@seekrit/cli 0.16.0 → 0.17.0

package/dist/index.js

@@ -595,6 +595,44 @@ z.object({
 	environmentId: z.string().min(1).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+const kmsKeyPurposeSchema = z.enum(["encrypt", "sign"]);
+const kmsKeySpecSchema = z.enum(["aes-256-gcm", "ecdsa-p256"]);
+/** A wrapped key grant supplied by the client (server never sees plaintext material). */
+const kmsGrantInputSchema = z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	/** Key material wrapped to the principal's public key (`wd1.` blob). */
+	wrappedKey: z.string().min(1)
+});
+z.object({
+	name: nameSchema,
+	purpose: kmsKeyPurposeSchema,
+	spec: kmsKeySpecSchema,
+	applicationId: z.string().min(1).nullish(),
+	groupId: z.string().min(1).nullish(),
+	/** ECDSA P-256 public key (JWK) for `sign` keys; omit for `encrypt` keys. */
+	publicKeyJwk: z.string().min(1).nullish(),
+	grants: z.array(kmsGrantInputSchema).min(1)
+}).refine((v) => !(v.applicationId && v.groupId), {
+	message: "a key may be scoped to an application or a group, not both",
+	path: ["groupId"]
+}).refine((v) => v.purpose === "sign" === (v.spec === "ecdsa-p256"), {
+	message: "sign keys require spec ecdsa-p256; encrypt keys require aes-256-gcm",
+	path: ["spec"]
+}).refine((v) => v.purpose === "sign" === (v.publicKeyJwk != null), {
+	message: "sign keys require a publicKeyJwk; encrypt keys must omit it",
+	path: ["publicKeyJwk"]
+});
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	/** Current-version key material wrapped to the principal's public key. */
+	wrappedKey: z.string().min(1)
+});
+z.object({
+	publicKeyJwk: z.string().min(1).nullish(),
+	grants: z.array(kmsGrantInputSchema).min(1)
+});
 z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
 z.object({
 	endpoint: z.url().max(2048),
@@ -663,7 +701,7 @@ function splitBlob(blob, prefix, segments) {
 //#endregion
 //#region ../../packages/crypto/src/aes.ts
 const SECRET_PREFIX = "sc1";
-const IV_LENGTH = 12;
+const IV_LENGTH$1 = 12;
 /** Generate a fresh 256-bit data encryption key for an environment. */
 function generateDek() {
 	return crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
@@ -680,7 +718,7 @@ async function importDek(dek, usage) {
 */
 async function encryptSecret(dek, plaintext, aad) {
 	const key = await importDek(dek, "encrypt");
-	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH$1));
 	const ciphertext = await crypto.subtle.encrypt({
 		name: "AES-GCM",
 		iv,
@@ -865,6 +903,137 @@ async function unwrapGcpCredential(wrapped, privateKeyJwk) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/kms.ts
+/**
+* Client-side KMS envelope encryption. A managed `encrypt` key is a 256-bit
+* AES-GCM key whose material reaches the client only as a `wd1.` grant (wrapped
+* to the principal's public key). These helpers operate on that material
+* directly — the server never sees plaintext or key material, exactly as for
+* environment DEKs.
+*
+* Blob formats:
+*   `ce1.<keyId>.<version>.<iv>.<ciphertext>`  — Encrypt output
+*   `dk1.<keyId>.<version>.<iv>.<ciphertext>`  — GenerateDataKey wrapped key
+*
+* The keyId + version travel in the blob (so Decrypt can select the right key
+* version) and are folded into the AAD (so a blob can't be replayed under a
+* different key/version). For `ce1` the caller's optional encryption *context*
+* is also bound — Decrypt must supply the same context, mirroring AWS KMS.
+*/
+const ENCRYPT_PREFIX = "ce1";
+const DATAKEY_PREFIX = "dk1";
+const IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+/** Generate fresh 256-bit material for an `encrypt` KMS key. */
+function generateEncryptKeyMaterial() {
+	return crypto.getRandomValues(new Uint8Array(KEY_LENGTH));
+}
+async function importAesKey(material, usage) {
+	return crypto.subtle.importKey("raw", material, { name: "AES-GCM" }, false, [usage]);
+}
+function encryptAad(ref, context) {
+	return `${ref.keyId}/${ref.version}/${context}`;
+}
+function dataKeyAad(keyId, version) {
+	return `${keyId}/${version}`;
+}
+function parseVersion(versionStr) {
+	const version = Number(versionStr);
+	if (!Number.isInteger(version) || version < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid key version in KMS blob");
+	return version;
+}
+/** Read the key id + version a `ce1`/`dk1` blob was produced under. */
+function kmsBlobKeyRef(blob) {
+	const prefix = blob.split(".")[0];
+	if (prefix !== ENCRYPT_PREFIX && prefix !== DATAKEY_PREFIX) throw new SeekritCryptoError("UNSUPPORTED_VERSION", `not a KMS blob: "${prefix ?? ""}"`);
+	const [keyId, versionStr] = splitBlob(blob, prefix, 4);
+	return {
+		keyId,
+		version: parseVersion(versionStr)
+	};
+}
+/** Encrypt a value under a managed key. `context` (bound as AAD) defaults to empty. */
+async function kmsEncrypt(material, ref, plaintext, context = "") {
+	const key = await importAesKey(material, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(encryptAad(ref, context))
+	}, key, utf8Encode(plaintext));
+	return [
+		ENCRYPT_PREFIX,
+		ref.keyId,
+		String(ref.version),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
+}
+/**
+* Decrypt a `ce1` blob. The caller supplies the material for the key version
+* named in the blob (see `kmsBlobKeyRef`) and the same `context` used to
+* encrypt.
+*/
+async function kmsDecrypt(material, blob, context = "") {
+	const [keyId, versionStr, ivB64, ctB64] = splitBlob(blob, ENCRYPT_PREFIX, 4);
+	const ref = {
+		keyId,
+		version: parseVersion(versionStr)
+	};
+	const key = await importAesKey(material, "decrypt");
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64),
+			additionalData: utf8Encode(encryptAad(ref, context))
+		}, key, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "KMS decryption failed: wrong key/version, tampered data, or mismatched context");
+	}
+}
+/**
+* Generate a fresh data key wrapped under a managed key — the envelope pattern
+* for large payloads (AWS KMS GenerateDataKey). Encrypt bulk data with
+* `plaintext`, store `wrapped` alongside it, and recover the key later with
+* `decryptDataKey`.
+*/
+async function generateDataKey(material, ref) {
+	const plaintext = crypto.getRandomValues(new Uint8Array(KEY_LENGTH));
+	const key = await importAesKey(material, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(dataKeyAad(ref.keyId, String(ref.version)))
+	}, key, plaintext);
+	return {
+		plaintext,
+		wrapped: [
+			DATAKEY_PREFIX,
+			ref.keyId,
+			String(ref.version),
+			toBase64Url(iv),
+			toBase64Url(new Uint8Array(ciphertext))
+		].join(".")
+	};
+}
+/** Recover a data key previously produced by `generateDataKey`. */
+async function decryptDataKey(material, wrapped) {
+	const [keyId, versionStr, ivB64, ctB64] = splitBlob(wrapped, DATAKEY_PREFIX, 4);
+	const key = await importAesKey(material, "decrypt");
+	try {
+		const dk = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64),
+			additionalData: utf8Encode(dataKeyAad(keyId, versionStr))
+		}, key, fromBase64Url(ctB64));
+		return new Uint8Array(dk);
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "data key unwrap failed: wrong key or tampered blob");
+	}
+}
+//#endregion
 //#region ../../packages/crypto/src/mongodb.ts
 /** Generate the ephemeral P-256 keypair a client uses to receive one MongoDB lease. */
 async function generateMongoRecipientKeyPair() {
@@ -1155,6 +1324,69 @@ async function generatePostgresCredential(options = {}) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/sign.ts
+/**
+* Managed signing keys for the client-side KMS — ECDSA over P-256 (the curve
+* already used for principal keypairs; universal in WebCrypto). A `sign` key's
+* private half reaches the client only as a `wd1.` grant wrapping its PKCS8
+* bytes; the public half is published per version so verification needs no
+* grant. Signatures are `sg1.<keyId>.<version>.<signature>` — the keyId +
+* version let a verifier fetch the matching version's public key.
+*/
+const ECDSA_PARAMS = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+const ECDSA_SIGN = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+const SIGN_PREFIX = "sg1";
+/** Generate a fresh signing keypair for a `sign` KMS key (or a new version). */
+async function generateSigningKeyMaterial() {
+	const pair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+	const [publicJwk, pkcs8] = await Promise.all([crypto.subtle.exportKey("jwk", pair.publicKey), crypto.subtle.exportKey("pkcs8", pair.privateKey)]);
+	return {
+		publicKeyJwk: JSON.stringify(publicJwk),
+		privateKeyPkcs8: new Uint8Array(pkcs8)
+	};
+}
+/** Import the wrapped-then-unwrapped PKCS8 private key for signing. */
+async function importSigningKey(pkcs8) {
+	return crypto.subtle.importKey("pkcs8", pkcs8, ECDSA_PARAMS, false, ["sign"]);
+}
+/** Import a published public key (JWK) for verification. */
+async function importVerifyingKey(publicKeyJwk) {
+	return crypto.subtle.importKey("jwk", JSON.parse(publicKeyJwk), ECDSA_PARAMS, false, ["verify"]);
+}
+/** Sign a message with a managed signing key; returns an `sg1.` blob. */
+async function signMessage(privateKey, ref, message) {
+	const data = typeof message === "string" ? utf8Encode(message) : message;
+	const sig = new Uint8Array(await crypto.subtle.sign(ECDSA_SIGN, privateKey, data));
+	return [
+		SIGN_PREFIX,
+		ref.keyId,
+		String(ref.version),
+		toBase64Url(sig)
+	].join(".");
+}
+/** Verify an `sg1.` signature over a message with the version's public key. */
+async function verifyMessage(publicKey, signature, message) {
+	const [, , sigB64] = splitBlob(signature, SIGN_PREFIX, 3);
+	const data = typeof message === "string" ? utf8Encode(message) : message;
+	return crypto.subtle.verify(ECDSA_SIGN, publicKey, fromBase64Url(sigB64), data);
+}
+/** Read the key id + version an `sg1.` signature was produced under. */
+function signatureKeyRef(signature) {
+	const [keyId, versionStr] = splitBlob(signature, SIGN_PREFIX, 3);
+	const version = Number(versionStr);
+	if (!Number.isInteger(version) || version < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid key version in signature");
+	return {
+		keyId,
+		version
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/ssh.ts
 /**
 * Client-side SSH certificate authority for minting *temporary SSH access*
@@ -1344,7 +1576,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.16.0";
+var version = "0.17.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1516,6 +1748,42 @@ var SeekritClient = class {
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
+	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
+	listKmsKeys(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
+	}
+	createKmsKey(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys`, input);
+	}
+	/** Key metadata + every version (admin). */
+	getKmsKey(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}`);
+	}
+	/** The caller's wrapped key material for a key, across granted versions. */
+	getMyKmsKey(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/key`);
+	}
+	/** Published public keys of a `sign` key (grant-free within the org). */
+	getKmsPublicKeys(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/public`);
+	}
+	listKmsGrants(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants`);
+	}
+	grantKmsKey(orgId, keyId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants`, input);
+	}
+	/** Revoke a principal entirely (all versions). */
+	revokeKmsKey(orgId, keyId, principal) {
+		const qs = new URLSearchParams(principal).toString();
+		return this.request("DELETE", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants?${qs}`);
+	}
+	rotateKmsKey(orgId, keyId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/rotate`, input);
+	}
+	disableKmsKey(orgId, keyId) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/disable`);
+	}
 	/** The broker's public key — wrap the admin credential to it before registering a target. */
 	getLeaseBrokerKey(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
@@ -2121,6 +2389,286 @@ function registerGcpCommands(program) {
 	});
 }
 //#endregion
+//#region src/kms.ts
+/** Collect a repeatable option into a list. */
+function collect$5(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** The calling principal's identity + public key (for a self-grant). */
+async function kmsCallerIdentity(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return {
+			principalType: "service_token",
+			principalId: tokenId,
+			publicKeyJwk: JSON.stringify(pub)
+		};
+	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+	return {
+		principalType: "user",
+		principalId: user.id,
+		publicKeyJwk: user.publicKeyJwk
+	};
+}
+/** Look up an org member (by email) or service token (by id) as a grant recipient. */
+async function kmsResolveRecipient(ctx, orgId, who) {
+	if (who.user) {
+		const { members } = await ctx.client.listMembers(orgId);
+		const m = members.find((x) => x.email === who.user);
+		if (!m) fail(`no member ${who.user}`);
+		if (!m.publicKeyJwk) fail(`${who.user} has not completed key setup`);
+		return {
+			principalType: "user",
+			principalId: m.userId,
+			publicKeyJwk: m.publicKeyJwk
+		};
+	}
+	if (who.token) {
+		const { tokens } = await ctx.client.listTokens(orgId);
+		const t = tokens.find((x) => x.id === who.token);
+		if (!t) fail(`no service token ${who.token}`);
+		return {
+			principalType: "service_token",
+			principalId: t.id,
+			publicKeyJwk: t.publicKeyJwk
+		};
+	}
+	fail("specify --user <email> or --token <id>");
+}
+async function kmsResolveKey(ctx, orgId, ref) {
+	const { keys } = await ctx.client.listKmsKeys(orgId);
+	const key = keys.find((k) => k.id === ref || k.name === ref);
+	if (!key) fail(`no KMS key "${ref}"`);
+	return key;
+}
+/** Recover a key's material for one version (default: current), for the caller. */
+async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
+	const mat = await ctx.client.getMyKmsKey(orgId, keyId);
+	const v = version ?? mat.currentVersion;
+	const grant = mat.grants.find((g) => g.version === v);
+	if (!grant) fail(`no grant for version ${v} of this key`);
+	return {
+		material: await unwrapDek(grant.wrappedKey, await getPrivateKey(ctx)),
+		version: v,
+		currentVersion: mat.currentVersion
+	};
+}
+function registerKmsCommands(program) {
+	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$5, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$5, []).action(async (options) => {
+		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
+		if (options.app && options.group) fail("pass at most one of --app or --group");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		let toWrap;
+		let publicKeyJwk;
+		if (options.purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		let applicationId;
+		let groupId;
+		if (options.app) {
+			const { apps } = await ctx.client.listApps(org.id);
+			const app = apps.find((a) => a.slug === options.app || a.id === options.app);
+			if (!app) fail(`no app "${options.app}" in ${org.slug}`);
+			applicationId = app.id;
+		} else if (options.group) {
+			const { groups } = await ctx.client.listGroups(org.id);
+			const group = groups.find((g) => g.slug === options.group || g.id === options.group);
+			if (!group) fail(`no group "${options.group}" in ${org.slug}`);
+			groupId = group.id;
+		}
+		const recipients = [await kmsCallerIdentity(ctx)];
+		for (const email of options.grantUser) recipients.push(await kmsResolveRecipient(ctx, org.id, { user: email }));
+		for (const tokenId of options.grantToken) recipients.push(await kmsResolveRecipient(ctx, org.id, { token: tokenId }));
+		const seen = /* @__PURE__ */ new Set();
+		const grants = [];
+		for (const r of recipients) {
+			const dedupeKey = `${r.principalType}:${r.principalId}`;
+			if (seen.has(dedupeKey)) continue;
+			seen.add(dedupeKey);
+			grants.push({
+				principalType: r.principalType,
+				principalId: r.principalId,
+				wrappedKey: await wrapDek(toWrap, r.publicKeyJwk)
+			});
+		}
+		const input = {
+			name: options.name,
+			purpose: options.purpose,
+			spec: options.purpose === "sign" ? "ecdsa-p256" : "aes-256-gcm",
+			...applicationId ? { applicationId } : {},
+			...groupId ? { groupId } : {},
+			...publicKeyJwk ? { publicKeyJwk } : {},
+			grants
+		};
+		const { key } = await ctx.client.createKmsKey(org.id, input);
+		console.error(`created ${key.purpose} key ${key.name} (${key.id}), ${grants.length} grant(s)`);
+	});
+	kms.command("ls").description("list keys you can see").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { keys } = await ctx.client.listKmsKeys(org.id);
+		if (keys.length === 0) {
+			console.error("(no keys)");
+			return;
+		}
+		for (const k of keys) {
+			const scope = k.applicationId ? `app:${k.applicationId}` : k.groupId ? `group:${k.groupId}` : "org";
+			const state = k.disabledAt ? " [disabled]" : "";
+			console.log(`${k.name}\t${k.purpose}\tv${k.currentVersion}\t${scope}\t${k.id}${state}`);
+		}
+	});
+	kms.command("grant").description("grant a principal use of a key's current version").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--user <email>", "grant an org member").option("--token <tokenId>", "grant a service token").action(async (options) => {
+		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const recipient = await kmsResolveRecipient(ctx, org.id, options);
+		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		await ctx.client.grantKmsKey(org.id, key.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId,
+			wrappedKey: await wrapDek(material, recipient.publicKeyJwk)
+		});
+		console.error(`granted ${key.name} to ${recipient.principalId}`);
+	});
+	kms.command("revoke").description("revoke a principal from a key (all versions)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--user <email>").option("--token <tokenId>").action(async (options) => {
+		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const recipient = await kmsResolveRecipient(ctx, org.id, options);
+		await ctx.client.revokeKmsKey(org.id, key.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId
+		});
+		console.error(`revoked ${recipient.principalId} from ${key.name}`);
+	});
+	kms.command("rotate").description("add a new key version and re-wrap it for every current grantee").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		let toWrap;
+		let publicKeyJwk;
+		if (key.purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		const { grants: current } = await ctx.client.listKmsGrants(org.id, key.id);
+		const [{ members }, { tokens }] = await Promise.all([ctx.client.listMembers(org.id), ctx.client.listTokens(org.id)]);
+		const grants = [];
+		for (const g of current) {
+			const pub = g.principalType === "user" ? members.find((m) => m.userId === g.principalId)?.publicKeyJwk : tokens.find((t) => t.id === g.principalId)?.publicKeyJwk;
+			if (!pub) {
+				console.error(`skipping ${g.principalType} ${g.principalId} (no public key)`);
+				continue;
+			}
+			grants.push({
+				principalType: g.principalType,
+				principalId: g.principalId,
+				wrappedKey: await wrapDek(toWrap, pub)
+			});
+		}
+		if (grants.length === 0) fail("no grantees with public keys to re-wrap for");
+		const { key: rotated } = await ctx.client.rotateKmsKey(org.id, key.id, {
+			...publicKeyJwk ? { publicKeyJwk } : {},
+			grants
+		});
+		console.error(`rotated ${rotated.name} to v${rotated.currentVersion} (${grants.length} grantees)`);
+	});
+	kms.command("disable").description("disable a key (blocks new grants/rotations; existing data still decrypts)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		await ctx.client.disableKmsKey(org.id, key.id);
+		console.error(`disabled ${key.name}`);
+	});
+	kms.command("encrypt").description("encrypt stdin under a key (prints a ce1 ciphertext blob)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "encryption context bound as AAD (required identically to decrypt)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		if (key.purpose !== "encrypt") fail(`${key.name} is a ${key.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		const plaintext = (await readStdin()).replace(/\n$/, "");
+		const blob = await kmsEncrypt(material, {
+			keyId: key.id,
+			version: currentVersion
+		}, plaintext, options.context ?? "");
+		console.log(blob);
+	});
+	kms.command("decrypt").description("decrypt a ce1 blob from stdin").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "the same encryption context used to encrypt").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const blob = (await readStdin()).trim();
+		const ref = kmsBlobKeyRef(blob);
+		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id, ref.version);
+		console.log(await kmsDecrypt(material, blob, options.context ?? ""));
+	});
+	kms.command("generate-data-key").description("generate a data key: prints JSON {plaintextBase64, wrapped}").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		if (key.purpose !== "encrypt") fail(`${key.name} is a ${key.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		const dk = await generateDataKey(material, {
+			keyId: key.id,
+			version: currentVersion
+		});
+		console.log(JSON.stringify({
+			plaintextBase64: toBase64(dk.plaintext),
+			wrapped: dk.wrapped
+		}));
+	});
+	kms.command("open-data-key").description("recover a data key from a dk1 blob on stdin (prints plaintext base64)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const wrapped = (await readStdin()).trim();
+		const ref = kmsBlobKeyRef(wrapped);
+		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id, ref.version);
+		console.log(toBase64(await decryptDataKey(material, wrapped)));
+	});
+	kms.command("sign").description("sign stdin with a signing key (prints an sg1 signature)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		if (key.purpose !== "sign") fail(`${key.name} is a ${key.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		const message = await readStdin();
+		const privateKey = await importSigningKey(material);
+		console.log(await signMessage(privateKey, {
+			keyId: key.id,
+			version: currentVersion
+		}, message));
+	});
+	kms.command("verify").description("verify an sg1 signature over stdin (exit 0 = valid)").requiredOption("--key <name>", "key name or id").requiredOption("--signature <sg1>", "the signature blob").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const ref = signatureKeyRef(options.signature);
+		const { versions } = await ctx.client.getKmsPublicKeys(org.id, key.id);
+		const pub = versions.find((v) => v.version === ref.version)?.publicKeyJwk;
+		if (!pub) fail(`no published public key for version ${ref.version}`);
+		const message = await readStdin();
+		if (await verifyMessage(await importVerifyingKey(pub), options.signature, message)) console.error("valid");
+		else {
+			console.error("INVALID");
+			process.exitCode = 1;
+		}
+	});
+}
+//#endregion
 //#region src/mongodb.ts
 /**
 * `seekrit mongodb` — temporary MongoDB credentials (Vault-style dynamic
@@ -3346,8 +3894,9 @@ registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);
 registerMongoCommands(program);
+registerKmsCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-ARBuneH3.js");
+	const { runMcpServer } = await import("./mcp-CVhEQDfd.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -3361,4 +3910,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { generatePostgresCredential as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, parseServiceToken as g, isServiceToken as h, resolveAppEnv as i, isTokenAuth as l, createServiceToken as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generateMysqlCredential as v, wrapDek as y };
+export { generateEncryptKeyMaterial as A, importVerifyingKey as C, generatePostgresCredential as D, verifyMessage as E, generateDek as F, toBase64 as I, kmsDecrypt as M, kmsEncrypt as N, generateMysqlCredential as O, wrapDek as P, importSigningKey as S, signatureKeyRef as T, version as _, kmsRecoverMaterial as a, parseServiceToken as b, resolveAppEnv as c, resolveOrg as d, getDek as f, writeProjectConfig as g, setFailThrows as h, kmsCallerIdentity as i, kmsBlobKeyRef as j, generateDataKey as k, resolveEnvTarget as l, tryBuildContext as m, fetchDecryptedSecrets as n, kmsResolveKey as o, isTokenAuth as p, materializeEnv as r, kmsResolveRecipient as s, encryptAndSetSecret as t, resolveGroup as u, createServiceToken as v, signMessage as w, generateSigningKeyMaterial as x, isServiceToken as y };

package/dist/{mcp-ARBuneH3.js → mcp-CVhEQDfd.js}

@@ -1,4 +1,4 @@
-import { _ as generatePostgresCredential, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as parseServiceToken, h as isServiceToken, i as resolveAppEnv, l as isTokenAuth, m as createServiceToken, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generateMysqlCredential, y as wrapDek } from "./index.js";
+import { A as generateEncryptKeyMaterial, C as importVerifyingKey, D as generatePostgresCredential, E as verifyMessage, F as generateDek, I as toBase64, M as kmsDecrypt, N as kmsEncrypt, O as generateMysqlCredential, P as wrapDek, S as importSigningKey, T as signatureKeyRef, _ as version, a as kmsRecoverMaterial, b as parseServiceToken, c as resolveAppEnv, d as resolveOrg, f as getDek, g as writeProjectConfig, h as setFailThrows, i as kmsCallerIdentity, j as kmsBlobKeyRef, k as generateDataKey, l as resolveEnvTarget, m as tryBuildContext, n as fetchDecryptedSecrets, o as kmsResolveKey, p as isTokenAuth, r as materializeEnv, s as kmsResolveRecipient, t as encryptAndSetSecret, u as resolveGroup, v as createServiceToken, w as signMessage, x as generateSigningKeyMaterial, y as isServiceToken } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -206,6 +206,158 @@ async function runMcpServer() {
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listMembers(orgRef.id)).members;
 	});
+	tool("kms_list_keys", "List managed KMS keys the caller can see (metadata only).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listKmsKeys(orgRef.id)).keys;
+	});
+	tool("kms_create_key", "Create an org-scoped managed key. Material is generated locally and wrapped to each grantee (self plus any listed users/tokens); the server never sees it. Use the CLI for app/group-scoped keys.", {
+		org: z.string().optional(),
+		name: z.string(),
+		purpose: z.enum(["encrypt", "sign"]),
+		grantUsers: z.array(z.string()).optional(),
+		grantTokens: z.array(z.string()).optional()
+	}, async ({ org, name, purpose, grantUsers, grantTokens }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		let toWrap;
+		let publicKeyJwk;
+		if (purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		const recipients = [await kmsCallerIdentity(ctx)];
+		for (const u of grantUsers ?? []) recipients.push(await kmsResolveRecipient(ctx, orgRef.id, { user: u }));
+		for (const t of grantTokens ?? []) recipients.push(await kmsResolveRecipient(ctx, orgRef.id, { token: t }));
+		const seen = /* @__PURE__ */ new Set();
+		const grants = [];
+		for (const r of recipients) {
+			const dedupeKey = `${r.principalType}:${r.principalId}`;
+			if (seen.has(dedupeKey)) continue;
+			seen.add(dedupeKey);
+			grants.push({
+				principalType: r.principalType,
+				principalId: r.principalId,
+				wrappedKey: await wrapDek(toWrap, r.publicKeyJwk)
+			});
+		}
+		const { key } = await ctx.client.createKmsKey(orgRef.id, {
+			name,
+			purpose,
+			spec: purpose === "sign" ? "ecdsa-p256" : "aes-256-gcm",
+			...publicKeyJwk ? { publicKeyJwk } : {},
+			grants
+		});
+		return key;
+	});
+	tool("kms_grant", "Grant a principal (user email or token id) use of a key's current version.", {
+		org: z.string().optional(),
+		key: z.string(),
+		user: z.string().optional(),
+		token: z.string().optional()
+	}, async ({ org, key, user, token }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const recipient = await kmsResolveRecipient(ctx, orgRef.id, {
+			user,
+			token
+		});
+		const { material } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		await ctx.client.grantKmsKey(orgRef.id, k.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId,
+			wrappedKey: await wrapDek(material, recipient.publicKeyJwk)
+		});
+		return {
+			granted: recipient.principalId,
+			key: k.name
+		};
+	});
+	tool("kms_encrypt", "Encrypt a value under a managed encrypt key; returns a ce1 ciphertext blob. `context` (if given) is bound as AAD and must be supplied identically to decrypt.", {
+		org: z.string().optional(),
+		key: z.string(),
+		plaintext: z.string(),
+		context: z.string().optional()
+	}, async ({ org, key, plaintext, context }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "encrypt") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		return { ciphertext: await kmsEncrypt(material, {
+			keyId: k.id,
+			version: currentVersion
+		}, plaintext, context ?? "") };
+	});
+	tool("kms_decrypt", "Decrypt a ce1 blob. Supply the same `context` used to encrypt.", {
+		org: z.string().optional(),
+		key: z.string(),
+		ciphertext: z.string(),
+		context: z.string().optional()
+	}, async ({ org, key, ciphertext, context }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const ref = kmsBlobKeyRef(ciphertext);
+		const { material } = await kmsRecoverMaterial(ctx, orgRef.id, k.id, ref.version);
+		return { plaintext: await kmsDecrypt(material, ciphertext, context ?? "") };
+	});
+	tool("kms_generate_data_key", "Generate a data key under a managed encrypt key (envelope encryption). Returns the plaintext key (base64) and its wrapped form to store.", {
+		org: z.string().optional(),
+		key: z.string()
+	}, async ({ org, key }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "encrypt") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		const dk = await generateDataKey(material, {
+			keyId: k.id,
+			version: currentVersion
+		});
+		return {
+			plaintextBase64: toBase64(dk.plaintext),
+			wrapped: dk.wrapped
+		};
+	});
+	tool("kms_sign", "Sign a message with a managed signing key; returns an sg1 signature blob.", {
+		org: z.string().optional(),
+		key: z.string(),
+		message: z.string()
+	}, async ({ org, key, message }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "sign") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		return { signature: await signMessage(await importSigningKey(material), {
+			keyId: k.id,
+			version: currentVersion
+		}, message) };
+	});
+	tool("kms_verify", "Verify an sg1 signature over a message using a signing key's published public key (no grant needed).", {
+		org: z.string().optional(),
+		key: z.string(),
+		signature: z.string(),
+		message: z.string()
+	}, async ({ org, key, signature, message }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const ref = signatureKeyRef(signature);
+		const { versions } = await ctx.client.getKmsPublicKeys(orgRef.id, k.id);
+		const pub = versions.find((v) => v.version === ref.version)?.publicKeyJwk;
+		if (!pub) throw new Error(`no published public key for version ${ref.version}`);
+		return { valid: await verifyMessage(await importVerifyingKey(pub), signature, message) };
+	});
 	tool("list_secrets", "List secret names + versions in an environment (never values).", targetShape, async (o) => {
 		const ctx = getCtx();
 		const { orgId, envId } = await resolveTargetEnv(ctx, o);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -23,9 +23,9 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
+    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/api-client": "0.0.1"
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",