@seekrit/cli 0.38.0 → 0.40.0

package/dist/index.js

@@ -28,6 +28,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Vault-style short-lived database and cloud credentials.",
 		default: true
 	},
+	"feature.rotation": {
+		kind: "feature",
+		label: "Secret rotation",
+		description: "Managed, scheduled rotation of stored credentials.",
+		default: true
+	},
 	"feature.log_sink": {
 		kind: "feature",
 		label: "Audit log export (SIEM)",
@@ -106,6 +112,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Maximum registered third-party sync destinations.",
 		default: null
 	},
+	"rotation.policies.max": {
+		kind: "limit",
+		label: "Rotation policies",
+		description: "Maximum secrets with managed rotation configured.",
+		default: null
+	},
 	members: {
 		kind: "metered",
 		label: "Members",
@@ -754,7 +766,7 @@ const connectionSchema = z.object({
 	database: z.string().min(1)
 });
 /** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
-const statementSchema = z.string().min(1).max(4e3);
+const statementSchema$1 = z.string().min(1).max(4e3);
 /** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
 const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
 const postgresTargetConfigSchema = z.object({
@@ -764,20 +776,20 @@ const postgresTargetConfigSchema = z.object({
 	schema: identifierSchema.optional(),
 	connection: connectionSchema,
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 /** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
-const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const mysqlHostSchema$1 = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
 const mysqlTargetConfigSchema = z.object({
 	provider: z.literal("mysql"),
 	executor: executorModeSchema,
 	accessLevel: mysqlAccessLevelSchema.optional(),
 	connection: connectionSchema,
-	userHost: mysqlHostSchema.optional(),
+	userHost: mysqlHostSchema$1.optional(),
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 const redisConnectionSchema = z.object({
 	host: z.string().min(1),
@@ -791,8 +803,8 @@ const redisTargetConfigSchema = z.object({
 	accessLevel: redisAccessLevelSchema.optional(),
 	connection: redisConnectionSchema,
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 const sshTargetConfigSchema = z.object({
 	provider: z.literal("ssh"),
@@ -1122,6 +1134,11 @@ const AUDIT_ACTIONS = [
 	"secret.deleted",
 	"secret.read",
 	"secret.restored",
+	"secret.rotation_configured",
+	"secret.rotation_updated",
+	"secret.rotation_disabled",
+	"secret.rotated",
+	"secret.rotation_failed",
 	"token.created",
 	"token.revoked",
 	"token.deleted",
@@ -1147,6 +1164,9 @@ const AUDIT_ACTIONS = [
 	"entitlement.override_cleared",
 	"billing.checkout_started",
 	"billing.portal_opened",
+	"promo.created",
+	"promo.updated",
+	"promo.redeemed",
 	"kms.key_created",
 	"kms.key_granted",
 	"kms.key_revoked",
@@ -1187,7 +1207,8 @@ const NOTIFICATION_TYPES = [
 	"token_expiring",
 	"lease_expired",
 	"sync_failed",
-	"honey_token_tripped"
+	"honey_token_tripped",
+	"secret_rotation_failed"
 ];
 /** UI-facing copy + default for each notification type. */
 const NOTIFICATION_TYPE_META = {
@@ -1240,6 +1261,11 @@ const NOTIFICATION_TYPE_META = {
 		label: "Honey token tripped",
 		description: "Someone tried to use one of your organization's decoy credentials (throttled per token). Nothing legitimate holds one, so every trip is worth reading.",
 		defaultEnabled: true
+	},
+	secret_rotation_failed: {
+		label: "Secret rotation failed",
+		description: "A scheduled secret rotation could not complete — the stored value may be out of step with the system it authenticates to.",
+		defaultEnabled: true
 	}
 };
 //#endregion
@@ -1467,6 +1493,25 @@ z.object({
 	note: z.string().max(500).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+z.object({
+	code: z.string().min(4).max(40),
+	family: planFamilySchema,
+	version: z.number().int().positive().optional(),
+	durationDays: z.number().int().positive().max(3650).nullish(),
+	maxRedemptions: z.number().int().positive().nullish(),
+	startsAt: z.iso.datetime().nullish(),
+	endsAt: z.iso.datetime().nullish(),
+	note: z.string().max(500).nullish()
+});
+z.object({
+	maxRedemptions: z.number().int().positive().nullish(),
+	startsAt: z.iso.datetime().nullish(),
+	endsAt: z.iso.datetime().nullish(),
+	note: z.string().max(500).nullish(),
+	/** Kill switch. Disabling stops new redemptions; live grants are untouched. */
+	disabled: z.boolean().optional()
+});
+z.object({ code: z.string().min(1).max(40) });
 z.object({ family: planFamilySchema });
 z.object({
 	sessionId: z.string().regex(/^skc_[0-9A-Za-z]+$/),
@@ -1484,6 +1529,99 @@ z.object({
 	action: z.string().optional(),
 	resourceType: z.string().optional()
 });
+z.enum([
+	"generated",
+	"postgres",
+	"mysql",
+	"redis"
+]);
+z.enum([
+	"active",
+	"paused",
+	"failed"
+]);
+/** Statuses an admin may set directly (`failed` is only reached by the sweep). */
+const settableRotationStatusSchema = z.enum(["active", "paused"]);
+const rotationAlphabetSchema = z.enum([
+	"alphanumeric",
+	"hex",
+	"base64url",
+	"printable"
+]);
+const rotationIntervalSchema = z.number().int().min(300).max(3600 * 24 * 365);
+/**
+* A database user name we are willing to *re-key*. Deliberately more permissive
+* than the lease providers' name schemas — those name accounts seekrit creates,
+* whereas this names an account the customer's DBA created years ago, which may
+* be mixed-case or contain dots or dashes.
+*
+* It stays injection-safe for every place it is interpolated: a double-quoted
+* Postgres identifier, a single-quoted MySQL literal, and a bare Redis command
+* token. The charset excludes both quote characters, backslash, whitespace, and
+* `;`, so there is no way out of the surrounding quoting, and no whitespace to
+* split one Redis argument into two.
+*/
+const rotationUsernameSchema = z.string().regex(/^[A-Za-z0-9_$.-]{1,63}$/, "must be 1–63 chars of letters, digits, underscore, dollar, dot or dash");
+/** A `{{name}}`/`{{host}}`/`{{verifier}}` templated statement or command line. */
+const statementSchema = z.string().min(1).max(4e3);
+const passwordLengthSchema = z.number().int().min(16).max(256);
+/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
+const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const generatedRotationConfigSchema = z.object({
+	kind: z.literal("generated"),
+	length: passwordLengthSchema.optional(),
+	alphabet: rotationAlphabetSchema.optional()
+});
+const postgresRotationConfigSchema = z.object({
+	kind: z.literal("postgres"),
+	username: rotationUsernameSchema,
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const mysqlRotationConfigSchema = z.object({
+	kind: z.literal("mysql"),
+	username: rotationUsernameSchema,
+	userHost: mysqlHostSchema.optional(),
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const redisRotationConfigSchema = z.object({
+	kind: z.literal("redis"),
+	username: rotationUsernameSchema,
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const rotationConfigSchema = z.discriminatedUnion("kind", [
+	generatedRotationConfigSchema,
+	postgresRotationConfigSchema,
+	mysqlRotationConfigSchema,
+	redisRotationConfigSchema
+]);
+z.object({
+	environmentId: z.string().min(1),
+	/** The secret whose value rotates. It must already exist. */
+	secretName: secretNameSchema,
+	config: rotationConfigSchema,
+	intervalSeconds: rotationIntervalSchema,
+	/**
+	* The registered lease target supplying the connection, executor mode, and
+	* wrapped admin credential. Required for every kind but `generated`.
+	*/
+	targetId: z.string().min(1).optional(),
+	/** Environment DEK wrapped to the rotator public key (`wd1.` blob). */
+	wrappedDek: z.string().min(1).optional(),
+	/** Rotate once immediately instead of waiting for the first interval. */
+	rotateNow: z.boolean().optional()
+});
+z.object({
+	intervalSeconds: rotationIntervalSchema.optional(),
+	config: rotationConfigSchema.optional(),
+	/**
+	* `paused` stops the sweep; `active` resumes it and clears the failure
+	* streak, which is also how a `failed` policy is recovered.
+	*/
+	status: settableRotationStatusSchema.optional()
+}).refine((v) => v.intervalSeconds !== void 0 || v.config !== void 0 || v.status !== void 0, "provide at least one of intervalSeconds, config, or status");
 //#endregion
 //#region ../../packages/core/src/sync.ts
 /**
@@ -1523,7 +1661,10 @@ const SYNC_PROVIDER_KINDS = [
 	"aws-parameter-store",
 	"render",
 	"fly",
-	"northflank"
+	"northflank",
+	"digitalocean",
+	"heroku",
+	"netlify"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1688,6 +1829,46 @@ const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]
 * address. The kind exists so the discriminated union stays uniform.
 */
 const northflankConnectionConfigSchema = z.object({ provider: z.literal("northflank") });
+/**
+* DigitalOcean account scope — deliberately empty, as Render's and Fly's are.
+*
+* A DigitalOcean personal access token belongs to one account (or one team, if
+* it was issued inside one) and carries that scope itself, and every endpoint
+* this connector calls addresses its app by id. There is no team id to
+* disambiguate the way Vercel needs one: the token plus the destination's app
+* id is the whole address.
+*/
+const digitalOceanConnectionConfigSchema = z.object({ provider: z.literal("digitalocean") });
+/**
+* Heroku account scope — empty, as Fly's and Render's are.
+*
+* A Heroku API token carries its user's access to every app and team they can
+* reach, and app names are globally unique, so the destination's app is the
+* whole address. There is no team id to state: unlike Vercel, where a personal
+* token 403s a team-owned project without `teamId`, Heroku resolves
+* `/apps/{app_id_or_name}` against everything the token can see, team-owned or
+* not.
+*/
+const herokuConnectionConfigSchema = z.object({ provider: z.literal("heroku") });
+/**
+* Netlify team scope — the one thing a Netlify token cannot tell us itself.
+*
+* Every environment variable endpoint is account-scoped
+* (`/accounts/{account_id}/env`), and a personal access token belongs to a
+* *user*, who may sit in several teams. So unlike Fly's or Heroku's, this
+* config is not empty: the token says who you are, and this says which team's
+* variables to write.
+*
+* Netlify treats the team's id and its slug as interchangeable wherever
+* `{account_id}` appears, so both are accepted. The slug is the one an operator
+* can find without an API call — it is in the dashboard URL
+* (`app.netlify.com/teams/<slug>`) and under Team settings → General.
+*/
+const netlifyConnectionConfigSchema = z.object({
+	provider: z.literal("netlify"),
+	/** Netlify team slug (`acme`) or account id — `{account_id}` accepts either. */
+	accountId: z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Netlify team slug or account ID — no slashes or spaces")
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1698,7 +1879,10 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	awsParameterStoreConnectionConfigSchema,
 	renderConnectionConfigSchema,
 	flyConnectionConfigSchema,
-	northflankConnectionConfigSchema
+	northflankConnectionConfigSchema,
+	digitalOceanConnectionConfigSchema,
+	herokuConnectionConfigSchema,
+	netlifyConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1942,6 +2126,187 @@ const northflankDestinationSchema = z.object({
 	/** Secret group id — the slug in the group's URL (`example-secret-group`). */
 	secretGroupId: northflankIdSchema
 });
+/**
+* When App Platform makes a variable visible. DigitalOcean's enum also has
+* `UNSET`, which is not offered: it means "no scope stated", and a secrets
+* manager that writes a value should say when that value applies.
+*
+* The default here is `RUN_TIME` rather than DigitalOcean's own
+* `RUN_AND_BUILD_TIME`, and the difference is deliberate. A build-time variable
+* is visible to every build command, every buildpack, and anything they print;
+* a secret only the running process needs has no business being there. Binding
+* a value a build genuinely needs — a private registry token, a sourcemap
+* upload key — is a decision worth making explicitly.
+*/
+const DIGITALOCEAN_ENV_SCOPES = [
+	"RUN_TIME",
+	"BUILD_TIME",
+	"RUN_AND_BUILD_TIME"
+];
+/**
+* A DigitalOcean app id — the UUID in the app's dashboard URL
+* (`cloud.digitalocean.com/apps/<id>`), and what `doctl apps list` prints.
+*
+* DigitalOcean's own spec types this as a bare string, but every app id it
+* issues is a UUID, and the slip worth catching is the one the API cannot tell
+* from a typo: pasting the app's *name* (`storefront`), which `GET /v2/apps/{id}`
+* answers with a flat 404 hours later inside an alarm, with nobody watching.
+*/
+const digitalOceanAppIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a DigitalOcean app ID (the UUID in the app's URL), not its name");
+/**
+* A component name, matching App Platform's own pattern for one. Names are
+* unique within an app, which is what makes a name — rather than an index into
+* `services` — the stable way to address a component's variables.
+*/
+const digitalOceanComponentNameSchema = z.string().trim().regex(/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/, "must be an App Platform component name (lowercase letters, numbers, and dashes)");
+/**
+* Where inside a DigitalOcean app a binding writes.
+*
+* ## A push is a deployment
+*
+* App Platform has no per-variable endpoint. Environment variables live in the
+* app spec, and the only way to change one is to submit a new spec — which
+* starts a **new deployment** of the app. That is not a side effect this
+* connector chose and there is no flag to suppress it; it is what "set an
+* environment variable" means on this platform, in the control panel and in
+* `doctl` alike.
+*
+* The deployment reuses each component's current source (seekrit never sends
+* `update_all_source_versions`), so it redeploys the code already running
+* rather than pulling a newer commit or image. It is still a real deployment:
+* a build, a health check, and a rollout. Bind an environment here knowing that
+* changing a secret in it will roll the app.
+*
+* ## Values are written encrypted
+*
+* Everything seekrit writes goes in as `type: SECRET`, so App Platform encrypts
+* it at rest and hands it back as an opaque `EV[1:…]` blob rather than as
+* plaintext. That is also why this connector cannot tell whether a value it is
+* about to write is already there — see
+* `apps/api/src/lib/sync/connectors/digitalocean.ts`.
+*/
+const digitalOceanAppDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("app"),
+	/** App id — the UUID in `cloud.digitalocean.com/apps/<id>`. */
+	appId: digitalOceanAppIdSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+/**
+* One component's own environment variables. Narrower than the app-level list:
+* only this service, worker, job, static site, or function sees them, and a key
+* here wins over the same key at app level.
+*/
+const digitalOceanComponentDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("component"),
+	appId: digitalOceanAppIdSchema,
+	/** Component name, as it appears in the app spec — not its type. */
+	componentName: digitalOceanComponentNameSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+const digitalOceanDestinationSchema = z.discriminatedUnion("kind", [digitalOceanAppDestinationSchema, digitalOceanComponentDestinationSchema]);
+/**
+* A Heroku app, named the way `/apps/{app_id_or_name}` names one: either the
+* app name or its UUID id. Both are accepted because both work, and the id is
+* the durable one — renaming an app in the dashboard breaks a binding that
+* holds its name, and does not break one that holds its id.
+*
+* The name pattern is Heroku's own (`^[a-z][a-z0-9-]{1,28}[a-z0-9]$`): 3–30
+* characters, starting with a letter and ending alphanumeric. Checking it here
+* turns the habitual slip — pasting `example.herokuapp.com`, or a name with
+* capitals — into a message at the form rather than a bare 404 from an alarm
+* with nobody watching.
+*/
+const herokuAppSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(value) || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value), "must be a Heroku app name (lowercase letters, numbers, and dashes) or its UUID");
+/**
+* The Heroku app whose config vars a binding owns.
+*
+* A Heroku app has **one** set of config vars, shared by every dyno and every
+* process type — there is no per-target split to state the way Vercel and Pages
+* have one. Heroku's convention is that staging and production are separate
+* *apps* (`storefront`, `storefront-staging`), so pointing at an environment
+* means naming that app, exactly as it does on Fly.
+*
+* Unlike Fly, values take effect **immediately**: setting config vars cuts a new
+* release and restarts the app's dynos, which is why a run sends exactly one
+* request — see the note in `apps/api/src/lib/sync/connectors/heroku.ts`.
+*/
+const herokuDestinationSchema = z.object({
+	provider: z.literal("heroku"),
+	/** App name as `heroku apps` prints it, or the app's UUID. */
+	app: herokuAppSchema
+});
+/**
+* The deploy contexts a Netlify value can be set for.
+*
+* These are Netlify's own, minus two. `all` is missing deliberately: Netlify
+* requires a **secret** value to be set against explicit contexts, and its
+* `setEnvVarValue` endpoint is reported to fail outright on `context: "all"` —
+* so the union offers only contexts that work under both. Naming the contexts
+* you mean is what you want here anyway; a binding already exists to map one
+* seekrit environment onto one deploy context. `dev-server` (Preview Server) is
+* left out for want of anyone asking.
+*
+* `branch` is the odd one: it needs a branch name alongside it, which the
+* destination carries as {@link netlifyDestinationSchema}'s `branch`.
+*/
+const NETLIFY_CONTEXTS = [
+	"production",
+	"deploy-preview",
+	"branch-deploy",
+	"branch",
+	"dev"
+];
+/**
+* A Netlify site, by its **API ID** — the UUID under Project configuration →
+* General → Project information.
+*
+* Netlify accepts a site's domain in place of its id where a site appears in a
+* *path* (`/sites/{site_id}`), but the environment variable endpoints take the
+* site as a `?site_id=` **query parameter** instead, and Netlify documents no
+* name resolution there. That asymmetry is why this is strict where the Heroku
+* and Fly destinations are permissive: a `site_id` Netlify does not resolve
+* does not 404 — the write lands on the *team*, as a shared variable inherited
+* by every site in it. Refusing anything but the UUID keeps a slip from turning
+* into a much wider blast radius than the operator asked for.
+*/
+const netlifySiteIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be the site's API ID (a UUID), not its name or URL");
+/**
+* The Netlify site, and which of its deploy contexts a binding owns.
+*
+* Netlify keys a value by (site, context), so the destination is that pair.
+* Contexts are a list rather than a single value for the same reason Vercel's
+* `targets` is one: a binding is unique per (connection, environment), so an
+* environment that feeds both production and deploy previews has to say so in
+* one destination or not at all.
+*
+* A push writes **only** the contexts listed here. Other contexts of the same
+* variable — and every variable this binding does not manage — are left as they
+* are, which is what makes it safe to point at a site that already has
+* variables set by hand.
+*
+* `secret` marks what seekrit creates as a Netlify **secret**: write-only, and
+* unreadable afterwards through the UI, CLI, and API. On by default, since that
+* is the whole point of pushing from a secrets manager. It applies only to
+* variables seekrit *creates* — Netlify will not let a flag be added to an
+* existing variable, or removed from one ever — and it needs a plan that
+* includes Secrets Controller.
+*/
+const netlifyDestinationSchema = z.object({
+	provider: z.literal("netlify"),
+	/** Site API ID (a UUID), from Project configuration → General. */
+	siteId: netlifySiteIdSchema,
+	/** Which deploy contexts receive these values. At least one. */
+	contexts: z.array(z.enum(NETLIFY_CONTEXTS)).min(1),
+	/** Branch name, required when `contexts` includes `branch`; ignored otherwise. */
+	branch: z.string().trim().min(1).max(255).optional(),
+	/** Create variables as Netlify secrets (default true). */
+	secret: z.boolean().optional()
+}).refine((d) => !d.contexts.includes("branch") || d.branch !== void 0, {
+	message: "a branch context needs the branch name it applies to",
+	path: ["branch"]
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -1952,7 +2317,10 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	awsParameterStoreDestinationSchema,
 	renderDestinationSchema,
 	flyDestinationSchema,
-	northflankDestinationSchema
+	northflankDestinationSchema,
+	digitalOceanDestinationSchema,
+	herokuDestinationSchema,
+	netlifyDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -2401,6 +2769,43 @@ async function decryptDataKey(material, wrapped) {
 	}
 }
 //#endregion
+//#region ../../packages/crypto/src/random.ts
+const ALPHABETS = {
+	alphanumeric: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+	hex: "0123456789abcdef",
+	base64url: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_",
+	/**
+	* Alphanumerics plus punctuation chosen to survive being pasted anywhere a
+	* secret goes: no quote of either kind, no backslash, backtick, `$`, or
+	* whitespace, so the value can't break out of a shell word, a SQL literal, a
+	* URL component, or a `.env` line.
+	*/
+	printable: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-._~!*+="
+};
+/**
+* A cryptographically random string of `length` characters drawn uniformly from
+* `alphabet` (default `alphanumeric`, ≈5.95 bits/char — 32 chars ≈ 190 bits).
+*
+* Uses rejection sampling: bytes at or above the largest multiple of the
+* alphabet size are discarded rather than folded, so `% n` introduces no modulo
+* bias toward the low end of the alphabet.
+*/
+function generateSecretValue(length, alphabet = "alphanumeric") {
+	if (!Number.isInteger(length) || length < 1) throw new RangeError("length must be a positive integer");
+	const chars = ALPHABETS[alphabet];
+	const n = chars.length;
+	const limit = 256 - 256 % n;
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < limit) out += chars[byte % n];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+//#endregion
 //#region ../../packages/crypto/src/mongodb.ts
 /** Generate the ephemeral P-256 keypair a client uses to receive one MongoDB lease. */
 async function generateMongoRecipientKeyPair() {
@@ -2465,7 +2870,6 @@ function mongoConnectionUri(cred) {
 * SCRAM helper does, with no hand-rolled hash primitive.
 */
 const DEFAULT_PASSWORD_LENGTH$2 = 32;
-const PASSWORD_ALPHABET$2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function sha1(data) {
 	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
 }
@@ -2474,17 +2878,6 @@ function toUpperHex(bytes) {
 	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
 	return hex.toUpperCase();
 }
-function randomPassword$2(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$2[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
 * for a known password. Pass the result straight to
@@ -2498,7 +2891,7 @@ async function mysqlNativePasswordVerifier(password) {
 * — the client-side half of a Vault-style dynamic MySQL credential.
 */
 async function generateMysqlCredential(options = {}) {
-	const password = randomPassword$2(options.length ?? DEFAULT_PASSWORD_LENGTH$2);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH$2);
 	return {
 		password,
 		verifier: await mysqlNativePasswordVerifier(password)
@@ -2778,7 +3171,6 @@ async function combineRecoveryShares(shareBytes) {
 * helper does, with no hand-rolled hash primitive.
 */
 const DEFAULT_PASSWORD_LENGTH$1 = 32;
-const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function sha256$1(data) {
 	return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
 }
@@ -2787,17 +3179,6 @@ function toLowerHex(bytes) {
 	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
 	return hex;
 }
-function randomPassword$1(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the Redis ACL password verifier `LOWER(HEX(SHA256(password)))` for a
 * known password. Pass the result straight to `ACL SETUSER … on #<verifier>`.
@@ -2810,7 +3191,7 @@ async function redisSha256Verifier(password) {
 * client-side half of a Vault-style dynamic Redis credential.
 */
 async function generateRedisCredential(options = {}) {
-	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
 	return {
 		password,
 		verifier: await redisSha256Verifier(password)
@@ -2818,7 +3199,6 @@ async function generateRedisCredential(options = {}) {
 }
 const SALT_LENGTH = 16;
 const DEFAULT_PASSWORD_LENGTH = 32;
-const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function hmacSha256(key, message) {
 	const k = await crypto.subtle.importKey("raw", key, {
 		name: "HMAC",
@@ -2839,17 +3219,6 @@ async function saltPassword(password, salt, iterations) {
 	}, material, 256);
 	return new Uint8Array(bits);
 }
-function randomPassword(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the `SCRAM-SHA-256$<i>:<salt>$<StoredKey>:<ServerKey>` verifier for a
 * known password. Pass the result straight to `CREATE ROLE … PASSWORD`.
@@ -2867,7 +3236,7 @@ async function scramSha256Verifier(password, options = {}) {
 * client-side half of a Vault-style dynamic Postgres credential.
 */
 async function generatePostgresCredential(options = {}) {
-	const password = randomPassword(options.length ?? DEFAULT_PASSWORD_LENGTH);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH);
 	const iterations = options.iterations ?? 4096;
 	return {
 		password,
@@ -3157,7 +3526,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.38.0";
+var version = "0.40.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -3589,6 +3958,39 @@ var SeekritClient = class {
 	revokeLease(orgId, leaseId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
 	}
+	/**
+	* The rotator public key (the broker DO's), plus the environments that have
+	* already granted it. Wrap an environment's DEK to this key client-side before
+	* configuring rotation — that wrap IS the grant, and the server can't make it.
+	*/
+	getRotatorKey(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation/rotator-key`);
+	}
+	listRotations(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation`);
+	}
+	getRotation(orgId, rotationId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation/${rotationId}`);
+	}
+	/**
+	* Configure (or replace) a secret's rotation policy. `version` comes back only
+	* when `rotateNow` was set — a rotated secret's new version number, never its
+	* value.
+	*/
+	configureRotation(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/rotation`, input);
+	}
+	updateRotation(orgId, rotationId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/rotation/${rotationId}`, input);
+	}
+	/** Rotate now. Returns the new version — the value stays where it belongs. */
+	rotateSecretNow(orgId, rotationId) {
+		return this.request("POST", `/v1/orgs/${orgId}/rotation/${rotationId}/rotate`);
+	}
+	/** Disable rotation. `rotatorRevoked` reports whether the broker's key grant went too. */
+	disableRotation(orgId, rotationId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/rotation/${rotationId}`);
+	}
 	listAudit(orgId, query = {}) {
 		const params = new URLSearchParams();
 		if (query.cursor) params.set("cursor", query.cursor);
@@ -3645,6 +4047,19 @@ var SeekritClient = class {
 	cancelSubscription(orgId) {
 		return this.request("POST", `/v1/orgs/${orgId}/billing/cancel`);
 	}
+	/**
+	* Redeem a promo code, comping the org onto the plan the code grants.
+	* Admin-only. Casing, spaces, and dashes are normalized server-side, so pass
+	* the code as the user typed it. Returns the refreshed billing view.
+	*
+	* Every invalid code fails the same way regardless of why (unknown, expired,
+	* fully redeemed, already used by this org) — the API deliberately won't
+	* confirm that a code exists. Show the returned message as-is rather than
+	* guessing at a more specific one.
+	*/
+	redeemPromoCode(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/promo`, input);
+	}
 };
 async function unauthenticatedPost(baseUrl, path, body, fetchImpl, client) {
 	const headers = {
@@ -6632,6 +7047,184 @@ function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
 }
+//#endregion
+//#region src/rotation.ts
+/**
+* `seekrit rotation` — managed, scheduled rotation of a stored secret's value.
+*
+* Zero-knowledge: enabling rotation unwraps this environment's DEK **on this
+* machine** and re-wraps it to the rotator public key (the per-org broker
+* Durable Object's), so the control plane only ever relays ciphertext. That wrap
+* is what lets the broker write a new value in place — and it is exactly why the
+* server can't enable rotation on its own.
+*
+* Rotated values are never printed here. Read them like any other secret
+* (`seekrit secrets get NAME`), which decrypts locally.
+*/
+/** Parse a duration like `30m`, `24h`, `90d`, or a bare seconds count. */
+function parseDurationSeconds(input, flag) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid ${flag} "${input}" (try 12h, 7d, 90d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+function formatInterval(seconds) {
+	if (seconds % 86400 === 0) return `${seconds / 86400}d`;
+	if (seconds % 3600 === 0) return `${seconds / 3600}h`;
+	if (seconds % 60 === 0) return `${seconds / 60}m`;
+	return `${seconds}s`;
+}
+/** One policy as a tab-separated line: name, kind, cadence, status, next run. */
+function rotationLine(r) {
+	const status = r.failureCount > 0 ? `${r.status} (${r.failureCount} failed)` : r.status;
+	return [
+		r.id,
+		r.secretName,
+		r.kind,
+		`every ${formatInterval(r.intervalSeconds)}`,
+		status,
+		`next ${r.nextRotateAt}`
+	].join("	");
+}
+/** Find a policy by id, or by secret name when it is unambiguous in the org. */
+async function resolveRotation(ctx, orgId, ref) {
+	const { rotations } = await ctx.client.listRotations(orgId);
+	const byId = rotations.find((r) => r.id === ref);
+	if (byId) return byId;
+	const byName = rotations.filter((r) => r.secretName === ref);
+	if (byName.length === 1) return byName[0];
+	if (byName.length > 1) fail(`"${ref}" rotates in ${byName.length} environments — pass the rotation id instead:\n${byName.map((r) => `  ${r.id}\t${r.environmentId}`).join("\n")}`);
+	fail(`no rotation policy "${ref}"`);
+}
+/** Build the rotation config from the CLI flags for a given kind. */
+function buildConfig$1(kind, options) {
+	const length = Number.parseInt(options.length, 10);
+	if (!Number.isFinite(length)) fail(`invalid --length "${options.length}"`);
+	if (kind === "generated") {
+		const alphabets = [
+			"alphanumeric",
+			"hex",
+			"base64url",
+			"printable"
+		];
+		if (!alphabets.includes(options.alphabet)) fail(`--alphabet must be one of ${alphabets.join(", ")}`);
+		return {
+			kind: "generated",
+			length,
+			alphabet: options.alphabet
+		};
+	}
+	if (!options.username) fail(`--username is required for a ${kind} rotation`);
+	const username = options.username;
+	if (kind === "postgres") return {
+		kind: "postgres",
+		username,
+		passwordLength: length
+	};
+	if (kind === "mysql") return {
+		kind: "mysql",
+		username,
+		passwordLength: length,
+		...options.userHost ? { userHost: options.userHost } : {}
+	};
+	if (kind === "redis") return {
+		kind: "redis",
+		username,
+		passwordLength: length
+	};
+	return fail(`--kind must be generated, postgres, mysql, or redis (got "${kind}")`);
+}
+function registerRotationCommands(program) {
+	const rotation = program.command("rotation").description("managed rotation of stored secret values (scheduled, zero-knowledge)");
+	rotation.command("enable <secretName>").description("configure rotation for an existing secret").option("--org <slug>").option("--app <slug>").option("--group <slug>", "rotate a secret in a group environment").requiredOption("--env <slug>").requiredOption("--kind <kind>", "generated | postgres | mysql | redis").requiredOption("--every <duration>", "rotation cadence, e.g. 24h, 30d").option("--username <name>", "the EXISTING database account to re-key (db kinds)").option("--target <idOrName>", "registered lease target to rotate against (db kinds)").option("--user-host <host>", "MySQL account host part (default %)").option("--length <n>", "generated value length", "32").option("--alphabet <set>", "generated kind only: alphanumeric | hex | base64url | printable", "alphanumeric").option("--now", "rotate immediately as well as on the schedule").action(async (secretName, options) => {
+		const ctx = buildContext();
+		const target = await resolveEnvTarget(ctx, options);
+		const config = buildConfig$1(options.kind, options);
+		const intervalSeconds = parseDurationSeconds(options.every, "--every");
+		let targetId;
+		if (config.kind !== "generated") {
+			if (!options.target) fail(`--target is required for a ${config.kind} rotation`);
+			const { targets } = await ctx.client.listLeaseTargets(target.orgId);
+			const t = targets.find((x) => x.id === options.target || x.name === options.target);
+			if (!t) fail(`no lease target "${options.target}" — register one with \`seekrit ${config.kind === "postgres" ? "pg" : config.kind} target add\``);
+			targetId = t.id;
+		}
+		const { publicKeyJwk, grantedEnvironmentIds } = await ctx.client.getRotatorKey(target.orgId);
+		let wrappedDek;
+		if (!grantedEnvironmentIds.includes(target.envId)) wrappedDek = await wrapDek(await getDek(ctx, target.orgId, target.envId), publicKeyJwk);
+		const { rotation: created, version } = await ctx.client.configureRotation(target.orgId, {
+			environmentId: target.envId,
+			secretName,
+			config,
+			intervalSeconds,
+			...targetId ? { targetId } : {},
+			...wrappedDek ? { wrappedDek } : {},
+			...options.now ? { rotateNow: true } : {}
+		});
+		console.error(`rotating ${created.secretName} in ${target.label} every ${formatInterval(created.intervalSeconds)} (${created.kind})${wrappedDek ? " — rotator key granted" : ""}`);
+		if (version !== void 0) console.error(`rotated now — ${created.secretName} is at version ${version}`);
+		else console.error(`first rotation: ${created.nextRotateAt}`);
+		console.log(created.id);
+	});
+	rotation.command("list").description("list rotation policies (schedules only — never values)").option("--org <slug>").option("--json", "print the full policies as JSON").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { rotations } = await ctx.client.listRotations(org.id);
+		if (options.json) {
+			console.log(JSON.stringify(rotations, null, 2));
+			return;
+		}
+		if (rotations.length === 0) {
+			console.error(`no rotation policies in ${org.slug}`);
+			return;
+		}
+		for (const r of rotations) console.log(rotationLine(r));
+	});
+	rotation.command("show <rotationOrSecret>").description("show one policy, including the last failure if any").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const r = await resolveRotation(ctx, (await resolveOrg(ctx, options.org)).id, ref);
+		console.log(JSON.stringify(r, null, 2));
+	});
+	rotation.command("rotate <rotationOrSecret>").description("rotate now (the same path the scheduler uses)").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		const { version, rotatedAt } = await ctx.client.rotateSecretNow(org.id, r.id);
+		console.error(`rotated ${r.secretName} at ${rotatedAt} — now at version ${version}. Read it with \`seekrit secrets get ${r.secretName}\`.`);
+	});
+	rotation.command("pause <rotationOrSecret>").description("stop rotating, keeping the policy").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		await ctx.client.updateRotation(org.id, r.id, { status: "paused" });
+		console.error(`paused rotation of ${r.secretName}`);
+	});
+	rotation.command("resume <rotationOrSecret>").description("resume rotating (also clears a failed streak)").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		const { rotation: updated } = await ctx.client.updateRotation(org.id, r.id, { status: "active" });
+		console.error(`resumed rotation of ${r.secretName} — next ${updated.nextRotateAt}`);
+	});
+	rotation.command("set-interval <rotationOrSecret>").description("change the cadence").requiredOption("--every <duration>", "new cadence, e.g. 24h, 30d").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		const { rotation: updated } = await ctx.client.updateRotation(org.id, r.id, { intervalSeconds: parseDurationSeconds(options.every, "--every") });
+		console.error(`${updated.secretName} now rotates every ${formatInterval(updated.intervalSeconds)} — next ${updated.nextRotateAt}`);
+	});
+	rotation.command("disable <rotationOrSecret>").description("stop rotating and remove the policy (the secret is untouched)").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		const { rotatorRevoked } = await ctx.client.disableRotation(org.id, r.id);
+		console.error(`disabled rotation of ${r.secretName}${rotatorRevoked ? " — rotator key access revoked for this environment" : ""}`);
+	});
+}
 /**
 * Fetch + decrypt every secret in a single environment.
 *
@@ -6998,6 +7591,19 @@ function assertFlyApp(value) {
 	return appName;
 }
 /**
+* Heroku takes an app name or the app's UUID, so both are accepted here. The
+* habitual slips are the hostname (`storefront.herokuapp.com`) and capitals;
+* both are a 404 from Heroku much later, so they are caught here with a message
+* that says which.
+*/
+function assertHerokuApp(value) {
+	if (!value) fail("--heroku-app is required for heroku (the app name, e.g. storefront-production)");
+	const app = value.trim();
+	if (/\.(herokuapp\.com|herokudns\.com)$/.test(app)) fail(`--heroku-app takes the app name, not its hostname — try "${app.split(".")[0]}"`);
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(app) && !/^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(app)) fail(`--heroku-app "${app}" is not a Heroku app name — 3 to 30 characters, starting with a lowercase letter, made of lowercase letters, numbers, and dashes (or the app's UUID)`);
+	return app;
+}
+/**
 * Northflank ids are slugs from the resource's URL, so the slip to catch is the
 * *display name* — "App Secrets" where "app-secrets" belongs.
 */
@@ -7007,10 +7613,36 @@ function assertNorthflankId(value, flag) {
 	if (!/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/.test(id)) fail(`${flag} should be a Northflank ID like "app-secrets", not "${id}"`);
 	return id;
 }
+/**
+* DigitalOcean app ids are UUIDs, and the slip to catch is the app *name* —
+* what the dashboard headline shows, and what the API answers with a bare 404.
+*/
+function assertDigitalOceanApp(value) {
+	if (!value) fail("--do-app is required for digitalocean (the UUID in the app's URL)");
+	const appId = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(appId)) fail(`--do-app should be the app's UUID, from its URL — not "${appId}"`);
+	return appId;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
 }
+/**
+* Netlify names a site by its **API ID**, and only that.
+*
+* Netlify does accept a site's domain where a site appears in a URL path, which
+* makes the strictness here look gratuitous — but the environment variable
+* endpoints take the site as a `?site_id=` query parameter, where Netlify
+* documents no name resolution. A site id it cannot resolve does not fail: the
+* variables land on the **team**, shared by every site in it. Refusing anything
+* but the UUID keeps a slip from writing much wider than was asked.
+*/
+function assertNetlifySite(value) {
+	if (!value) fail("--netlify-site is required for netlify (the site's API ID, a UUID)");
+	const site = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(site)) fail(`--netlify-site "${site}" is not a site API ID — Netlify shows it under Project configuration → General → Project information, and it is a UUID, not the site name or its .netlify.app address`);
+	return site;
+}
 /** Account-scope config for a connection (never the credential itself). */
 function buildConfig(provider, options) {
 	switch (provider) {
@@ -7046,6 +7678,14 @@ function buildConfig(provider, options) {
 		case "render": return { provider: "render" };
 		case "fly": return { provider: "fly" };
 		case "northflank": return { provider: "northflank" };
+		case "digitalocean": return { provider: "digitalocean" };
+		case "heroku": return { provider: "heroku" };
+		case "netlify":
+			if (!options.accountId) fail("--account-id is required for netlify — the team slug from app.netlify.com/teams/<slug>, or the account ID");
+			return {
+				provider: "netlify",
+				accountId: options.accountId
+			};
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -7144,6 +7784,41 @@ function buildDestination(provider, options) {
 			projectId: assertNorthflankId(options.project, "--project"),
 			secretGroupId: assertNorthflankId(options.secretGroup, "--secret-group")
 		};
+		case "digitalocean": {
+			const appId = assertDigitalOceanApp(options.doApp);
+			const scope = assertMember(options.envScope, DIGITALOCEAN_ENV_SCOPES, "--env-scope", "RUN_TIME");
+			const componentName = options.component?.trim();
+			if (!componentName) return {
+				provider: "digitalocean",
+				kind: "app",
+				appId,
+				scope
+			};
+			if (!/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/.test(componentName)) fail(`--component "${componentName}" is not an App Platform component name (lowercase letters, numbers, and dashes)`);
+			return {
+				provider: "digitalocean",
+				kind: "component",
+				appId,
+				componentName,
+				scope
+			};
+		}
+		case "heroku": return {
+			provider: "heroku",
+			app: assertHerokuApp(options.herokuApp)
+		};
+		case "netlify": {
+			const contexts = assertMembers(list(options.target, "production"), NETLIFY_CONTEXTS, "--target");
+			const branch = options.gitBranch?.trim();
+			if (contexts.includes("branch") && !branch) fail("--git-branch is required with `--target branch` — the branch the values apply to");
+			return {
+				provider: "netlify",
+				siteId: assertNetlifySite(options.netlifySite),
+				contexts,
+				...contexts.includes("branch") && branch ? { branch } : {},
+				secret: options.netlifySecret !== false
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -7159,6 +7834,9 @@ function describeDestination(destination) {
 		case "render": return destination.kind === "service" ? destination.serviceId : `env group ${destination.envGroupId}`;
 		case "fly": return destination.appName;
 		case "northflank": return `${destination.projectId} / ${destination.secretGroupId}`;
+		case "digitalocean": return `${destination.appId}${destination.kind === "component" ? ` / ${destination.componentName}` : ""} (${destination.scope})`;
+		case "heroku": return destination.app;
+		case "netlify": return `${destination.siteId} (${destination.contexts.map((context) => context === "branch" ? `branch @${destination.branch}` : context).join(", ")})`;
 	}
 }
 /**
@@ -7169,7 +7847,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -7193,7 +7871,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -8061,6 +8739,7 @@ registerAwsCommands(program);
 registerGcpCommands(program);
 registerMongoCommands(program);
 registerKmsCommands(program);
+registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
 	const { runMcpServer } = await import("./mcp-DR-zla_u.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
-    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",