@seekrit/cli 0.32.0 → 0.33.0

package/dist/index.js

@@ -16,6 +16,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Client-side managed keys for application-layer encryption and signing.",
 		default: true
 	},
+	"feature.honey_tokens": {
+		kind: "feature",
+		label: "Honey tokens",
+		description: "Decoy credentials that alert the moment anyone tries to use them.",
+		default: true
+	},
 	"feature.leases": {
 		kind: "feature",
 		label: "Temporary access",
@@ -122,7 +128,7 @@ const PLAN_FAMILIES = {
 		id: "free",
 		name: "Free",
 		description: "Get started with the essentials.",
-		current: 1,
+		current: 3,
 		hidden: false
 	},
 	team: {
@@ -1119,6 +1125,9 @@ const AUDIT_ACTIONS = [
 	"token.created",
 	"token.revoked",
 	"token.deleted",
+	"honey_token.created",
+	"honey_token.deleted",
+	"honey_token.tripped",
 	"cli_session.approved",
 	"cli_session.denied",
 	"cli_session.revoked",
@@ -1177,7 +1186,8 @@ const NOTIFICATION_TYPES = [
 	"org_welcome",
 	"token_expiring",
 	"lease_expired",
-	"sync_failed"
+	"sync_failed",
+	"honey_token_tripped"
 ];
 /** UI-facing copy + default for each notification type. */
 const NOTIFICATION_TYPE_META = {
@@ -1225,6 +1235,11 @@ const NOTIFICATION_TYPE_META = {
 		label: "Third-party sync failed",
 		description: "A sync to an external destination failed repeatedly and stopped retrying. The destination is now holding stale values.",
 		defaultEnabled: true
+	},
+	honey_token_tripped: {
+		label: "Honey token tripped",
+		description: "Someone tried to use one of your organization's decoy credentials (throttled per token). Nothing legitimate holds one, so every trip is worth reading.",
+		defaultEnabled: true
 	}
 };
 //#endregion
@@ -1332,6 +1347,14 @@ z.object({
 	environmentId: z.string().min(1).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+z.object({
+	name: nameSchema,
+	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full token string. */
+	tokenHash: z.string().min(1),
+	/** Where the decoy was planted, as a reminder for whoever reads the alert. */
+	placement: z.string().max(200).nullish()
+});
 const kmsKeyPurposeSchema = z.enum(["encrypt", "sign"]);
 const kmsKeySpecSchema = z.enum(["aes-256-gcm", "ecdsa-p256"]);
 /** A wrapped key grant supplied by the client (server never sees plaintext material). */
@@ -2684,6 +2707,14 @@ async function createServiceToken() {
 		publicKeyJwk
 	};
 }
+async function createHoneyToken() {
+	const { token, tokenId, tokenHash } = await createServiceToken();
+	return {
+		token,
+		tokenId,
+		tokenHash
+	};
+}
 async function parseServiceToken(token) {
 	const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
 	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
@@ -2720,7 +2751,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.32.0";
+var version = "0.33.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -3032,6 +3063,16 @@ var SeekritClient = class {
 	deleteToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}/permanent`);
 	}
+	listHoneyTokens(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/honey-tokens`);
+	}
+	createHoneyToken(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/honey-tokens`, input);
+	}
+	/** Delete a decoy outright — there is no access to revoke first. */
+	deleteHoneyToken(orgId, honeyTokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/honey-tokens/${honeyTokenId}`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -5233,6 +5274,52 @@ function registerGroupCommands(program) {
 	});
 }
 //#endregion
+//#region src/honey.ts
+/**
+* Honey tokens — decoy credentials that unlock nothing and alert when used.
+*
+* Minted client-side like real tokens (the API only ever sees a hash), printed
+* once, and then planted wherever a thief would rummage. The CLI is the natural
+* home for this: `seekrit honey-token create` piped straight into the file,
+* commit, config, or CI variable you want watched.
+*/
+function registerHoneyTokenCommands(program) {
+	const honey = program.command("honey-token").description("plant decoy credentials that alert when anyone tries to use them");
+	honey.command("create").description("mint a decoy credential; prints it once").requiredOption("--name <name>", "display name, e.g. legacy-ci-bait").option("--org <slug>").option("--placement <note>", "where you're planting it (echoed in the alert email)").action(async (options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		const created = await createHoneyToken();
+		await ctx.client.createHoneyToken(orgRef.id, {
+			name: options.name,
+			tokenId: created.tokenId,
+			tokenHash: created.tokenHash,
+			placement: options.placement ?? null
+		});
+		console.error("decoy created — save it now, it is not stored. Plant it somewhere a thief would look, NOT anywhere your own tooling reads: a deploy script that tries it by mistake trips the alarm just as loudly. It grants nothing.");
+		console.log(created.token);
+	});
+	honey.command("list").alias("ls").description("list decoy credentials and whether any have been tripped").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		const { honeyTokens } = await ctx.client.listHoneyTokens(orgRef.id);
+		emit(options, { honeyTokens }, () => printTable(honeyTokens, [
+			col("name", (t) => t.name),
+			col("status", (t) => t.tripCount > 0 ? `TRIPPED ${t.tripCount}×` : "untouched"),
+			col("planted in", (t) => t.placement ?? "—"),
+			col("last tripped", (t) => t.lastTrippedAt ?? "never"),
+			col("last source", (t) => t.lastTripIp ?? "—"),
+			col("id", (t) => t.id)
+		], "no decoys planted — create one with `seekrit honey-token create`"));
+	});
+	honey.command("delete <honeyTokenId>").alias("rm").description("delete a decoy (stops it alerting)").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (honeyTokenId, options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Delete ${honeyTokenId}? Wherever you planted it goes back to being unwatched — pull the bait too.`);
+		await ctx.client.deleteHoneyToken(orgRef.id, honeyTokenId);
+		console.error(`${honeyTokenId} deleted`);
+	});
+}
+//#endregion
 //#region src/logsink.ts
 /** Collect repeated `--header Name: value` flags into a map. */
 function collectHeader(value, acc = {}) {
@@ -7307,6 +7394,7 @@ program.command("export").description("print decrypted secrets (dotenv, json, or
 	console.log(formatSecrets(values, options.format));
 });
 registerAccessCommands(program);
+registerHoneyTokenCommands(program);
 const token = program.command("token").description("manage service tokens (CI, docker, agents)");
 token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
 	const ctx = buildContext();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -28,8 +28,8 @@
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/core": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",