@seekrit/cli 0.19.0 → 0.21.0

package/dist/index.js

@@ -1976,7 +1976,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.19.0";
+var version = "0.21.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -2005,7 +2005,8 @@ var SeekritClient = class {
 			const token = await this.auth.getToken();
 			if (!token) throw new SeekritApiError(401, "unauthorized", "session expired");
 			headers.authorization = `Bearer ${token}`;
-		} else headers["x-seekrit-dev-user"] = this.auth.email;
+		} else if (this.auth.type === "m2m") headers.authorization = `Basic ${btoa(`${this.auth.clientId}:${this.auth.clientSecret}`)}`;
+		else headers["x-seekrit-dev-user"] = this.auth.email;
 		if (body !== void 0) headers["content-type"] = "application/json";
 		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
 			method,
@@ -2258,6 +2259,10 @@ var SeekritClient = class {
 	disableKmsKey(orgId, keyId) {
 		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/disable`);
 	}
+	/** Soft-delete a key: it drops out of every listing and read path. */
+	deleteKmsKey(orgId, keyId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/kms/keys/${keyId}`);
+	}
 	/** The broker's public key — wrap the admin credential to it before registering a target. */
 	getLeaseBrokerKey(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
@@ -2355,6 +2360,17 @@ function writeGlobalConfig(update) {
 	mkdirSync(dirname(path), { recursive: true });
 	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
 }
+/** The admin token previously auto-minted from these M2M credentials, if any. */
+function readCachedM2mToken(clientId) {
+	return readGlobalConfig().m2mTokens?.[clientId];
+}
+/** Remember an auto-minted admin token so the next run reuses it. */
+function cacheM2mToken(clientId, token) {
+	writeGlobalConfig({ m2mTokens: {
+		...readGlobalConfig().m2mTokens,
+		[clientId]: token
+	} });
+}
 /** Walk up from cwd looking for seekrit.json. */
 function findProjectConfig(startDir = process.cwd()) {
 	let dir = startDir;
@@ -2451,7 +2467,7 @@ function tryBuildContext(dotenvVars = {}) {
 }
 function buildContext() {
 	const ctx = tryBuildContext();
-	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER");
+	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…` (or `--client-id … --client-secret …`), or set SEEKRIT_TOKEN / SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET / SEEKRIT_DEV_USER");
 	return ctx;
 }
 function isTokenAuth(ctx) {
@@ -3101,6 +3117,13 @@ function registerKmsCommands(program) {
 		await ctx.client.disableKmsKey(org.id, key.id);
 		console.error(`disabled ${key.name}`);
 	});
+	kms.command("delete").description("delete a key (hides it from all listings; the name frees up for reuse)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		await ctx.client.deleteKmsKey(org.id, key.id);
+		console.error(`deleted ${key.name}`);
+	});
 	kms.command("encrypt").description("encrypt stdin under a key (prints a ce1 ciphertext blob)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "encryption context bound as AAD (required identically to decrypt)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
@@ -3177,6 +3200,77 @@ function registerKmsCommands(program) {
 	});
 }
 //#endregion
+//#region src/m2m.ts
+/**
+* Resolve M2M client credentials from (in order) the process environment, a
+* `.env` overlay (for `seekrit run`), then saved config. Both halves must come
+* through for the credential to be usable.
+*/
+function readM2mCreds(dotenvVars = {}) {
+	const config = readGlobalConfig();
+	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const clientId = fromEnv("SEEKRIT_CLIENT_ID") ?? config.clientId;
+	const clientSecret = fromEnv("SEEKRIT_CLIENT_SECRET") ?? config.clientSecret;
+	if (!clientId || !clientSecret) return null;
+	return {
+		clientId,
+		clientSecret
+	};
+}
+/** True when a service/dev credential is already configured explicitly. */
+function hasExplicitCredential(dotenvVars) {
+	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	if (fromEnv("SEEKRIT_TOKEN") || fromEnv("SEEKRIT_DEV_USER")) return true;
+	const config = readGlobalConfig();
+	return Boolean(config.token || config.devUser);
+}
+/** Mint a fresh org-scoped admin token using M2M credentials (keyless). */
+async function mintAdminToken(apiUrl, creds) {
+	const client = new SeekritClient({
+		baseUrl: apiUrl,
+		auth: {
+			type: "m2m",
+			clientId: creds.clientId,
+			clientSecret: creds.clientSecret
+		}
+	});
+	const { orgs } = await client.listOrgs();
+	const org = orgs[0];
+	if (!org) throw new Error("machine client has no organization — sign up first (POST /signup)");
+	const created = await createServiceToken();
+	await client.createToken(org.id, {
+		name: "agent-admin (auto)",
+		tokenId: created.tokenId,
+		tokenHash: created.tokenHash,
+		publicKeyJwk: created.publicKeyJwk,
+		role: "admin",
+		environmentId: null
+	});
+	return created.token;
+}
+/**
+* If M2M credentials are configured (and no explicit token/dev-user is), ensure
+* an admin token exists for them — minting and caching one on first use — and
+* expose it as `SEEKRIT_TOKEN` so the normal credential resolution
+* ({@link tryBuildContext}) picks it up. A no-op (returns null) when there is
+* nothing to bootstrap. Throws only when credentials ARE present but minting
+* fails, so the reason surfaces instead of a later opaque "no credentials".
+*/
+async function ensureM2mAdminToken(dotenvVars = {}) {
+	if (hasExplicitCredential(dotenvVars)) return null;
+	const creds = readM2mCreds(dotenvVars);
+	if (!creds) return null;
+	const cached = readCachedM2mToken(creds.clientId);
+	if (cached) {
+		process.env.SEEKRIT_TOKEN = cached;
+		return cached;
+	}
+	const token = await mintAdminToken(process.env.SEEKRIT_API_URL ?? dotenvVars.SEEKRIT_API_URL ?? readGlobalConfig().apiUrl ?? "https://api.seekrit.dev", creds);
+	cacheM2mToken(creds.clientId, token);
+	process.env.SEEKRIT_TOKEN = token;
+	return token;
+}
+//#endregion
 //#region src/mongodb.ts
 /**
 * `seekrit mongodb` — temporary MongoDB credentials (Vault-style dynamic
@@ -4225,10 +4319,16 @@ function collectList(value, acc = []) {
 	return acc;
 }
 const program = new Command("seekrit").description("End-to-end encrypted secrets manager").version(version).enablePositionalOptions();
-program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_…)").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").action((options) => {
+program.hook("preAction", async () => {
+	await ensureM2mAdminToken();
+});
+program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_…)").option("--client-id <id>", "machine (M2M) client id — auto-mints an admin token").option("--client-secret <secret>", "machine (M2M) client secret").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").action((options) => {
 	if (options.token && !isServiceToken(options.token)) fail("token must start with skt_");
+	if (Boolean(options.clientId) !== Boolean(options.clientSecret)) fail("--client-id and --client-secret must be given together");
 	writeGlobalConfig({
 		...options.token ? { token: options.token } : {},
+		...options.clientId ? { clientId: options.clientId } : {},
+		...options.clientSecret ? { clientSecret: options.clientSecret } : {},
 		...options.devUser ? { devUser: options.devUser } : {},
 		...options.apiUrl ? { apiUrl: options.apiUrl } : {}
 	});
@@ -4451,6 +4551,7 @@ async function materializeForRun(options) {
 	const dotenvVars = {};
 	overlayEnvFiles(dotenvVars, {}, envFiles);
 	try {
+		await ensureM2mAdminToken(dotenvVars);
 		const ctx = tryBuildContext(dotenvVars);
 		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
 		return await materialize(ctx, options);
@@ -4615,7 +4716,7 @@ registerMongoCommands(program);
 registerKmsCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-DR_Ghb4w.js");
+	const { runMcpServer } = await import("./mcp-DScHFOMG.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -4629,4 +4730,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { generateEncryptKeyMaterial as A, importVerifyingKey as C, generatePostgresCredential as D, verifyMessage as E, generateDek as F, toBase64 as I, kmsDecrypt as M, kmsEncrypt as N, generateMysqlCredential as O, wrapDek as P, importSigningKey as S, signatureKeyRef as T, version as _, kmsRecoverMaterial as a, parseServiceToken as b, resolveAppEnv as c, resolveOrg as d, getDek as f, writeProjectConfig as g, setFailThrows as h, kmsCallerIdentity as i, kmsBlobKeyRef as j, generateDataKey as k, resolveEnvTarget as l, tryBuildContext as m, fetchDecryptedSecrets as n, kmsResolveKey as o, isTokenAuth as p, materializeEnv as r, kmsResolveRecipient as s, encryptAndSetSecret as t, resolveGroup as u, createServiceToken as v, signMessage as w, generateSigningKeyMaterial as x, isServiceToken as y };
+export { generateDataKey as A, importSigningKey as C, verifyMessage as D, signatureKeyRef as E, wrapDek as F, generateDek as I, toBase64 as L, kmsBlobKeyRef as M, kmsDecrypt as N, generatePostgresCredential as O, kmsEncrypt as P, generateSigningKeyMaterial as S, signMessage as T, writeProjectConfig as _, kmsCallerIdentity as a, isServiceToken as b, kmsResolveRecipient as c, resolveGroup as d, resolveOrg as f, setFailThrows as g, tryBuildContext as h, ensureM2mAdminToken as i, generateEncryptKeyMaterial as j, generateMysqlCredential as k, resolveAppEnv as l, isTokenAuth as m, fetchDecryptedSecrets as n, kmsRecoverMaterial as o, getDek as p, materializeEnv as r, kmsResolveKey as s, encryptAndSetSecret as t, resolveEnvTarget as u, version as v, importVerifyingKey as w, parseServiceToken as x, createServiceToken as y };

package/dist/{mcp-DR_Ghb4w.js → mcp-DScHFOMG.js}

@@ -1,4 +1,4 @@
-import { A as generateEncryptKeyMaterial, C as importVerifyingKey, D as generatePostgresCredential, E as verifyMessage, F as generateDek, I as toBase64, M as kmsDecrypt, N as kmsEncrypt, O as generateMysqlCredential, P as wrapDek, S as importSigningKey, T as signatureKeyRef, _ as version, a as kmsRecoverMaterial, b as parseServiceToken, c as resolveAppEnv, d as resolveOrg, f as getDek, g as writeProjectConfig, h as setFailThrows, i as kmsCallerIdentity, j as kmsBlobKeyRef, k as generateDataKey, l as resolveEnvTarget, m as tryBuildContext, n as fetchDecryptedSecrets, o as kmsResolveKey, p as isTokenAuth, r as materializeEnv, s as kmsResolveRecipient, t as encryptAndSetSecret, u as resolveGroup, v as createServiceToken, w as signMessage, x as generateSigningKeyMaterial, y as isServiceToken } from "./index.js";
+import { A as generateDataKey, C as importSigningKey, D as verifyMessage, E as signatureKeyRef, F as wrapDek, I as generateDek, L as toBase64, M as kmsBlobKeyRef, N as kmsDecrypt, O as generatePostgresCredential, P as kmsEncrypt, S as generateSigningKeyMaterial, T as signMessage, _ as writeProjectConfig, a as kmsCallerIdentity, b as isServiceToken, c as kmsResolveRecipient, d as resolveGroup, f as resolveOrg, g as setFailThrows, h as tryBuildContext, i as ensureM2mAdminToken, j as generateEncryptKeyMaterial, k as generateMysqlCredential, l as resolveAppEnv, m as isTokenAuth, n as fetchDecryptedSecrets, o as kmsRecoverMaterial, p as getDek, r as materializeEnv, s as kmsResolveKey, t as encryptAndSetSecret, u as resolveEnvTarget, v as version, w as importVerifyingKey, x as parseServiceToken, y as createServiceToken } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -29,7 +29,7 @@ function errText(err) {
 /** Build the client context or throw a friendly, agent-readable error. */
 function getCtx() {
 	const ctx = tryBuildContext();
-	if (!ctx) throw new Error("no credentials — set SEEKRIT_TOKEN (a skt_… token) or SEEKRIT_DEV_USER in the MCP server env, or run `seekrit login` first");
+	if (!ctx) throw new Error("no credentials — set SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET (machine credentials from POST /signup) or SEEKRIT_TOKEN (a skt_… token) in the MCP server env, or run `seekrit login` first");
 	return ctx;
 }
 /**
@@ -117,6 +117,7 @@ async function resolveTargetEnv(ctx, o) {
 }
 async function runMcpServer(options = {}) {
 	setFailThrows(true);
+	await ensureM2mAdminToken();
 	const server = new McpServer({
 		name: "seekrit",
 		version: options.version ?? version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,8 +27,8 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/core": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",