@seekrit/cli 0.18.0 → 0.20.0

package/dist/index.js

@@ -96,26 +96,40 @@ const ENTITLEMENT_KEYS = Object.keys({
 		metric: "monthly_resolves"
 	}
 });
-const PLAN_FAMILY_IDS = Object.keys({
+//#endregion
+//#region ../../packages/core/src/plans.ts
+const PLAN_FAMILIES = {
 	free: {
 		id: "free",
 		name: "Free",
 		description: "Get started with the essentials.",
-		current: 1
+		current: 1,
+		hidden: false
+	},
+	team: {
+		id: "team",
+		name: "Team",
+		description: "For small teams collaborating on secrets.",
+		current: 1,
+		hidden: false
 	},
 	pro: {
 		id: "pro",
 		name: "Pro",
 		description: "For teams running secrets in production.",
-		current: 1
+		current: 1,
+		hidden: true
 	},
 	enterprise: {
 		id: "enterprise",
 		name: "Enterprise",
 		description: "Unlimited scale with advanced governance.",
-		current: 1
+		current: 1,
+		hidden: false
 	}
-});
+};
+const PLAN_FAMILY_IDS = Object.keys(PLAN_FAMILIES);
+PLAN_FAMILY_IDS.filter((family) => !PLAN_FAMILIES[family].hidden);
 //#endregion
 //#region ../../packages/core/src/billing.ts
 /**
@@ -665,6 +679,7 @@ z.object({
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
+z.object({ required: z.boolean() });
 z.object({
 	email: emailSchema,
 	role: inviteRoleSchema.default("member")
@@ -1961,7 +1976,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.18.0";
+var version = "0.20.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1990,7 +2005,8 @@ var SeekritClient = class {
 			const token = await this.auth.getToken();
 			if (!token) throw new SeekritApiError(401, "unauthorized", "session expired");
 			headers.authorization = `Bearer ${token}`;
-		} else headers["x-seekrit-dev-user"] = this.auth.email;
+		} else if (this.auth.type === "m2m") headers.authorization = `Basic ${btoa(`${this.auth.clientId}:${this.auth.clientSecret}`)}`;
+		else headers["x-seekrit-dev-user"] = this.auth.email;
 		if (body !== void 0) headers["content-type"] = "application/json";
 		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
 			method,
@@ -2038,6 +2054,17 @@ var SeekritClient = class {
 	listMembers(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/members`);
 	}
+	/**
+	* The org-wide "require a second factor for all members" policy. `configured`
+	* is false when the identity provider isn't wired up (local dev), in which
+	* case the toggle is inert.
+	*/
+	getMfaPolicy(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/mfa-policy`);
+	}
+	setMfaPolicy(orgId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/mfa-policy`, input);
+	}
 	listInvites(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/invites`);
 	}
@@ -2329,6 +2356,17 @@ function writeGlobalConfig(update) {
 	mkdirSync(dirname(path), { recursive: true });
 	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
 }
+/** The admin token previously auto-minted from these M2M credentials, if any. */
+function readCachedM2mToken(clientId) {
+	return readGlobalConfig().m2mTokens?.[clientId];
+}
+/** Remember an auto-minted admin token so the next run reuses it. */
+function cacheM2mToken(clientId, token) {
+	writeGlobalConfig({ m2mTokens: {
+		...readGlobalConfig().m2mTokens,
+		[clientId]: token
+	} });
+}
 /** Walk up from cwd looking for seekrit.json. */
 function findProjectConfig(startDir = process.cwd()) {
 	let dir = startDir;
@@ -2425,7 +2463,7 @@ function tryBuildContext(dotenvVars = {}) {
 }
 function buildContext() {
 	const ctx = tryBuildContext();
-	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER");
+	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…` (or `--client-id … --client-secret …`), or set SEEKRIT_TOKEN / SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET / SEEKRIT_DEV_USER");
 	return ctx;
 }
 function isTokenAuth(ctx) {
@@ -3151,6 +3189,77 @@ function registerKmsCommands(program) {
 	});
 }
 //#endregion
+//#region src/m2m.ts
+/**
+* Resolve M2M client credentials from (in order) the process environment, a
+* `.env` overlay (for `seekrit run`), then saved config. Both halves must come
+* through for the credential to be usable.
+*/
+function readM2mCreds(dotenvVars = {}) {
+	const config = readGlobalConfig();
+	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const clientId = fromEnv("SEEKRIT_CLIENT_ID") ?? config.clientId;
+	const clientSecret = fromEnv("SEEKRIT_CLIENT_SECRET") ?? config.clientSecret;
+	if (!clientId || !clientSecret) return null;
+	return {
+		clientId,
+		clientSecret
+	};
+}
+/** True when a service/dev credential is already configured explicitly. */
+function hasExplicitCredential(dotenvVars) {
+	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	if (fromEnv("SEEKRIT_TOKEN") || fromEnv("SEEKRIT_DEV_USER")) return true;
+	const config = readGlobalConfig();
+	return Boolean(config.token || config.devUser);
+}
+/** Mint a fresh org-scoped admin token using M2M credentials (keyless). */
+async function mintAdminToken(apiUrl, creds) {
+	const client = new SeekritClient({
+		baseUrl: apiUrl,
+		auth: {
+			type: "m2m",
+			clientId: creds.clientId,
+			clientSecret: creds.clientSecret
+		}
+	});
+	const { orgs } = await client.listOrgs();
+	const org = orgs[0];
+	if (!org) throw new Error("machine client has no organization — sign up first (POST /signup)");
+	const created = await createServiceToken();
+	await client.createToken(org.id, {
+		name: "agent-admin (auto)",
+		tokenId: created.tokenId,
+		tokenHash: created.tokenHash,
+		publicKeyJwk: created.publicKeyJwk,
+		role: "admin",
+		environmentId: null
+	});
+	return created.token;
+}
+/**
+* If M2M credentials are configured (and no explicit token/dev-user is), ensure
+* an admin token exists for them — minting and caching one on first use — and
+* expose it as `SEEKRIT_TOKEN` so the normal credential resolution
+* ({@link tryBuildContext}) picks it up. A no-op (returns null) when there is
+* nothing to bootstrap. Throws only when credentials ARE present but minting
+* fails, so the reason surfaces instead of a later opaque "no credentials".
+*/
+async function ensureM2mAdminToken(dotenvVars = {}) {
+	if (hasExplicitCredential(dotenvVars)) return null;
+	const creds = readM2mCreds(dotenvVars);
+	if (!creds) return null;
+	const cached = readCachedM2mToken(creds.clientId);
+	if (cached) {
+		process.env.SEEKRIT_TOKEN = cached;
+		return cached;
+	}
+	const token = await mintAdminToken(process.env.SEEKRIT_API_URL ?? dotenvVars.SEEKRIT_API_URL ?? readGlobalConfig().apiUrl ?? "https://api.seekrit.dev", creds);
+	cacheM2mToken(creds.clientId, token);
+	process.env.SEEKRIT_TOKEN = token;
+	return token;
+}
+//#endregion
 //#region src/mongodb.ts
 /**
 * `seekrit mongodb` — temporary MongoDB credentials (Vault-style dynamic
@@ -4199,10 +4308,16 @@ function collectList(value, acc = []) {
 	return acc;
 }
 const program = new Command("seekrit").description("End-to-end encrypted secrets manager").version(version).enablePositionalOptions();
-program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_…)").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").action((options) => {
+program.hook("preAction", async () => {
+	await ensureM2mAdminToken();
+});
+program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_…)").option("--client-id <id>", "machine (M2M) client id — auto-mints an admin token").option("--client-secret <secret>", "machine (M2M) client secret").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").action((options) => {
 	if (options.token && !isServiceToken(options.token)) fail("token must start with skt_");
+	if (Boolean(options.clientId) !== Boolean(options.clientSecret)) fail("--client-id and --client-secret must be given together");
 	writeGlobalConfig({
 		...options.token ? { token: options.token } : {},
+		...options.clientId ? { clientId: options.clientId } : {},
+		...options.clientSecret ? { clientSecret: options.clientSecret } : {},
 		...options.devUser ? { devUser: options.devUser } : {},
 		...options.apiUrl ? { apiUrl: options.apiUrl } : {}
 	});
@@ -4425,6 +4540,7 @@ async function materializeForRun(options) {
 	const dotenvVars = {};
 	overlayEnvFiles(dotenvVars, {}, envFiles);
 	try {
+		await ensureM2mAdminToken(dotenvVars);
 		const ctx = tryBuildContext(dotenvVars);
 		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
 		return await materialize(ctx, options);
@@ -4589,7 +4705,7 @@ registerMongoCommands(program);
 registerKmsCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-CVhEQDfd.js");
+	const { runMcpServer } = await import("./mcp-DScHFOMG.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -4603,4 +4719,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { generateEncryptKeyMaterial as A, importVerifyingKey as C, generatePostgresCredential as D, verifyMessage as E, generateDek as F, toBase64 as I, kmsDecrypt as M, kmsEncrypt as N, generateMysqlCredential as O, wrapDek as P, importSigningKey as S, signatureKeyRef as T, version as _, kmsRecoverMaterial as a, parseServiceToken as b, resolveAppEnv as c, resolveOrg as d, getDek as f, writeProjectConfig as g, setFailThrows as h, kmsCallerIdentity as i, kmsBlobKeyRef as j, generateDataKey as k, resolveEnvTarget as l, tryBuildContext as m, fetchDecryptedSecrets as n, kmsResolveKey as o, isTokenAuth as p, materializeEnv as r, kmsResolveRecipient as s, encryptAndSetSecret as t, resolveGroup as u, createServiceToken as v, signMessage as w, generateSigningKeyMaterial as x, isServiceToken as y };
+export { generateDataKey as A, importSigningKey as C, verifyMessage as D, signatureKeyRef as E, wrapDek as F, generateDek as I, toBase64 as L, kmsBlobKeyRef as M, kmsDecrypt as N, generatePostgresCredential as O, kmsEncrypt as P, generateSigningKeyMaterial as S, signMessage as T, writeProjectConfig as _, kmsCallerIdentity as a, isServiceToken as b, kmsResolveRecipient as c, resolveGroup as d, resolveOrg as f, setFailThrows as g, tryBuildContext as h, ensureM2mAdminToken as i, generateEncryptKeyMaterial as j, generateMysqlCredential as k, resolveAppEnv as l, isTokenAuth as m, fetchDecryptedSecrets as n, kmsRecoverMaterial as o, getDek as p, materializeEnv as r, kmsResolveKey as s, encryptAndSetSecret as t, resolveEnvTarget as u, version as v, importVerifyingKey as w, parseServiceToken as x, createServiceToken as y };

package/dist/{mcp-CVhEQDfd.js → mcp-DScHFOMG.js}

@@ -1,4 +1,4 @@
-import { A as generateEncryptKeyMaterial, C as importVerifyingKey, D as generatePostgresCredential, E as verifyMessage, F as generateDek, I as toBase64, M as kmsDecrypt, N as kmsEncrypt, O as generateMysqlCredential, P as wrapDek, S as importSigningKey, T as signatureKeyRef, _ as version, a as kmsRecoverMaterial, b as parseServiceToken, c as resolveAppEnv, d as resolveOrg, f as getDek, g as writeProjectConfig, h as setFailThrows, i as kmsCallerIdentity, j as kmsBlobKeyRef, k as generateDataKey, l as resolveEnvTarget, m as tryBuildContext, n as fetchDecryptedSecrets, o as kmsResolveKey, p as isTokenAuth, r as materializeEnv, s as kmsResolveRecipient, t as encryptAndSetSecret, u as resolveGroup, v as createServiceToken, w as signMessage, x as generateSigningKeyMaterial, y as isServiceToken } from "./index.js";
+import { A as generateDataKey, C as importSigningKey, D as verifyMessage, E as signatureKeyRef, F as wrapDek, I as generateDek, L as toBase64, M as kmsBlobKeyRef, N as kmsDecrypt, O as generatePostgresCredential, P as kmsEncrypt, S as generateSigningKeyMaterial, T as signMessage, _ as writeProjectConfig, a as kmsCallerIdentity, b as isServiceToken, c as kmsResolveRecipient, d as resolveGroup, f as resolveOrg, g as setFailThrows, h as tryBuildContext, i as ensureM2mAdminToken, j as generateEncryptKeyMaterial, k as generateMysqlCredential, l as resolveAppEnv, m as isTokenAuth, n as fetchDecryptedSecrets, o as kmsRecoverMaterial, p as getDek, r as materializeEnv, s as kmsResolveKey, t as encryptAndSetSecret, u as resolveEnvTarget, v as version, w as importVerifyingKey, x as parseServiceToken, y as createServiceToken } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -29,7 +29,7 @@ function errText(err) {
 /** Build the client context or throw a friendly, agent-readable error. */
 function getCtx() {
 	const ctx = tryBuildContext();
-	if (!ctx) throw new Error("no credentials — set SEEKRIT_TOKEN (a skt_… token) or SEEKRIT_DEV_USER in the MCP server env, or run `seekrit login` first");
+	if (!ctx) throw new Error("no credentials — set SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET (machine credentials from POST /signup) or SEEKRIT_TOKEN (a skt_… token) in the MCP server env, or run `seekrit login` first");
 	return ctx;
 }
 /**
@@ -115,11 +115,12 @@ async function resolveTargetEnv(ctx, o) {
 	}
 	return resolveEnvTarget(ctx, o);
 }
-async function runMcpServer() {
+async function runMcpServer(options = {}) {
 	setFailThrows(true);
+	await ensureM2mAdminToken();
 	const server = new McpServer({
 		name: "seekrit",
-		version
+		version: options.version ?? version
 	});
 	/** Register a tool whose handler returns data (serialized) or throws (→ isError). */
 	const tool = (name, description, shape, handler) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -9,6 +9,9 @@
   "bin": {
     "seekrit": "./dist/index.js"
   },
+  "exports": {
+    "./mcp": "./src/mcp.ts"
+  },
   "files": [
     "dist"
   ],