@seekrit/cli 0.13.0 → 0.14.0

package/dist/index.js

@@ -11,7 +11,8 @@ z.enum([
 	"postgres",
 	"mysql",
 	"ssh",
-	"redis"
+	"redis",
+	"aws"
 ]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
@@ -66,6 +67,35 @@ const redisUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3
 * The alphabet is bare hex, so it is a safe bare command token.
 */
 const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase-hex SHA-256 digest (64 chars)");
+/**
+* An IAM role ARN the broker is allowed to assume. Bounded and structurally
+* validated: `arn:<partition>:iam::<account>:role/<path-and-name>`. Partition
+* covers commercial (`aws`), GovCloud (`aws-us-gov`), and China (`aws-cn`).
+*/
+const awsRoleArnSchema = z.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
+/** An AWS region id, e.g. `us-east-1`, `eu-west-2`, `us-gov-west-1`. */
+const awsRegionSchema = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
+/**
+* An STS external id — the shared string a role's trust policy can require so a
+* confused-deputy can't assume it. AWS allows a broad charset; we keep to the
+* documented safe set and bound the length.
+*/
+const awsExternalIdSchema = z.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
+z.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
+/**
+* The consumer's ephemeral P-256 public key (JWK-serialized) that a tier-2
+* credential is wrapped to before it is returned. Validated structurally here;
+* the executor imports it defensively before wrapping. Bounded so a giant blob
+* can't be pushed through the control plane.
+*/
+const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
+	try {
+		const jwk = JSON.parse(s);
+		return jwk.kty === "EC" && jwk.crv === "P-256" && !!jwk.x && !!jwk.y;
+	} catch {
+		return false;
+	}
+}, "must be a JWK-serialized P-256 public key");
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -144,11 +174,22 @@ const sshTargetConfigSchema = z.object({
 		user: sshPrincipalSchema.optional()
 	}).optional()
 });
+const AWS_MAX_TTL_SECONDS = 3600 * 12;
+const awsTargetConfigSchema = z.object({
+	provider: z.literal("aws"),
+	executor: z.literal("in_do"),
+	roleArn: awsRoleArnSchema,
+	region: awsRegionSchema,
+	externalId: awsExternalIdSchema.optional(),
+	sessionPolicy: z.string().min(1).max(4e3).optional(),
+	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
+});
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
 	redisTargetConfigSchema,
-	sshTargetConfigSchema
+	sshTargetConfigSchema,
+	awsTargetConfigSchema
 ]);
 z.object({
 	name: z.string().trim().min(1).max(128),
@@ -210,13 +251,57 @@ const mintSshLeaseSchema = z.object({
 	principals: z.array(sshPrincipalSchema).min(1).max(32),
 	ttlSeconds: ttlSecondsSchema
 });
+/**
+* Client → API: mint an AWS lease. The client generates an ephemeral P-256
+* keypair locally and sends only the public key; STS mints the credential and
+* the broker returns it wrapped to that key. The private key never leaves the
+* requesting machine, so the plaintext credential is only decryptable there.
+*
+* TTL bounds are STS's own `DurationSeconds` limits (15 min – 12 h), not the
+* generic lease bounds — STS rejects anything below 900 seconds.
+*/
+const mintAwsLeaseSchema = z.object({
+	provider: z.literal("aws"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
+});
 z.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
 	mintRedisLeaseSchema,
-	mintSshLeaseSchema
+	mintSshLeaseSchema,
+	mintAwsLeaseSchema
 ]);
 //#endregion
+//#region ../../packages/core/src/providers/aws.ts
+/**
+* The one-time IAM setup an admin performs so seekrit can assume the target
+* role. Analogue of `sshHostSetupInstructions` / `postgresGroupBootstrapSql` —
+* printed for the admin to apply, never executed by seekrit. Shows the trust
+* policy the role needs so the broker's base IAM principal may assume it.
+*/
+function awsTrustPolicyInstructions(config) {
+	return [
+		"# Attach a trust policy to the target role so the IAM principal whose",
+		"# access key you registered as the admin secret may assume it. Replace",
+		"# <ADMIN_PRINCIPAL_ARN> with that principal (user or role) ARN.",
+		"{",
+		"  \"Version\": \"2012-10-17\",",
+		"  \"Statement\": [",
+		"    {",
+		"      \"Effect\": \"Allow\",",
+		"      \"Principal\": { \"AWS\": \"<ADMIN_PRINCIPAL_ARN>\" },",
+		`      "Action": "sts:AssumeRole"${config.externalId ? `,\n      "Condition": { "StringEquals": { "sts:ExternalId": "${config.externalId}" } }` : ""}`,
+		"    }",
+		"  ]",
+		"}",
+		"",
+		"# The admin principal also needs an identity policy allowing sts:AssumeRole",
+		`# on ${config.roleArn}. seekrit only ever calls AssumeRole on this role.`
+	].join("\n");
+}
+//#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
@@ -508,6 +593,103 @@ async function importPrivateKeyPkcs8(pkcs8) {
 	}, true, ["deriveBits"]);
 }
 //#endregion
+//#region ../../packages/crypto/src/wrap.ts
+/**
+* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
+* the recipient's public key; the shared secret is run through HKDF-SHA256 to
+* derive a one-time AES-256-GCM wrapping key. Only the holder of the
+* recipient private key can unwrap.
+*
+* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
+*/
+const WRAP_PREFIX = "wd1";
+const HKDF_INFO = "seekrit/wrap-dek/v1";
+async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
+	const ecdh = {
+		name: "ECDH",
+		public: peerPublicKey
+	};
+	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
+	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt,
+		info: utf8Encode(HKDF_INFO)
+	}, hkdfKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
+}
+/** Wrap an environment DEK to a principal's public key. */
+async function wrapDek(dek, recipientPublicKeyJwk) {
+	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
+	const ephemeral = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, wrappingKey, dek);
+	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	return [
+		WRAP_PREFIX,
+		toBase64Url(ephemeralRaw),
+		toBase64Url(salt),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
+}
+/** Unwrap an environment DEK with the principal's private ECDH key. */
+async function unwrapDek(wrapped, privateKey) {
+	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
+	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, false, []), fromBase64Url(saltB64), "decrypt");
+	try {
+		const dek = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64)
+		}, wrappingKey, fromBase64Url(ctB64));
+		return new Uint8Array(dek);
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
+	}
+}
+//#endregion
+//#region ../../packages/crypto/src/aws.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one AWS lease. */
+async function generateAwsRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by an AWS lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext STS credential.
+*/
+async function unwrapAwsCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped AWS credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.accessKeyId !== "string" || typeof c.secretAccessKey !== "string" || typeof c.sessionToken !== "string" || typeof c.expiration !== "string" || typeof c.region !== "string") throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped AWS credential is missing fields");
+	return {
+		accessKeyId: c.accessKeyId,
+		secretAccessKey: c.secretAccessKey,
+		sessionToken: c.sessionToken,
+		expiration: c.expiration,
+		region: c.region
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -951,111 +1133,8 @@ function isServiceToken(value) {
 	return value.startsWith(`${TOKEN_PREFIX}_`);
 }
 //#endregion
-//#region ../../packages/crypto/src/wrap.ts
-/**
-* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
-* the recipient's public key; the shared secret is run through HKDF-SHA256 to
-* derive a one-time AES-256-GCM wrapping key. Only the holder of the
-* recipient private key can unwrap.
-*
-* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
-*/
-const WRAP_PREFIX = "wd1";
-const HKDF_INFO = "seekrit/wrap-dek/v1";
-async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
-	const ecdh = {
-		name: "ECDH",
-		public: peerPublicKey
-	};
-	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
-	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt,
-		info: utf8Encode(HKDF_INFO)
-	}, hkdfKey, {
-		name: "AES-GCM",
-		length: 256
-	}, false, [usage]);
-}
-/** Wrap an environment DEK to a principal's public key. */
-async function wrapDek(dek, recipientPublicKeyJwk) {
-	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
-	const ephemeral = await crypto.subtle.generateKey({
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, true, ["deriveBits"]);
-	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
-	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
-	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	const ciphertext = await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, wrappingKey, dek);
-	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
-	return [
-		WRAP_PREFIX,
-		toBase64Url(ephemeralRaw),
-		toBase64Url(salt),
-		toBase64Url(iv),
-		toBase64Url(new Uint8Array(ciphertext))
-	].join(".");
-}
-/** Unwrap an environment DEK with the principal's private ECDH key. */
-async function unwrapDek(wrapped, privateKey) {
-	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
-	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, false, []), fromBase64Url(saltB64), "decrypt");
-	try {
-		const dek = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: fromBase64Url(ivB64)
-		}, wrappingKey, fromBase64Url(ctB64));
-		return new Uint8Array(dek);
-	} catch {
-		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
-	}
-}
-//#endregion
 //#region package.json
-var version = "0.13.0";
-const PROJECT_FILE = "seekrit.json";
-function globalConfigPath() {
-	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
-}
-function readGlobalConfig() {
-	const path = globalConfigPath();
-	if (!existsSync(path)) return {};
-	return JSON.parse(readFileSync(path, "utf8"));
-}
-function writeGlobalConfig(update) {
-	const path = globalConfigPath();
-	const merged = {
-		...readGlobalConfig(),
-		...update
-	};
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
-}
-/** Walk up from cwd looking for seekrit.json. */
-function findProjectConfig(startDir = process.cwd()) {
-	let dir = startDir;
-	const { root } = parse(dir);
-	while (true) {
-		const candidate = join(dir, PROJECT_FILE);
-		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
-		if (dir === root) return null;
-		dir = dirname(dir);
-	}
-}
-function writeProjectConfig(config, dir = process.cwd()) {
-	const path = join(dir, PROJECT_FILE);
-	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
-	return path;
-}
+var version = "0.14.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1263,6 +1342,40 @@ var SeekritClient = class {
 		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
 	}
 };
+const PROJECT_FILE = "seekrit.json";
+function globalConfigPath() {
+	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
+}
+function readGlobalConfig() {
+	const path = globalConfigPath();
+	if (!existsSync(path)) return {};
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+function writeGlobalConfig(update) {
+	const path = globalConfigPath();
+	const merged = {
+		...readGlobalConfig(),
+		...update
+	};
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+}
+/** Walk up from cwd looking for seekrit.json. */
+function findProjectConfig(startDir = process.cwd()) {
+	let dir = startDir;
+	const { root } = parse(dir);
+	while (true) {
+		const candidate = join(dir, PROJECT_FILE);
+		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
+		if (dir === root) return null;
+		dir = dirname(dir);
+	}
+}
+function writeProjectConfig(config, dir = process.cwd()) {
+	const path = join(dir, PROJECT_FILE);
+	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
+	return path;
+}
 //#endregion
 //#region src/io.ts
 let failThrows = false;
@@ -1368,6 +1481,235 @@ async function getDek(ctx, orgId, envId) {
 	return unwrapDek(wrappedDek, privateKey);
 }
 //#endregion
+//#region src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
+/**
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
+*/
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
+//#endregion
+//#region src/aws.ts
+/**
+* `seekrit aws` — temporary AWS credentials via STS AssumeRole (Vault-style
+* dynamic secrets, the tier-2 sibling of `seekrit pg`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; STS mints the
+* credential and the broker returns it wrapped to that key, so the control plane
+* only ever relays ciphertext and only this machine can unwrap it. Registering a
+* target wraps the base IAM credential to the broker's public key locally, so
+* the control plane never sees it either — its only needed permission is
+* `sts:AssumeRole` on the target role.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$4(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/**
+* The base IAM credential the broker assumes the role with. From flags or the
+* standard AWS env vars; JSON-serialized so the executor can parse it. Never the
+* plaintext leaves this machine unwrapped — it is wrapped to the broker key.
+*/
+function resolveBaseCredential(opts) {
+	const accessKeyId = opts.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = opts.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY;
+	const sessionToken = process.env.AWS_SESSION_TOKEN;
+	if (!accessKeyId || !secretAccessKey) fail("provide the base IAM credential via --access-key-id/--secret-access-key or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (it needs only sts:AssumeRole on the role)");
+	return JSON.stringify({
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	});
+}
+function registerAwsCommands(program) {
+	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
+	const target = aws.command("target").description("manage AWS role targets");
+	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
+		const config = {
+			provider: "aws",
+			executor: "in_do",
+			roleArn: options.roleArn,
+			region: options.region,
+			...options.externalId ? { externalId: options.externalId } : {},
+			...sessionPolicy ? { sessionPolicy } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$4(options.maxTtl) } : {}
+		};
+		const baseCredential = resolveBaseCredential(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(baseCredential), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered AWS target ${created.name} (${created.id})`);
+		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
+		console.log(awsTrustPolicyInstructions(config));
+	});
+	target.command("list").description("list AWS role targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "aws") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
+		}
+	});
+	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
+		console.log(awsTrustPolicyInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
+		const ttlSeconds = parseTtlSeconds$4(options.ttl);
+		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
+		const recipient = await generateAwsRecipientKeyPair();
+		const { aws: leased } = await ctx.client.mintLease(org.id, {
+			provider: "aws",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapAwsCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cfg.roleArn} in ${cred.region} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify({
+			...cred,
+			roleArn: cfg.roleArn
+		}, null, 2));
+		else {
+			console.log(`export AWS_ACCESS_KEY_ID=${cred.accessKeyId}`);
+			console.log(`export AWS_SECRET_ACCESS_KEY=${cred.secretAccessKey}`);
+			console.log(`export AWS_SESSION_TOKEN=${cred.sessionToken}`);
+			console.log(`export AWS_REGION=${cred.region}`);
+		}
+	});
+	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "aws") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
+	});
+}
+//#endregion
 //#region src/dotenv.ts
 /**
 * Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
@@ -1462,94 +1804,6 @@ function resolveLeaseAdminSecret(opts) {
 	return adminUrl;
 }
 //#endregion
-//#region src/target.ts
-/** Resolve the target org from a flag, the committed config, or a lone org. */
-async function resolveOrg(ctx, orgSlug) {
-	const wanted = orgSlug ?? findProjectConfig()?.org;
-	const { orgs } = await ctx.client.listOrgs();
-	if (wanted) {
-		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
-		if (!org) fail(`no accessible org "${wanted}"`);
-		return {
-			id: org.id,
-			slug: org.slug
-		};
-	}
-	const only = orgs[0];
-	if (orgs.length === 1 && only) return {
-		id: only.id,
-		slug: only.slug
-	};
-	fail("specify --org (or run `seekrit init`)");
-}
-/**
-* Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
-*/
-async function resolveEnvTarget(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.env) fail("specify --env");
-	if (opts.group) {
-		const { groups } = await ctx.client.listGroups(org.id);
-		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
-		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
-		return {
-			orgId: org.id,
-			envId: env.id,
-			label: `${group.slug}@${env.slug}`
-		};
-	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		envId: env.id,
-		label: `${app.slug}/${env.slug}`
-	};
-}
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		appId: app.id,
-		appSlug: app.slug,
-		envId: env.id,
-		envSlug: env.slug
-	};
-}
-/** Resolve a group by slug within the target org. */
-async function resolveGroup(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.group) fail("specify --group");
-	const { groups } = await ctx.client.listGroups(org.id);
-	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-	return {
-		orgId: org.id,
-		id: group.id,
-		slug: group.slug
-	};
-}
-//#endregion
 //#region src/mysql.ts
 /**
 * `seekrit mysql` — temporary MySQL/MariaDB credentials (Vault-style dynamic
@@ -2596,8 +2850,9 @@ registerMysqlCommands(program);
 registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerSshCommands(program);
+registerAwsCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-BEcV_KpM.js");
+	const { runMcpServer } = await import("./mcp-ARBuneH3.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -2611,4 +2866,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { parseServiceToken as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveAppEnv as i, isTokenAuth as l, wrapDek as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generatePostgresCredential as v, generateMysqlCredential as y };
+export { generatePostgresCredential as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, parseServiceToken as g, isServiceToken as h, resolveAppEnv as i, isTokenAuth as l, createServiceToken as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generateMysqlCredential as v, wrapDek as y };

package/dist/{mcp-BEcV_KpM.js → mcp-ARBuneH3.js}

@@ -1,4 +1,4 @@
-import { _ as parseServiceToken, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateMysqlCredential } from "./index.js";
+import { _ as generatePostgresCredential, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as parseServiceToken, h as isServiceToken, i as resolveAppEnv, l as isTokenAuth, m as createServiceToken, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generateMysqlCredential, y as wrapDek } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {