@seekrit/cli 0.24.0 → 0.26.0

package/dist/{mcp-t-sJ_SvE.js → mcp-DLplPOvz.js}

@@ -1,4 +1,4 @@
-import { A as generateMysqlCredential, C as generateSigningKeyMaterial, D as signatureKeyRef, E as signMessage, F as kmsEncrypt, I as wrapDek, L as generateDek, M as generateEncryptKeyMaterial, N as kmsBlobKeyRef, O as verifyMessage, P as kmsDecrypt, R as toBase64, S as parseServiceToken, T as importVerifyingKey, _ as setFailThrows, a as ensureM2mAdminToken, b as createServiceToken, c as kmsResolveKey, d as resolveEnvTarget, f as resolveGroup, g as tryBuildContext, h as isTokenAuth, i as materializeEnv, j as generateDataKey, k as generatePostgresCredential, l as kmsResolveRecipient, m as getDek, n as fetchDecryptedSecrets, o as kmsCallerIdentity, p as resolveOrg, r as fetchDecryptedVersion, s as kmsRecoverMaterial, t as encryptAndSetSecret, u as resolveAppEnv, v as writeProjectConfig, w as importSigningKey, x as isServiceToken, y as version } from "./index.js";
+import { A as verifyMessage, B as toBase64, C as isServiceToken, D as importVerifyingKey, E as importSigningKey, F as kmsBlobKeyRef, I as kmsDecrypt, L as kmsEncrypt, M as generateMysqlCredential, N as generateDataKey, O as signMessage, P as generateEncryptKeyMaterial, R as wrapDek, S as createServiceToken, T as generateSigningKeyMaterial, V as parseBranchTtl, _ as isTokenAuth, a as ensureM2mAdminToken, b as writeProjectConfig, c as kmsResolveKey, d as resolveAppEnv, f as resolveBranch, g as getDek, h as resolveOrg, i as materializeEnv, j as generatePostgresCredential, k as signatureKeyRef, l as kmsResolveRecipient, m as resolveGroup, n as fetchDecryptedSecrets, o as kmsCallerIdentity, p as resolveEnvTarget, r as fetchDecryptedVersion, s as kmsRecoverMaterial, t as encryptAndSetSecret, u as resolveApp, v as tryBuildContext, w as parseServiceToken, x as version, y as setFailThrows, z as generateDek } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -159,6 +159,7 @@ async function materializeFor(ctx, o) {
 	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, o)).envId;
 	return materializeEnv(ctx, {
 		envId,
+		branch: o.branch,
 		with: o.with,
 		envFiles: o.envFile ?? [".env"]
 	});
@@ -252,6 +253,24 @@ async function runMcpServer(options = {}) {
 		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
 		return (await ctx.client.listEnvs(orgRef.id, appRow.id)).environments;
 	});
+	tool("list_branches", "List ephemeral branch configs in an application (optionally just one environment's).", {
+		org: z.string().optional(),
+		app: z.string(),
+		env: z.string().optional()
+	}, async ({ org, app, env }) => {
+		const ctx = getCtx();
+		const appRef = await resolveApp(ctx, {
+			org,
+			app
+		});
+		if (!env) return (await ctx.client.listAppBranches(appRef.orgId, appRef.id)).branches;
+		const parent = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		});
+		return (await ctx.client.listBranches(parent.orgId, parent.envId)).branches;
+	});
 	tool("list_groups", "List shared groups (reusable secret bags) in an organization.", { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
@@ -514,6 +533,55 @@ async function runMcpServer(options = {}) {
 			wrappedDek
 		})).environment;
 	});
+	tool("create_branch", "Fork an environment into an ephemeral branch (a per-PR / preview config). The branch inherits the parent's secrets by layering at read time — nothing is copied or re-encrypted — and holds only the values you override on it. Generates the branch's data key locally, grants it to the caller, and shares it with the parent's other readers.", {
+		org: z.string().optional(),
+		app: z.string(),
+		from: z.string().describe("the environment to branch"),
+		slug: z.string().describe("the branch name, e.g. pr-142"),
+		ttl: z.string().optional().describe("lifetime: 12h, 7d, 2w, … or `never` (default 7d)")
+	}, async ({ org, app, from, slug, ttl }) => {
+		const ctx = getCtx();
+		const parent = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env: from
+		});
+		const parsedTtl = parseBranchTtl(ttl ?? "7d");
+		if (parsedTtl === null) throw new Error(`invalid ttl "${ttl}" (try 12h, 7d, 2w, or never)`);
+		const me = await kmsCallerIdentity(ctx);
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, me.publicKeyJwk);
+		const grants = [];
+		const { grantees } = await ctx.client.listGrantees(parent.orgId, parent.envId);
+		for (const grantee of grantees) {
+			if (grantee.principalType === me.principalType && grantee.principalId === me.principalId) continue;
+			grants.push({
+				principalType: grantee.principalType,
+				principalId: grantee.principalId,
+				wrappedDek: await wrapDek(dek, grantee.publicKeyJwk)
+			});
+		}
+		return (await ctx.client.createBranch(parent.orgId, parent.envId, {
+			slug,
+			ttlSeconds: Number.isFinite(parsedTtl) ? parsedTtl : null,
+			wrappedDek,
+			grants
+		})).branch;
+	});
+	tool("delete_branch", "Tear down a branch config and every value it overrode. The parent environment is untouched.", {
+		org: z.string().optional(),
+		app: z.string(),
+		branch: z.string()
+	}, async ({ org, app, branch }) => {
+		const ctx = getCtx();
+		const appRef = await resolveApp(ctx, {
+			org,
+			app
+		});
+		const target = await resolveBranch(ctx, appRef, branch);
+		await ctx.client.deleteBranch(appRef.orgId, target.id);
+		return { deleted: target.slug };
+	});
 	tool("create_group_env", "Create a group environment. Generates the data key locally and grants it to the caller.", {
 		org: z.string().optional(),
 		group: z.string(),
@@ -573,7 +641,7 @@ async function runMcpServer(options = {}) {
 		await ctx.client.unlinkEnvGroup(target.orgId, target.envId, g.id);
 		return { ok: true };
 	});
-	tool("set_secret", "Encrypt a value locally and store it in an environment.", {
+	tool("set_secret", "Encrypt a value locally and store it in an environment. A value may reference another secret as ${OTHER_SECRET}: the reference is stored literally and expanded whenever the secret is read, so it tracks the referenced value. Write $${OTHER_SECRET} for a literal.", {
 		...targetShape,
 		name: z.string(),
 		value: z.string()
@@ -587,10 +655,11 @@ async function runMcpServer(options = {}) {
 			name: o.name
 		};
 	});
-	tool("get_secret", "Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command). Pass `version` to read an earlier version instead of the current one.", {
+	tool("get_secret", "Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command). A revealed current value has its ${OTHER_SECRET} references expanded against this environment's own secrets; pass raw:true for the stored text instead. Pass `version` to read an earlier version instead of the current one (always as stored, never expanded).", {
 		...targetShape,
 		name: z.string(),
 		reveal: z.boolean().optional(),
+		raw: z.boolean().optional().describe("skip ${OTHER_SECRET} expansion (with reveal)"),
 		version: z.number().int().positive().optional().describe("an earlier version from list_secret_versions (default: current)")
 	}, async (o) => {
 		const ctx = getCtx();
@@ -615,7 +684,7 @@ async function runMcpServer(options = {}) {
 				revealed: true
 			};
 		}
-		const values = await fetchDecryptedSecrets(ctx, orgId, envId);
+		const values = await fetchDecryptedSecrets(ctx, orgId, envId, { raw: o.raw });
 		if (!(o.name in values)) throw new Error(`no secret named ${o.name}`);
 		return {
 			name: o.name,
@@ -674,6 +743,7 @@ async function runMcpServer(options = {}) {
 		org: z.string().optional(),
 		app: z.string().optional(),
 		env: z.string().optional().describe("environment slug (token auth infers this)"),
+		branch: z.string().optional().describe("read an ephemeral branch of that environment"),
 		with: z.record(z.string(), z.string()).optional().describe("group=env slice overrides"),
 		envFile: z.array(z.string()).optional().describe(".env files to overlay (default [.env])"),
 		cwd: z.string().optional()
@@ -695,6 +765,7 @@ async function runMcpServer(options = {}) {
 		org: z.string().optional(),
 		app: z.string().optional(),
 		env: z.string().optional(),
+		branch: z.string().optional().describe("read an ephemeral branch of that environment"),
 		with: z.record(z.string(), z.string()).optional()
 	}, async (o) => {
 		const ctx = getCtx();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -26,8 +26,8 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
-    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
+    "@seekrit/api-client": "0.0.1",
     "@seekrit/crypto": "0.0.1"
   },
   "scripts": {