@seekrit/cli 0.13.0 → 0.15.0

package/dist/index.js

@@ -11,7 +11,9 @@ z.enum([
 	"postgres",
 	"mysql",
 	"ssh",
-	"redis"
+	"redis",
+	"aws",
+	"gcp"
 ]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
@@ -66,6 +68,51 @@ const redisUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3
 * The alphabet is bare hex, so it is a safe bare command token.
 */
 const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase-hex SHA-256 digest (64 chars)");
+/**
+* An IAM role ARN the broker is allowed to assume. Bounded and structurally
+* validated: `arn:<partition>:iam::<account>:role/<path-and-name>`. Partition
+* covers commercial (`aws`), GovCloud (`aws-us-gov`), and China (`aws-cn`).
+*/
+const awsRoleArnSchema = z.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
+/** An AWS region id, e.g. `us-east-1`, `eu-west-2`, `us-gov-west-1`. */
+const awsRegionSchema = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
+/**
+* An STS external id — the shared string a role's trust policy can require so a
+* confused-deputy can't assume it. AWS allows a broad charset; we keep to the
+* documented safe set and bound the length.
+*/
+const awsExternalIdSchema = z.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
+z.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
+/**
+* A GCP service-account email the broker is allowed to impersonate (or that
+* appears in a delegation chain). Structurally validated and bounded: it is
+* interpolated into the IAM Credentials API URL path, so the charset excludes
+* anything that could break out of a path segment. Covers user-managed
+* (`name@<project>.iam.gserviceaccount.com`) and Google-managed
+* (`<project-number>-compute@developer.gserviceaccount.com`) forms.
+*/
+const gcpServiceAccountEmailSchema = z.string().max(256).regex(/^[a-z0-9-]+@[a-z0-9.-]+\.gserviceaccount\.com$/, "must be a service-account email (…@….gserviceaccount.com)");
+/**
+* An OAuth 2.0 scope granted to the minted access token, e.g.
+* `https://www.googleapis.com/auth/cloud-platform`. Bounded and whitespace-free
+* (scopes are space-delimited); passed to the IAM Credentials API in a JSON body
+* array, not a URL, so this is sanity/DoS hardening rather than an injection gate.
+*/
+const gcpOauthScopeSchema = z.string().min(1).max(256).regex(/^\S+$/, "must be a single OAuth scope with no whitespace");
+/**
+* The consumer's ephemeral P-256 public key (JWK-serialized) that a tier-2
+* credential is wrapped to before it is returned. Validated structurally here;
+* the executor imports it defensively before wrapping. Bounded so a giant blob
+* can't be pushed through the control plane.
+*/
+const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
+	try {
+		const jwk = JSON.parse(s);
+		return jwk.kty === "EC" && jwk.crv === "P-256" && !!jwk.x && !!jwk.y;
+	} catch {
+		return false;
+	}
+}, "must be a JWK-serialized P-256 public key");
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -144,11 +191,32 @@ const sshTargetConfigSchema = z.object({
 		user: sshPrincipalSchema.optional()
 	}).optional()
 });
+const AWS_MAX_TTL_SECONDS = 3600 * 12;
+const awsTargetConfigSchema = z.object({
+	provider: z.literal("aws"),
+	executor: z.literal("in_do"),
+	roleArn: awsRoleArnSchema,
+	region: awsRegionSchema,
+	externalId: awsExternalIdSchema.optional(),
+	sessionPolicy: z.string().min(1).max(4e3).optional(),
+	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
+});
+const GCP_MAX_TTL_SECONDS = 3600 * 12;
+const gcpTargetConfigSchema = z.object({
+	provider: z.literal("gcp"),
+	executor: z.literal("in_do"),
+	serviceAccount: gcpServiceAccountEmailSchema,
+	scopes: z.array(gcpOauthScopeSchema).min(1).max(32).optional(),
+	delegates: z.array(gcpServiceAccountEmailSchema).max(8).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
+});
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
 	redisTargetConfigSchema,
-	sshTargetConfigSchema
+	sshTargetConfigSchema,
+	awsTargetConfigSchema,
+	gcpTargetConfigSchema
 ]);
 z.object({
 	name: z.string().trim().min(1).max(128),
@@ -210,13 +278,97 @@ const mintSshLeaseSchema = z.object({
 	principals: z.array(sshPrincipalSchema).min(1).max(32),
 	ttlSeconds: ttlSecondsSchema
 });
+/**
+* Client → API: mint an AWS lease. The client generates an ephemeral P-256
+* keypair locally and sends only the public key; STS mints the credential and
+* the broker returns it wrapped to that key. The private key never leaves the
+* requesting machine, so the plaintext credential is only decryptable there.
+*
+* TTL bounds are STS's own `DurationSeconds` limits (15 min – 12 h), not the
+* generic lease bounds — STS rejects anything below 900 seconds.
+*/
+const mintAwsLeaseSchema = z.object({
+	provider: z.literal("aws"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
+});
+/**
+* Client → API: mint a GCP lease. Like AWS (tier 2): the client generates an
+* ephemeral P-256 keypair locally and sends only the public key; the IAM
+* Credentials API mints the access token and the broker returns it wrapped to
+* that key. The private key never leaves the requesting machine, so the plaintext
+* token is only decryptable there.
+*
+* TTL bounds are GCP's `generateAccessToken` limits (1 min – 12 h); tokens over
+* 1 h require the credential-lifetime-extension org policy.
+*/
+const mintGcpLeaseSchema = z.object({
+	provider: z.literal("gcp"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
+});
 z.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
 	mintRedisLeaseSchema,
-	mintSshLeaseSchema
+	mintSshLeaseSchema,
+	mintAwsLeaseSchema,
+	mintGcpLeaseSchema
 ]);
 //#endregion
+//#region ../../packages/core/src/providers/aws.ts
+/**
+* The one-time IAM setup an admin performs so seekrit can assume the target
+* role. Analogue of `sshHostSetupInstructions` / `postgresGroupBootstrapSql` —
+* printed for the admin to apply, never executed by seekrit. Shows the trust
+* policy the role needs so the broker's base IAM principal may assume it.
+*/
+function awsTrustPolicyInstructions(config) {
+	return [
+		"# Attach a trust policy to the target role so the IAM principal whose",
+		"# access key you registered as the admin secret may assume it. Replace",
+		"# <ADMIN_PRINCIPAL_ARN> with that principal (user or role) ARN.",
+		"{",
+		"  \"Version\": \"2012-10-17\",",
+		"  \"Statement\": [",
+		"    {",
+		"      \"Effect\": \"Allow\",",
+		"      \"Principal\": { \"AWS\": \"<ADMIN_PRINCIPAL_ARN>\" },",
+		`      "Action": "sts:AssumeRole"${config.externalId ? `,\n      "Condition": { "StringEquals": { "sts:ExternalId": "${config.externalId}" } }` : ""}`,
+		"    }",
+		"  ]",
+		"}",
+		"",
+		"# The admin principal also needs an identity policy allowing sts:AssumeRole",
+		`# on ${config.roleArn}. seekrit only ever calls AssumeRole on this role.`
+	].join("\n");
+}
+//#endregion
+//#region ../../packages/core/src/providers/gcp.ts
+/**
+* The one-time IAM setup an admin performs so seekrit can impersonate the target
+* service account. Analogue of `awsTrustPolicyInstructions` — printed for the
+* admin to apply, never executed by seekrit. Grants the *source* service account
+* (the one whose key was registered as the admin secret) the token-creator role
+* on the target service account.
+*/
+function gcpSetupInstructions(config) {
+	return [
+		"# Grant the service account whose key you registered as the admin secret",
+		"# permission to mint tokens for the target service account. Replace",
+		"# <SOURCE_SA_EMAIL> with the client_email from that key JSON.",
+		`gcloud iam service-accounts add-iam-policy-binding ${config.serviceAccount} \\`,
+		"  --member=\"serviceAccount:<SOURCE_SA_EMAIL>\" \\",
+		"  --role=\"roles/iam.serviceAccountTokenCreator\"",
+		"",
+		"# The source service account's project must have the IAM Service Account",
+		"# Credentials API enabled (seekrit only ever calls generateAccessToken):",
+		"gcloud services enable iamcredentials.googleapis.com"
+	].join("\n");
+}
+//#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
@@ -508,6 +660,130 @@ async function importPrivateKeyPkcs8(pkcs8) {
 	}, true, ["deriveBits"]);
 }
 //#endregion
+//#region ../../packages/crypto/src/wrap.ts
+/**
+* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
+* the recipient's public key; the shared secret is run through HKDF-SHA256 to
+* derive a one-time AES-256-GCM wrapping key. Only the holder of the
+* recipient private key can unwrap.
+*
+* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
+*/
+const WRAP_PREFIX = "wd1";
+const HKDF_INFO = "seekrit/wrap-dek/v1";
+async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
+	const ecdh = {
+		name: "ECDH",
+		public: peerPublicKey
+	};
+	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
+	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt,
+		info: utf8Encode(HKDF_INFO)
+	}, hkdfKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
+}
+/** Wrap an environment DEK to a principal's public key. */
+async function wrapDek(dek, recipientPublicKeyJwk) {
+	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
+	const ephemeral = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, wrappingKey, dek);
+	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	return [
+		WRAP_PREFIX,
+		toBase64Url(ephemeralRaw),
+		toBase64Url(salt),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
+}
+/** Unwrap an environment DEK with the principal's private ECDH key. */
+async function unwrapDek(wrapped, privateKey) {
+	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
+	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, false, []), fromBase64Url(saltB64), "decrypt");
+	try {
+		const dek = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64)
+		}, wrappingKey, fromBase64Url(ctB64));
+		return new Uint8Array(dek);
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
+	}
+}
+//#endregion
+//#region ../../packages/crypto/src/aws.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one AWS lease. */
+async function generateAwsRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by an AWS lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext STS credential.
+*/
+async function unwrapAwsCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped AWS credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.accessKeyId !== "string" || typeof c.secretAccessKey !== "string" || typeof c.sessionToken !== "string" || typeof c.expiration !== "string" || typeof c.region !== "string") throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped AWS credential is missing fields");
+	return {
+		accessKeyId: c.accessKeyId,
+		secretAccessKey: c.secretAccessKey,
+		sessionToken: c.sessionToken,
+		expiration: c.expiration,
+		region: c.region
+	};
+}
+//#endregion
+//#region ../../packages/crypto/src/gcp.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one GCP lease. */
+async function generateGcpRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by a GCP lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext access token.
+*/
+async function unwrapGcpCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped GCP credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.accessToken !== "string" || typeof c.expiration !== "string" || typeof c.serviceAccount !== "string" || !Array.isArray(c.scopes) || !c.scopes.every((s) => typeof s === "string")) throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped GCP credential is missing fields");
+	return {
+		accessToken: c.accessToken,
+		expiration: c.expiration,
+		serviceAccount: c.serviceAccount,
+		scopes: c.scopes
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -951,111 +1227,8 @@ function isServiceToken(value) {
 	return value.startsWith(`${TOKEN_PREFIX}_`);
 }
 //#endregion
-//#region ../../packages/crypto/src/wrap.ts
-/**
-* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
-* the recipient's public key; the shared secret is run through HKDF-SHA256 to
-* derive a one-time AES-256-GCM wrapping key. Only the holder of the
-* recipient private key can unwrap.
-*
-* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
-*/
-const WRAP_PREFIX = "wd1";
-const HKDF_INFO = "seekrit/wrap-dek/v1";
-async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
-	const ecdh = {
-		name: "ECDH",
-		public: peerPublicKey
-	};
-	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
-	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt,
-		info: utf8Encode(HKDF_INFO)
-	}, hkdfKey, {
-		name: "AES-GCM",
-		length: 256
-	}, false, [usage]);
-}
-/** Wrap an environment DEK to a principal's public key. */
-async function wrapDek(dek, recipientPublicKeyJwk) {
-	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
-	const ephemeral = await crypto.subtle.generateKey({
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, true, ["deriveBits"]);
-	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
-	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
-	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	const ciphertext = await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, wrappingKey, dek);
-	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
-	return [
-		WRAP_PREFIX,
-		toBase64Url(ephemeralRaw),
-		toBase64Url(salt),
-		toBase64Url(iv),
-		toBase64Url(new Uint8Array(ciphertext))
-	].join(".");
-}
-/** Unwrap an environment DEK with the principal's private ECDH key. */
-async function unwrapDek(wrapped, privateKey) {
-	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
-	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
-		name: "ECDH",
-		namedCurve: "P-256"
-	}, false, []), fromBase64Url(saltB64), "decrypt");
-	try {
-		const dek = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: fromBase64Url(ivB64)
-		}, wrappingKey, fromBase64Url(ctB64));
-		return new Uint8Array(dek);
-	} catch {
-		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
-	}
-}
-//#endregion
 //#region package.json
-var version = "0.13.0";
-const PROJECT_FILE = "seekrit.json";
-function globalConfigPath() {
-	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
-}
-function readGlobalConfig() {
-	const path = globalConfigPath();
-	if (!existsSync(path)) return {};
-	return JSON.parse(readFileSync(path, "utf8"));
-}
-function writeGlobalConfig(update) {
-	const path = globalConfigPath();
-	const merged = {
-		...readGlobalConfig(),
-		...update
-	};
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
-}
-/** Walk up from cwd looking for seekrit.json. */
-function findProjectConfig(startDir = process.cwd()) {
-	let dir = startDir;
-	const { root } = parse(dir);
-	while (true) {
-		const candidate = join(dir, PROJECT_FILE);
-		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
-		if (dir === root) return null;
-		dir = dirname(dir);
-	}
-}
-function writeProjectConfig(config, dir = process.cwd()) {
-	const path = join(dir, PROJECT_FILE);
-	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
-	return path;
-}
+var version = "0.15.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1263,26 +1436,60 @@ var SeekritClient = class {
 		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
 	}
 };
-//#endregion
-//#region src/io.ts
-let failThrows = false;
-/**
-* In `seekrit mcp` the process is a long-lived stdio server, so a `fail()`
-* must surface as a catchable error (→ a tool error result) rather than
-* exiting and killing every other tool. Toggled on once at MCP startup.
-*/
-function setFailThrows(value) {
-	failThrows = value;
+const PROJECT_FILE = "seekrit.json";
+function globalConfigPath() {
+	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
 }
-function fail(message) {
-	if (failThrows) throw new Error(message);
-	console.error(`error: ${message}`);
-	process.exit(1);
+function readGlobalConfig() {
+	const path = globalConfigPath();
+	if (!existsSync(path)) return {};
+	return JSON.parse(readFileSync(path, "utf8"));
 }
-/** Prompt without echoing input (for passphrases). */
-function promptHidden(question) {
-	const muted = new Writable({ write(_chunk, _encoding, callback) {
-		callback();
+function writeGlobalConfig(update) {
+	const path = globalConfigPath();
+	const merged = {
+		...readGlobalConfig(),
+		...update
+	};
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+}
+/** Walk up from cwd looking for seekrit.json. */
+function findProjectConfig(startDir = process.cwd()) {
+	let dir = startDir;
+	const { root } = parse(dir);
+	while (true) {
+		const candidate = join(dir, PROJECT_FILE);
+		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
+		if (dir === root) return null;
+		dir = dirname(dir);
+	}
+}
+function writeProjectConfig(config, dir = process.cwd()) {
+	const path = join(dir, PROJECT_FILE);
+	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
+	return path;
+}
+//#endregion
+//#region src/io.ts
+let failThrows = false;
+/**
+* In `seekrit mcp` the process is a long-lived stdio server, so a `fail()`
+* must surface as a catchable error (→ a tool error result) rather than
+* exiting and killing every other tool. Toggled on once at MCP startup.
+*/
+function setFailThrows(value) {
+	failThrows = value;
+}
+function fail(message) {
+	if (failThrows) throw new Error(message);
+	console.error(`error: ${message}`);
+	process.exit(1);
+}
+/** Prompt without echoing input (for passphrases). */
+function promptHidden(question) {
+	const muted = new Writable({ write(_chunk, _encoding, callback) {
+		callback();
 	} });
 	process.stderr.write(question);
 	const rl = createInterface({
@@ -1368,6 +1575,235 @@ async function getDek(ctx, orgId, envId) {
 	return unwrapDek(wrappedDek, privateKey);
 }
 //#endregion
+//#region src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
+/**
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
+*/
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
+//#endregion
+//#region src/aws.ts
+/**
+* `seekrit aws` — temporary AWS credentials via STS AssumeRole (Vault-style
+* dynamic secrets, the tier-2 sibling of `seekrit pg`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; STS mints the
+* credential and the broker returns it wrapped to that key, so the control plane
+* only ever relays ciphertext and only this machine can unwrap it. Registering a
+* target wraps the base IAM credential to the broker's public key locally, so
+* the control plane never sees it either — its only needed permission is
+* `sts:AssumeRole` on the target role.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$5(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/**
+* The base IAM credential the broker assumes the role with. From flags or the
+* standard AWS env vars; JSON-serialized so the executor can parse it. Never the
+* plaintext leaves this machine unwrapped — it is wrapped to the broker key.
+*/
+function resolveBaseCredential(opts) {
+	const accessKeyId = opts.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = opts.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY;
+	const sessionToken = process.env.AWS_SESSION_TOKEN;
+	if (!accessKeyId || !secretAccessKey) fail("provide the base IAM credential via --access-key-id/--secret-access-key or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (it needs only sts:AssumeRole on the role)");
+	return JSON.stringify({
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	});
+}
+function registerAwsCommands(program) {
+	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
+	const target = aws.command("target").description("manage AWS role targets");
+	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
+		const config = {
+			provider: "aws",
+			executor: "in_do",
+			roleArn: options.roleArn,
+			region: options.region,
+			...options.externalId ? { externalId: options.externalId } : {},
+			...sessionPolicy ? { sessionPolicy } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
+		};
+		const baseCredential = resolveBaseCredential(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(baseCredential), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered AWS target ${created.name} (${created.id})`);
+		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
+		console.log(awsTrustPolicyInstructions(config));
+	});
+	target.command("list").description("list AWS role targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "aws") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
+		}
+	});
+	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
+		console.log(awsTrustPolicyInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
+		const ttlSeconds = parseTtlSeconds$5(options.ttl);
+		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
+		const recipient = await generateAwsRecipientKeyPair();
+		const { aws: leased } = await ctx.client.mintLease(org.id, {
+			provider: "aws",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapAwsCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cfg.roleArn} in ${cred.region} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify({
+			...cred,
+			roleArn: cfg.roleArn
+		}, null, 2));
+		else {
+			console.log(`export AWS_ACCESS_KEY_ID=${cred.accessKeyId}`);
+			console.log(`export AWS_SECRET_ACCESS_KEY=${cred.secretAccessKey}`);
+			console.log(`export AWS_SESSION_TOKEN=${cred.sessionToken}`);
+			console.log(`export AWS_REGION=${cred.region}`);
+		}
+	});
+	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "aws") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
+	});
+}
+//#endregion
 //#region src/dotenv.ts
 /**
 * Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
@@ -1419,6 +1855,147 @@ function formatSecrets(values, format) {
 	}
 }
 //#endregion
+//#region src/gcp.ts
+/**
+* `seekrit gcp` — temporary GCP credentials via IAM Credentials
+* `generateAccessToken` (Vault-style dynamic secrets, the tier-2 sibling of
+* `seekrit aws`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; GCP mints the token and
+* the broker returns it wrapped to that key, so the control plane only ever
+* relays ciphertext and only this machine can unwrap it. Registering a target
+* wraps the service-account key JSON to the broker's public key locally, so the
+* control plane never sees it either — the source service account needs only
+* `roles/iam.serviceAccountTokenCreator` on the target.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$4(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** Collect a repeatable flag (e.g. --scope) into a list. */
+function collectList$1(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* The service-account key JSON the broker impersonates with. From --key-file or
+* GOOGLE_APPLICATION_CREDENTIALS. Never leaves this machine unwrapped — it is
+* wrapped to the broker key before upload.
+*/
+function resolveServiceAccountKey(opts) {
+	const path = opts.keyFile ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (!path) fail("provide the source service-account key JSON via --key-file or GOOGLE_APPLICATION_CREDENTIALS (it needs roles/iam.serviceAccountTokenCreator on the target)");
+	const raw = readFileSync(path, "utf8").trim();
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.client_email !== "string" || typeof parsed.private_key !== "string") fail(`${path} is not a service-account key JSON (missing client_email/private_key)`);
+	} catch {
+		fail(`${path} is not valid JSON`);
+	}
+	return raw;
+}
+function registerGcpCommands(program) {
+	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
+	const target = gcp.command("target").description("manage GCP service-account targets");
+	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = {
+			provider: "gcp",
+			executor: "in_do",
+			serviceAccount: options.serviceAccount,
+			...options.scope?.length ? { scopes: options.scope } : {},
+			...options.delegate?.length ? { delegates: options.delegate } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$4(options.maxTtl) } : {}
+		};
+		const keyJson = resolveServiceAccountKey(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(keyJson), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered GCP target ${created.name} (${created.id})`);
+		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
+		console.log(gcpSetupInstructions(config));
+	});
+	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "gcp") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
+		}
+	});
+	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
+		console.log(gcpSetupInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
+		const ttlSeconds = parseTtlSeconds$4(options.ttl);
+		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
+		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
+		const recipient = await generateGcpRecipientKeyPair();
+		const { gcp: leased } = await ctx.client.mintLease(org.id, {
+			provider: "gcp",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapGcpCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cred.serviceAccount} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify(cred, null, 2));
+		else {
+			console.log(`export CLOUDSDK_AUTH_ACCESS_TOKEN=${cred.accessToken}`);
+			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
+		}
+	});
+	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "gcp") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
+	});
+}
+//#endregion
 //#region src/provisioner.ts
 /**
 * `seekrit provisioner` — helpers for the self-hosted **remote executor**
@@ -1462,94 +2039,6 @@ function resolveLeaseAdminSecret(opts) {
 	return adminUrl;
 }
 //#endregion
-//#region src/target.ts
-/** Resolve the target org from a flag, the committed config, or a lone org. */
-async function resolveOrg(ctx, orgSlug) {
-	const wanted = orgSlug ?? findProjectConfig()?.org;
-	const { orgs } = await ctx.client.listOrgs();
-	if (wanted) {
-		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
-		if (!org) fail(`no accessible org "${wanted}"`);
-		return {
-			id: org.id,
-			slug: org.slug
-		};
-	}
-	const only = orgs[0];
-	if (orgs.length === 1 && only) return {
-		id: only.id,
-		slug: only.slug
-	};
-	fail("specify --org (or run `seekrit init`)");
-}
-/**
-* Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
-*/
-async function resolveEnvTarget(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.env) fail("specify --env");
-	if (opts.group) {
-		const { groups } = await ctx.client.listGroups(org.id);
-		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
-		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
-		return {
-			orgId: org.id,
-			envId: env.id,
-			label: `${group.slug}@${env.slug}`
-		};
-	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		envId: env.id,
-		label: `${app.slug}/${env.slug}`
-	};
-}
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		appId: app.id,
-		appSlug: app.slug,
-		envId: env.id,
-		envSlug: env.slug
-	};
-}
-/** Resolve a group by slug within the target org. */
-async function resolveGroup(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.group) fail("specify --group");
-	const { groups } = await ctx.client.listGroups(org.id);
-	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-	return {
-		orgId: org.id,
-		id: group.id,
-		slug: group.slug
-	};
-}
-//#endregion
 //#region src/mysql.ts
 /**
 * `seekrit mysql` — temporary MySQL/MariaDB credentials (Vault-style dynamic
@@ -2596,8 +3085,10 @@ registerMysqlCommands(program);
 registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerSshCommands(program);
+registerAwsCommands(program);
+registerGcpCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-BEcV_KpM.js");
+	const { runMcpServer } = await import("./mcp-ARBuneH3.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -2611,4 +3102,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { parseServiceToken as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveAppEnv as i, isTokenAuth as l, wrapDek as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generatePostgresCredential as v, generateMysqlCredential as y };
+export { generatePostgresCredential as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, parseServiceToken as g, isServiceToken as h, resolveAppEnv as i, isTokenAuth as l, createServiceToken as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generateMysqlCredential as v, wrapDek as y };

package/dist/{mcp-BEcV_KpM.js → mcp-ARBuneH3.js}

@@ -1,4 +1,4 @@
-import { _ as parseServiceToken, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateMysqlCredential } from "./index.js";
+import { _ as generatePostgresCredential, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as parseServiceToken, h as isServiceToken, i as resolveAppEnv, l as isTokenAuth, m as createServiceToken, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generateMysqlCredential, y as wrapDek } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -23,9 +23,9 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
-    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",