@seekrit/cli 0.15.0 → 0.17.0

package/dist/index.js

@@ -13,7 +13,8 @@ z.enum([
 	"ssh",
 	"redis",
 	"aws",
-	"gcp"
+	"gcp",
+	"mongodb"
 ]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
@@ -113,6 +114,22 @@ const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
 		return false;
 	}
 }, "must be a JWK-serialized P-256 public key");
+z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1–64 chars of [A-Za-z0-9_-]");
+/**
+* A MongoDB database name — the db a preset role is granted on, or the
+* authentication database a leased user is created in. MongoDB forbids
+* `/\. "$*<>:|?` and the empty string in db names; we keep to a safe subset.
+*/
+const mongoDatabaseNameSchema = z.string().regex(/^[A-Za-z0-9_-]{1,63}$/, "must be 1–63 chars of [A-Za-z0-9_-]");
+/**
+* A single MongoDB role grant `{ role, db }` for a `custom` target — e.g.
+* `{ role: "readWrite", db: "app" }` or a user-defined role. Admin-supplied
+* trusted input, set once at registration; still bounded structurally.
+*/
+const mongoRoleSchema = z.object({
+	role: z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be a role name"),
+	db: mongoDatabaseNameSchema
+});
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -133,6 +150,11 @@ const redisAccessLevelSchema = z.enum([
 	"readwrite",
 	"custom"
 ]);
+const mongoAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
 const connectionSchema = z.object({
 	host: z.string().min(1),
 	port: z.number().int().min(1).max(65535),
@@ -210,13 +232,24 @@ const gcpTargetConfigSchema = z.object({
 	delegates: z.array(gcpServiceAccountEmailSchema).max(8).optional(),
 	maxTtlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
 });
+const mongoTargetConfigSchema = z.object({
+	provider: z.literal("mongodb"),
+	executor: z.literal("in_do"),
+	accessLevel: mongoAccessLevelSchema.optional(),
+	connection: connectionSchema,
+	authSource: mongoDatabaseNameSchema.optional(),
+	roles: z.array(mongoRoleSchema).min(1).max(32).optional(),
+	tls: z.boolean().optional(),
+	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional()
+});
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
 	redisTargetConfigSchema,
 	sshTargetConfigSchema,
 	awsTargetConfigSchema,
-	gcpTargetConfigSchema
+	gcpTargetConfigSchema,
+	mongoTargetConfigSchema
 ]);
 z.object({
 	name: z.string().trim().min(1).max(128),
@@ -309,13 +342,27 @@ const mintGcpLeaseSchema = z.object({
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
 });
+/**
+* Client → API: mint a MongoDB lease. Like AWS (tier 2), the client generates
+* an ephemeral P-256 keypair locally and sends only the public key; the broker
+* generates the password, runs `createUser`, and returns the credential wrapped
+* to that key. The private key never leaves the requesting machine, so the
+* plaintext credential is only decryptable there.
+*/
+const mintMongoLeaseSchema = z.object({
+	provider: z.literal("mongodb"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: ttlSecondsSchema
+});
 z.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
 	mintRedisLeaseSchema,
 	mintSshLeaseSchema,
 	mintAwsLeaseSchema,
-	mintGcpLeaseSchema
+	mintGcpLeaseSchema,
+	mintMongoLeaseSchema
 ]);
 //#endregion
 //#region ../../packages/core/src/providers/aws.ts
@@ -369,6 +416,32 @@ function gcpSetupInstructions(config) {
 	].join("\n");
 }
 //#endregion
+//#region ../../packages/core/src/providers/mongodb.ts
+/**
+* The one-time setup an admin performs so seekrit can provision users: create a
+* dedicated provisioning user with `userAdmin` on the target database (or
+* `userAdminAnyDatabase` if leases span databases). Printed for the admin to run
+* in `mongosh`, never executed by seekrit — the analogue of
+* `awsTrustPolicyInstructions` / `sshHostSetupInstructions`.
+*/
+function mongoAdminSetupInstructions(config) {
+	const authSource = config.authSource ?? "admin";
+	const db = config.connection.database;
+	return [
+		`// Run once in mongosh against the "${authSource}" database. Creates the`,
+		"// provisioning user whose connection string you register as the admin secret.",
+		`use ${authSource}`,
+		"db.createUser({",
+		"  user: \"seekrit_provisioner\",",
+		"  pwd: passwordPrompt(),",
+		`  roles: [{ role: "userAdmin", db: "${db}" }],`,
+		"})",
+		"",
+		`// Register it: seekrit mongodb target add --name ${db} \\`,
+		`//   --uri "mongodb://seekrit_provisioner:<pwd>@${config.connection.host}:${config.connection.port}/?authSource=${authSource}"`
+	].join("\n");
+}
+//#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
@@ -445,6 +518,8 @@ const NOTIFICATION_TYPES = [
 /** URL-safe identifier segment: `my-app`, `production`, … */
 const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
 const nameSchema = z.string().trim().min(1).max(128);
+/** An email address, normalized to trimmed lowercase before validation. */
+const emailSchema = z.string().trim().toLowerCase().pipe(z.email().max(320));
 /** Env-var style secret name: FOO, DATABASE_URL, apiKey2 … */
 const secretNameSchema = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
 z.enum([
@@ -452,6 +527,8 @@ z.enum([
 	"admin",
 	"member"
 ]);
+/** Role a person may be invited at — never `owner` (ownership isn't invitable). */
+const inviteRoleSchema = z.enum(["admin", "member"]);
 const principalTypeSchema = z.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
 const serviceTokenRoleSchema = z.enum(["admin", "member"]);
@@ -463,6 +540,10 @@ z.object({
 	name: nameSchema,
 	slug: slugSchema
 });
+z.object({
+	email: emailSchema,
+	role: inviteRoleSchema.default("member")
+});
 z.object({
 	name: nameSchema,
 	slug: slugSchema
@@ -514,6 +595,44 @@ z.object({
 	environmentId: z.string().min(1).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+const kmsKeyPurposeSchema = z.enum(["encrypt", "sign"]);
+const kmsKeySpecSchema = z.enum(["aes-256-gcm", "ecdsa-p256"]);
+/** A wrapped key grant supplied by the client (server never sees plaintext material). */
+const kmsGrantInputSchema = z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	/** Key material wrapped to the principal's public key (`wd1.` blob). */
+	wrappedKey: z.string().min(1)
+});
+z.object({
+	name: nameSchema,
+	purpose: kmsKeyPurposeSchema,
+	spec: kmsKeySpecSchema,
+	applicationId: z.string().min(1).nullish(),
+	groupId: z.string().min(1).nullish(),
+	/** ECDSA P-256 public key (JWK) for `sign` keys; omit for `encrypt` keys. */
+	publicKeyJwk: z.string().min(1).nullish(),
+	grants: z.array(kmsGrantInputSchema).min(1)
+}).refine((v) => !(v.applicationId && v.groupId), {
+	message: "a key may be scoped to an application or a group, not both",
+	path: ["groupId"]
+}).refine((v) => v.purpose === "sign" === (v.spec === "ecdsa-p256"), {
+	message: "sign keys require spec ecdsa-p256; encrypt keys require aes-256-gcm",
+	path: ["spec"]
+}).refine((v) => v.purpose === "sign" === (v.publicKeyJwk != null), {
+	message: "sign keys require a publicKeyJwk; encrypt keys must omit it",
+	path: ["publicKeyJwk"]
+});
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	/** Current-version key material wrapped to the principal's public key. */
+	wrappedKey: z.string().min(1)
+});
+z.object({
+	publicKeyJwk: z.string().min(1).nullish(),
+	grants: z.array(kmsGrantInputSchema).min(1)
+});
 z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
 z.object({
 	endpoint: z.url().max(2048),
@@ -582,7 +701,7 @@ function splitBlob(blob, prefix, segments) {
 //#endregion
 //#region ../../packages/crypto/src/aes.ts
 const SECRET_PREFIX = "sc1";
-const IV_LENGTH = 12;
+const IV_LENGTH$1 = 12;
 /** Generate a fresh 256-bit data encryption key for an environment. */
 function generateDek() {
 	return crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
@@ -599,7 +718,7 @@ async function importDek(dek, usage) {
 */
 async function encryptSecret(dek, plaintext, aad) {
 	const key = await importDek(dek, "encrypt");
-	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH$1));
 	const ciphertext = await crypto.subtle.encrypt({
 		name: "AES-GCM",
 		iv,
@@ -784,6 +903,172 @@ async function unwrapGcpCredential(wrapped, privateKeyJwk) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/kms.ts
+/**
+* Client-side KMS envelope encryption. A managed `encrypt` key is a 256-bit
+* AES-GCM key whose material reaches the client only as a `wd1.` grant (wrapped
+* to the principal's public key). These helpers operate on that material
+* directly — the server never sees plaintext or key material, exactly as for
+* environment DEKs.
+*
+* Blob formats:
+*   `ce1.<keyId>.<version>.<iv>.<ciphertext>`  — Encrypt output
+*   `dk1.<keyId>.<version>.<iv>.<ciphertext>`  — GenerateDataKey wrapped key
+*
+* The keyId + version travel in the blob (so Decrypt can select the right key
+* version) and are folded into the AAD (so a blob can't be replayed under a
+* different key/version). For `ce1` the caller's optional encryption *context*
+* is also bound — Decrypt must supply the same context, mirroring AWS KMS.
+*/
+const ENCRYPT_PREFIX = "ce1";
+const DATAKEY_PREFIX = "dk1";
+const IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+/** Generate fresh 256-bit material for an `encrypt` KMS key. */
+function generateEncryptKeyMaterial() {
+	return crypto.getRandomValues(new Uint8Array(KEY_LENGTH));
+}
+async function importAesKey(material, usage) {
+	return crypto.subtle.importKey("raw", material, { name: "AES-GCM" }, false, [usage]);
+}
+function encryptAad(ref, context) {
+	return `${ref.keyId}/${ref.version}/${context}`;
+}
+function dataKeyAad(keyId, version) {
+	return `${keyId}/${version}`;
+}
+function parseVersion(versionStr) {
+	const version = Number(versionStr);
+	if (!Number.isInteger(version) || version < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid key version in KMS blob");
+	return version;
+}
+/** Read the key id + version a `ce1`/`dk1` blob was produced under. */
+function kmsBlobKeyRef(blob) {
+	const prefix = blob.split(".")[0];
+	if (prefix !== ENCRYPT_PREFIX && prefix !== DATAKEY_PREFIX) throw new SeekritCryptoError("UNSUPPORTED_VERSION", `not a KMS blob: "${prefix ?? ""}"`);
+	const [keyId, versionStr] = splitBlob(blob, prefix, 4);
+	return {
+		keyId,
+		version: parseVersion(versionStr)
+	};
+}
+/** Encrypt a value under a managed key. `context` (bound as AAD) defaults to empty. */
+async function kmsEncrypt(material, ref, plaintext, context = "") {
+	const key = await importAesKey(material, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(encryptAad(ref, context))
+	}, key, utf8Encode(plaintext));
+	return [
+		ENCRYPT_PREFIX,
+		ref.keyId,
+		String(ref.version),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
+}
+/**
+* Decrypt a `ce1` blob. The caller supplies the material for the key version
+* named in the blob (see `kmsBlobKeyRef`) and the same `context` used to
+* encrypt.
+*/
+async function kmsDecrypt(material, blob, context = "") {
+	const [keyId, versionStr, ivB64, ctB64] = splitBlob(blob, ENCRYPT_PREFIX, 4);
+	const ref = {
+		keyId,
+		version: parseVersion(versionStr)
+	};
+	const key = await importAesKey(material, "decrypt");
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64),
+			additionalData: utf8Encode(encryptAad(ref, context))
+		}, key, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "KMS decryption failed: wrong key/version, tampered data, or mismatched context");
+	}
+}
+/**
+* Generate a fresh data key wrapped under a managed key — the envelope pattern
+* for large payloads (AWS KMS GenerateDataKey). Encrypt bulk data with
+* `plaintext`, store `wrapped` alongside it, and recover the key later with
+* `decryptDataKey`.
+*/
+async function generateDataKey(material, ref) {
+	const plaintext = crypto.getRandomValues(new Uint8Array(KEY_LENGTH));
+	const key = await importAesKey(material, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(dataKeyAad(ref.keyId, String(ref.version)))
+	}, key, plaintext);
+	return {
+		plaintext,
+		wrapped: [
+			DATAKEY_PREFIX,
+			ref.keyId,
+			String(ref.version),
+			toBase64Url(iv),
+			toBase64Url(new Uint8Array(ciphertext))
+		].join(".")
+	};
+}
+/** Recover a data key previously produced by `generateDataKey`. */
+async function decryptDataKey(material, wrapped) {
+	const [keyId, versionStr, ivB64, ctB64] = splitBlob(wrapped, DATAKEY_PREFIX, 4);
+	const key = await importAesKey(material, "decrypt");
+	try {
+		const dk = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64),
+			additionalData: utf8Encode(dataKeyAad(keyId, versionStr))
+		}, key, fromBase64Url(ctB64));
+		return new Uint8Array(dk);
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "data key unwrap failed: wrong key or tampered blob");
+	}
+}
+//#endregion
+//#region ../../packages/crypto/src/mongodb.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one MongoDB lease. */
+async function generateMongoRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by a MongoDB lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext credential.
+*/
+async function unwrapMongoCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped MongoDB credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.username !== "string" || typeof c.password !== "string" || typeof c.database !== "string" || typeof c.authSource !== "string" || typeof c.host !== "string" || typeof c.port !== "number" || typeof c.expiration !== "string") throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped MongoDB credential is missing fields");
+	return {
+		username: c.username,
+		password: c.password,
+		database: c.database,
+		authSource: c.authSource,
+		host: c.host,
+		port: c.port,
+		expiration: c.expiration,
+		uri: mongoConnectionUri(c)
+	};
+}
+/** Build a `mongodb://user:pass@host:port/db?authSource=…` URI from a credential. */
+function mongoConnectionUri(cred) {
+	return `mongodb://${encodeURIComponent(cred.username)}:${encodeURIComponent(cred.password)}@${cred.host}:${cred.port}/${cred.database}?authSource=${cred.authSource}`;
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -1039,6 +1324,69 @@ async function generatePostgresCredential(options = {}) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/sign.ts
+/**
+* Managed signing keys for the client-side KMS — ECDSA over P-256 (the curve
+* already used for principal keypairs; universal in WebCrypto). A `sign` key's
+* private half reaches the client only as a `wd1.` grant wrapping its PKCS8
+* bytes; the public half is published per version so verification needs no
+* grant. Signatures are `sg1.<keyId>.<version>.<signature>` — the keyId +
+* version let a verifier fetch the matching version's public key.
+*/
+const ECDSA_PARAMS = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+const ECDSA_SIGN = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+const SIGN_PREFIX = "sg1";
+/** Generate a fresh signing keypair for a `sign` KMS key (or a new version). */
+async function generateSigningKeyMaterial() {
+	const pair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+	const [publicJwk, pkcs8] = await Promise.all([crypto.subtle.exportKey("jwk", pair.publicKey), crypto.subtle.exportKey("pkcs8", pair.privateKey)]);
+	return {
+		publicKeyJwk: JSON.stringify(publicJwk),
+		privateKeyPkcs8: new Uint8Array(pkcs8)
+	};
+}
+/** Import the wrapped-then-unwrapped PKCS8 private key for signing. */
+async function importSigningKey(pkcs8) {
+	return crypto.subtle.importKey("pkcs8", pkcs8, ECDSA_PARAMS, false, ["sign"]);
+}
+/** Import a published public key (JWK) for verification. */
+async function importVerifyingKey(publicKeyJwk) {
+	return crypto.subtle.importKey("jwk", JSON.parse(publicKeyJwk), ECDSA_PARAMS, false, ["verify"]);
+}
+/** Sign a message with a managed signing key; returns an `sg1.` blob. */
+async function signMessage(privateKey, ref, message) {
+	const data = typeof message === "string" ? utf8Encode(message) : message;
+	const sig = new Uint8Array(await crypto.subtle.sign(ECDSA_SIGN, privateKey, data));
+	return [
+		SIGN_PREFIX,
+		ref.keyId,
+		String(ref.version),
+		toBase64Url(sig)
+	].join(".");
+}
+/** Verify an `sg1.` signature over a message with the version's public key. */
+async function verifyMessage(publicKey, signature, message) {
+	const [, , sigB64] = splitBlob(signature, SIGN_PREFIX, 3);
+	const data = typeof message === "string" ? utf8Encode(message) : message;
+	return crypto.subtle.verify(ECDSA_SIGN, publicKey, fromBase64Url(sigB64), data);
+}
+/** Read the key id + version an `sg1.` signature was produced under. */
+function signatureKeyRef(signature) {
+	const [keyId, versionStr] = splitBlob(signature, SIGN_PREFIX, 3);
+	const version = Number(versionStr);
+	if (!Number.isInteger(version) || version < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid key version in signature");
+	return {
+		keyId,
+		version
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/ssh.ts
 /**
 * Client-side SSH certificate authority for minting *temporary SSH access*
@@ -1228,7 +1576,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.15.0";
+var version = "0.17.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1301,6 +1649,15 @@ var SeekritClient = class {
 	listMembers(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/members`);
 	}
+	listInvites(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/invites`);
+	}
+	createInvite(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/invites`, input);
+	}
+	revokeInvite(orgId, inviteId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/invites/${inviteId}`);
+	}
 	listApps(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/apps`);
 	}
@@ -1391,6 +1748,42 @@ var SeekritClient = class {
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
+	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
+	listKmsKeys(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
+	}
+	createKmsKey(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys`, input);
+	}
+	/** Key metadata + every version (admin). */
+	getKmsKey(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}`);
+	}
+	/** The caller's wrapped key material for a key, across granted versions. */
+	getMyKmsKey(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/key`);
+	}
+	/** Published public keys of a `sign` key (grant-free within the org). */
+	getKmsPublicKeys(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/public`);
+	}
+	listKmsGrants(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants`);
+	}
+	grantKmsKey(orgId, keyId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants`, input);
+	}
+	/** Revoke a principal entirely (all versions). */
+	revokeKmsKey(orgId, keyId, principal) {
+		const qs = new URLSearchParams(principal).toString();
+		return this.request("DELETE", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants?${qs}`);
+	}
+	rotateKmsKey(orgId, keyId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/rotate`, input);
+	}
+	disableKmsKey(orgId, keyId) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/disable`);
+	}
 	/** The broker's public key — wrap the admin credential to it before registering a target. */
 	getLeaseBrokerKey(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
@@ -1677,7 +2070,7 @@ async function resolveGroup(ctx, opts) {
 * `sts:AssumeRole` on the target role.
 */
 /** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$5(input) {
+function parseTtlSeconds$6(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
 	return Number(m[1]) * ({
@@ -1717,7 +2110,7 @@ function registerAwsCommands(program) {
 			region: options.region,
 			...options.externalId ? { externalId: options.externalId } : {},
 			...sessionPolicy ? { sessionPolicy } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$6(options.maxTtl) } : {}
 		};
 		const baseCredential = resolveBaseCredential(options);
 		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
@@ -1765,7 +2158,7 @@ function registerAwsCommands(program) {
 		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
 		const cfg = t.config;
 		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
-		const ttlSeconds = parseTtlSeconds$5(options.ttl);
+		const ttlSeconds = parseTtlSeconds$6(options.ttl);
 		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
 		const recipient = await generateAwsRecipientKeyPair();
 		const { aws: leased } = await ctx.client.mintLease(org.id, {
@@ -1870,7 +2263,7 @@ function formatSecrets(values, format) {
 * `roles/iam.serviceAccountTokenCreator` on the target.
 */
 /** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$4(input) {
+function parseTtlSeconds$5(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
 	return Number(m[1]) * ({
@@ -1914,7 +2307,7 @@ function registerGcpCommands(program) {
 			serviceAccount: options.serviceAccount,
 			...options.scope?.length ? { scopes: options.scope } : {},
 			...options.delegate?.length ? { delegates: options.delegate } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$4(options.maxTtl) } : {}
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
 		};
 		const keyJson = resolveServiceAccountKey(options);
 		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
@@ -1961,7 +2354,7 @@ function registerGcpCommands(program) {
 		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
 		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
 		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
-		const ttlSeconds = parseTtlSeconds$4(options.ttl);
+		const ttlSeconds = parseTtlSeconds$5(options.ttl);
 		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
 		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
 		const recipient = await generateGcpRecipientKeyPair();
@@ -1996,6 +2389,419 @@ function registerGcpCommands(program) {
 	});
 }
 //#endregion
+//#region src/kms.ts
+/** Collect a repeatable option into a list. */
+function collect$5(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** The calling principal's identity + public key (for a self-grant). */
+async function kmsCallerIdentity(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return {
+			principalType: "service_token",
+			principalId: tokenId,
+			publicKeyJwk: JSON.stringify(pub)
+		};
+	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+	return {
+		principalType: "user",
+		principalId: user.id,
+		publicKeyJwk: user.publicKeyJwk
+	};
+}
+/** Look up an org member (by email) or service token (by id) as a grant recipient. */
+async function kmsResolveRecipient(ctx, orgId, who) {
+	if (who.user) {
+		const { members } = await ctx.client.listMembers(orgId);
+		const m = members.find((x) => x.email === who.user);
+		if (!m) fail(`no member ${who.user}`);
+		if (!m.publicKeyJwk) fail(`${who.user} has not completed key setup`);
+		return {
+			principalType: "user",
+			principalId: m.userId,
+			publicKeyJwk: m.publicKeyJwk
+		};
+	}
+	if (who.token) {
+		const { tokens } = await ctx.client.listTokens(orgId);
+		const t = tokens.find((x) => x.id === who.token);
+		if (!t) fail(`no service token ${who.token}`);
+		return {
+			principalType: "service_token",
+			principalId: t.id,
+			publicKeyJwk: t.publicKeyJwk
+		};
+	}
+	fail("specify --user <email> or --token <id>");
+}
+async function kmsResolveKey(ctx, orgId, ref) {
+	const { keys } = await ctx.client.listKmsKeys(orgId);
+	const key = keys.find((k) => k.id === ref || k.name === ref);
+	if (!key) fail(`no KMS key "${ref}"`);
+	return key;
+}
+/** Recover a key's material for one version (default: current), for the caller. */
+async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
+	const mat = await ctx.client.getMyKmsKey(orgId, keyId);
+	const v = version ?? mat.currentVersion;
+	const grant = mat.grants.find((g) => g.version === v);
+	if (!grant) fail(`no grant for version ${v} of this key`);
+	return {
+		material: await unwrapDek(grant.wrappedKey, await getPrivateKey(ctx)),
+		version: v,
+		currentVersion: mat.currentVersion
+	};
+}
+function registerKmsCommands(program) {
+	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$5, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$5, []).action(async (options) => {
+		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
+		if (options.app && options.group) fail("pass at most one of --app or --group");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		let toWrap;
+		let publicKeyJwk;
+		if (options.purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		let applicationId;
+		let groupId;
+		if (options.app) {
+			const { apps } = await ctx.client.listApps(org.id);
+			const app = apps.find((a) => a.slug === options.app || a.id === options.app);
+			if (!app) fail(`no app "${options.app}" in ${org.slug}`);
+			applicationId = app.id;
+		} else if (options.group) {
+			const { groups } = await ctx.client.listGroups(org.id);
+			const group = groups.find((g) => g.slug === options.group || g.id === options.group);
+			if (!group) fail(`no group "${options.group}" in ${org.slug}`);
+			groupId = group.id;
+		}
+		const recipients = [await kmsCallerIdentity(ctx)];
+		for (const email of options.grantUser) recipients.push(await kmsResolveRecipient(ctx, org.id, { user: email }));
+		for (const tokenId of options.grantToken) recipients.push(await kmsResolveRecipient(ctx, org.id, { token: tokenId }));
+		const seen = /* @__PURE__ */ new Set();
+		const grants = [];
+		for (const r of recipients) {
+			const dedupeKey = `${r.principalType}:${r.principalId}`;
+			if (seen.has(dedupeKey)) continue;
+			seen.add(dedupeKey);
+			grants.push({
+				principalType: r.principalType,
+				principalId: r.principalId,
+				wrappedKey: await wrapDek(toWrap, r.publicKeyJwk)
+			});
+		}
+		const input = {
+			name: options.name,
+			purpose: options.purpose,
+			spec: options.purpose === "sign" ? "ecdsa-p256" : "aes-256-gcm",
+			...applicationId ? { applicationId } : {},
+			...groupId ? { groupId } : {},
+			...publicKeyJwk ? { publicKeyJwk } : {},
+			grants
+		};
+		const { key } = await ctx.client.createKmsKey(org.id, input);
+		console.error(`created ${key.purpose} key ${key.name} (${key.id}), ${grants.length} grant(s)`);
+	});
+	kms.command("ls").description("list keys you can see").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { keys } = await ctx.client.listKmsKeys(org.id);
+		if (keys.length === 0) {
+			console.error("(no keys)");
+			return;
+		}
+		for (const k of keys) {
+			const scope = k.applicationId ? `app:${k.applicationId}` : k.groupId ? `group:${k.groupId}` : "org";
+			const state = k.disabledAt ? " [disabled]" : "";
+			console.log(`${k.name}\t${k.purpose}\tv${k.currentVersion}\t${scope}\t${k.id}${state}`);
+		}
+	});
+	kms.command("grant").description("grant a principal use of a key's current version").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--user <email>", "grant an org member").option("--token <tokenId>", "grant a service token").action(async (options) => {
+		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const recipient = await kmsResolveRecipient(ctx, org.id, options);
+		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		await ctx.client.grantKmsKey(org.id, key.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId,
+			wrappedKey: await wrapDek(material, recipient.publicKeyJwk)
+		});
+		console.error(`granted ${key.name} to ${recipient.principalId}`);
+	});
+	kms.command("revoke").description("revoke a principal from a key (all versions)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--user <email>").option("--token <tokenId>").action(async (options) => {
+		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const recipient = await kmsResolveRecipient(ctx, org.id, options);
+		await ctx.client.revokeKmsKey(org.id, key.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId
+		});
+		console.error(`revoked ${recipient.principalId} from ${key.name}`);
+	});
+	kms.command("rotate").description("add a new key version and re-wrap it for every current grantee").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		let toWrap;
+		let publicKeyJwk;
+		if (key.purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		const { grants: current } = await ctx.client.listKmsGrants(org.id, key.id);
+		const [{ members }, { tokens }] = await Promise.all([ctx.client.listMembers(org.id), ctx.client.listTokens(org.id)]);
+		const grants = [];
+		for (const g of current) {
+			const pub = g.principalType === "user" ? members.find((m) => m.userId === g.principalId)?.publicKeyJwk : tokens.find((t) => t.id === g.principalId)?.publicKeyJwk;
+			if (!pub) {
+				console.error(`skipping ${g.principalType} ${g.principalId} (no public key)`);
+				continue;
+			}
+			grants.push({
+				principalType: g.principalType,
+				principalId: g.principalId,
+				wrappedKey: await wrapDek(toWrap, pub)
+			});
+		}
+		if (grants.length === 0) fail("no grantees with public keys to re-wrap for");
+		const { key: rotated } = await ctx.client.rotateKmsKey(org.id, key.id, {
+			...publicKeyJwk ? { publicKeyJwk } : {},
+			grants
+		});
+		console.error(`rotated ${rotated.name} to v${rotated.currentVersion} (${grants.length} grantees)`);
+	});
+	kms.command("disable").description("disable a key (blocks new grants/rotations; existing data still decrypts)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		await ctx.client.disableKmsKey(org.id, key.id);
+		console.error(`disabled ${key.name}`);
+	});
+	kms.command("encrypt").description("encrypt stdin under a key (prints a ce1 ciphertext blob)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "encryption context bound as AAD (required identically to decrypt)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		if (key.purpose !== "encrypt") fail(`${key.name} is a ${key.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		const plaintext = (await readStdin()).replace(/\n$/, "");
+		const blob = await kmsEncrypt(material, {
+			keyId: key.id,
+			version: currentVersion
+		}, plaintext, options.context ?? "");
+		console.log(blob);
+	});
+	kms.command("decrypt").description("decrypt a ce1 blob from stdin").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "the same encryption context used to encrypt").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const blob = (await readStdin()).trim();
+		const ref = kmsBlobKeyRef(blob);
+		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id, ref.version);
+		console.log(await kmsDecrypt(material, blob, options.context ?? ""));
+	});
+	kms.command("generate-data-key").description("generate a data key: prints JSON {plaintextBase64, wrapped}").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		if (key.purpose !== "encrypt") fail(`${key.name} is a ${key.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		const dk = await generateDataKey(material, {
+			keyId: key.id,
+			version: currentVersion
+		});
+		console.log(JSON.stringify({
+			plaintextBase64: toBase64(dk.plaintext),
+			wrapped: dk.wrapped
+		}));
+	});
+	kms.command("open-data-key").description("recover a data key from a dk1 blob on stdin (prints plaintext base64)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const wrapped = (await readStdin()).trim();
+		const ref = kmsBlobKeyRef(wrapped);
+		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id, ref.version);
+		console.log(toBase64(await decryptDataKey(material, wrapped)));
+	});
+	kms.command("sign").description("sign stdin with a signing key (prints an sg1 signature)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		if (key.purpose !== "sign") fail(`${key.name} is a ${key.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		const message = await readStdin();
+		const privateKey = await importSigningKey(material);
+		console.log(await signMessage(privateKey, {
+			keyId: key.id,
+			version: currentVersion
+		}, message));
+	});
+	kms.command("verify").description("verify an sg1 signature over stdin (exit 0 = valid)").requiredOption("--key <name>", "key name or id").requiredOption("--signature <sg1>", "the signature blob").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const ref = signatureKeyRef(options.signature);
+		const { versions } = await ctx.client.getKmsPublicKeys(org.id, key.id);
+		const pub = versions.find((v) => v.version === ref.version)?.publicKeyJwk;
+		if (!pub) fail(`no published public key for version ${ref.version}`);
+		const message = await readStdin();
+		if (await verifyMessage(await importVerifyingKey(pub), options.signature, message)) console.error("valid");
+		else {
+			console.error("INVALID");
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
+//#region src/mongodb.ts
+/**
+* `seekrit mongodb` — temporary MongoDB credentials (Vault-style dynamic
+* secrets), the tier-2 sibling of `seekrit aws`.
+*
+* MongoDB hashes the password server-side (no verifier injection), so minting
+* generates an ephemeral P-256 keypair on THIS machine and sends only the public
+* key; the broker creates the user and returns the credential wrapped to that
+* key, so the control plane only ever relays ciphertext and only this machine
+* can unwrap it. Registering a target wraps the admin connection string to the
+* broker's public key locally, so the control plane never sees it either.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$4(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 8h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** Collect a repeatable option into an array. */
+function collect$4(value, previous) {
+	return [...previous, value];
+}
+/** Parse `readWrite@app` → { role, db } for a custom target. */
+function parseRole(spec) {
+	const [role, db] = spec.split("@");
+	if (!role || !db) fail(`invalid --role "${spec}" (use role@database, e.g. readWrite@app)`);
+	return {
+		role,
+		db
+	};
+}
+/**
+* The admin connection string the broker provisions with. From `--uri` or
+* SEEKRIT_MONGODB_ADMIN_URL; never leaves this machine unwrapped — it is wrapped
+* to the broker key. Needs `userAdmin` on the target database.
+*/
+function resolveAdminUri(uri) {
+	const value = uri ?? process.env.SEEKRIT_MONGODB_ADMIN_URL;
+	if (!value) fail("provide the admin connection string via --uri or SEEKRIT_MONGODB_ADMIN_URL (mongodb://user:pass@host:port/?authSource=admin; needs userAdmin on the database)");
+	return value;
+}
+function registerMongoCommands(program) {
+	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
+	const target = mongo.command("target").description("manage MongoDB targets");
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const adminUri = resolveAdminUri(options.uri);
+		const url = new URL(adminUri);
+		const accessLevel = options.access;
+		if (accessLevel === "custom" && options.role.length === 0) fail("--access custom requires at least one --role role@db");
+		const config = {
+			provider: "mongodb",
+			executor: "in_do",
+			accessLevel,
+			connection: {
+				host: url.hostname,
+				port: url.port ? Number(url.port) : 27017,
+				database: options.database
+			},
+			...options.authSource ? { authSource: options.authSource } : {},
+			...accessLevel === "custom" ? { roles: options.role.map(parseRole) } : {},
+			...options.tls ? {} : { tls: false }
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminUri), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered MongoDB target ${created.name} (${created.id})`);
+		console.error("\nEnsure a provisioning user exists, then `seekrit mongodb lease`:\n");
+		console.log(mongoAdminSetupInstructions(config));
+	});
+	target.command("list").description("list MongoDB targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "mongodb") continue;
+			const host = `${cfg.connection.host}:${cfg.connection.port}`;
+			console.log(`${t.id}\t${t.name}\t${host}\t${cfg.connection.database}\t${cfg.accessLevel ?? "readonly"}`);
+		}
+	});
+	target.command("rm <targetId>").description("delete a MongoDB target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	mongo.command("lease <target>").description("mint short-lived MongoDB credentials; prints a ready-to-use connection URI").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 30m, 1h, 8h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (t.config.provider !== "mongodb") fail(`"${t?.name}" is not a mongodb target (see \`seekrit aws\`)`);
+		const recipient = await generateMongoRecipientKeyPair();
+		const { mongodb: leased } = await ctx.client.mintLease(org.id, {
+			provider: "mongodb",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds: parseTtlSeconds$4(options.ttl)
+		});
+		const cred = await unwrapMongoCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cred.username} on ${cred.host}:${cred.port}/${cred.database} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify(cred, null, 2));
+		else console.log(`export MONGODB_URI='${cred.uri}'`);
+	});
+	mongo.command("leases").description("list MongoDB leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "mongodb") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	mongo.command("revoke <leaseId>").description("revoke a lease now (drops the MongoDB user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (the MongoDB user has been dropped)`);
+	});
+}
+//#endregion
 //#region src/provisioner.ts
 /**
 * `seekrit provisioner` — helpers for the self-hosted **remote executor**
@@ -3087,8 +3893,10 @@ registerProvisionerCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);
+registerMongoCommands(program);
+registerKmsCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-ARBuneH3.js");
+	const { runMcpServer } = await import("./mcp-CVhEQDfd.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -3102,4 +3910,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { generatePostgresCredential as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, parseServiceToken as g, isServiceToken as h, resolveAppEnv as i, isTokenAuth as l, createServiceToken as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generateMysqlCredential as v, wrapDek as y };
+export { generateEncryptKeyMaterial as A, importVerifyingKey as C, generatePostgresCredential as D, verifyMessage as E, generateDek as F, toBase64 as I, kmsDecrypt as M, kmsEncrypt as N, generateMysqlCredential as O, wrapDek as P, importSigningKey as S, signatureKeyRef as T, version as _, kmsRecoverMaterial as a, parseServiceToken as b, resolveAppEnv as c, resolveOrg as d, getDek as f, writeProjectConfig as g, setFailThrows as h, kmsCallerIdentity as i, kmsBlobKeyRef as j, generateDataKey as k, resolveEnvTarget as l, tryBuildContext as m, fetchDecryptedSecrets as n, kmsResolveKey as o, isTokenAuth as p, materializeEnv as r, kmsResolveRecipient as s, encryptAndSetSecret as t, resolveGroup as u, createServiceToken as v, signMessage as w, generateSigningKeyMaterial as x, isServiceToken as y };

package/dist/{mcp-ARBuneH3.js → mcp-CVhEQDfd.js}

@@ -1,4 +1,4 @@
-import { _ as generatePostgresCredential, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as parseServiceToken, h as isServiceToken, i as resolveAppEnv, l as isTokenAuth, m as createServiceToken, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generateMysqlCredential, y as wrapDek } from "./index.js";
+import { A as generateEncryptKeyMaterial, C as importVerifyingKey, D as generatePostgresCredential, E as verifyMessage, F as generateDek, I as toBase64, M as kmsDecrypt, N as kmsEncrypt, O as generateMysqlCredential, P as wrapDek, S as importSigningKey, T as signatureKeyRef, _ as version, a as kmsRecoverMaterial, b as parseServiceToken, c as resolveAppEnv, d as resolveOrg, f as getDek, g as writeProjectConfig, h as setFailThrows, i as kmsCallerIdentity, j as kmsBlobKeyRef, k as generateDataKey, l as resolveEnvTarget, m as tryBuildContext, n as fetchDecryptedSecrets, o as kmsResolveKey, p as isTokenAuth, r as materializeEnv, s as kmsResolveRecipient, t as encryptAndSetSecret, u as resolveGroup, v as createServiceToken, w as signMessage, x as generateSigningKeyMaterial, y as isServiceToken } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -206,6 +206,158 @@ async function runMcpServer() {
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listMembers(orgRef.id)).members;
 	});
+	tool("kms_list_keys", "List managed KMS keys the caller can see (metadata only).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listKmsKeys(orgRef.id)).keys;
+	});
+	tool("kms_create_key", "Create an org-scoped managed key. Material is generated locally and wrapped to each grantee (self plus any listed users/tokens); the server never sees it. Use the CLI for app/group-scoped keys.", {
+		org: z.string().optional(),
+		name: z.string(),
+		purpose: z.enum(["encrypt", "sign"]),
+		grantUsers: z.array(z.string()).optional(),
+		grantTokens: z.array(z.string()).optional()
+	}, async ({ org, name, purpose, grantUsers, grantTokens }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		let toWrap;
+		let publicKeyJwk;
+		if (purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		const recipients = [await kmsCallerIdentity(ctx)];
+		for (const u of grantUsers ?? []) recipients.push(await kmsResolveRecipient(ctx, orgRef.id, { user: u }));
+		for (const t of grantTokens ?? []) recipients.push(await kmsResolveRecipient(ctx, orgRef.id, { token: t }));
+		const seen = /* @__PURE__ */ new Set();
+		const grants = [];
+		for (const r of recipients) {
+			const dedupeKey = `${r.principalType}:${r.principalId}`;
+			if (seen.has(dedupeKey)) continue;
+			seen.add(dedupeKey);
+			grants.push({
+				principalType: r.principalType,
+				principalId: r.principalId,
+				wrappedKey: await wrapDek(toWrap, r.publicKeyJwk)
+			});
+		}
+		const { key } = await ctx.client.createKmsKey(orgRef.id, {
+			name,
+			purpose,
+			spec: purpose === "sign" ? "ecdsa-p256" : "aes-256-gcm",
+			...publicKeyJwk ? { publicKeyJwk } : {},
+			grants
+		});
+		return key;
+	});
+	tool("kms_grant", "Grant a principal (user email or token id) use of a key's current version.", {
+		org: z.string().optional(),
+		key: z.string(),
+		user: z.string().optional(),
+		token: z.string().optional()
+	}, async ({ org, key, user, token }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const recipient = await kmsResolveRecipient(ctx, orgRef.id, {
+			user,
+			token
+		});
+		const { material } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		await ctx.client.grantKmsKey(orgRef.id, k.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId,
+			wrappedKey: await wrapDek(material, recipient.publicKeyJwk)
+		});
+		return {
+			granted: recipient.principalId,
+			key: k.name
+		};
+	});
+	tool("kms_encrypt", "Encrypt a value under a managed encrypt key; returns a ce1 ciphertext blob. `context` (if given) is bound as AAD and must be supplied identically to decrypt.", {
+		org: z.string().optional(),
+		key: z.string(),
+		plaintext: z.string(),
+		context: z.string().optional()
+	}, async ({ org, key, plaintext, context }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "encrypt") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		return { ciphertext: await kmsEncrypt(material, {
+			keyId: k.id,
+			version: currentVersion
+		}, plaintext, context ?? "") };
+	});
+	tool("kms_decrypt", "Decrypt a ce1 blob. Supply the same `context` used to encrypt.", {
+		org: z.string().optional(),
+		key: z.string(),
+		ciphertext: z.string(),
+		context: z.string().optional()
+	}, async ({ org, key, ciphertext, context }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const ref = kmsBlobKeyRef(ciphertext);
+		const { material } = await kmsRecoverMaterial(ctx, orgRef.id, k.id, ref.version);
+		return { plaintext: await kmsDecrypt(material, ciphertext, context ?? "") };
+	});
+	tool("kms_generate_data_key", "Generate a data key under a managed encrypt key (envelope encryption). Returns the plaintext key (base64) and its wrapped form to store.", {
+		org: z.string().optional(),
+		key: z.string()
+	}, async ({ org, key }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "encrypt") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		const dk = await generateDataKey(material, {
+			keyId: k.id,
+			version: currentVersion
+		});
+		return {
+			plaintextBase64: toBase64(dk.plaintext),
+			wrapped: dk.wrapped
+		};
+	});
+	tool("kms_sign", "Sign a message with a managed signing key; returns an sg1 signature blob.", {
+		org: z.string().optional(),
+		key: z.string(),
+		message: z.string()
+	}, async ({ org, key, message }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "sign") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		return { signature: await signMessage(await importSigningKey(material), {
+			keyId: k.id,
+			version: currentVersion
+		}, message) };
+	});
+	tool("kms_verify", "Verify an sg1 signature over a message using a signing key's published public key (no grant needed).", {
+		org: z.string().optional(),
+		key: z.string(),
+		signature: z.string(),
+		message: z.string()
+	}, async ({ org, key, signature, message }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const ref = signatureKeyRef(signature);
+		const { versions } = await ctx.client.getKmsPublicKeys(orgRef.id, k.id);
+		const pub = versions.find((v) => v.version === ref.version)?.publicKeyJwk;
+		if (!pub) throw new Error(`no published public key for version ${ref.version}`);
+		return { valid: await verifyMessage(await importVerifyingKey(pub), signature, message) };
+	});
 	tool("list_secrets", "List secret names + versions in an environment (never values).", targetShape, async (o) => {
 		const ctx = getCtx();
 		const { orgId, envId } = await resolveTargetEnv(ctx, o);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -23,9 +23,9 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
+    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/api-client": "0.0.1"
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",