@seekrit/cli 0.14.0 → 0.16.0

package/dist/index.js

@@ -12,7 +12,9 @@ z.enum([
 	"mysql",
 	"ssh",
 	"redis",
-	"aws"
+	"aws",
+	"gcp",
+	"mongodb"
 ]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
@@ -83,6 +85,22 @@ const awsRegionSchema = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be a
 const awsExternalIdSchema = z.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
 z.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
 /**
+* A GCP service-account email the broker is allowed to impersonate (or that
+* appears in a delegation chain). Structurally validated and bounded: it is
+* interpolated into the IAM Credentials API URL path, so the charset excludes
+* anything that could break out of a path segment. Covers user-managed
+* (`name@<project>.iam.gserviceaccount.com`) and Google-managed
+* (`<project-number>-compute@developer.gserviceaccount.com`) forms.
+*/
+const gcpServiceAccountEmailSchema = z.string().max(256).regex(/^[a-z0-9-]+@[a-z0-9.-]+\.gserviceaccount\.com$/, "must be a service-account email (…@….gserviceaccount.com)");
+/**
+* An OAuth 2.0 scope granted to the minted access token, e.g.
+* `https://www.googleapis.com/auth/cloud-platform`. Bounded and whitespace-free
+* (scopes are space-delimited); passed to the IAM Credentials API in a JSON body
+* array, not a URL, so this is sanity/DoS hardening rather than an injection gate.
+*/
+const gcpOauthScopeSchema = z.string().min(1).max(256).regex(/^\S+$/, "must be a single OAuth scope with no whitespace");
+/**
 * The consumer's ephemeral P-256 public key (JWK-serialized) that a tier-2
 * credential is wrapped to before it is returned. Validated structurally here;
 * the executor imports it defensively before wrapping. Bounded so a giant blob
@@ -96,6 +114,22 @@ const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
 		return false;
 	}
 }, "must be a JWK-serialized P-256 public key");
+z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1–64 chars of [A-Za-z0-9_-]");
+/**
+* A MongoDB database name — the db a preset role is granted on, or the
+* authentication database a leased user is created in. MongoDB forbids
+* `/\. "$*<>:|?` and the empty string in db names; we keep to a safe subset.
+*/
+const mongoDatabaseNameSchema = z.string().regex(/^[A-Za-z0-9_-]{1,63}$/, "must be 1–63 chars of [A-Za-z0-9_-]");
+/**
+* A single MongoDB role grant `{ role, db }` for a `custom` target — e.g.
+* `{ role: "readWrite", db: "app" }` or a user-defined role. Admin-supplied
+* trusted input, set once at registration; still bounded structurally.
+*/
+const mongoRoleSchema = z.object({
+	role: z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be a role name"),
+	db: mongoDatabaseNameSchema
+});
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -116,6 +150,11 @@ const redisAccessLevelSchema = z.enum([
 	"readwrite",
 	"custom"
 ]);
+const mongoAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
 const connectionSchema = z.object({
 	host: z.string().min(1),
 	port: z.number().int().min(1).max(65535),
@@ -184,12 +223,33 @@ const awsTargetConfigSchema = z.object({
 	sessionPolicy: z.string().min(1).max(4e3).optional(),
 	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
 });
+const GCP_MAX_TTL_SECONDS = 3600 * 12;
+const gcpTargetConfigSchema = z.object({
+	provider: z.literal("gcp"),
+	executor: z.literal("in_do"),
+	serviceAccount: gcpServiceAccountEmailSchema,
+	scopes: z.array(gcpOauthScopeSchema).min(1).max(32).optional(),
+	delegates: z.array(gcpServiceAccountEmailSchema).max(8).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
+});
+const mongoTargetConfigSchema = z.object({
+	provider: z.literal("mongodb"),
+	executor: z.literal("in_do"),
+	accessLevel: mongoAccessLevelSchema.optional(),
+	connection: connectionSchema,
+	authSource: mongoDatabaseNameSchema.optional(),
+	roles: z.array(mongoRoleSchema).min(1).max(32).optional(),
+	tls: z.boolean().optional(),
+	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional()
+});
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
 	redisTargetConfigSchema,
 	sshTargetConfigSchema,
-	awsTargetConfigSchema
+	awsTargetConfigSchema,
+	gcpTargetConfigSchema,
+	mongoTargetConfigSchema
 ]);
 z.object({
 	name: z.string().trim().min(1).max(128),
@@ -266,12 +326,43 @@ const mintAwsLeaseSchema = z.object({
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
 });
+/**
+* Client → API: mint a GCP lease. Like AWS (tier 2): the client generates an
+* ephemeral P-256 keypair locally and sends only the public key; the IAM
+* Credentials API mints the access token and the broker returns it wrapped to
+* that key. The private key never leaves the requesting machine, so the plaintext
+* token is only decryptable there.
+*
+* TTL bounds are GCP's `generateAccessToken` limits (1 min – 12 h); tokens over
+* 1 h require the credential-lifetime-extension org policy.
+*/
+const mintGcpLeaseSchema = z.object({
+	provider: z.literal("gcp"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
+});
+/**
+* Client → API: mint a MongoDB lease. Like AWS (tier 2), the client generates
+* an ephemeral P-256 keypair locally and sends only the public key; the broker
+* generates the password, runs `createUser`, and returns the credential wrapped
+* to that key. The private key never leaves the requesting machine, so the
+* plaintext credential is only decryptable there.
+*/
+const mintMongoLeaseSchema = z.object({
+	provider: z.literal("mongodb"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: ttlSecondsSchema
+});
 z.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
 	mintRedisLeaseSchema,
 	mintSshLeaseSchema,
-	mintAwsLeaseSchema
+	mintAwsLeaseSchema,
+	mintGcpLeaseSchema,
+	mintMongoLeaseSchema
 ]);
 //#endregion
 //#region ../../packages/core/src/providers/aws.ts
@@ -302,6 +393,55 @@ function awsTrustPolicyInstructions(config) {
 	].join("\n");
 }
 //#endregion
+//#region ../../packages/core/src/providers/gcp.ts
+/**
+* The one-time IAM setup an admin performs so seekrit can impersonate the target
+* service account. Analogue of `awsTrustPolicyInstructions` — printed for the
+* admin to apply, never executed by seekrit. Grants the *source* service account
+* (the one whose key was registered as the admin secret) the token-creator role
+* on the target service account.
+*/
+function gcpSetupInstructions(config) {
+	return [
+		"# Grant the service account whose key you registered as the admin secret",
+		"# permission to mint tokens for the target service account. Replace",
+		"# <SOURCE_SA_EMAIL> with the client_email from that key JSON.",
+		`gcloud iam service-accounts add-iam-policy-binding ${config.serviceAccount} \\`,
+		"  --member=\"serviceAccount:<SOURCE_SA_EMAIL>\" \\",
+		"  --role=\"roles/iam.serviceAccountTokenCreator\"",
+		"",
+		"# The source service account's project must have the IAM Service Account",
+		"# Credentials API enabled (seekrit only ever calls generateAccessToken):",
+		"gcloud services enable iamcredentials.googleapis.com"
+	].join("\n");
+}
+//#endregion
+//#region ../../packages/core/src/providers/mongodb.ts
+/**
+* The one-time setup an admin performs so seekrit can provision users: create a
+* dedicated provisioning user with `userAdmin` on the target database (or
+* `userAdminAnyDatabase` if leases span databases). Printed for the admin to run
+* in `mongosh`, never executed by seekrit — the analogue of
+* `awsTrustPolicyInstructions` / `sshHostSetupInstructions`.
+*/
+function mongoAdminSetupInstructions(config) {
+	const authSource = config.authSource ?? "admin";
+	const db = config.connection.database;
+	return [
+		`// Run once in mongosh against the "${authSource}" database. Creates the`,
+		"// provisioning user whose connection string you register as the admin secret.",
+		`use ${authSource}`,
+		"db.createUser({",
+		"  user: \"seekrit_provisioner\",",
+		"  pwd: passwordPrompt(),",
+		`  roles: [{ role: "userAdmin", db: "${db}" }],`,
+		"})",
+		"",
+		`// Register it: seekrit mongodb target add --name ${db} \\`,
+		`//   --uri "mongodb://seekrit_provisioner:<pwd>@${config.connection.host}:${config.connection.port}/?authSource=${authSource}"`
+	].join("\n");
+}
+//#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
@@ -378,6 +518,8 @@ const NOTIFICATION_TYPES = [
 /** URL-safe identifier segment: `my-app`, `production`, … */
 const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
 const nameSchema = z.string().trim().min(1).max(128);
+/** An email address, normalized to trimmed lowercase before validation. */
+const emailSchema = z.string().trim().toLowerCase().pipe(z.email().max(320));
 /** Env-var style secret name: FOO, DATABASE_URL, apiKey2 … */
 const secretNameSchema = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
 z.enum([
@@ -385,6 +527,8 @@ z.enum([
 	"admin",
 	"member"
 ]);
+/** Role a person may be invited at — never `owner` (ownership isn't invitable). */
+const inviteRoleSchema = z.enum(["admin", "member"]);
 const principalTypeSchema = z.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
 const serviceTokenRoleSchema = z.enum(["admin", "member"]);
@@ -396,6 +540,10 @@ z.object({
 	name: nameSchema,
 	slug: slugSchema
 });
+z.object({
+	email: emailSchema,
+	role: inviteRoleSchema.default("member")
+});
 z.object({
 	name: nameSchema,
 	slug: slugSchema
@@ -690,6 +838,68 @@ async function unwrapAwsCredential(wrapped, privateKeyJwk) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/gcp.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one GCP lease. */
+async function generateGcpRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by a GCP lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext access token.
+*/
+async function unwrapGcpCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped GCP credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.accessToken !== "string" || typeof c.expiration !== "string" || typeof c.serviceAccount !== "string" || !Array.isArray(c.scopes) || !c.scopes.every((s) => typeof s === "string")) throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped GCP credential is missing fields");
+	return {
+		accessToken: c.accessToken,
+		expiration: c.expiration,
+		serviceAccount: c.serviceAccount,
+		scopes: c.scopes
+	};
+}
+//#endregion
+//#region ../../packages/crypto/src/mongodb.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one MongoDB lease. */
+async function generateMongoRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by a MongoDB lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext credential.
+*/
+async function unwrapMongoCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped MongoDB credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.username !== "string" || typeof c.password !== "string" || typeof c.database !== "string" || typeof c.authSource !== "string" || typeof c.host !== "string" || typeof c.port !== "number" || typeof c.expiration !== "string") throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped MongoDB credential is missing fields");
+	return {
+		username: c.username,
+		password: c.password,
+		database: c.database,
+		authSource: c.authSource,
+		host: c.host,
+		port: c.port,
+		expiration: c.expiration,
+		uri: mongoConnectionUri(c)
+	};
+}
+/** Build a `mongodb://user:pass@host:port/db?authSource=…` URI from a credential. */
+function mongoConnectionUri(cred) {
+	return `mongodb://${encodeURIComponent(cred.username)}:${encodeURIComponent(cred.password)}@${cred.host}:${cred.port}/${cred.database}?authSource=${cred.authSource}`;
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -1134,7 +1344,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.14.0";
+var version = "0.16.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1207,6 +1417,15 @@ var SeekritClient = class {
 	listMembers(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/members`);
 	}
+	listInvites(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/invites`);
+	}
+	createInvite(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/invites`, input);
+	}
+	revokeInvite(orgId, inviteId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/invites/${inviteId}`);
+	}
 	listApps(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/apps`);
 	}
@@ -1583,7 +1802,7 @@ async function resolveGroup(ctx, opts) {
 * `sts:AssumeRole` on the target role.
 */
 /** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$4(input) {
+function parseTtlSeconds$6(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
 	return Number(m[1]) * ({
@@ -1623,7 +1842,7 @@ function registerAwsCommands(program) {
 			region: options.region,
 			...options.externalId ? { externalId: options.externalId } : {},
 			...sessionPolicy ? { sessionPolicy } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$4(options.maxTtl) } : {}
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$6(options.maxTtl) } : {}
 		};
 		const baseCredential = resolveBaseCredential(options);
 		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
@@ -1671,7 +1890,7 @@ function registerAwsCommands(program) {
 		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
 		const cfg = t.config;
 		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
-		const ttlSeconds = parseTtlSeconds$4(options.ttl);
+		const ttlSeconds = parseTtlSeconds$6(options.ttl);
 		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
 		const recipient = await generateAwsRecipientKeyPair();
 		const { aws: leased } = await ctx.client.mintLease(org.id, {
@@ -1761,6 +1980,280 @@ function formatSecrets(values, format) {
 	}
 }
 //#endregion
+//#region src/gcp.ts
+/**
+* `seekrit gcp` — temporary GCP credentials via IAM Credentials
+* `generateAccessToken` (Vault-style dynamic secrets, the tier-2 sibling of
+* `seekrit aws`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; GCP mints the token and
+* the broker returns it wrapped to that key, so the control plane only ever
+* relays ciphertext and only this machine can unwrap it. Registering a target
+* wraps the service-account key JSON to the broker's public key locally, so the
+* control plane never sees it either — the source service account needs only
+* `roles/iam.serviceAccountTokenCreator` on the target.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$5(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** Collect a repeatable flag (e.g. --scope) into a list. */
+function collectList$1(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* The service-account key JSON the broker impersonates with. From --key-file or
+* GOOGLE_APPLICATION_CREDENTIALS. Never leaves this machine unwrapped — it is
+* wrapped to the broker key before upload.
+*/
+function resolveServiceAccountKey(opts) {
+	const path = opts.keyFile ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (!path) fail("provide the source service-account key JSON via --key-file or GOOGLE_APPLICATION_CREDENTIALS (it needs roles/iam.serviceAccountTokenCreator on the target)");
+	const raw = readFileSync(path, "utf8").trim();
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.client_email !== "string" || typeof parsed.private_key !== "string") fail(`${path} is not a service-account key JSON (missing client_email/private_key)`);
+	} catch {
+		fail(`${path} is not valid JSON`);
+	}
+	return raw;
+}
+function registerGcpCommands(program) {
+	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
+	const target = gcp.command("target").description("manage GCP service-account targets");
+	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = {
+			provider: "gcp",
+			executor: "in_do",
+			serviceAccount: options.serviceAccount,
+			...options.scope?.length ? { scopes: options.scope } : {},
+			...options.delegate?.length ? { delegates: options.delegate } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
+		};
+		const keyJson = resolveServiceAccountKey(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(keyJson), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered GCP target ${created.name} (${created.id})`);
+		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
+		console.log(gcpSetupInstructions(config));
+	});
+	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "gcp") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
+		}
+	});
+	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
+		console.log(gcpSetupInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
+		const ttlSeconds = parseTtlSeconds$5(options.ttl);
+		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
+		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
+		const recipient = await generateGcpRecipientKeyPair();
+		const { gcp: leased } = await ctx.client.mintLease(org.id, {
+			provider: "gcp",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapGcpCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cred.serviceAccount} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify(cred, null, 2));
+		else {
+			console.log(`export CLOUDSDK_AUTH_ACCESS_TOKEN=${cred.accessToken}`);
+			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
+		}
+	});
+	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "gcp") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
+	});
+}
+//#endregion
+//#region src/mongodb.ts
+/**
+* `seekrit mongodb` — temporary MongoDB credentials (Vault-style dynamic
+* secrets), the tier-2 sibling of `seekrit aws`.
+*
+* MongoDB hashes the password server-side (no verifier injection), so minting
+* generates an ephemeral P-256 keypair on THIS machine and sends only the public
+* key; the broker creates the user and returns the credential wrapped to that
+* key, so the control plane only ever relays ciphertext and only this machine
+* can unwrap it. Registering a target wraps the admin connection string to the
+* broker's public key locally, so the control plane never sees it either.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$4(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 8h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** Collect a repeatable option into an array. */
+function collect$4(value, previous) {
+	return [...previous, value];
+}
+/** Parse `readWrite@app` → { role, db } for a custom target. */
+function parseRole(spec) {
+	const [role, db] = spec.split("@");
+	if (!role || !db) fail(`invalid --role "${spec}" (use role@database, e.g. readWrite@app)`);
+	return {
+		role,
+		db
+	};
+}
+/**
+* The admin connection string the broker provisions with. From `--uri` or
+* SEEKRIT_MONGODB_ADMIN_URL; never leaves this machine unwrapped — it is wrapped
+* to the broker key. Needs `userAdmin` on the target database.
+*/
+function resolveAdminUri(uri) {
+	const value = uri ?? process.env.SEEKRIT_MONGODB_ADMIN_URL;
+	if (!value) fail("provide the admin connection string via --uri or SEEKRIT_MONGODB_ADMIN_URL (mongodb://user:pass@host:port/?authSource=admin; needs userAdmin on the database)");
+	return value;
+}
+function registerMongoCommands(program) {
+	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
+	const target = mongo.command("target").description("manage MongoDB targets");
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const adminUri = resolveAdminUri(options.uri);
+		const url = new URL(adminUri);
+		const accessLevel = options.access;
+		if (accessLevel === "custom" && options.role.length === 0) fail("--access custom requires at least one --role role@db");
+		const config = {
+			provider: "mongodb",
+			executor: "in_do",
+			accessLevel,
+			connection: {
+				host: url.hostname,
+				port: url.port ? Number(url.port) : 27017,
+				database: options.database
+			},
+			...options.authSource ? { authSource: options.authSource } : {},
+			...accessLevel === "custom" ? { roles: options.role.map(parseRole) } : {},
+			...options.tls ? {} : { tls: false }
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminUri), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered MongoDB target ${created.name} (${created.id})`);
+		console.error("\nEnsure a provisioning user exists, then `seekrit mongodb lease`:\n");
+		console.log(mongoAdminSetupInstructions(config));
+	});
+	target.command("list").description("list MongoDB targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "mongodb") continue;
+			const host = `${cfg.connection.host}:${cfg.connection.port}`;
+			console.log(`${t.id}\t${t.name}\t${host}\t${cfg.connection.database}\t${cfg.accessLevel ?? "readonly"}`);
+		}
+	});
+	target.command("rm <targetId>").description("delete a MongoDB target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	mongo.command("lease <target>").description("mint short-lived MongoDB credentials; prints a ready-to-use connection URI").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 30m, 1h, 8h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (t.config.provider !== "mongodb") fail(`"${t?.name}" is not a mongodb target (see \`seekrit aws\`)`);
+		const recipient = await generateMongoRecipientKeyPair();
+		const { mongodb: leased } = await ctx.client.mintLease(org.id, {
+			provider: "mongodb",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds: parseTtlSeconds$4(options.ttl)
+		});
+		const cred = await unwrapMongoCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cred.username} on ${cred.host}:${cred.port}/${cred.database} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify(cred, null, 2));
+		else console.log(`export MONGODB_URI='${cred.uri}'`);
+	});
+	mongo.command("leases").description("list MongoDB leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "mongodb") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	mongo.command("revoke <leaseId>").description("revoke a lease now (drops the MongoDB user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (the MongoDB user has been dropped)`);
+	});
+}
+//#endregion
 //#region src/provisioner.ts
 /**
 * `seekrit provisioner` — helpers for the self-hosted **remote executor**
@@ -2851,6 +3344,8 @@ registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
+registerGcpCommands(program);
+registerMongoCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
 	const { runMcpServer } = await import("./mcp-ARBuneH3.js");
 	await runMcpServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -23,9 +23,9 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
-    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",