@seekrit/cli 0.23.4 → 0.24.0

package/dist/index.js

@@ -708,6 +708,8 @@ z.object({
 z.object({ 
 /** Opaque versioned ciphertext blob from @seekrit/crypto. */
 ciphertext: z.string().min(1).max(65536) });
+z.object({ version: z.number().int().positive() });
+z.object({ limit: z.coerce.number().int().min(1).max(200).default(50) });
 z.object({
 	publicKeyJwk: z.string().min(1),
 	/**
@@ -1152,7 +1154,7 @@ function encryptAad(ref, context) {
 function dataKeyAad(keyId, version) {
 	return `${keyId}/${version}`;
 }
-function parseVersion(versionStr) {
+function parseVersion$1(versionStr) {
 	const version = Number(versionStr);
 	if (!Number.isInteger(version) || version < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid key version in KMS blob");
 	return version;
@@ -1164,7 +1166,7 @@ function kmsBlobKeyRef(blob) {
 	const [keyId, versionStr] = splitBlob(blob, prefix, 4);
 	return {
 		keyId,
-		version: parseVersion(versionStr)
+		version: parseVersion$1(versionStr)
 	};
 }
 /** Encrypt a value under a managed key. `context` (bound as AAD) defaults to empty. */
@@ -1193,7 +1195,7 @@ async function kmsDecrypt(material, blob, context = "") {
 	const [keyId, versionStr, ivB64, ctB64] = splitBlob(blob, ENCRYPT_PREFIX, 4);
 	const ref = {
 		keyId,
-		version: parseVersion(versionStr)
+		version: parseVersion$1(versionStr)
 	};
 	const key = await importAesKey(material, "decrypt");
 	try {
@@ -1976,7 +1978,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.23.4";
+var version = "0.24.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -2153,6 +2155,19 @@ var SeekritClient = class {
 	deleteSecret(orgId, envId, name) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`);
 	}
+	/** A secret's append-only history, newest version first. */
+	listSecretVersions(orgId, envId, name, query = {}) {
+		const qs = query.limit === void 0 ? "" : `?limit=${query.limit}`;
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}/versions${qs}`);
+	}
+	/**
+	* Roll a secret back to an earlier version. Keyless — the server copies the
+	* ciphertext it already stores, so this appends a new version rather than
+	* rewinding, and needs no DEK on the caller's side.
+	*/
+	restoreSecret(orgId, envId, name, version) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}/restore`, { version });
+	}
 	/** The calling principal's wrapped DEK for this environment. */
 	getMyEnvKey(orgId, envId) {
 		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
@@ -4080,14 +4095,23 @@ function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
 }
-//#endregion
-//#region src/secrets.ts
 /** Fetch + decrypt every secret in a single environment. */
 async function fetchDecryptedSecrets(ctx, orgId, envId) {
 	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
 	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
 	return Object.fromEntries(entries);
 }
+/**
+* Decrypt one historical version of a secret. Ciphertext is bound to
+* `(envId, name)` as AAD and neither changes across versions, so an old blob
+* opens with the environment's current data key — no special handling needed.
+*/
+async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
+	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
+	const row = versions.find((v) => v.version === version);
+	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
+	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
+}
 async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
 	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
 	await ctx.client.setSecret(orgId, envId, name, ciphertext);
@@ -4480,6 +4504,12 @@ group.command("env").description("manage a group’s environments (per-slug valu
 	});
 	console.error(`created ${groupRef.slug}@${created.environment.slug} (${created.environment.id})`);
 });
+/** Parse a positive integer flag/argument (version numbers, page sizes). */
+function parseVersion(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 1) fail(`expected a positive whole number, got "${raw}"`);
+	return n;
+}
 /** Attach the environment-selection flags shared by every `secrets` command. */
 function withTarget(cmd) {
 	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>", "environment slug");
@@ -4491,10 +4521,12 @@ withTarget(secrets.command("list").description("list secret names (no values)"))
 	const { secrets: rows } = await ctx.client.listSecrets(orgId, envId);
 	for (const row of rows) console.log(`${row.name}\tv${row.version}\t${row.updatedAt}`);
 });
-withTarget(secrets.command("get <name>").description("decrypt and print one secret value")).action(async (name, options) => {
+withTarget(secrets.command("get <name>").description("decrypt and print one secret value").option("--version <n>", "print an earlier version instead of the current one")).action(async (name, options) => {
 	const ctx = buildContext();
 	const { orgId, envId } = await resolveEnvTarget(ctx, options);
-	const value = (await fetchDecryptedSecrets(ctx, orgId, envId))[name];
+	let value;
+	if (options.version === void 0) value = (await fetchDecryptedSecrets(ctx, orgId, envId))[name];
+	else value = await fetchDecryptedVersion(ctx, orgId, envId, name, parseVersion(options.version));
 	if (value === void 0) fail(`no secret named ${name}`);
 	process.stdout.write(value);
 	if (process.stdout.isTTY) process.stdout.write("\n");
@@ -4530,6 +4562,22 @@ withTarget(secrets.command("import [file]").description("bulk-import secrets fro
 	const { created, updated } = await importSecrets(ctx, orgId, envId, entries);
 	console.error(`imported ${created.length + updated.length} secret(s) into ${label} (${created.length} new, ${updated.length} updated)`);
 });
+withTarget(secrets.command("history <name>").description("list a secret's versions (metadata only — no values)").option("--limit <n>", `how many versions to show (max 200)`, "20")).action(async (name, options) => {
+	const ctx = buildContext();
+	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	const { versions, currentVersion } = await ctx.client.listSecretVersions(orgId, envId, name, { limit: parseVersion(options.limit) });
+	for (const v of versions) {
+		const marks = [v.version === currentVersion ? "current" : null, v.restoredFromVersion === null ? null : `restored from v${v.restoredFromVersion}`].filter(Boolean);
+		const note = marks.length > 0 ? `\t${marks.join(", ")}` : "";
+		console.log(`v${v.version}\t${v.createdAt}\t${v.createdByType}:${v.createdById}${note}`);
+	}
+});
+withTarget(secrets.command("restore <name> <version>").description("roll a secret back to an earlier version (stored as a new version)")).action(async (name, version, options) => {
+	const ctx = buildContext();
+	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	const { secret, restoredFrom } = await ctx.client.restoreSecret(orgId, envId, name, parseVersion(version));
+	console.error(`${name} restored from v${restoredFrom} — now v${secret.version}`);
+});
 withTarget(secrets.command("rm <name>").description("delete a secret")).action(async (name, options) => {
 	const ctx = buildContext();
 	const { orgId, envId } = await resolveEnvTarget(ctx, options);
@@ -4861,7 +4909,7 @@ registerMongoCommands(program);
 registerKmsCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-CbNXG37n.js");
+	const { runMcpServer } = await import("./mcp-t-sJ_SvE.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -4875,4 +4923,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { generateDataKey as A, importSigningKey as C, verifyMessage as D, signatureKeyRef as E, wrapDek as F, generateDek as I, toBase64 as L, kmsBlobKeyRef as M, kmsDecrypt as N, generatePostgresCredential as O, kmsEncrypt as P, generateSigningKeyMaterial as S, signMessage as T, writeProjectConfig as _, kmsCallerIdentity as a, isServiceToken as b, kmsResolveRecipient as c, resolveGroup as d, resolveOrg as f, setFailThrows as g, tryBuildContext as h, ensureM2mAdminToken as i, generateEncryptKeyMaterial as j, generateMysqlCredential as k, resolveAppEnv as l, isTokenAuth as m, fetchDecryptedSecrets as n, kmsRecoverMaterial as o, getDek as p, materializeEnv as r, kmsResolveKey as s, encryptAndSetSecret as t, resolveEnvTarget as u, version as v, importVerifyingKey as w, parseServiceToken as x, createServiceToken as y };
+export { generateMysqlCredential as A, generateSigningKeyMaterial as C, signatureKeyRef as D, signMessage as E, kmsEncrypt as F, wrapDek as I, generateDek as L, generateEncryptKeyMaterial as M, kmsBlobKeyRef as N, verifyMessage as O, kmsDecrypt as P, toBase64 as R, parseServiceToken as S, importVerifyingKey as T, setFailThrows as _, ensureM2mAdminToken as a, createServiceToken as b, kmsResolveKey as c, resolveEnvTarget as d, resolveGroup as f, tryBuildContext as g, isTokenAuth as h, materializeEnv as i, generateDataKey as j, generatePostgresCredential as k, kmsResolveRecipient as l, getDek as m, fetchDecryptedSecrets as n, kmsCallerIdentity as o, resolveOrg as p, fetchDecryptedVersion as r, kmsRecoverMaterial as s, encryptAndSetSecret as t, resolveAppEnv as u, writeProjectConfig as v, importSigningKey as w, isServiceToken as x, version as y };

package/dist/{mcp-CbNXG37n.js → mcp-t-sJ_SvE.js}

@@ -1,4 +1,4 @@
-import { A as generateDataKey, C as importSigningKey, D as verifyMessage, E as signatureKeyRef, F as wrapDek, I as generateDek, L as toBase64, M as kmsBlobKeyRef, N as kmsDecrypt, O as generatePostgresCredential, P as kmsEncrypt, S as generateSigningKeyMaterial, T as signMessage, _ as writeProjectConfig, a as kmsCallerIdentity, b as isServiceToken, c as kmsResolveRecipient, d as resolveGroup, f as resolveOrg, g as setFailThrows, h as tryBuildContext, i as ensureM2mAdminToken, j as generateEncryptKeyMaterial, k as generateMysqlCredential, l as resolveAppEnv, m as isTokenAuth, n as fetchDecryptedSecrets, o as kmsRecoverMaterial, p as getDek, r as materializeEnv, s as kmsResolveKey, t as encryptAndSetSecret, u as resolveEnvTarget, v as version, w as importVerifyingKey, x as parseServiceToken, y as createServiceToken } from "./index.js";
+import { A as generateMysqlCredential, C as generateSigningKeyMaterial, D as signatureKeyRef, E as signMessage, F as kmsEncrypt, I as wrapDek, L as generateDek, M as generateEncryptKeyMaterial, N as kmsBlobKeyRef, O as verifyMessage, P as kmsDecrypt, R as toBase64, S as parseServiceToken, T as importVerifyingKey, _ as setFailThrows, a as ensureM2mAdminToken, b as createServiceToken, c as kmsResolveKey, d as resolveEnvTarget, f as resolveGroup, g as tryBuildContext, h as isTokenAuth, i as materializeEnv, j as generateDataKey, k as generatePostgresCredential, l as kmsResolveRecipient, m as getDek, n as fetchDecryptedSecrets, o as kmsCallerIdentity, p as resolveOrg, r as fetchDecryptedVersion, s as kmsRecoverMaterial, t as encryptAndSetSecret, u as resolveAppEnv, v as writeProjectConfig, w as importSigningKey, x as isServiceToken, y as version } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -73,6 +73,8 @@ function getStartedText() {
 		"## 3. Store secrets",
 		"- `set_secret` — encrypts a value locally and stores the ciphertext.",
 		"- `list_secrets` — confirm names + versions (never returns values).",
+		"- `list_secret_versions` + `restore_secret` — undo a bad write by rolling",
+		"  back to an earlier version (keyless, and history is append-only).",
 		"",
 		"## 4. Use secrets without exposing them",
 		"- `run_command -- <cmd>` — inject secrets into a subprocess; prefer this.",
@@ -585,10 +587,11 @@ async function runMcpServer(options = {}) {
 			name: o.name
 		};
 	});
-	tool("get_secret", "Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command).", {
+	tool("get_secret", "Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command). Pass `version` to read an earlier version instead of the current one.", {
 		...targetShape,
 		name: z.string(),
-		reveal: z.boolean().optional()
+		reveal: z.boolean().optional(),
+		version: z.number().int().positive().optional().describe("an earlier version from list_secret_versions (default: current)")
 	}, async (o) => {
 		const ctx = getCtx();
 		const { orgId, envId } = await resolveTargetEnv(ctx, o);
@@ -598,11 +601,20 @@ async function runMcpServer(options = {}) {
 			if (!row) throw new Error(`no secret named ${o.name}`);
 			return {
 				name: row.name,
-				version: row.version,
+				version: o.version ?? row.version,
 				revealed: false
 			};
 		}
 		ensureDecryptable(ctx);
+		if (o.version !== void 0) {
+			const value = await fetchDecryptedVersion(ctx, orgId, envId, o.name, o.version);
+			return {
+				name: o.name,
+				version: o.version,
+				value,
+				revealed: true
+			};
+		}
 		const values = await fetchDecryptedSecrets(ctx, orgId, envId);
 		if (!(o.name in values)) throw new Error(`no secret named ${o.name}`);
 		return {
@@ -611,6 +623,39 @@ async function runMcpServer(options = {}) {
 			revealed: true
 		};
 	});
+	tool("list_secret_versions", "List a secret's version history: who wrote each version, when, and which ones were restores. Never returns values — pair it with restore_secret to roll back, or get_secret(version, reveal:true) to inspect one.", {
+		...targetShape,
+		name: z.string(),
+		limit: z.number().int().min(1).max(200).optional().describe("default 20")
+	}, async (o) => {
+		const ctx = getCtx();
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { versions, currentVersion } = await ctx.client.listSecretVersions(orgId, envId, o.name, { limit: o.limit ?? 20 });
+		return {
+			currentVersion,
+			versions: versions.map((v) => ({
+				version: v.version,
+				createdAt: v.createdAt,
+				createdBy: `${v.createdByType}:${v.createdById}`,
+				restoredFromVersion: v.restoredFromVersion
+			}))
+		};
+	});
+	tool("restore_secret", "Roll a secret back to an earlier version. The stored ciphertext is replayed as a NEW version (history is append-only, nothing is overwritten). Keyless — no decryption happens, so this works even without a key.", {
+		...targetShape,
+		name: z.string(),
+		version: z.number().int().positive()
+	}, async (o) => {
+		const ctx = getCtx();
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { secret, restoredFrom } = await ctx.client.restoreSecret(orgId, envId, o.name, o.version);
+		return {
+			ok: true,
+			name: o.name,
+			restoredFrom,
+			version: secret.version
+		};
+	});
 	tool("delete_secret", "Delete a secret from an environment.", {
 		...targetShape,
 		name: z.string()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.23.4",
+  "version": "0.24.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {