@seekrit/cli 0.14.0 → 0.15.0

package/dist/index.js

@@ -12,7 +12,8 @@ z.enum([
 	"mysql",
 	"ssh",
 	"redis",
-	"aws"
+	"aws",
+	"gcp"
 ]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
@@ -83,6 +84,22 @@ const awsRegionSchema = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be a
 const awsExternalIdSchema = z.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
 z.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
 /**
+* A GCP service-account email the broker is allowed to impersonate (or that
+* appears in a delegation chain). Structurally validated and bounded: it is
+* interpolated into the IAM Credentials API URL path, so the charset excludes
+* anything that could break out of a path segment. Covers user-managed
+* (`name@<project>.iam.gserviceaccount.com`) and Google-managed
+* (`<project-number>-compute@developer.gserviceaccount.com`) forms.
+*/
+const gcpServiceAccountEmailSchema = z.string().max(256).regex(/^[a-z0-9-]+@[a-z0-9.-]+\.gserviceaccount\.com$/, "must be a service-account email (…@….gserviceaccount.com)");
+/**
+* An OAuth 2.0 scope granted to the minted access token, e.g.
+* `https://www.googleapis.com/auth/cloud-platform`. Bounded and whitespace-free
+* (scopes are space-delimited); passed to the IAM Credentials API in a JSON body
+* array, not a URL, so this is sanity/DoS hardening rather than an injection gate.
+*/
+const gcpOauthScopeSchema = z.string().min(1).max(256).regex(/^\S+$/, "must be a single OAuth scope with no whitespace");
+/**
 * The consumer's ephemeral P-256 public key (JWK-serialized) that a tier-2
 * credential is wrapped to before it is returned. Validated structurally here;
 * the executor imports it defensively before wrapping. Bounded so a giant blob
@@ -184,12 +201,22 @@ const awsTargetConfigSchema = z.object({
 	sessionPolicy: z.string().min(1).max(4e3).optional(),
 	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
 });
+const GCP_MAX_TTL_SECONDS = 3600 * 12;
+const gcpTargetConfigSchema = z.object({
+	provider: z.literal("gcp"),
+	executor: z.literal("in_do"),
+	serviceAccount: gcpServiceAccountEmailSchema,
+	scopes: z.array(gcpOauthScopeSchema).min(1).max(32).optional(),
+	delegates: z.array(gcpServiceAccountEmailSchema).max(8).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
+});
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
 	redisTargetConfigSchema,
 	sshTargetConfigSchema,
-	awsTargetConfigSchema
+	awsTargetConfigSchema,
+	gcpTargetConfigSchema
 ]);
 z.object({
 	name: z.string().trim().min(1).max(128),
@@ -266,12 +293,29 @@ const mintAwsLeaseSchema = z.object({
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
 });
+/**
+* Client → API: mint a GCP lease. Like AWS (tier 2): the client generates an
+* ephemeral P-256 keypair locally and sends only the public key; the IAM
+* Credentials API mints the access token and the broker returns it wrapped to
+* that key. The private key never leaves the requesting machine, so the plaintext
+* token is only decryptable there.
+*
+* TTL bounds are GCP's `generateAccessToken` limits (1 min – 12 h); tokens over
+* 1 h require the credential-lifetime-extension org policy.
+*/
+const mintGcpLeaseSchema = z.object({
+	provider: z.literal("gcp"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
+});
 z.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
 	mintRedisLeaseSchema,
 	mintSshLeaseSchema,
-	mintAwsLeaseSchema
+	mintAwsLeaseSchema,
+	mintGcpLeaseSchema
 ]);
 //#endregion
 //#region ../../packages/core/src/providers/aws.ts
@@ -302,6 +346,29 @@ function awsTrustPolicyInstructions(config) {
 	].join("\n");
 }
 //#endregion
+//#region ../../packages/core/src/providers/gcp.ts
+/**
+* The one-time IAM setup an admin performs so seekrit can impersonate the target
+* service account. Analogue of `awsTrustPolicyInstructions` — printed for the
+* admin to apply, never executed by seekrit. Grants the *source* service account
+* (the one whose key was registered as the admin secret) the token-creator role
+* on the target service account.
+*/
+function gcpSetupInstructions(config) {
+	return [
+		"# Grant the service account whose key you registered as the admin secret",
+		"# permission to mint tokens for the target service account. Replace",
+		"# <SOURCE_SA_EMAIL> with the client_email from that key JSON.",
+		`gcloud iam service-accounts add-iam-policy-binding ${config.serviceAccount} \\`,
+		"  --member=\"serviceAccount:<SOURCE_SA_EMAIL>\" \\",
+		"  --role=\"roles/iam.serviceAccountTokenCreator\"",
+		"",
+		"# The source service account's project must have the IAM Service Account",
+		"# Credentials API enabled (seekrit only ever calls generateAccessToken):",
+		"gcloud services enable iamcredentials.googleapis.com"
+	].join("\n");
+}
+//#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
@@ -690,6 +757,33 @@ async function unwrapAwsCredential(wrapped, privateKeyJwk) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/gcp.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one GCP lease. */
+async function generateGcpRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by a GCP lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext access token.
+*/
+async function unwrapGcpCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped GCP credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.accessToken !== "string" || typeof c.expiration !== "string" || typeof c.serviceAccount !== "string" || !Array.isArray(c.scopes) || !c.scopes.every((s) => typeof s === "string")) throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped GCP credential is missing fields");
+	return {
+		accessToken: c.accessToken,
+		expiration: c.expiration,
+		serviceAccount: c.serviceAccount,
+		scopes: c.scopes
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -1134,7 +1228,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.14.0";
+var version = "0.15.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1583,7 +1677,7 @@ async function resolveGroup(ctx, opts) {
 * `sts:AssumeRole` on the target role.
 */
 /** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$4(input) {
+function parseTtlSeconds$5(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
 	return Number(m[1]) * ({
@@ -1623,7 +1717,7 @@ function registerAwsCommands(program) {
 			region: options.region,
 			...options.externalId ? { externalId: options.externalId } : {},
 			...sessionPolicy ? { sessionPolicy } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$4(options.maxTtl) } : {}
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
 		};
 		const baseCredential = resolveBaseCredential(options);
 		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
@@ -1671,7 +1765,7 @@ function registerAwsCommands(program) {
 		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
 		const cfg = t.config;
 		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
-		const ttlSeconds = parseTtlSeconds$4(options.ttl);
+		const ttlSeconds = parseTtlSeconds$5(options.ttl);
 		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
 		const recipient = await generateAwsRecipientKeyPair();
 		const { aws: leased } = await ctx.client.mintLease(org.id, {
@@ -1761,6 +1855,147 @@ function formatSecrets(values, format) {
 	}
 }
 //#endregion
+//#region src/gcp.ts
+/**
+* `seekrit gcp` — temporary GCP credentials via IAM Credentials
+* `generateAccessToken` (Vault-style dynamic secrets, the tier-2 sibling of
+* `seekrit aws`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; GCP mints the token and
+* the broker returns it wrapped to that key, so the control plane only ever
+* relays ciphertext and only this machine can unwrap it. Registering a target
+* wraps the service-account key JSON to the broker's public key locally, so the
+* control plane never sees it either — the source service account needs only
+* `roles/iam.serviceAccountTokenCreator` on the target.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$4(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** Collect a repeatable flag (e.g. --scope) into a list. */
+function collectList$1(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* The service-account key JSON the broker impersonates with. From --key-file or
+* GOOGLE_APPLICATION_CREDENTIALS. Never leaves this machine unwrapped — it is
+* wrapped to the broker key before upload.
+*/
+function resolveServiceAccountKey(opts) {
+	const path = opts.keyFile ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (!path) fail("provide the source service-account key JSON via --key-file or GOOGLE_APPLICATION_CREDENTIALS (it needs roles/iam.serviceAccountTokenCreator on the target)");
+	const raw = readFileSync(path, "utf8").trim();
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.client_email !== "string" || typeof parsed.private_key !== "string") fail(`${path} is not a service-account key JSON (missing client_email/private_key)`);
+	} catch {
+		fail(`${path} is not valid JSON`);
+	}
+	return raw;
+}
+function registerGcpCommands(program) {
+	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
+	const target = gcp.command("target").description("manage GCP service-account targets");
+	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = {
+			provider: "gcp",
+			executor: "in_do",
+			serviceAccount: options.serviceAccount,
+			...options.scope?.length ? { scopes: options.scope } : {},
+			...options.delegate?.length ? { delegates: options.delegate } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$4(options.maxTtl) } : {}
+		};
+		const keyJson = resolveServiceAccountKey(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(keyJson), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered GCP target ${created.name} (${created.id})`);
+		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
+		console.log(gcpSetupInstructions(config));
+	});
+	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "gcp") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
+		}
+	});
+	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
+		console.log(gcpSetupInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
+		const ttlSeconds = parseTtlSeconds$4(options.ttl);
+		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
+		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
+		const recipient = await generateGcpRecipientKeyPair();
+		const { gcp: leased } = await ctx.client.mintLease(org.id, {
+			provider: "gcp",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapGcpCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cred.serviceAccount} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify(cred, null, 2));
+		else {
+			console.log(`export CLOUDSDK_AUTH_ACCESS_TOKEN=${cred.accessToken}`);
+			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
+		}
+	});
+	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "gcp") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
+	});
+}
+//#endregion
 //#region src/provisioner.ts
 /**
 * `seekrit provisioner` — helpers for the self-hosted **remote executor**
@@ -2851,6 +3086,7 @@ registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
+registerGcpCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
 	const { runMcpServer } = await import("./mcp-ARBuneH3.js");
 	await runMcpServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -23,9 +23,9 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
-    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",