@seekrit/cli 0.17.0 → 0.17.2

package/dist/index.js

@@ -7,6 +7,128 @@ import { homedir, tmpdir } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
+/** All catalog keys as a runtime array (for iteration / zod enums). */
+const ENTITLEMENT_KEYS = Object.keys({
+	"feature.kms": {
+		kind: "feature",
+		label: "Managed keys (KMS)",
+		description: "Client-side managed keys for application-layer encryption and signing.",
+		default: true
+	},
+	"feature.leases": {
+		kind: "feature",
+		label: "Temporary access",
+		description: "Vault-style short-lived database and cloud credentials.",
+		default: true
+	},
+	"feature.log_sink": {
+		kind: "feature",
+		label: "Audit log export (SIEM)",
+		description: "Stream the audit log to an external OTLP collector.",
+		default: true
+	},
+	"feature.proxy": {
+		kind: "feature",
+		label: "Agent egress proxy",
+		description: "Substitute secrets into outbound requests for untrusted workloads.",
+		default: true
+	},
+	"feature.sso": {
+		kind: "feature",
+		label: "SSO / SAML",
+		description: "Single sign-on beyond the built-in providers.",
+		default: true
+	},
+	"apps.max": {
+		kind: "limit",
+		label: "Applications",
+		description: "Maximum applications in the organization.",
+		default: null
+	},
+	"envs.per_app.max": {
+		kind: "limit",
+		label: "Environments per application",
+		description: "Maximum environments under a single application.",
+		default: null
+	},
+	"secrets.per_env.max": {
+		kind: "limit",
+		label: "Secrets per environment",
+		description: "Maximum secrets in a single environment.",
+		default: null
+	},
+	"groups.max": {
+		kind: "limit",
+		label: "Groups",
+		description: "Maximum reusable secret groups in the organization.",
+		default: null
+	},
+	"tokens.max": {
+		kind: "limit",
+		label: "Service tokens",
+		description: "Maximum active service tokens in the organization.",
+		default: null
+	},
+	"kms.keys.max": {
+		kind: "limit",
+		label: "Managed keys",
+		description: "Maximum managed KMS keys in the organization.",
+		default: null
+	},
+	"lease.targets.max": {
+		kind: "limit",
+		label: "Lease targets",
+		description: "Maximum registered temporary-access targets.",
+		default: null
+	},
+	members: {
+		kind: "metered",
+		label: "Members",
+		description: "Users in the organization. Included in the plan, then billed per seat.",
+		default: null,
+		metric: "member_count"
+	},
+	"resolves.monthly": {
+		kind: "metered",
+		label: "Monthly resolves",
+		description: "Secret resolutions per month. Included in the plan, then billed per unit.",
+		default: null,
+		metric: "monthly_resolves"
+	}
+});
+const PLAN_FAMILY_IDS = Object.keys({
+	free: {
+		id: "free",
+		name: "Free",
+		description: "Get started with the essentials.",
+		current: 1
+	},
+	pro: {
+		id: "pro",
+		name: "Pro",
+		description: "For teams running secrets in production.",
+		current: 1
+	},
+	enterprise: {
+		id: "enterprise",
+		name: "Enterprise",
+		description: "Unlimited scale with advanced governance.",
+		current: 1
+	}
+});
+//#endregion
+//#region ../../packages/core/src/billing.ts
+/**
+* Lifecycle states a subscription can be in. Mirrors the biller's own states
+* (Stripe) but is provider-neutral so a different biller could map onto it.
+*/
+const SUBSCRIPTION_STATUSES = [
+	"trialing",
+	"active",
+	"past_due",
+	"canceled",
+	"paused"
+];
 z.enum([
 	"postgres",
 	"mysql",
@@ -540,6 +662,9 @@ z.object({
 	name: nameSchema,
 	slug: slugSchema
 });
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
 z.object({
 	email: emailSchema,
 	role: inviteRoleSchema.default("member")
@@ -639,6 +764,26 @@ z.object({
 	headers: z.record(z.string().min(1).max(256), z.string().max(4096)).optional(),
 	enabled: z.boolean().default(true)
 });
+const planFamilySchema = z.enum(PLAN_FAMILY_IDS);
+const subscriptionStatusSchema = z.enum(SUBSCRIPTION_STATUSES);
+z.enum(ENTITLEMENT_KEYS);
+/** An entitlement value: boolean (features), number or null/unlimited (limits, metered). */
+const entitlementValueSchema = z.union([
+	z.boolean(),
+	z.number(),
+	z.null()
+]);
+z.object({
+	family: planFamilySchema,
+	version: z.number().int().positive().optional(),
+	status: subscriptionStatusSchema.default("active")
+});
+z.object({
+	value: entitlementValueSchema,
+	note: z.string().max(500).nullish(),
+	expiresAt: z.iso.datetime().nullish()
+});
+z.object({ family: planFamilySchema });
 z.object({
 	cursor: z.string().optional(),
 	limit: z.coerce.number().int().min(1).max(200).default(50),
@@ -1576,7 +1721,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.17.0";
+var version = "0.17.2";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1646,6 +1791,10 @@ var SeekritClient = class {
 	getOrg(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}`);
 	}
+	/** Rename an organization (display name only — the slug is immutable). */
+	updateOrg(orgId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}`, input);
+	}
 	listMembers(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/members`);
 	}
@@ -1667,6 +1816,10 @@ var SeekritClient = class {
 	getApp(orgId, appId) {
 		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}`);
 	}
+	/** Rename an application (display name only — the slug is immutable). */
+	updateApp(orgId, appId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/apps/${appId}`, input);
+	}
 	deleteApp(orgId, appId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/apps/${appId}`);
 	}
@@ -1691,6 +1844,10 @@ var SeekritClient = class {
 	getGroup(orgId, groupId) {
 		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}`);
 	}
+	/** Rename a group (display name only — the slug is immutable). */
+	updateGroup(orgId, groupId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/groups/${groupId}`, input);
+	}
 	deleteGroup(orgId, groupId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/groups/${groupId}`);
 	}
@@ -1748,6 +1905,10 @@ var SeekritClient = class {
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
+	/** Permanently delete a token. Only allowed once it has been revoked. */
+	deleteToken(orgId, tokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}/permanent`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -1828,6 +1989,40 @@ var SeekritClient = class {
 	testLogSink(orgId) {
 		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
 	}
+	/**
+	* The org's plan, effective entitlements, current metered usage ("X of Y"),
+	* overrides, and which self-serve actions are available (`manage`). Readable
+	* by any member; `enforced` reports whether limits are currently active
+	* (false until plans are turned on, when every org has full access).
+	*/
+	getBilling(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/billing`);
+	}
+	/**
+	* Start self-serve checkout to upgrade the org to a plan family. Returns a
+	* biller-hosted URL to redirect the browser to. Admin-only; the biller must
+	* be configured (see `getBilling().manage`). The resulting subscription links
+	* back to the org via the checkout webhook.
+	*/
+	startCheckout(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/checkout`, input);
+	}
+	/**
+	* Open the biller's Billing Portal to manage the existing subscription
+	* (update card, change plan, cancel). Returns a URL to redirect to. Admin-only
+	* and only once a biller customer is linked (see `getBilling().manage.portal`).
+	*/
+	openBillingPortal(orgId) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/portal`);
+	}
+	/**
+	* Downgrade the org to the Free (default) plan: cancels any active paid
+	* subscription in the biller and reverts the org to Free immediately.
+	* Admin-only. Refetch `getBilling` for the new state.
+	*/
+	cancelSubscription(orgId) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/cancel`);
+	}
 };
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
@@ -2586,7 +2781,7 @@ function registerKmsCommands(program) {
 		});
 		console.error(`rotated ${rotated.name} to v${rotated.currentVersion} (${grants.length} grantees)`);
 	});
-	kms.command("disable").description("disable a key (blocks new grants/rotations; existing data still decrypts)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("disable").description("disable a key (blocks all use: encrypt/decrypt/sign and new grants/rotations)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -3886,6 +4081,12 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 	await ctx.client.revokeToken(orgRef.id, tokenId);
 	console.error(`${tokenId} revoked`);
 });
+token.command("delete <tokenId>").description("permanently delete a revoked service token (revoke it first)").option("--org <slug>").action(async (tokenId, options) => {
+	const ctx = buildContext();
+	const orgRef = await resolveOrg(ctx, options.org);
+	await ctx.client.deleteToken(orgRef.id, tokenId);
+	console.error(`${tokenId} deleted`);
+});
 registerPgCommands(program);
 registerMysqlCommands(program);
 registerRedisCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {