() => fallback);
+			throw new SeekritApiError(res.status, payload.error?.code ?? "internal", payload.error?.message ?? `HTTP ${res.status}`);
 		}
+		return await res.json();
+	}
+	me() {
+		return this.request("GET", "/v1/me");
+	}
+	getMyKeys() {
+		return this.request("GET", "/v1/me/keys");
+	}
+	setMyKeys(input) {
+		return this.request("PUT", "/v1/me/keys", input);
+	}
+	getMyNotificationPrefs() {
+		return this.request("GET", "/v1/me/notifications");
+	}
+	setMyNotificationPrefs(input) {
+		return this.request("PUT", "/v1/me/notifications", input);
+	}
+	listOrgs() {
+		return this.request("GET", "/v1/orgs");
+	}
+	createOrg(input) {
+		return this.request("POST", "/v1/orgs", input);
+	}
+	getOrg(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}`);
+	}
+	listMembers(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/members`);
+	}
+	listApps(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps`);
+	}
+	createApp(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/apps`, input);
+	}
+	getApp(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}`);
+	}
+	deleteApp(orgId, appId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/apps/${appId}`);
+	}
+	listEnvs(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/envs`);
+	}
+	createEnv(orgId, appId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/apps/${appId}/envs`, input);
+	}
+	getEnv(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
+	}
+	deleteEnv(orgId, envId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
+	}
+	listGroups(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups`);
+	}
+	createGroup(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/groups`, input);
+	}
+	getGroup(orgId, groupId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}`);
+	}
+	deleteGroup(orgId, groupId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/groups/${groupId}`);
+	}
+	listGroupEnvs(orgId, groupId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}/envs`);
+	}
+	createGroupEnv(orgId, groupId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/groups/${groupId}/envs`, input);
+	}
+	listEnvGroups(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/groups`);
+	}
+	linkEnvGroup(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/groups`, input);
+	}
+	unlinkEnvGroup(orgId, envId, groupId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/groups/${groupId}`);
+	}
+	/** Ordered ciphertext layers + wrapped DEKs for the calling principal. */
+	resolve(query = {}) {
+		const params = new URLSearchParams();
+		if (query.env) params.set("env", query.env);
+		for (const [group, slug] of Object.entries(query.with ?? {})) params.append("with", `${group}:${slug}`);
+		const qs = params.size > 0 ? `?${params}` : "";
+		return this.request("GET", `/v1/resolve${qs}`);
+	}
+	listSecrets(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/secrets`);
+	}
+	setSecret(orgId, envId, name, ciphertext) {
+		return this.request("PUT", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`, { ciphertext });
+	}
+	deleteSecret(orgId, envId, name) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`);
+	}
+	/** The calling principal's wrapped DEK for this environment. */
+	getMyEnvKey(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
+	}
+	listEnvKeys(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/keys`);
+	}
+	grantEnvKey(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/keys`, input);
+	}
+	revokeEnvKey(orgId, envId, grantId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/keys/${grantId}`);
+	}
+	listTokens(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/tokens`);
+	}
+	createToken(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
+	}
+	revokeToken(orgId, tokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
+	}
+	/** The broker's public key — wrap the admin credential to it before registering a target. */
+	getLeaseBrokerKey(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
+	}
+	listLeaseTargets(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases/targets`);
+	}
+	registerLeaseTarget(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/leases/targets`, input);
+	}
+	deleteLeaseTarget(orgId, targetId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/leases/targets/${targetId}`);
+	}
+	listLeases(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases`);
+	}
+	mintLease(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/leases`, input);
+	}
+	revokeLease(orgId, leaseId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
+	}
+	listAudit(orgId, query = {}) {
+		const params = new URLSearchParams();
+		if (query.cursor) params.set("cursor", query.cursor);
+		if (query.limit) params.set("limit", String(query.limit));
+		if (query.action) params.set("action", query.action);
+		if (query.resourceType) params.set("resourceType", query.resourceType);
+		const qs = params.size > 0 ? `?${params}` : "";
+		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
+	}
+	getLogSink(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
+	}
+	setLogSink(orgId, input) {
+		return this.request("PUT", `/v1/orgs/${orgId}/log-sink`, input);
+	}
+	deleteLogSink(orgId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/log-sink`);
+	}
+	/** Send a synthetic record to the configured endpoint to verify connectivity. */
+	testLogSink(orgId) {
+		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
+	}
+};
+//#endregion
+//#region src/io.ts
+let failThrows = false;
+/**
+* In `seekrit mcp` the process is a long-lived stdio server, so a `fail()`
+* must surface as a catchable error (→ a tool error result) rather than
+* exiting and killing every other tool. Toggled on once at MCP startup.
+*/
+function setFailThrows(value) {
+	failThrows = value;
+}
+function fail(message) {
+	if (failThrows) throw new Error(message);
+	console.error(`error: ${message}`);
+	process.exit(1);
+}
+/** Prompt without echoing input (for passphrases). */
+function promptHidden(question) {
+	const muted = new Writable({ write(_chunk, _encoding, callback) {
+		callback();
+	} });
+	process.stderr.write(question);
+	const rl = createInterface({
+		input: process.stdin,
+		output: muted,
+		terminal: true
 	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`removed ${targetId}`);
-	});
-	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
-		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
-		if (target.provider !== "mysql") fail(`target "${targetRef}" is not a MySQL target`);
-		const userName = options.user ?? generateUserName();
-		const ttlSeconds = parseTtlSeconds$2(options.ttl);
-		const { password, verifier } = await generateMysqlCredential();
-		const { connection } = await ctx.client.mintLease(org.id, {
-			provider: "mysql",
-			targetId: target.id,
-			roleName: userName,
-			verifier,
-			ttlSeconds
+	return new Promise((resolve) => {
+		rl.question("", (answer) => {
+			rl.close();
+			process.stderr.write("\n");
+			resolve(answer);
 		});
-		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
-		console.error(`leased ${userName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
-		if (options.json) console.log(JSON.stringify({
-			...connection,
-			password,
-			url
-		}, null, 2));
-		else console.log(url);
-	});
-	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) {
-			if (l.provider !== "mysql") continue;
-			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
-		}
-	});
-	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId}`);
 	});
 }
-/** Collect a repeatable option into an array. */
-function collect$2(value, acc) {
-	acc.push(value);
-	return acc;
+/** Read all of stdin (for `seekrit secrets set NAME -` piping). */
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8");
 }
-z.enum([
-	"postgres",
-	"mysql",
-	"ssh"
-]);
-const executorModeSchema = z.enum(["in_do", "remote"]);
-/**
-* A Postgres role name we are willing to create. Deliberately strict — this
-* value is interpolated into a SQL template, so it must be a bare identifier
-* with no way to break out of quoting (no quotes, whitespace, or semicolons).
-*/
-const postgresRoleNameSchema = z.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must be 3–63 chars, lowercase letters/digits/underscore, starting with a letter or underscore");
-/**
-* A SCRAM-SHA-256 verifier string as produced by @seekrit/crypto. Validated so
-* it, too, is safe to interpolate into a quoted SQL literal (the alphabet is
-* base64 + the fixed structural characters, none of which is a single quote).
-*/
-const scramVerifierSchema = z.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
+//#endregion
+//#region src/context.ts
 /**
-* An SSH login principal (a Unix-style username the certificate authorizes).
-* Bounded and restricted to a safe charset — principals are SSH-wire-encoded,
-* not shell-interpolated, so this is sanity/DoS hardening, not an injection gate.
+* Build the client context from configured credentials, or return null when
+* none are set. `seekrit run` uses this to degrade to a plain launcher instead
+* of exiting; every other command goes through `buildContext`, which fails.
+*
+* `dotenvVars` supplies `SEEKRIT_*` values read from a `.env` file. They sit
+* below the live `process.env` but above the saved config, so a project-local
+* `.env` can carry the token / API URL — matching `seekrit-run`'s
+* `flag > env > .env` credential resolution. Empty for every command but
+* `seekrit run`, which loads `.env` before authenticating.
 */
-const sshPrincipalSchema = z.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "must be 1–64 chars of letters, digits, dot, dash, underscore");
-/** An `ssh-ed25519 <base64> [comment]` public key line (deep-validated on sign). */
-const sshPublicKeySchema = z.string().max(2048).regex(/^ssh-ed25519 [A-Za-z0-9+/=]+( .*)?$/, "must be an ssh-ed25519 public key");
-/** An SSH certificate extension name, e.g. `permit-pty`. */
-const sshExtensionSchema = z.string().regex(/^[a-z0-9-]{1,64}$/);
+function tryBuildContext(dotenvVars = {}) {
+	const config = readGlobalConfig();
+	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token;
+	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
+	let auth;
+	if (token) auth = {
+		type: "bearer",
+		token
+	};
+	else if (devUser) auth = {
+		type: "dev",
+		email: devUser
+	};
+	else return null;
+	return {
+		client: new SeekritClient({
+			baseUrl: apiUrl,
+			auth
+		}),
+		auth
+	};
+}
+function buildContext() {
+	const ctx = tryBuildContext();
+	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER");
+	return ctx;
+}
+function isTokenAuth(ctx) {
+	return ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token);
+}
 /**
-* A MySQL/MariaDB user name we are willing to create. Interpolated into a
-* quoted SQL literal (`'{{name}}'@'%'`), so it is kept strict — plain
-* alphanumerics/underscore, no quotes/whitespace/semicolons to break out.
+* Recover the calling principal's private key:
+*  - service tokens carry their private key in the token string;
+*  - users fetch their passphrase-encrypted key from the API and unlock it.
 */
-const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+async function getPrivateKey(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { privateKey } = await parseServiceToken(ctx.auth.token);
+		return privateKey;
+	}
+	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
+	return importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey));
+}
+/** Recover one environment's DEK for the current principal. */
+async function getDek(ctx, orgId, envId) {
+	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
+	return unwrapDek(wrappedDek, privateKey);
+}
+//#endregion
+//#region src/dotenv.ts
 /**
-* A `mysql_native_password` authentication string — `*` followed by 40 upper
-* hex chars (`UPPER(HEX(SHA1(SHA1(password))))`), as produced by
-* @seekrit/crypto `mysqlNativePasswordVerifier`. Stored verbatim by
-* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`, and its
-* alphabet contains no single quote, so it is safe in a quoted SQL literal.
+* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
+* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
+* escapes; unquoted values drop trailing ` # comments`). Multiline values are
+* not supported — keep those in seekrit itself.
 */
-const mysqlNativeVerifierSchema = z.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
-const postgresAccessLevelSchema = z.enum([
-	"readonly",
-	"readwrite",
-	"custom"
-]);
-/** The group role each preset's leased credentials inherit. */
-const POSTGRES_GROUP_ROLES = {
-	readonly: "seekrit_readonly",
-	readwrite: "seekrit_readwrite"
-};
-const mysqlAccessLevelSchema = z.enum([
-	"readonly",
-	"readwrite",
-	"custom"
-]);
-const connectionSchema = z.object({
-	host: z.string().min(1),
-	port: z.number().int().min(1).max(65535),
-	database: z.string().min(1)
-});
-/** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
-const statementSchema = z.string().min(1).max(4e3);
-/** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
-const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
-const postgresTargetConfigSchema = z.object({
-	provider: z.literal("postgres"),
-	executor: executorModeSchema,
-	accessLevel: postgresAccessLevelSchema.optional(),
-	schema: identifierSchema.optional(),
-	connection: connectionSchema,
-	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
-});
-/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
-const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
-const mysqlTargetConfigSchema = z.object({
-	provider: z.literal("mysql"),
-	executor: executorModeSchema,
-	accessLevel: mysqlAccessLevelSchema.optional(),
-	connection: connectionSchema,
-	userHost: mysqlHostSchema.optional(),
-	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
-});
-const sshTargetConfigSchema = z.object({
-	provider: z.literal("ssh"),
-	executor: z.literal("in_do"),
-	caPublicKey: sshPublicKeySchema,
-	allowedPrincipals: z.array(sshPrincipalSchema).max(64).optional(),
-	extensions: z.array(sshExtensionSchema).max(16).optional(),
-	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional(),
-	connection: z.object({
-		host: z.string().min(1).optional(),
-		user: sshPrincipalSchema.optional()
-	}).optional()
-});
-const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
-	postgresTargetConfigSchema,
-	mysqlTargetConfigSchema,
-	sshTargetConfigSchema
-]);
-z.object({
-	name: z.string().trim().min(1).max(128),
-	config: leaseTargetConfigSchema,
-	/**
-	* The admin/provisioning credential (e.g. a Postgres connection string),
-	* encrypted client-side to the broker's public key (a `wd1.` wrap). The
-	* control plane stores only this ciphertext — it never sees the plaintext.
-	*/
-	wrappedAdminSecret: z.string().min(1)
-});
-/** Requested lease lifetime, shared by all providers. */
-const ttlSecondsSchema = z.number().int().min(60).max(3600 * 24 * 7);
+function parseDotenv(content) {
+	const out = {};
+	for (const raw of content.split(/\r?\n/)) {
+		let line = raw.trim();
+		if (!line || line.startsWith("#")) continue;
+		if (line.startsWith("export ")) line = line.slice(7).trimStart();
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		const key = line.slice(0, eq).trim();
+		if (!key) continue;
+		let value = line.slice(eq + 1).trim();
+		const quote = value[0];
+		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
+			value = value.slice(1, -1);
+			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+		} else {
+			const comment = value.indexOf(" #");
+			if (comment !== -1) value = value.slice(0, comment).trim();
+		}
+		out[key] = value;
+	}
+	return out;
+}
+//#endregion
+//#region src/format.ts
+function needsQuoting(value) {
+	return /[\s"'`$\\#]/.test(value) || value === "";
+}
+function dotenvQuote(value) {
+	if (!needsQuoting(value)) return value;
+	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n")}"`;
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function formatSecrets(values, format) {
+	const names = Object.keys(values).sort();
+	switch (format) {
+		case "json": return JSON.stringify(values, names, 2);
+		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
+		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+	}
+}
+//#endregion
+//#region src/provisioner.ts
 /**
-* Client → API: mint a Postgres lease. The client generates the password and
-* its SCRAM verifier locally and sends only the verifier — the plaintext
-* password never leaves the requesting machine.
+* `seekrit provisioner` — helpers for the self-hosted **remote executor**
+* (`seekrit-provisioner`), the daemon that runs a target's provisioning SQL
+* inside the customer's own network so the control plane never sees the database
+* admin credential.
+*
+* The only stateful command is `keygen`: the shared HMAC key authenticates the
+* signed commands the broker sends the daemon. The same base64 value is given to
+* BOTH `--hmac-key` when registering a remote target AND the daemon's
+* `SEEKRIT_PROVISIONER_HMAC_KEY`.
 */
-const mintPostgresLeaseSchema = z.object({
-	provider: z.literal("postgres"),
-	targetId: z.string().min(1),
-	roleName: postgresRoleNameSchema,
-	verifier: scramVerifierSchema,
-	ttlSeconds: ttlSecondsSchema
-});
+function registerProvisionerCommands(program) {
+	program.command("provisioner").description("self-hosted remote executor (seekrit-provisioner) helpers").command("keygen").description("generate a shared HMAC key for a remote provisioning target").action(() => {
+		const key = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+		console.log(toBase64(key));
+		console.error("Give this key to BOTH `--hmac-key` when registering a remote target AND the\ndaemon's SEEKRIT_PROVISIONER_HMAC_KEY. Keep it secret; it authenticates the\nbroker's commands to your provisioner.");
+	});
+}
 /**
-* Client → API: mint a MySQL/MariaDB lease. The client generates the password
-* and its `mysql_native_password` hash locally and sends only the hash — the
-* plaintext password never leaves the requesting machine.
+* Resolve the "admin secret" a lease target registration wraps to the broker.
+* Its meaning depends on the executor:
+*
+* - **remote** — the shared HMAC key (base64). The real database admin
+*   credential is NOT sent to seekrit; it is configured on the daemon instead.
+*   Preferred source is `--hmac-key` / `SEEKRIT_PROVISIONER_HMAC_KEY`, with the
+*   older `--admin-url` / provider admin-url env kept as a fallback.
+* - **in_do** — the database admin connection string, which the broker decrypts
+*   transiently to run the SQL itself.
+*
+* `fail()` never returns, so the result is always a non-empty string.
 */
-const mintMysqlLeaseSchema = z.object({
-	provider: z.literal("mysql"),
-	targetId: z.string().min(1),
-	roleName: mysqlUserNameSchema,
-	verifier: mysqlNativeVerifierSchema,
-	ttlSeconds: ttlSecondsSchema
-});
+function resolveLeaseAdminSecret(opts) {
+	if (opts.executor === "remote") {
+		const key = opts.hmacKey ?? process.env.SEEKRIT_PROVISIONER_HMAC_KEY ?? opts.adminUrl ?? process.env[opts.adminUrlEnv];
+		if (!key) fail("the remote executor needs the shared HMAC key — pass --hmac-key or set SEEKRIT_PROVISIONER_HMAC_KEY (mint one with `seekrit provisioner keygen`)");
+		return key.trim();
+	}
+	const adminUrl = opts.adminUrl ?? process.env[opts.adminUrlEnv];
+	if (!adminUrl) fail(`provide the admin connection string via --admin-url or ${opts.adminUrlEnv}`);
+	return adminUrl;
+}
+//#endregion
+//#region src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
 /**
-* Client → API: mint an SSH lease. The client generates an ephemeral keypair
-* locally and sends only the public key; the signed certificate comes back in
-* the response. The private key never leaves the requesting machine.
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
 */
-const mintSshLeaseSchema = z.object({
-	provider: z.literal("ssh"),
-	targetId: z.string().min(1),
-	publicKey: sshPublicKeySchema,
-	principals: z.array(sshPrincipalSchema).min(1).max(32),
-	ttlSeconds: ttlSecondsSchema
-});
-z.discriminatedUnion("provider", [
-	mintPostgresLeaseSchema,
-	mintMysqlLeaseSchema,
-	mintSshLeaseSchema
-]);
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
 //#endregion
-//#region ../../packages/core/src/providers/postgres.ts
+//#region src/mysql.ts
 /**
-* The one-time setup SQL an admin runs to create the shared group role that a
-* read-only / read-write target's leased credentials inherit. Idempotent (safe
-* to re-run). Returns null for custom targets (the admin owns their own SQL).
+* `seekrit mysql` — temporary MySQL/MariaDB credentials (Vault-style dynamic
+* secrets).
 *
-* Identifiers are interpolated from admin-supplied config (database/schema) and
-* fixed group-role constants — this SQL is displayed for the admin to run in
-* their own database, not executed by seekrit.
+* Zero-knowledge: minting generates the password and its
+* `mysql_native_password` hash on THIS machine and sends only the hash; the
+* plaintext password never reaches the API or gets stored. Registering a target
+* wraps the admin connection string to the broker's public key locally, so the
+* control plane only ever stores ciphertext.
 */
-function postgresGroupBootstrapSql(config) {
-	if (config.accessLevel !== "readonly" && config.accessLevel !== "readwrite") return null;
-	const group = POSTGRES_GROUP_ROLES[config.accessLevel];
-	const schema = config.schema ?? "public";
-	const db = config.connection.database;
-	const privileges = config.accessLevel === "readonly" ? "SELECT" : "SELECT, INSERT, UPDATE, DELETE";
-	const lines = [
-		`-- Run once as an admin on "${db}". Temporary ${config.accessLevel} credentials inherit this role.`,
-		"DO $$ BEGIN",
-		`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${group}') THEN`,
-		`    CREATE ROLE ${group} NOLOGIN;`,
-		"  END IF;",
-		"END $$;",
-		`GRANT CONNECT ON DATABASE "${db}" TO ${group};`,
-		`GRANT USAGE ON SCHEMA "${schema}" TO ${group};`,
-		`GRANT ${privileges} ON ALL TABLES IN SCHEMA "${schema}" TO ${group};`,
-		`ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT ${privileges} ON TABLES TO ${group};`
-	];
-	if (config.accessLevel === "readwrite") lines.push(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO ${group};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE, SELECT ON SEQUENCES TO ${group};`);
-	return lines.join("\n");
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds$2(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid MySQL user name: `tmp_` + lowercase alphanumerics. */
+function generateUserName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerMysqlCommands(program) {
+	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
+	const target = mysql.command("target").description("manage provisioning targets");
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_MYSQL_ADMIN_URL"
+		});
+		const config = {
+			provider: "mysql",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				database: options.database
+			},
+			userHost: options.userHost,
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : {},
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			if (t.provider !== "mysql") continue;
+			const cfg = t.config;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.provider !== "mysql") fail(`target "${targetRef}" is not a MySQL target`);
+		const userName = options.user ?? generateUserName();
+		const ttlSeconds = parseTtlSeconds$2(options.ttl);
+		const { password, verifier } = await generateMysqlCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "mysql",
+			targetId: target.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds
+		});
+		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${userName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "mysql") continue;
+			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+		}
+	});
+	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
 }
-//#endregion
-//#region ../../packages/core/src/providers/ssh.ts
-/**
-* The one-time host setup an admin runs so a target's certificates are accepted.
-* Analogue of `postgresGroupBootstrapSql` — displayed for the admin to run, not
-* executed by seekrit. Embeds the CA public key so it's copy-paste runnable.
-*/
-function sshHostSetupInstructions(config) {
-	const principals = config.allowedPrincipals?.length ? config.allowedPrincipals : ["<login-user>"];
-	return [
-		"# Run once on each target host so it trusts seekrit-issued certificates.",
-		"# 1. Install the CA public key and trust it for user authentication:",
-		`echo '${config.caPublicKey}' | sudo tee /etc/ssh/seekrit_ca.pub`,
-		"sudo sh -c 'echo \"TrustedUserCAKeys /etc/ssh/seekrit_ca.pub\" >> /etc/ssh/sshd_config'",
-		"# 2. (optional) Restrict which cert principals may log in as which users via",
-		"#    AuthorizedPrincipalsFile, e.g. /etc/ssh/auth_principals/<user> listing:",
-		...principals.map((p) => `#      ${p}`),
-		"# 3. Reload sshd:",
-		"sudo systemctl reload sshd"
-	].join("\n");
+/** Collect a repeatable option into an array. */
+function collect$2(value, acc) {
+	acc.push(value);
+	return acc;
 }
 //#endregion
-//#region ../../packages/core/src/types.ts
-/**
-* Transactional notification emails seekrit can send. Each id is one
-* user-facing on/off toggle (see `NOTIFICATION_TYPE_META`). These carry only
-* audit-grade metadata — never secret material — and every one is opt-out
-* (defaults on). Kept as a const array so the API, api-client, and dashboard
-* share a single source of truth (mirrors `AUDIT_ACTIONS`).
-*/
-const NOTIFICATION_TYPES = [
-	"token_created",
-	"token_revoked",
-	"env_access_granted",
-	"env_access_revoked",
-	"resolve_denied",
-	"org_welcome",
-	"token_expiring",
-	"lease_expired"
-];
-//#endregion
-//#region ../../packages/core/src/schemas.ts
-/** URL-safe identifier segment: `my-app`, `production`, … */
-const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
-const nameSchema = z.string().trim().min(1).max(128);
-z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
-z.enum([
-	"owner",
-	"admin",
-	"member"
-]);
-const principalTypeSchema = z.enum(["user", "service_token"]);
-/** Org-level capability a service token can hold (never `owner`). */
-const serviceTokenRoleSchema = z.enum(["admin", "member"]);
-z.object({
-	name: nameSchema,
-	slug: slugSchema
-});
-z.object({
-	name: nameSchema,
-	slug: slugSchema
-});
-z.object({
-	name: nameSchema,
-	slug: slugSchema
-});
-z.object({
-	groupId: z.string().min(1),
-	/** Precedence among an env's groups (higher wins). Appended if omitted. */
-	position: z.number().int().min(0).optional()
-});
-z.object({
-	name: nameSchema,
-	slug: slugSchema,
-	/** Environment DEK wrapped to the creator's public key — created client-side. */
-	wrappedDek: z.string().min(1)
-});
-z.object({ 
-/** Opaque versioned ciphertext blob from @seekrit/crypto. */
-ciphertext: z.string().min(1).max(65536) });
-z.object({
-	publicKeyJwk: z.string().min(1),
-	/**
-	* Private key encrypted with a passphrase-derived KEK; opaque to the
-	* server. Self-contained blob (embeds KDF salt + iterations).
-	*/
-	encryptedPrivateKey: z.string().min(1)
-});
-z.object({
-	principalType: principalTypeSchema,
-	principalId: z.string().min(1),
-	wrappedDek: z.string().min(1)
-});
-z.object({
-	name: nameSchema,
-	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
-	/** SHA-256 hash (base64url) of the full token string. */
-	tokenHash: z.string().min(1),
-	publicKeyJwk: z.string().min(1),
-	/**
-	* Org-level capability. Defaults to `member` (a runtime credential); pass
-	* `admin` to mint a headless provisioning token. Only an admin caller may
-	* create an `admin` token, so capability cannot escalate itself.
-	*/
-	role: serviceTokenRoleSchema.default("member"),
-	/**
-	* The application environment this token is bound to (org + app + env).
-	* Optional so org-admin tokens can exist, but required for runtime tokens
-	* that resolve secrets via `GET /v1/resolve`.
-	*/
-	environmentId: z.string().min(1).nullish(),
-	expiresAt: z.iso.datetime().nullish()
-});
-z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
-z.object({
-	endpoint: z.url().max(2048),
-	headers: z.record(z.string().min(1).max(256), z.string().max(4096)).optional(),
-	enabled: z.boolean().default(true)
-});
-z.object({
-	cursor: z.string().optional(),
-	limit: z.coerce.number().int().min(1).max(200).default(50),
-	action: z.string().optional(),
-	resourceType: z.string().optional()
-});
-//#endregion
 //#region src/pg.ts
 /**
 * `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
@@ -1689,37 +1722,6 @@ function collect$1(value, acc) {
 	return acc;
 }
 //#endregion
-//#region src/dotenv.ts
-/**
-* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
-* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
-* escapes; unquoted values drop trailing ` # comments`). Multiline values are
-* not supported — keep those in seekrit itself.
-*/
-function parseDotenv(content) {
-	const out = {};
-	for (const raw of content.split(/\r?\n/)) {
-		let line = raw.trim();
-		if (!line || line.startsWith("#")) continue;
-		if (line.startsWith("export ")) line = line.slice(7).trimStart();
-		const eq = line.indexOf("=");
-		if (eq === -1) continue;
-		const key = line.slice(0, eq).trim();
-		if (!key) continue;
-		let value = line.slice(eq + 1).trim();
-		const quote = value[0];
-		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
-			value = value.slice(1, -1);
-			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
-		} else {
-			const comment = value.indexOf(" #");
-			if (comment !== -1) value = value.slice(0, comment).trim();
-		}
-		out[key] = value;
-	}
-	return out;
-}
-//#endregion
 //#region src/secrets.ts
 /** Fetch + decrypt every secret in a single environment. */
 async function fetchDecryptedSecrets(ctx, orgId, envId) {
@@ -1732,6 +1734,27 @@ async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
 	await ctx.client.setSecret(orgId, envId, name, ciphertext);
 }
 /**
+* Encrypt and store many secrets into one environment. The DEK is fetched once
+* (so user auth prompts for the passphrase a single time, not per variable),
+* then each value is encrypted locally and written. Existing names are
+* overwritten; the result splits them into created vs. updated for a summary.
+* Callers validate the names first — a rejected name aborts before any write.
+*/
+async function importSecrets(ctx, orgId, envId, entries) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const existing = new Set(secrets.map((s) => s.name));
+	const result = {
+		created: [],
+		updated: []
+	};
+	for (const [name, value] of Object.entries(entries)) {
+		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
+		await ctx.client.setSecret(orgId, envId, name, ciphertext);
+		(existing.has(name) ? result.updated : result.created).push(name);
+	}
+	return result;
+}
+/**
 * Resolve the full, layered environment for a running app: composed group
 * secrets (lowest precedence) → the app env's own secrets → `.env` files.
 * Each layer's DEK is unwrapped once with the principal's private key and its
@@ -2111,6 +2134,31 @@ withTarget(secrets.command("set <name> [value]").description("encrypt and store
 	await encryptAndSetSecret(ctx, orgId, envId, name, value === void 0 || value === "-" ? (await readStdin()).replace(/\n$/, "") : value);
 	console.error(`${name} saved`);
 });
+withTarget(secrets.command("import [file]").description("bulk-import secrets from a .env file (default .env; '-' reads stdin)").option("--dry-run", "list the variable names that would be imported, without writing")).action(async (file, options) => {
+	const source = file ?? ".env";
+	let content;
+	if (source === "-") content = await readStdin();
+	else {
+		if (!existsSync(source)) fail(`no such file: ${source}`);
+		content = readFileSync(source, "utf8");
+	}
+	const entries = parseDotenv(content);
+	const names = Object.keys(entries);
+	if (names.length === 0) fail(`no variables found in ${source === "-" ? "stdin" : source}`);
+	const invalid = names.filter((name) => !secretNameSchema.safeParse(name).success);
+	if (invalid.length > 0) fail(`invalid secret name(s): ${invalid.join(", ")} (must match [A-Za-z_][A-Za-z0-9_]*)`);
+	const ctx = buildContext();
+	const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+	if (options.dryRun) {
+		const { secrets: existingRows } = await ctx.client.listSecrets(orgId, envId);
+		const existing = new Set(existingRows.map((s) => s.name));
+		console.error(`would import ${names.length} secret(s) into ${label}:`);
+		for (const name of names.sort()) console.error(`  ${name}\t${existing.has(name) ? "update" : "new"}`);
+		return;
+	}
+	const { created, updated } = await importSecrets(ctx, orgId, envId, entries);
+	console.error(`imported ${created.length + updated.length} secret(s) into ${label} (${created.length} new, ${updated.length} updated)`);
+});
 withTarget(secrets.command("rm <name>").description("delete a secret")).action(async (name, options) => {
 	const ctx = buildContext();
 	const { orgId, envId } = await resolveEnvTarget(ctx, options);