@seekrit/cli 0.12.0 → 0.13.0

package/dist/index.js

@@ -10,7 +10,8 @@ import { Writable } from "node:stream";
 z.enum([
 	"postgres",
 	"mysql",
-	"ssh"
+	"ssh",
+	"redis"
 ]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
@@ -49,6 +50,22 @@ const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3
 * alphabet contains no single quote, so it is safe in a quoted SQL literal.
 */
 const mysqlNativeVerifierSchema = z.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
+/**
+* A Redis ACL user name we are willing to create. Interpolated into a Redis
+* command line as a bare token (`ACL SETUSER <name> …`), so it is kept strict —
+* plain alphanumerics/underscore, no whitespace to split the arg or ACL rule
+* characters (`~ + @ # & %`) that could be read as a permission.
+*/
+const redisUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+/**
+* A Redis password verifier — the lowercase-hex SHA-256 of the password, as
+* produced by @seekrit/crypto `redisSha256Verifier`. `ACL SETUSER … on #<hex>`
+* stores this digest verbatim, and it cannot authenticate: Redis `AUTH` hashes
+* the *plaintext* it receives with SHA-256 and compares, so the stored digest
+* is preimage-resistant (the password is high-entropy and machine-generated).
+* The alphabet is bare hex, so it is a safe bare command token.
+*/
+const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase-hex SHA-256 digest (64 chars)");
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -64,6 +81,11 @@ const mysqlAccessLevelSchema = z.enum([
 	"readwrite",
 	"custom"
 ]);
+const redisAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
 const connectionSchema = z.object({
 	host: z.string().min(1),
 	port: z.number().int().min(1).max(65535),
@@ -95,6 +117,21 @@ const mysqlTargetConfigSchema = z.object({
 	createStatements: z.array(statementSchema).max(16).optional(),
 	revokeStatements: z.array(statementSchema).max(16).optional()
 });
+const redisConnectionSchema = z.object({
+	host: z.string().min(1),
+	port: z.number().int().min(1).max(65535),
+	/** Redis logical database index (the `/<n>` in a connection URL). */
+	db: z.number().int().min(0).max(15).optional()
+});
+const redisTargetConfigSchema = z.object({
+	provider: z.literal("redis"),
+	executor: executorModeSchema,
+	accessLevel: redisAccessLevelSchema.optional(),
+	connection: redisConnectionSchema,
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema).max(16).optional(),
+	revokeStatements: z.array(statementSchema).max(16).optional()
+});
 const sshTargetConfigSchema = z.object({
 	provider: z.literal("ssh"),
 	executor: z.literal("in_do"),
@@ -110,6 +147,7 @@ const sshTargetConfigSchema = z.object({
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
+	redisTargetConfigSchema,
 	sshTargetConfigSchema
 ]);
 z.object({
@@ -149,6 +187,18 @@ const mintMysqlLeaseSchema = z.object({
 	ttlSeconds: ttlSecondsSchema
 });
 /**
+* Client → API: mint a Redis lease. The client generates the password and its
+* SHA-256 hex digest locally and sends only the digest — the plaintext password
+* never leaves the requesting machine.
+*/
+const mintRedisLeaseSchema = z.object({
+	provider: z.literal("redis"),
+	targetId: z.string().min(1),
+	roleName: redisUserNameSchema,
+	verifier: redisSha256VerifierSchema,
+	ttlSeconds: ttlSecondsSchema
+});
+/**
 * Client → API: mint an SSH lease. The client generates an ephemeral keypair
 * locally and sends only the public key; the signed certificate comes back in
 * the response. The private key never leaves the requesting machine.
@@ -163,6 +213,7 @@ const mintSshLeaseSchema = z.object({
 z.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
+	mintRedisLeaseSchema,
 	mintSshLeaseSchema
 ]);
 //#endregion
@@ -485,8 +536,8 @@ async function importPrivateKeyPkcs8(pkcs8) {
 * browser, the CLI, the MCP server, and Workers — so this runs everywhere the
 * SCRAM helper does, with no hand-rolled hash primitive.
 */
-const DEFAULT_PASSWORD_LENGTH$1 = 32;
-const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+const DEFAULT_PASSWORD_LENGTH$2 = 32;
+const PASSWORD_ALPHABET$2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function sha1(data) {
 	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
 }
@@ -495,12 +546,12 @@ function toUpperHex(bytes) {
 	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
 	return hex.toUpperCase();
 }
-function randomPassword$1(length) {
+function randomPassword$2(length) {
 	let out = "";
 	while (out.length < length) {
 		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
 		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
+			if (byte < 248) out += PASSWORD_ALPHABET$2[byte % 62];
 			if (out.length === length) break;
 		}
 	}
@@ -519,7 +570,7 @@ async function mysqlNativePasswordVerifier(password) {
 * — the client-side half of a Vault-style dynamic MySQL credential.
 */
 async function generateMysqlCredential(options = {}) {
-	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	const password = randomPassword$2(options.length ?? DEFAULT_PASSWORD_LENGTH$2);
 	return {
 		password,
 		verifier: await mysqlNativePasswordVerifier(password)
@@ -585,6 +636,73 @@ async function decryptPrivateKey(passphrase, blob) {
 		throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
 	}
 }
+//#endregion
+//#region ../../packages/crypto/src/redis.ts
+/**
+* Client-side construction of a Redis (6+) ACL password verifier, for minting
+* *temporary Redis login credentials* without the password plaintext ever
+* reaching seekrit's control plane OR Redis itself.
+*
+* The trick mirrors the Postgres SCRAM (scram.ts) and MySQL (mysql.ts) ones:
+* `ACL SETUSER <name> on #<hex>` stores the lowercase-hex SHA-256 of the
+* password verbatim — Redis does NOT re-hash it. So the flow is:
+*
+*   1. the machine that will connect generates a random password locally,
+*   2. computes this digest locally,
+*   3. sends only the digest to the broker → `ACL SETUSER … on #<digest>`,
+*   4. connects directly to Redis with the plaintext it never shared.
+*
+* Zero-knowledge at both layers: the control plane relays only the digest, and
+* the digest is NOT sufficient to authenticate. Redis `AUTH <user> <password>`
+* hashes the *plaintext* it receives with SHA-256 and compares it to the stored
+* digest — verifying a client needs the password, not the digest, and SHA-256
+* is preimage-resistant for a high-entropy machine-generated password. A dump of
+* the ACL rules (`ACL GETUSER`, `CONFIG REWRITE`'d aclfile) therefore cannot log
+* in.
+*
+* SHA-256 is available via WebCrypto (`crypto.subtle.digest`) in the browser,
+* the CLI, the MCP server, and Workers — so this runs everywhere the SCRAM
+* helper does, with no hand-rolled hash primitive.
+*/
+const DEFAULT_PASSWORD_LENGTH$1 = 32;
+const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function sha256$1(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+}
+function toLowerHex(bytes) {
+	let hex = "";
+	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+	return hex;
+}
+function randomPassword$1(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+/**
+* Compute the Redis ACL password verifier `LOWER(HEX(SHA256(password)))` for a
+* known password. Pass the result straight to `ACL SETUSER … on #<verifier>`.
+*/
+async function redisSha256Verifier(password) {
+	return toLowerHex(await sha256$1(utf8Encode(password)));
+}
+/**
+* Mint a fresh random password and its SHA-256 hex digest in one step — the
+* client-side half of a Vault-style dynamic Redis credential.
+*/
+async function generateRedisCredential(options = {}) {
+	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	return {
+		password,
+		verifier: await redisSha256Verifier(password)
+	};
+}
 const SALT_LENGTH = 16;
 const DEFAULT_PASSWORD_LENGTH = 32;
 const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
@@ -903,7 +1021,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.12.0";
+var version = "0.13.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -1444,7 +1562,7 @@ async function resolveGroup(ctx, opts) {
 * control plane only ever stores ciphertext.
 */
 /** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds$2(input) {
+function parseTtlSeconds$3(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
 	return Number(m[1]) * ({
@@ -1455,7 +1573,7 @@ function parseTtlSeconds$2(input) {
 	}[m[2] || "s"] ?? 1);
 }
 /** A fresh, valid MySQL user name: `tmp_` + lowercase alphanumerics. */
-function generateUserName(prefix = "tmp") {
+function generateUserName$1(prefix = "tmp") {
 	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
 	let out = "";
 	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
@@ -1465,7 +1583,7 @@ function generateUserName(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1530,8 +1648,8 @@ function registerMysqlCommands(program) {
 		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
 		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
 		if (target.provider !== "mysql") fail(`target "${targetRef}" is not a MySQL target`);
-		const userName = options.user ?? generateUserName();
-		const ttlSeconds = parseTtlSeconds$2(options.ttl);
+		const userName = options.user ?? generateUserName$1();
+		const ttlSeconds = parseTtlSeconds$3(options.ttl);
 		const { password, verifier } = await generateMysqlCredential();
 		const { connection } = await ctx.client.mintLease(org.id, {
 			provider: "mysql",
@@ -1566,7 +1684,7 @@ function registerMysqlCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$2(value, acc) {
+function collect$3(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -1582,7 +1700,7 @@ function collect$2(value, acc) {
 * ciphertext.
 */
 /** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds$1(input) {
+function parseTtlSeconds$2(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
 	return Number(m[1]) * ({
@@ -1603,7 +1721,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$1, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$1, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1685,7 +1803,7 @@ function registerPgCommands(program) {
 		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
 		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
 		const roleName = options.role ?? generateRoleName();
-		const ttlSeconds = parseTtlSeconds$1(options.ttl);
+		const ttlSeconds = parseTtlSeconds$2(options.ttl);
 		const { password, verifier } = await generatePostgresCredential();
 		const { connection } = await ctx.client.mintLease(org.id, {
 			provider: "postgres",
@@ -1717,6 +1835,145 @@ function registerPgCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
+function collect$2(value, acc) {
+	acc.push(value);
+	return acc;
+}
+//#endregion
+//#region src/redis.ts
+/**
+* `seekrit redis` — temporary Redis (6+) credentials (Vault-style dynamic
+* secrets).
+*
+* Zero-knowledge: minting generates the password and its SHA-256 digest on THIS
+* machine and sends only the digest; the plaintext password never reaches the
+* API or gets stored. Registering a target wraps the admin connection string to
+* the broker's public key locally, so the control plane only ever stores
+* ciphertext.
+*/
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds$1(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid Redis ACL user name: `tmp_` + lowercase alphanumerics. */
+function generateUserName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerRedisCommands(program) {
+	const redis = program.command("redis").description("temporary Redis credentials (short-lived, zero-knowledge)");
+	const target = redis.command("target").description("manage provisioning targets");
+	target.command("add").description("register a Redis server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-cache").option("--org <slug>").requiredOption("--host <host>", "redis host").option("--port <port>", "redis port", "6379").option("--db <index>", "logical database index (the /<n> in the URL)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin redis:// (or rediss://) connection string (or set SEEKRIT_REDIS_ADMIN_URL); wrapped locally").option("--create-statement <cmd>", "custom SETUSER template (repeatable)", collect$1, []).option("--revoke-statement <cmd>", "custom DELUSER template (repeatable)", collect$1, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_REDIS_ADMIN_URL"
+		});
+		const config = {
+			provider: "redis",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				...options.db !== void 0 ? { db: Number.parseInt(options.db, 10) } : {}
+			},
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : {},
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			if (t.provider !== "redis") continue;
+			const cfg = t.config;
+			const db = cfg.connection.db ?? 0;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${db}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	redis.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "ACL user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.provider !== "redis") fail(`target "${targetRef}" is not a Redis target`);
+		const userName = options.user ?? generateUserName();
+		const ttlSeconds = parseTtlSeconds$1(options.ttl);
+		const { password, verifier } = await generateRedisCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "redis",
+			targetId: target.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds
+		});
+		const url = `redis://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${userName} on ${connection.host}:${connection.port} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	redis.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "redis") continue;
+			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+		}
+	});
+	redis.command("revoke <leaseId>").description("revoke a lease now (deletes the ACL user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
 function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
@@ -2336,6 +2593,7 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 });
 registerPgCommands(program);
 registerMysqlCommands(program);
+registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerSshCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -24,8 +24,8 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/core": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",