@seekrit/cli 0.20.0 → 0.22.0

package/dist/index.js

@@ -1976,7 +1976,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.20.0";
+var version = "0.22.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1993,13 +1993,16 @@ var SeekritClient = class {
 	baseUrl;
 	auth;
 	fetchImpl;
+	client;
 	constructor(options) {
 		this.baseUrl = options.baseUrl.replace(/\/$/, "");
 		this.auth = options.auth;
 		this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+		this.client = options.client;
 	}
 	async request(method, path, body) {
 		const headers = { accept: "application/json" };
+		if (this.client) headers["x-seekrit-client"] = this.client;
 		if (this.auth.type === "bearer") headers.authorization = `Bearer ${this.auth.token}`;
 		else if (this.auth.type === "dynamic") {
 			const token = await this.auth.getToken();
@@ -2259,6 +2262,10 @@ var SeekritClient = class {
 	disableKmsKey(orgId, keyId) {
 		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/disable`);
 	}
+	/** Soft-delete a key: it drops out of every listing and read path. */
+	deleteKmsKey(orgId, keyId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/kms/keys/${keyId}`);
+	}
 	/** The broker's public key — wrap the admin credential to it before registering a target. */
 	getLeaseBrokerKey(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
@@ -2426,6 +2433,8 @@ async function readStdin() {
 }
 //#endregion
 //#region src/context.ts
+/** Sent as `x-seekrit-client` so the API attributes usage to the CLI (analytics). */
+const CLI_CLIENT = `cli/${version}`;
 /**
 * Build the client context from configured credentials, or return null when
 * none are set. `seekrit run` uses this to degrade to a plain launcher instead
@@ -2456,7 +2465,8 @@ function tryBuildContext(dotenvVars = {}) {
 	return {
 		client: new SeekritClient({
 			baseUrl: apiUrl,
-			auth
+			auth,
+			client: CLI_CLIENT
 		}),
 		auth
 	};
@@ -3113,6 +3123,13 @@ function registerKmsCommands(program) {
 		await ctx.client.disableKmsKey(org.id, key.id);
 		console.error(`disabled ${key.name}`);
 	});
+	kms.command("delete").description("delete a key (hides it from all listings; the name frees up for reuse)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		await ctx.client.deleteKmsKey(org.id, key.id);
+		console.error(`deleted ${key.name}`);
+	});
 	kms.command("encrypt").description("encrypt stdin under a key (prints a ce1 ciphertext blob)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "encryption context bound as AAD (required identically to decrypt)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
@@ -3221,7 +3238,8 @@ async function mintAdminToken(apiUrl, creds) {
 			type: "m2m",
 			clientId: creds.clientId,
 			clientSecret: creds.clientSecret
-		}
+		},
+		client: `cli/${version}`
 	});
 	const { orgs } = await client.listOrgs();
 	const org = orgs[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {