@seekrit/cli 0.12.0 → 0.14.0

package/dist/index.js

@@ -10,7 +10,9 @@ import { Writable } from "node:stream";
 z.enum([
 	"postgres",
 	"mysql",
-	"ssh"
+	"ssh",
+	"redis",
+	"aws"
 ]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
@@ -49,6 +51,51 @@ const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3
 * alphabet contains no single quote, so it is safe in a quoted SQL literal.
 */
 const mysqlNativeVerifierSchema = z.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
+/**
+* A Redis ACL user name we are willing to create. Interpolated into a Redis
+* command line as a bare token (`ACL SETUSER <name> …`), so it is kept strict —
+* plain alphanumerics/underscore, no whitespace to split the arg or ACL rule
+* characters (`~ + @ # & %`) that could be read as a permission.
+*/
+const redisUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+/**
+* A Redis password verifier — the lowercase-hex SHA-256 of the password, as
+* produced by @seekrit/crypto `redisSha256Verifier`. `ACL SETUSER … on #<hex>`
+* stores this digest verbatim, and it cannot authenticate: Redis `AUTH` hashes
+* the *plaintext* it receives with SHA-256 and compares, so the stored digest
+* is preimage-resistant (the password is high-entropy and machine-generated).
+* The alphabet is bare hex, so it is a safe bare command token.
+*/
+const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase-hex SHA-256 digest (64 chars)");
+/**
+* An IAM role ARN the broker is allowed to assume. Bounded and structurally
+* validated: `arn:<partition>:iam::<account>:role/<path-and-name>`. Partition
+* covers commercial (`aws`), GovCloud (`aws-us-gov`), and China (`aws-cn`).
+*/
+const awsRoleArnSchema = z.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
+/** An AWS region id, e.g. `us-east-1`, `eu-west-2`, `us-gov-west-1`. */
+const awsRegionSchema = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
+/**
+* An STS external id — the shared string a role's trust policy can require so a
+* confused-deputy can't assume it. AWS allows a broad charset; we keep to the
+* documented safe set and bound the length.
+*/
+const awsExternalIdSchema = z.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
+z.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
+/**
+* The consumer's ephemeral P-256 public key (JWK-serialized) that a tier-2
+* credential is wrapped to before it is returned. Validated structurally here;
+* the executor imports it defensively before wrapping. Bounded so a giant blob
+* can't be pushed through the control plane.
+*/
+const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
+	try {
+		const jwk = JSON.parse(s);
+		return jwk.kty === "EC" && jwk.crv === "P-256" && !!jwk.x && !!jwk.y;
+	} catch {
+		return false;
+	}
+}, "must be a JWK-serialized P-256 public key");
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -64,6 +111,11 @@ const mysqlAccessLevelSchema = z.enum([
 	"readwrite",
 	"custom"
 ]);
+const redisAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
 const connectionSchema = z.object({
 	host: z.string().min(1),
 	port: z.number().int().min(1).max(65535),
@@ -95,6 +147,21 @@ const mysqlTargetConfigSchema = z.object({
 	createStatements: z.array(statementSchema).max(16).optional(),
 	revokeStatements: z.array(statementSchema).max(16).optional()
 });
+const redisConnectionSchema = z.object({
+	host: z.string().min(1),
+	port: z.number().int().min(1).max(65535),
+	/** Redis logical database index (the `/<n>` in a connection URL). */
+	db: z.number().int().min(0).max(15).optional()
+});
+const redisTargetConfigSchema = z.object({
+	provider: z.literal("redis"),
+	executor: executorModeSchema,
+	accessLevel: redisAccessLevelSchema.optional(),
+	connection: redisConnectionSchema,
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema).max(16).optional(),
+	revokeStatements: z.array(statementSchema).max(16).optional()
+});
 const sshTargetConfigSchema = z.object({
 	provider: z.literal("ssh"),
 	executor: z.literal("in_do"),
@@ -107,10 +174,22 @@ const sshTargetConfigSchema = z.object({
 		user: sshPrincipalSchema.optional()
 	}).optional()
 });
+const AWS_MAX_TTL_SECONDS = 3600 * 12;
+const awsTargetConfigSchema = z.object({
+	provider: z.literal("aws"),
+	executor: z.literal("in_do"),
+	roleArn: awsRoleArnSchema,
+	region: awsRegionSchema,
+	externalId: awsExternalIdSchema.optional(),
+	sessionPolicy: z.string().min(1).max(4e3).optional(),
+	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
+});
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
-	sshTargetConfigSchema
+	redisTargetConfigSchema,
+	sshTargetConfigSchema,
+	awsTargetConfigSchema
 ]);
 z.object({
 	name: z.string().trim().min(1).max(128),
@@ -149,6 +228,18 @@ const mintMysqlLeaseSchema = z.object({
 	ttlSeconds: ttlSecondsSchema
 });
 /**
+* Client → API: mint a Redis lease. The client generates the password and its
+* SHA-256 hex digest locally and sends only the digest — the plaintext password
+* never leaves the requesting machine.
+*/
+const mintRedisLeaseSchema = z.object({
+	provider: z.literal("redis"),
+	targetId: z.string().min(1),
+	roleName: redisUserNameSchema,
+	verifier: redisSha256VerifierSchema,
+	ttlSeconds: ttlSecondsSchema
+});
+/**
 * Client → API: mint an SSH lease. The client generates an ephemeral keypair
 * locally and sends only the public key; the signed certificate comes back in
 * the response. The private key never leaves the requesting machine.
@@ -160,12 +251,57 @@ const mintSshLeaseSchema = z.object({
 	principals: z.array(sshPrincipalSchema).min(1).max(32),
 	ttlSeconds: ttlSecondsSchema
 });
+/**
+* Client → API: mint an AWS lease. The client generates an ephemeral P-256
+* keypair locally and sends only the public key; STS mints the credential and
+* the broker returns it wrapped to that key. The private key never leaves the
+* requesting machine, so the plaintext credential is only decryptable there.
+*
+* TTL bounds are STS's own `DurationSeconds` limits (15 min – 12 h), not the
+* generic lease bounds — STS rejects anything below 900 seconds.
+*/
+const mintAwsLeaseSchema = z.object({
+	provider: z.literal("aws"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
+});
 z.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
-	mintSshLeaseSchema
+	mintRedisLeaseSchema,
+	mintSshLeaseSchema,
+	mintAwsLeaseSchema
 ]);
 //#endregion
+//#region ../../packages/core/src/providers/aws.ts
+/**
+* The one-time IAM setup an admin performs so seekrit can assume the target
+* role. Analogue of `sshHostSetupInstructions` / `postgresGroupBootstrapSql` —
+* printed for the admin to apply, never executed by seekrit. Shows the trust
+* policy the role needs so the broker's base IAM principal may assume it.
+*/
+function awsTrustPolicyInstructions(config) {
+	return [
+		"# Attach a trust policy to the target role so the IAM principal whose",
+		"# access key you registered as the admin secret may assume it. Replace",
+		"# <ADMIN_PRINCIPAL_ARN> with that principal (user or role) ARN.",
+		"{",
+		"  \"Version\": \"2012-10-17\",",
+		"  \"Statement\": [",
+		"    {",
+		"      \"Effect\": \"Allow\",",
+		"      \"Principal\": { \"AWS\": \"<ADMIN_PRINCIPAL_ARN>\" },",
+		`      "Action": "sts:AssumeRole"${config.externalId ? `,\n      "Condition": { "StringEquals": { "sts:ExternalId": "${config.externalId}" } }` : ""}`,
+		"    }",
+		"  ]",
+		"}",
+		"",
+		"# The admin principal also needs an identity policy allowing sts:AssumeRole",
+		`# on ${config.roleArn}. seekrit only ever calls AssumeRole on this role.`
+	].join("\n");
+}
+//#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
@@ -457,6 +593,103 @@ async function importPrivateKeyPkcs8(pkcs8) {
 	}, true, ["deriveBits"]);
 }
 //#endregion
+//#region ../../packages/crypto/src/wrap.ts
+/**
+* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
+* the recipient's public key; the shared secret is run through HKDF-SHA256 to
+* derive a one-time AES-256-GCM wrapping key. Only the holder of the
+* recipient private key can unwrap.
+*
+* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
+*/
+const WRAP_PREFIX = "wd1";
+const HKDF_INFO = "seekrit/wrap-dek/v1";
+async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
+	const ecdh = {
+		name: "ECDH",
+		public: peerPublicKey
+	};
+	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
+	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt,
+		info: utf8Encode(HKDF_INFO)
+	}, hkdfKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
+}
+/** Wrap an environment DEK to a principal's public key. */
+async function wrapDek(dek, recipientPublicKeyJwk) {
+	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
+	const ephemeral = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, wrappingKey, dek);
+	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	return [
+		WRAP_PREFIX,
+		toBase64Url(ephemeralRaw),
+		toBase64Url(salt),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
+}
+/** Unwrap an environment DEK with the principal's private ECDH key. */
+async function unwrapDek(wrapped, privateKey) {
+	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
+	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, false, []), fromBase64Url(saltB64), "decrypt");
+	try {
+		const dek = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64)
+		}, wrappingKey, fromBase64Url(ctB64));
+		return new Uint8Array(dek);
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
+	}
+}
+//#endregion
+//#region ../../packages/crypto/src/aws.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one AWS lease. */
+async function generateAwsRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by an AWS lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext STS credential.
+*/
+async function unwrapAwsCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped AWS credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.accessKeyId !== "string" || typeof c.secretAccessKey !== "string" || typeof c.sessionToken !== "string" || typeof c.expiration !== "string" || typeof c.region !== "string") throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped AWS credential is missing fields");
+	return {
+		accessKeyId: c.accessKeyId,
+		secretAccessKey: c.secretAccessKey,
+		sessionToken: c.sessionToken,
+		expiration: c.expiration,
+		region: c.region
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -485,8 +718,8 @@ async function importPrivateKeyPkcs8(pkcs8) {
 * browser, the CLI, the MCP server, and Workers — so this runs everywhere the
 * SCRAM helper does, with no hand-rolled hash primitive.
 */
-const DEFAULT_PASSWORD_LENGTH$1 = 32;
-const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+const DEFAULT_PASSWORD_LENGTH$2 = 32;
+const PASSWORD_ALPHABET$2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function sha1(data) {
 	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
 }
@@ -495,12 +728,12 @@ function toUpperHex(bytes) {
 	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
 	return hex.toUpperCase();
 }
-function randomPassword$1(length) {
+function randomPassword$2(length) {
 	let out = "";
 	while (out.length < length) {
 		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
 		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
+			if (byte < 248) out += PASSWORD_ALPHABET$2[byte % 62];
 			if (out.length === length) break;
 		}
 	}
@@ -519,7 +752,7 @@ async function mysqlNativePasswordVerifier(password) {
 * — the client-side half of a Vault-style dynamic MySQL credential.
 */
 async function generateMysqlCredential(options = {}) {
-	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	const password = randomPassword$2(options.length ?? DEFAULT_PASSWORD_LENGTH$2);
 	return {
 		password,
 		verifier: await mysqlNativePasswordVerifier(password)
@@ -585,6 +818,73 @@ async function decryptPrivateKey(passphrase, blob) {
 		throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
 	}
 }
+//#endregion
+//#region ../../packages/crypto/src/redis.ts
+/**
+* Client-side construction of a Redis (6+) ACL password verifier, for minting
+* *temporary Redis login credentials* without the password plaintext ever
+* reaching seekrit's control plane OR Redis itself.
+*
+* The trick mirrors the Postgres SCRAM (scram.ts) and MySQL (mysql.ts) ones:
+* `ACL SETUSER <name> on #<hex>` stores the lowercase-hex SHA-256 of the
+* password verbatim — Redis does NOT re-hash it. So the flow is:
+*
+*   1. the machine that will connect generates a random password locally,
+*   2. computes this digest locally,
+*   3. sends only the digest to the broker → `ACL SETUSER … on #<digest>`,
+*   4. connects directly to Redis with the plaintext it never shared.
+*
+* Zero-knowledge at both layers: the control plane relays only the digest, and
+* the digest is NOT sufficient to authenticate. Redis `AUTH <user> <password>`
+* hashes the *plaintext* it receives with SHA-256 and compares it to the stored
+* digest — verifying a client needs the password, not the digest, and SHA-256
+* is preimage-resistant for a high-entropy machine-generated password. A dump of
+* the ACL rules (`ACL GETUSER`, `CONFIG REWRITE`'d aclfile) therefore cannot log
+* in.
+*
+* SHA-256 is available via WebCrypto (`crypto.subtle.digest`) in the browser,
+* the CLI, the MCP server, and Workers — so this runs everywhere the SCRAM
+* helper does, with no hand-rolled hash primitive.
+*/
+const DEFAULT_PASSWORD_LENGTH$1 = 32;
+const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function sha256$1(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+}
+function toLowerHex(bytes) {
+	let hex = "";
+	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+	return hex;
+}
+function randomPassword$1(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+/**
+* Compute the Redis ACL password verifier `LOWER(HEX(SHA256(password)))` for a
+* known password. Pass the result straight to `ACL SETUSER … on #<verifier>`.
+*/
+async function redisSha256Verifier(password) {
+	return toLowerHex(await sha256$1(utf8Encode(password)));
+}
+/**
+* Mint a fresh random password and its SHA-256 hex digest in one step — the
+* client-side half of a Vault-style dynamic Redis credential.
+*/
+async function generateRedisCredential(options = {}) {
+	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	return {
+		password,
+		verifier: await redisSha256Verifier(password)
+	};
+}
 const SALT_LENGTH = 16;
 const DEFAULT_PASSWORD_LENGTH = 32;
 const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
@@ -833,111 +1133,8 @@ function isServiceToken(value) {
 	return value.startsWith(`${TOKEN_PREFIX}_`);
 }
 //#endregion
-//#region ../../packages/crypto/src/wrap.ts
-/**
-* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
-* the recipient's public key; the shared secret is run through HKDF-SHA256 to
-* derive a one-time AES-256-GCM wrapping key. Only the holder of the
-* recipient private key can unwrap.
-*
-* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
-*/
-const WRAP_PREFIX = "wd1";
-const HKDF_INFO = "seekrit/wrap-dek/v1";
-async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
-	const ecdh = {
-		name: "ECDH",
-		public: peerPublicKey
-	};
-	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
-	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt,
-		info: utf8Encode(HKDF_INFO)
-	}, hkdfKey, {
-		name: "AES-GCM",
-		length: 256
-	}, false, [usage]);
-}
-/** Wrap an environment DEK to a principal's public key. */
-async function wrapDek(dek, recipientPublicKeyJwk) {
-	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
-	const ephemeral = await crypto.subtle.generateKey({
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, true, ["deriveBits"]);
-	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
-	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
-	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	const ciphertext = await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, wrappingKey, dek);
-	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
-	return [
-		WRAP_PREFIX,
-		toBase64Url(ephemeralRaw),
-		toBase64Url(salt),
-		toBase64Url(iv),
-		toBase64Url(new Uint8Array(ciphertext))
-	].join(".");
-}
-/** Unwrap an environment DEK with the principal's private ECDH key. */
-async function unwrapDek(wrapped, privateKey) {
-	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
-	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, false, []), fromBase64Url(saltB64), "decrypt");
-	try {
-		const dek = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: fromBase64Url(ivB64)
-		}, wrappingKey, fromBase64Url(ctB64));
-		return new Uint8Array(dek);
-	} catch {
-		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
-	}
-}
-//#endregion
 //#region package.json
-var version = "0.12.0";
-const PROJECT_FILE = "seekrit.json";
-function globalConfigPath() {
-	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
-}
-function readGlobalConfig() {
-	const path = globalConfigPath();
-	if (!existsSync(path)) return {};
-	return JSON.parse(readFileSync(path, "utf8"));
-}
-function writeGlobalConfig(update) {
-	const path = globalConfigPath();
-	const merged = {
-		...readGlobalConfig(),
-		...update
-	};
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
-}
-/** Walk up from cwd looking for seekrit.json. */
-function findProjectConfig(startDir = process.cwd()) {
-	let dir = startDir;
-	const { root } = parse(dir);
-	while (true) {
-		const candidate = join(dir, PROJECT_FILE);
-		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
-		if (dir === root) return null;
-		dir = dirname(dir);
-	}
-}
-function writeProjectConfig(config, dir = process.cwd()) {
-	const path = join(dir, PROJECT_FILE);
-	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
-	return path;
-}
+var version = "0.14.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1145,6 +1342,40 @@ var SeekritClient = class {
 		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
 	}
 };
+const PROJECT_FILE = "seekrit.json";
+function globalConfigPath() {
+	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
+}
+function readGlobalConfig() {
+	const path = globalConfigPath();
+	if (!existsSync(path)) return {};
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+function writeGlobalConfig(update) {
+	const path = globalConfigPath();
+	const merged = {
+		...readGlobalConfig(),
+		...update
+	};
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+}
+/** Walk up from cwd looking for seekrit.json. */
+function findProjectConfig(startDir = process.cwd()) {
+	let dir = startDir;
+	const { root } = parse(dir);
+	while (true) {
+		const candidate = join(dir, PROJECT_FILE);
+		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
+		if (dir === root) return null;
+		dir = dirname(dir);
+	}
+}
+function writeProjectConfig(config, dir = process.cwd()) {
+	const path = join(dir, PROJECT_FILE);
+	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
+	return path;
+}
 //#endregion
 //#region src/io.ts
 let failThrows = false;
@@ -1250,6 +1481,235 @@ async function getDek(ctx, orgId, envId) {
 	return unwrapDek(wrappedDek, privateKey);
 }
 //#endregion
+//#region src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
+/**
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
+*/
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
+//#endregion
+//#region src/aws.ts
+/**
+* `seekrit aws` — temporary AWS credentials via STS AssumeRole (Vault-style
+* dynamic secrets, the tier-2 sibling of `seekrit pg`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; STS mints the
+* credential and the broker returns it wrapped to that key, so the control plane
+* only ever relays ciphertext and only this machine can unwrap it. Registering a
+* target wraps the base IAM credential to the broker's public key locally, so
+* the control plane never sees it either — its only needed permission is
+* `sts:AssumeRole` on the target role.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$4(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/**
+* The base IAM credential the broker assumes the role with. From flags or the
+* standard AWS env vars; JSON-serialized so the executor can parse it. Never the
+* plaintext leaves this machine unwrapped — it is wrapped to the broker key.
+*/
+function resolveBaseCredential(opts) {
+	const accessKeyId = opts.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = opts.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY;
+	const sessionToken = process.env.AWS_SESSION_TOKEN;
+	if (!accessKeyId || !secretAccessKey) fail("provide the base IAM credential via --access-key-id/--secret-access-key or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (it needs only sts:AssumeRole on the role)");
+	return JSON.stringify({
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	});
+}
+function registerAwsCommands(program) {
+	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
+	const target = aws.command("target").description("manage AWS role targets");
+	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
+		const config = {
+			provider: "aws",
+			executor: "in_do",
+			roleArn: options.roleArn,
+			region: options.region,
+			...options.externalId ? { externalId: options.externalId } : {},
+			...sessionPolicy ? { sessionPolicy } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$4(options.maxTtl) } : {}
+		};
+		const baseCredential = resolveBaseCredential(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(baseCredential), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered AWS target ${created.name} (${created.id})`);
+		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
+		console.log(awsTrustPolicyInstructions(config));
+	});
+	target.command("list").description("list AWS role targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "aws") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
+		}
+	});
+	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
+		console.log(awsTrustPolicyInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
+		const ttlSeconds = parseTtlSeconds$4(options.ttl);
+		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
+		const recipient = await generateAwsRecipientKeyPair();
+		const { aws: leased } = await ctx.client.mintLease(org.id, {
+			provider: "aws",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapAwsCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cfg.roleArn} in ${cred.region} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify({
+			...cred,
+			roleArn: cfg.roleArn
+		}, null, 2));
+		else {
+			console.log(`export AWS_ACCESS_KEY_ID=${cred.accessKeyId}`);
+			console.log(`export AWS_SECRET_ACCESS_KEY=${cred.secretAccessKey}`);
+			console.log(`export AWS_SESSION_TOKEN=${cred.sessionToken}`);
+			console.log(`export AWS_REGION=${cred.region}`);
+		}
+	});
+	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "aws") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
+	});
+}
+//#endregion
 //#region src/dotenv.ts
 /**
 * Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
@@ -1344,94 +1804,6 @@ function resolveLeaseAdminSecret(opts) {
 	return adminUrl;
 }
 //#endregion
-//#region src/target.ts
-/** Resolve the target org from a flag, the committed config, or a lone org. */
-async function resolveOrg(ctx, orgSlug) {
-	const wanted = orgSlug ?? findProjectConfig()?.org;
-	const { orgs } = await ctx.client.listOrgs();
-	if (wanted) {
-		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
-		if (!org) fail(`no accessible org "${wanted}"`);
-		return {
-			id: org.id,
-			slug: org.slug
-		};
-	}
-	const only = orgs[0];
-	if (orgs.length === 1 && only) return {
-		id: only.id,
-		slug: only.slug
-	};
-	fail("specify --org (or run `seekrit init`)");
-}
-/**
-* Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
-*/
-async function resolveEnvTarget(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.env) fail("specify --env");
-	if (opts.group) {
-		const { groups } = await ctx.client.listGroups(org.id);
-		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
-		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
-		return {
-			orgId: org.id,
-			envId: env.id,
-			label: `${group.slug}@${env.slug}`
-		};
-	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		envId: env.id,
-		label: `${app.slug}/${env.slug}`
-	};
-}
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		appId: app.id,
-		appSlug: app.slug,
-		envId: env.id,
-		envSlug: env.slug
-	};
-}
-/** Resolve a group by slug within the target org. */
-async function resolveGroup(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.group) fail("specify --group");
-	const { groups } = await ctx.client.listGroups(org.id);
-	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-	return {
-		orgId: org.id,
-		id: group.id,
-		slug: group.slug
-	};
-}
-//#endregion
 //#region src/mysql.ts
 /**
 * `seekrit mysql` — temporary MySQL/MariaDB credentials (Vault-style dynamic
@@ -1444,7 +1816,7 @@ async function resolveGroup(ctx, opts) {
 * control plane only ever stores ciphertext.
 */
 /** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds$2(input) {
+function parseTtlSeconds$3(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
 	return Number(m[1]) * ({
@@ -1455,7 +1827,7 @@ function parseTtlSeconds$2(input) {
 	}[m[2] || "s"] ?? 1);
 }
 /** A fresh, valid MySQL user name: `tmp_` + lowercase alphanumerics. */
-function generateUserName(prefix = "tmp") {
+function generateUserName$1(prefix = "tmp") {
 	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
 	let out = "";
 	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
@@ -1465,7 +1837,7 @@ function generateUserName(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1530,8 +1902,8 @@ function registerMysqlCommands(program) {
 		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
 		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
 		if (target.provider !== "mysql") fail(`target "${targetRef}" is not a MySQL target`);
-		const userName = options.user ?? generateUserName();
-		const ttlSeconds = parseTtlSeconds$2(options.ttl);
+		const userName = options.user ?? generateUserName$1();
+		const ttlSeconds = parseTtlSeconds$3(options.ttl);
 		const { password, verifier } = await generateMysqlCredential();
 		const { connection } = await ctx.client.mintLease(org.id, {
 			provider: "mysql",
@@ -1566,7 +1938,7 @@ function registerMysqlCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$2(value, acc) {
+function collect$3(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -1582,7 +1954,7 @@ function collect$2(value, acc) {
 * ciphertext.
 */
 /** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds$1(input) {
+function parseTtlSeconds$2(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
 	return Number(m[1]) * ({
@@ -1603,7 +1975,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$1, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$1, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1685,7 +2057,7 @@ function registerPgCommands(program) {
 		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
 		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
 		const roleName = options.role ?? generateRoleName();
-		const ttlSeconds = parseTtlSeconds$1(options.ttl);
+		const ttlSeconds = parseTtlSeconds$2(options.ttl);
 		const { password, verifier } = await generatePostgresCredential();
 		const { connection } = await ctx.client.mintLease(org.id, {
 			provider: "postgres",
@@ -1717,6 +2089,145 @@ function registerPgCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
+function collect$2(value, acc) {
+	acc.push(value);
+	return acc;
+}
+//#endregion
+//#region src/redis.ts
+/**
+* `seekrit redis` — temporary Redis (6+) credentials (Vault-style dynamic
+* secrets).
+*
+* Zero-knowledge: minting generates the password and its SHA-256 digest on THIS
+* machine and sends only the digest; the plaintext password never reaches the
+* API or gets stored. Registering a target wraps the admin connection string to
+* the broker's public key locally, so the control plane only ever stores
+* ciphertext.
+*/
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds$1(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid Redis ACL user name: `tmp_` + lowercase alphanumerics. */
+function generateUserName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerRedisCommands(program) {
+	const redis = program.command("redis").description("temporary Redis credentials (short-lived, zero-knowledge)");
+	const target = redis.command("target").description("manage provisioning targets");
+	target.command("add").description("register a Redis server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-cache").option("--org <slug>").requiredOption("--host <host>", "redis host").option("--port <port>", "redis port", "6379").option("--db <index>", "logical database index (the /<n> in the URL)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin redis:// (or rediss://) connection string (or set SEEKRIT_REDIS_ADMIN_URL); wrapped locally").option("--create-statement <cmd>", "custom SETUSER template (repeatable)", collect$1, []).option("--revoke-statement <cmd>", "custom DELUSER template (repeatable)", collect$1, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_REDIS_ADMIN_URL"
+		});
+		const config = {
+			provider: "redis",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				...options.db !== void 0 ? { db: Number.parseInt(options.db, 10) } : {}
+			},
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : {},
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			if (t.provider !== "redis") continue;
+			const cfg = t.config;
+			const db = cfg.connection.db ?? 0;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${db}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	redis.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "ACL user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.provider !== "redis") fail(`target "${targetRef}" is not a Redis target`);
+		const userName = options.user ?? generateUserName();
+		const ttlSeconds = parseTtlSeconds$1(options.ttl);
+		const { password, verifier } = await generateRedisCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "redis",
+			targetId: target.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds
+		});
+		const url = `redis://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${userName} on ${connection.host}:${connection.port} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	redis.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "redis") continue;
+			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+		}
+	});
+	redis.command("revoke <leaseId>").description("revoke a lease now (deletes the ACL user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
 function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
@@ -2336,10 +2847,12 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 });
 registerPgCommands(program);
 registerMysqlCommands(program);
+registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerSshCommands(program);
+registerAwsCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-BEcV_KpM.js");
+	const { runMcpServer } = await import("./mcp-ARBuneH3.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -2353,4 +2866,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { parseServiceToken as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveAppEnv as i, isTokenAuth as l, wrapDek as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generatePostgresCredential as v, generateMysqlCredential as y };
+export { generatePostgresCredential as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, parseServiceToken as g, isServiceToken as h, resolveAppEnv as i, isTokenAuth as l, createServiceToken as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generateMysqlCredential as v, wrapDek as y };

package/dist/{mcp-BEcV_KpM.js → mcp-ARBuneH3.js}

@@ -1,4 +1,4 @@
-import { _ as parseServiceToken, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateMysqlCredential } from "./index.js";
+import { _ as generatePostgresCredential, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as parseServiceToken, h as isServiceToken, i as resolveAppEnv, l as isTokenAuth, m as createServiceToken, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generateMysqlCredential, y as wrapDek } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -24,8 +24,8 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/core": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",