@seekrit/cli 0.39.0 → 0.41.0

package/dist/index.js

@@ -28,6 +28,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Vault-style short-lived database and cloud credentials.",
 		default: true
 	},
+	"feature.rotation": {
+		kind: "feature",
+		label: "Secret rotation",
+		description: "Managed, scheduled rotation of stored credentials.",
+		default: true
+	},
 	"feature.log_sink": {
 		kind: "feature",
 		label: "Audit log export (SIEM)",
@@ -106,6 +112,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Maximum registered third-party sync destinations.",
 		default: null
 	},
+	"rotation.policies.max": {
+		kind: "limit",
+		label: "Rotation policies",
+		description: "Maximum secrets with managed rotation configured.",
+		default: null
+	},
 	members: {
 		kind: "metered",
 		label: "Members",
@@ -754,7 +766,7 @@ const connectionSchema = z.object({
 	database: z.string().min(1)
 });
 /** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
-const statementSchema = z.string().min(1).max(4e3);
+const statementSchema$1 = z.string().min(1).max(4e3);
 /** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
 const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
 const postgresTargetConfigSchema = z.object({
@@ -764,20 +776,20 @@ const postgresTargetConfigSchema = z.object({
 	schema: identifierSchema.optional(),
 	connection: connectionSchema,
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 /** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
-const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const mysqlHostSchema$1 = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
 const mysqlTargetConfigSchema = z.object({
 	provider: z.literal("mysql"),
 	executor: executorModeSchema,
 	accessLevel: mysqlAccessLevelSchema.optional(),
 	connection: connectionSchema,
-	userHost: mysqlHostSchema.optional(),
+	userHost: mysqlHostSchema$1.optional(),
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 const redisConnectionSchema = z.object({
 	host: z.string().min(1),
@@ -791,8 +803,8 @@ const redisTargetConfigSchema = z.object({
 	accessLevel: redisAccessLevelSchema.optional(),
 	connection: redisConnectionSchema,
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 const sshTargetConfigSchema = z.object({
 	provider: z.literal("ssh"),
@@ -1122,6 +1134,11 @@ const AUDIT_ACTIONS = [
 	"secret.deleted",
 	"secret.read",
 	"secret.restored",
+	"secret.rotation_configured",
+	"secret.rotation_updated",
+	"secret.rotation_disabled",
+	"secret.rotated",
+	"secret.rotation_failed",
 	"token.created",
 	"token.revoked",
 	"token.deleted",
@@ -1147,6 +1164,9 @@ const AUDIT_ACTIONS = [
 	"entitlement.override_cleared",
 	"billing.checkout_started",
 	"billing.portal_opened",
+	"promo.created",
+	"promo.updated",
+	"promo.redeemed",
 	"kms.key_created",
 	"kms.key_granted",
 	"kms.key_revoked",
@@ -1187,7 +1207,8 @@ const NOTIFICATION_TYPES = [
 	"token_expiring",
 	"lease_expired",
 	"sync_failed",
-	"honey_token_tripped"
+	"honey_token_tripped",
+	"secret_rotation_failed"
 ];
 /** UI-facing copy + default for each notification type. */
 const NOTIFICATION_TYPE_META = {
@@ -1240,6 +1261,11 @@ const NOTIFICATION_TYPE_META = {
 		label: "Honey token tripped",
 		description: "Someone tried to use one of your organization's decoy credentials (throttled per token). Nothing legitimate holds one, so every trip is worth reading.",
 		defaultEnabled: true
+	},
+	secret_rotation_failed: {
+		label: "Secret rotation failed",
+		description: "A scheduled secret rotation could not complete — the stored value may be out of step with the system it authenticates to.",
+		defaultEnabled: true
 	}
 };
 //#endregion
@@ -1467,6 +1493,25 @@ z.object({
 	note: z.string().max(500).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+z.object({
+	code: z.string().min(4).max(40),
+	family: planFamilySchema,
+	version: z.number().int().positive().optional(),
+	durationDays: z.number().int().positive().max(3650).nullish(),
+	maxRedemptions: z.number().int().positive().nullish(),
+	startsAt: z.iso.datetime().nullish(),
+	endsAt: z.iso.datetime().nullish(),
+	note: z.string().max(500).nullish()
+});
+z.object({
+	maxRedemptions: z.number().int().positive().nullish(),
+	startsAt: z.iso.datetime().nullish(),
+	endsAt: z.iso.datetime().nullish(),
+	note: z.string().max(500).nullish(),
+	/** Kill switch. Disabling stops new redemptions; live grants are untouched. */
+	disabled: z.boolean().optional()
+});
+z.object({ code: z.string().min(1).max(40) });
 z.object({ family: planFamilySchema });
 z.object({
 	sessionId: z.string().regex(/^skc_[0-9A-Za-z]+$/),
@@ -1484,6 +1529,99 @@ z.object({
 	action: z.string().optional(),
 	resourceType: z.string().optional()
 });
+z.enum([
+	"generated",
+	"postgres",
+	"mysql",
+	"redis"
+]);
+z.enum([
+	"active",
+	"paused",
+	"failed"
+]);
+/** Statuses an admin may set directly (`failed` is only reached by the sweep). */
+const settableRotationStatusSchema = z.enum(["active", "paused"]);
+const rotationAlphabetSchema = z.enum([
+	"alphanumeric",
+	"hex",
+	"base64url",
+	"printable"
+]);
+const rotationIntervalSchema = z.number().int().min(300).max(3600 * 24 * 365);
+/**
+* A database user name we are willing to *re-key*. Deliberately more permissive
+* than the lease providers' name schemas — those name accounts seekrit creates,
+* whereas this names an account the customer's DBA created years ago, which may
+* be mixed-case or contain dots or dashes.
+*
+* It stays injection-safe for every place it is interpolated: a double-quoted
+* Postgres identifier, a single-quoted MySQL literal, and a bare Redis command
+* token. The charset excludes both quote characters, backslash, whitespace, and
+* `;`, so there is no way out of the surrounding quoting, and no whitespace to
+* split one Redis argument into two.
+*/
+const rotationUsernameSchema = z.string().regex(/^[A-Za-z0-9_$.-]{1,63}$/, "must be 1–63 chars of letters, digits, underscore, dollar, dot or dash");
+/** A `{{name}}`/`{{host}}`/`{{verifier}}` templated statement or command line. */
+const statementSchema = z.string().min(1).max(4e3);
+const passwordLengthSchema = z.number().int().min(16).max(256);
+/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
+const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const generatedRotationConfigSchema = z.object({
+	kind: z.literal("generated"),
+	length: passwordLengthSchema.optional(),
+	alphabet: rotationAlphabetSchema.optional()
+});
+const postgresRotationConfigSchema = z.object({
+	kind: z.literal("postgres"),
+	username: rotationUsernameSchema,
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const mysqlRotationConfigSchema = z.object({
+	kind: z.literal("mysql"),
+	username: rotationUsernameSchema,
+	userHost: mysqlHostSchema.optional(),
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const redisRotationConfigSchema = z.object({
+	kind: z.literal("redis"),
+	username: rotationUsernameSchema,
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const rotationConfigSchema = z.discriminatedUnion("kind", [
+	generatedRotationConfigSchema,
+	postgresRotationConfigSchema,
+	mysqlRotationConfigSchema,
+	redisRotationConfigSchema
+]);
+z.object({
+	environmentId: z.string().min(1),
+	/** The secret whose value rotates. It must already exist. */
+	secretName: secretNameSchema,
+	config: rotationConfigSchema,
+	intervalSeconds: rotationIntervalSchema,
+	/**
+	* The registered lease target supplying the connection, executor mode, and
+	* wrapped admin credential. Required for every kind but `generated`.
+	*/
+	targetId: z.string().min(1).optional(),
+	/** Environment DEK wrapped to the rotator public key (`wd1.` blob). */
+	wrappedDek: z.string().min(1).optional(),
+	/** Rotate once immediately instead of waiting for the first interval. */
+	rotateNow: z.boolean().optional()
+});
+z.object({
+	intervalSeconds: rotationIntervalSchema.optional(),
+	config: rotationConfigSchema.optional(),
+	/**
+	* `paused` stops the sweep; `active` resumes it and clears the failure
+	* streak, which is also how a `failed` policy is recovered.
+	*/
+	status: settableRotationStatusSchema.optional()
+}).refine((v) => v.intervalSeconds !== void 0 || v.config !== void 0 || v.status !== void 0, "provide at least one of intervalSeconds, config, or status");
 //#endregion
 //#region ../../packages/core/src/sync.ts
 /**
@@ -1525,7 +1663,11 @@ const SYNC_PROVIDER_KINDS = [
 	"fly",
 	"northflank",
 	"digitalocean",
-	"heroku"
+	"heroku",
+	"netlify",
+	"bunnyshell",
+	"github-actions",
+	"gcp-secret-manager"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1711,6 +1853,101 @@ const digitalOceanConnectionConfigSchema = z.object({ provider: z.literal("digit
 * not.
 */
 const herokuConnectionConfigSchema = z.object({ provider: z.literal("heroku") });
+/**
+* Netlify team scope — the one thing a Netlify token cannot tell us itself.
+*
+* Every environment variable endpoint is account-scoped
+* (`/accounts/{account_id}/env`), and a personal access token belongs to a
+* *user*, who may sit in several teams. So unlike Fly's or Heroku's, this
+* config is not empty: the token says who you are, and this says which team's
+* variables to write.
+*
+* Netlify treats the team's id and its slug as interchangeable wherever
+* `{account_id}` appears, so both are accepted. The slug is the one an operator
+* can find without an API call — it is in the dashboard URL
+* (`app.netlify.com/teams/<slug>`) and under Team settings → General.
+*/
+const netlifyConnectionConfigSchema = z.object({
+	provider: z.literal("netlify"),
+	/** Netlify team slug (`acme`) or account id — `{account_id}` accepts either. */
+	accountId: z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Netlify team slug or account ID — no slashes or spaces")
+});
+/**
+* Bunnyshell account scope — empty, as Fly's, Heroku's, and Northflank's are.
+*
+* A Bunnyshell access token (from `environments.bunnyshell.com/access-token`)
+* belongs to a *user* and carries their access to every organization they are
+* in, exactly as a Heroku token does. Unlike Netlify's, that does not force an
+* organization onto the connection, because nothing here is addressed *through*
+* one: both variable collections name their parent by an opaque, globally
+* unique id (`environment` or `project`), so the token plus the destination's
+* id is the whole address. The API offers an `organization` filter, but it
+* narrows a listing — it is not part of an address.
+*/
+const bunnyshellConnectionConfigSchema = z.object({ provider: z.literal("bunnyshell") });
+/**
+* GitHub account scope — empty for github.com, which is the whole point.
+*
+* A GitHub token addresses everything by `{owner}/{repo}` or `{org}`, and those
+* are the destination's business, so there is no account half to state the way
+* Cloudflare and Netlify need one. `baseUrl` is the single exception, and it is
+* not an account scope at all: it names a **GitHub Enterprise Server** install,
+* whose API lives on the customer's own host rather than on `api.github.com`.
+*
+* Left unset for github.com and for Enterprise Cloud (which is `api.github.com`
+* with a different plan behind it). Set only for a self-hosted GHES appliance,
+* where the REST API is at `https://<host>/api/v3`.
+*/
+const githubActionsConnectionConfigSchema = z.object({
+	provider: z.literal("github-actions"),
+	/**
+	* GitHub Enterprise Server API root, e.g. `https://github.acme.com/api/v3`.
+	* Omit for github.com. Must be `https:` — this URL carries the token.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the GitHub Enterprise Server API root, e.g. https://github.acme.com/api/v3").optional()
+});
+/**
+* A Google Cloud project, as `projects/{project}` accepts one: either the
+* project **ID** (`acme-prod`, 6–30 characters, what the console shows) or the
+* project **number** (all digits). Both are accepted because both work, and
+* the id is the one an operator can read off their own dashboard.
+*
+* Validated by shape for the reason Cloudflare's account id is: every Secret
+* Manager URL is built from this string, and a typo would otherwise surface as
+* a 403 from Google hours later inside an alarm, with nobody watching.
+*/
+const gcpProjectSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(value) || /^\d{1,20}$/.test(value), "must be a Google Cloud project ID (e.g. acme-prod) or project number");
+/**
+* Google Cloud project scope — which project's Secret Manager to write.
+*
+* The service account is *not* here, unlike AWS's access key id: a GCP
+* credential is a key JSON that names its own `client_email`, so the identity
+* arrives with the credential the way a Vercel token's does. What the
+* credential cannot say is which project to write, because a service account
+* can be granted access to secrets in projects other than its own — so that is
+* this field, exactly as Cloudflare's account id is.
+*
+* One project per connection. Syncing an environment into two projects means
+* two connections, which also keeps their key grants separate.
+*
+* Global secrets only: v1 addresses `secretmanager.googleapis.com`, not the
+* per-location `secretmanager.<location>.rep.googleapis.com` endpoints that
+* regional secrets live behind. Data residency is expressed instead through the
+* destination's user-managed replication.
+*/
+const gcpSecretManagerConnectionConfigSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	/** Project ID (`acme-prod`) or project number. */
+	projectId: gcpProjectSchema
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1723,7 +1960,11 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	flyConnectionConfigSchema,
 	northflankConnectionConfigSchema,
 	digitalOceanConnectionConfigSchema,
-	herokuConnectionConfigSchema
+	herokuConnectionConfigSchema,
+	netlifyConnectionConfigSchema,
+	bunnyshellConnectionConfigSchema,
+	githubActionsConnectionConfigSchema,
+	gcpSecretManagerConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -2078,6 +2319,362 @@ const herokuDestinationSchema = z.object({
 	/** App name as `heroku apps` prints it, or the app's UUID. */
 	app: herokuAppSchema
 });
+/**
+* The deploy contexts a Netlify value can be set for.
+*
+* These are Netlify's own, minus two. `all` is missing deliberately: Netlify
+* requires a **secret** value to be set against explicit contexts, and its
+* `setEnvVarValue` endpoint is reported to fail outright on `context: "all"` —
+* so the union offers only contexts that work under both. Naming the contexts
+* you mean is what you want here anyway; a binding already exists to map one
+* seekrit environment onto one deploy context. `dev-server` (Preview Server) is
+* left out for want of anyone asking.
+*
+* `branch` is the odd one: it needs a branch name alongside it, which the
+* destination carries as {@link netlifyDestinationSchema}'s `branch`.
+*/
+const NETLIFY_CONTEXTS = [
+	"production",
+	"deploy-preview",
+	"branch-deploy",
+	"branch",
+	"dev"
+];
+/**
+* A Netlify site, by its **API ID** — the UUID under Project configuration →
+* General → Project information.
+*
+* Netlify accepts a site's domain in place of its id where a site appears in a
+* *path* (`/sites/{site_id}`), but the environment variable endpoints take the
+* site as a `?site_id=` **query parameter** instead, and Netlify documents no
+* name resolution there. That asymmetry is why this is strict where the Heroku
+* and Fly destinations are permissive: a `site_id` Netlify does not resolve
+* does not 404 — the write lands on the *team*, as a shared variable inherited
+* by every site in it. Refusing anything but the UUID keeps a slip from turning
+* into a much wider blast radius than the operator asked for.
+*/
+const netlifySiteIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be the site's API ID (a UUID), not its name or URL");
+/**
+* The Netlify site, and which of its deploy contexts a binding owns.
+*
+* Netlify keys a value by (site, context), so the destination is that pair.
+* Contexts are a list rather than a single value for the same reason Vercel's
+* `targets` is one: a binding is unique per (connection, environment), so an
+* environment that feeds both production and deploy previews has to say so in
+* one destination or not at all.
+*
+* A push writes **only** the contexts listed here. Other contexts of the same
+* variable — and every variable this binding does not manage — are left as they
+* are, which is what makes it safe to point at a site that already has
+* variables set by hand.
+*
+* `secret` marks what seekrit creates as a Netlify **secret**: write-only, and
+* unreadable afterwards through the UI, CLI, and API. On by default, since that
+* is the whole point of pushing from a secrets manager. It applies only to
+* variables seekrit *creates* — Netlify will not let a flag be added to an
+* existing variable, or removed from one ever — and it needs a plan that
+* includes Secrets Controller.
+*/
+const netlifyDestinationSchema = z.object({
+	provider: z.literal("netlify"),
+	/** Site API ID (a UUID), from Project configuration → General. */
+	siteId: netlifySiteIdSchema,
+	/** Which deploy contexts receive these values. At least one. */
+	contexts: z.array(z.enum(NETLIFY_CONTEXTS)).min(1),
+	/** Branch name, required when `contexts` includes `branch`; ignored otherwise. */
+	branch: z.string().trim().min(1).max(255).optional(),
+	/** Create variables as Netlify secrets (default true). */
+	secret: z.boolean().optional()
+}).refine((d) => !d.contexts.includes("branch") || d.branch !== void 0, {
+	message: "a branch context needs the branch name it applies to",
+	path: ["branch"]
+});
+/**
+* A Bunnyshell resource id, as the platform hands it out.
+*
+* Deliberately loose. Bunnyshell documents no format for these — they are
+* opaque strings from `bns environments list` or the dashboard URL — so
+* asserting a shape here would be inventing a rule the platform never stated,
+* and the failure mode would be seekrit refusing an id that works.
+*
+* Being loose is affordable here in a way it is not on Netlify, where an
+* unresolved `site_id` silently widens a write to the whole team. Both
+* Bunnyshell variable collections name their parent in the **request body** of
+* a create, as a required relation: an id the platform cannot resolve is a 422
+* naming the field, not a write that lands somewhere broader. The listing side
+* is fenced separately — the connector re-checks every variable's own parent
+* before it touches it, so a filter that failed to bite cannot turn into an
+* edit of a neighbouring environment's variables.
+*/
+const bunnyshellIdSchema = z.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Bunnyshell ID — no slashes or spaces");
+/**
+* Variables on one Bunnyshell **environment** — the set every component in it
+* inherits, and the closest match to a seekrit environment.
+*
+* This is the destination for an environment that already exists and stays
+* around: a primary environment, or a long-lived ephemeral one.
+*/
+const bunnyshellEnvironmentDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("environment"),
+	/** Environment ID, as `bns environments list` prints it. */
+	environmentId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Variables on a Bunnyshell **project** — inherited by every environment
+* created in it from then on.
+*
+* Worth thinking about twice, for the reason a Render environment group is:
+* the blast radius is the project, not one environment. It earns its place
+* anyway, because it is the only destination that reaches an environment which
+* *does not exist yet*. Bunnyshell's whole shape is ephemeral environments spun
+* up per branch or per pull request; pushing to the environment cannot seed one
+* that a webhook will create tomorrow, and pushing to the project can.
+*
+* An environment inherits the project's value at creation and may then be
+* overridden at its own scope — so a project binding does not fight an
+* environment binding pointed at the same name, it loses to it.
+*/
+const bunnyshellProjectDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("project"),
+	/** Project ID, as `bns projects list` prints it. */
+	projectId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Where in Bunnyshell a binding writes.
+*
+* Split on `kind` rather than into two providers — the way Render's service and
+* environment group are, and unlike Cloudflare's three — because the two are the
+* same API twice over: `/v1/environment_variables` and `/v1/project_variables`
+* take the same fields, fail the same ways, and differ only in which parent they
+* name. One connector serves both, so one provider does too.
+*
+* `secret` is Bunnyshell's `isSecret`, and means less than Netlify's flag of the
+* same name: Bunnyshell encrypts every variable with an organization key whether
+* or not the flag is set, so this only decides whether the value is obscured in
+* the dashboard and stored encrypted in an exported definition. It is on by
+* default all the same — a value pushed from a secrets manager should not be
+* sitting in plain view of everyone with project access. It applies only to
+* variables seekrit **creates**: an update never sends the flag, so a variable
+* an operator deliberately un-secreted stays that way.
+*/
+const bunnyshellDestinationSchema = z.discriminatedUnion("kind", [bunnyshellEnvironmentDestinationSchema, bunnyshellProjectDestinationSchema]);
+/**
+* Which repositories in an organization can read an org-level secret.
+*
+* GitHub's own enum, unchanged. There is deliberately **no default**: `all` hands
+* the value to every repository in the organization — including ones added
+* tomorrow, and including forks' workflows to the extent the org allows them —
+* and that is not a blast radius a secrets manager should pick on an operator's
+* behalf. Naming it is the point.
+*/
+const GITHUB_ACTIONS_VISIBILITIES = [
+	"all",
+	"private",
+	"selected"
+];
+/**
+* A GitHub account or organization login, matching GitHub's own rule:
+* alphanumeric with single internal hyphens, 39 characters at most.
+*
+* Checked here so the habitual slip — pasting a URL, or `owner/repo` into the
+* owner field — fails at the form rather than as a 404 from an alarm with nobody
+* watching.
+*/
+const githubOwnerSchema = z.string().trim().min(1).max(39).regex(/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/, "must be a GitHub user or organization login — not a URL or an owner/repo pair");
+/**
+* A repository name. GitHub's rules are looser than an owner's: letters,
+* numbers, hyphens, underscores, and periods, up to 100 characters. `.` and `..`
+* are refused outright — they would traverse the API path rather than name a
+* repository.
+*/
+const githubRepoSchema = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "must be a repository name alone (`api`), not `owner/repo` or a URL").refine((value) => value !== "." && value !== "..", "is not a repository name");
+/**
+* A deployment environment name.
+*
+* Deliberately permissive: GitHub allows spaces and most punctuation here, and
+* the dashboard shows names like `prod (eu-west)`. Only the two things that would
+* break the request are refused — an empty name, and the path separators that
+* would let a name escape its URL segment. Everything else is GitHub's to reject.
+*/
+const githubEnvironmentSchema = z.string().trim().min(1).max(255).refine((value) => !value.includes("/") && !value.includes("\\"), "cannot contain a slash — that is a path separator, not part of an environment name");
+/**
+* One repository's Actions secrets.
+*
+* Every workflow in the repository can read these, including one added by a pull
+* request from a collaborator with write access. That is GitHub's model, not a
+* choice this connector makes — but it is the reason `environment` exists below,
+* and the reason to prefer it for anything that touches production.
+*/
+const githubActionsRepoDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("repo"),
+	/** Repository owner — a user or organization login. */
+	owner: githubOwnerSchema,
+	/** Repository name, without the owner. */
+	repo: githubRepoSchema
+});
+/**
+* One deployment environment's Actions secrets — the narrowest scope GitHub has.
+*
+* A job reads these only by declaring `environment: <name>`, which also subjects
+* it to that environment's protection rules: required reviewers, wait timers, and
+* the branch policy. That combination is the closest GitHub gets to "this secret
+* is for production, and reaching it requires approval", and it is the scope to
+* reach for by default.
+*
+* The environment must already exist. This connector will not create one: an
+* environment is a deployment gate, and silently creating an unprotected one
+* because a name was misspelled would quietly remove the protection the operator
+* was relying on.
+*/
+const githubActionsEnvironmentDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("environment"),
+	owner: githubOwnerSchema,
+	repo: githubRepoSchema,
+	/** Environment name, exactly as the repository's Settings → Environments shows it. */
+	environment: githubEnvironmentSchema
+});
+/**
+* An organization's Actions secrets.
+*
+* The widest scope in the product, and the only destination on any provider that
+* can hand a value to repositories nobody named. Read {@link
+* GITHUB_ACTIONS_VISIBILITIES} before using it.
+*
+* `selectedRepositoryIds` takes numeric repository **ids**, not names, because
+* that is what GitHub's API takes. An id is visible at
+* `GET /repos/{owner}/{repo}` as `id`, and in the dashboard nowhere at all —
+* which is friction worth accepting rather than resolving names to ids here: name
+* resolution would mean this connector picking which repository an ambiguous
+* name meant, and getting that wrong widens a secret's reach silently.
+*/
+const githubActionsOrgDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("org"),
+	/** Organization login. */
+	org: githubOwnerSchema,
+	/** Which repositories may read these secrets. Stated, never defaulted. */
+	visibility: z.enum(GITHUB_ACTIONS_VISIBILITIES),
+	/** Numeric repository ids, required when `visibility` is `selected`. */
+	selectedRepositoryIds: z.array(z.number().int().positive()).max(500).optional()
+}).refine((dest) => dest.visibility !== "selected" || dest.selectedRepositoryIds !== void 0 && dest.selectedRepositoryIds.length > 0, {
+	message: "selected visibility needs at least one repository id",
+	path: ["selectedRepositoryIds"]
+}).refine((dest) => dest.visibility === "selected" || dest.selectedRepositoryIds === void 0, {
+	message: "repository ids only apply to selected visibility — remove them, or select it",
+	path: ["selectedRepositoryIds"]
+});
+const githubActionsDestinationSchema = z.discriminatedUnion("kind", [
+	githubActionsRepoDestinationSchema,
+	githubActionsEnvironmentDestinationSchema,
+	githubActionsOrgDestinationSchema
+]);
+/**
+* How a binding lays its secrets out in Secret Manager. The same two shapes the
+* AWS Secrets Manager destination offers, and for the same reasons:
+*
+* - `secret-per-name` — one GCP secret per seekrit secret. The direct
+*   translation, and what Cloud Run's `--set-secrets` and GKE's Secret Manager
+*   CSI driver mount one at a time.
+* - `json-bundle` — every value as one JSON object in a single secret. Costs one
+*   active version instead of fifty, which is the whole billing unit here.
+*/
+const GCP_SECRET_MANAGER_LAYOUTS = ["secret-per-name", "json-bundle"];
+/**
+* Where Google keeps the copies of a secret. Chosen at creation and
+* **immutable** afterwards — changing it means deleting the secret and letting
+* the next run recreate it.
+*
+* - `automatic` — Google picks the locations. One billable replica, and what
+*   you want unless a policy says otherwise.
+* - `user-managed` — the binding names the regions. This is how data residency
+*   is expressed for global secrets, and each region is billed as its own
+*   active version.
+*/
+const GCP_REPLICATION_POLICIES = ["automatic", "user-managed"];
+/**
+* A Secret Manager secret ID. Google's own rule, quoted from the API reference:
+* "a string with a maximum length of 255 characters and can contain uppercase
+* and lowercase letters, numerals, and the hyphen (`-`) and underscore (`_`)
+* characters."
+*
+* Notably **no slashes and no dots**, which is what makes this a different
+* field from AWS's `pathPrefix` rather than the same idea renamed: a Secret
+* Manager namespace is spelled `prod-storefront-DB_URL`, not
+* `prod/storefront/DB_URL`.
+*/
+const gcpSecretIdSchema = z.string().trim().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/, "may contain letters, digits, hyphens, and underscores");
+/**
+* A GCP region for a user-managed replica (`us-east1`, `europe-west4`,
+* `northamerica-northeast1`). Validated by shape rather than against a list,
+* because Google adds regions faster than we ship — a name Secret Manager does
+* not know is refused by Google with a clear message at creation.
+*/
+const gcpLocationSchema = z.string().trim().regex(/^[a-z]+-[a-z]+\d+$/, "must be a GCP region ID, e.g. us-east1");
+/**
+* A Cloud KMS key, as its full resource name — the only form the API accepts:
+* `projects/p/locations/l/keyRings/r/cryptoKeys/k`.
+*
+* Stricter than AWS's `kmsKeyId` (which tolerates five spellings) because
+* Google tolerates exactly one, and because a key in the wrong *location* is
+* rejected at creation: an automatic-replication secret needs a `global` key,
+* and a user-managed replica needs one in its own region.
+*/
+const gcpKmsKeyNameSchema = z.string().trim().max(1024).regex(/^projects\/[^/]+\/locations\/[^/]+\/keyRings\/[^/]+\/cryptoKeys\/[^/]+$/, "must be a full Cloud KMS key name (projects/…/locations/…/keyRings/…/cryptoKeys/…)");
+/**
+* Where inside a project's Secret Manager a binding writes.
+*
+* ## Every push would otherwise cost a version
+*
+* Secret Manager has no "set the value" call — only `addVersion`, which appends.
+* A run pushes the whole environment (never a diff), so changing one secret in
+* an environment of fifty would leave fifty new versions behind, forty-nine of
+* them identical to their predecessors, each one billed for as long as it stays
+* active.
+*
+* So this connector writes a version only when the value actually changed,
+* decided from a keyed digest it keeps in the secret's own **annotations** — see
+* `apps/api/src/lib/sync/connectors/gcp-secret-manager.ts` for why it is keyed
+* and what that costs. `pruneVersions` is the other half of the bill: with it
+* on, the version a push supersedes is destroyed as soon as the new one lands,
+* so a secret keeps exactly one active version.
+*/
+const gcpSecretManagerDestinationSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	layout: z.enum(GCP_SECRET_MANAGER_LAYOUTS).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret ID, e.g.
+	* `prod-storefront-`. Optional, but strongly advised in a project that holds
+	* anything else — without it a binding writes at the root of a namespace it
+	* does not own, and Secret Manager has no folders to hide behind.
+	*/
+	idPrefix: z.string().trim().max(200).regex(/^[A-Za-z0-9_-]*$/, "may contain letters, digits, hyphens, and underscores").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod-storefront-env`. */
+	secretId: gcpSecretIdSchema.optional(),
+	replication: z.enum(GCP_REPLICATION_POLICIES).default("automatic"),
+	/** `user-managed` only: the regions to replicate to. At least one. */
+	locations: z.array(gcpLocationSchema).min(1).max(16).optional(),
+	/** Customer-managed encryption key. Omitted means Google-managed keys. */
+	kmsKeyName: gcpKmsKeyNameSchema.optional(),
+	/** Destroy the version each push supersedes, keeping one active version. */
+	pruneVersions: z.boolean().optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretId !== void 0, {
+	message: "a json-bundle destination needs the ID of the secret to write",
+	path: ["secretId"]
+}).refine((d) => d.replication !== "user-managed" || (d.locations?.length ?? 0) > 0, {
+	message: "user-managed replication needs at least one location",
+	path: ["locations"]
+}).refine((d) => d.kmsKeyName === void 0 || d.replication === "automatic" || (d.locations?.length ?? 0) === 1, {
+	message: "a customer-managed key covers one location — use automatic replication, or a single location",
+	path: ["kmsKeyName"]
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -2090,7 +2687,11 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	flyDestinationSchema,
 	northflankDestinationSchema,
 	digitalOceanDestinationSchema,
-	herokuDestinationSchema
+	herokuDestinationSchema,
+	netlifyDestinationSchema,
+	bunnyshellDestinationSchema,
+	githubActionsDestinationSchema,
+	gcpSecretManagerDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -2539,6 +3140,43 @@ async function decryptDataKey(material, wrapped) {
 	}
 }
 //#endregion
+//#region ../../packages/crypto/src/random.ts
+const ALPHABETS = {
+	alphanumeric: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+	hex: "0123456789abcdef",
+	base64url: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_",
+	/**
+	* Alphanumerics plus punctuation chosen to survive being pasted anywhere a
+	* secret goes: no quote of either kind, no backslash, backtick, `$`, or
+	* whitespace, so the value can't break out of a shell word, a SQL literal, a
+	* URL component, or a `.env` line.
+	*/
+	printable: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-._~!*+="
+};
+/**
+* A cryptographically random string of `length` characters drawn uniformly from
+* `alphabet` (default `alphanumeric`, ≈5.95 bits/char — 32 chars ≈ 190 bits).
+*
+* Uses rejection sampling: bytes at or above the largest multiple of the
+* alphabet size are discarded rather than folded, so `% n` introduces no modulo
+* bias toward the low end of the alphabet.
+*/
+function generateSecretValue(length, alphabet = "alphanumeric") {
+	if (!Number.isInteger(length) || length < 1) throw new RangeError("length must be a positive integer");
+	const chars = ALPHABETS[alphabet];
+	const n = chars.length;
+	const limit = 256 - 256 % n;
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < limit) out += chars[byte % n];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+//#endregion
 //#region ../../packages/crypto/src/mongodb.ts
 /** Generate the ephemeral P-256 keypair a client uses to receive one MongoDB lease. */
 async function generateMongoRecipientKeyPair() {
@@ -2603,7 +3241,6 @@ function mongoConnectionUri(cred) {
 * SCRAM helper does, with no hand-rolled hash primitive.
 */
 const DEFAULT_PASSWORD_LENGTH$2 = 32;
-const PASSWORD_ALPHABET$2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function sha1(data) {
 	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
 }
@@ -2612,17 +3249,6 @@ function toUpperHex(bytes) {
 	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
 	return hex.toUpperCase();
 }
-function randomPassword$2(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$2[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
 * for a known password. Pass the result straight to
@@ -2636,7 +3262,7 @@ async function mysqlNativePasswordVerifier(password) {
 * — the client-side half of a Vault-style dynamic MySQL credential.
 */
 async function generateMysqlCredential(options = {}) {
-	const password = randomPassword$2(options.length ?? DEFAULT_PASSWORD_LENGTH$2);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH$2);
 	return {
 		password,
 		verifier: await mysqlNativePasswordVerifier(password)
@@ -2916,7 +3542,6 @@ async function combineRecoveryShares(shareBytes) {
 * helper does, with no hand-rolled hash primitive.
 */
 const DEFAULT_PASSWORD_LENGTH$1 = 32;
-const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function sha256$1(data) {
 	return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
 }
@@ -2925,17 +3550,6 @@ function toLowerHex(bytes) {
 	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
 	return hex;
 }
-function randomPassword$1(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the Redis ACL password verifier `LOWER(HEX(SHA256(password)))` for a
 * known password. Pass the result straight to `ACL SETUSER … on #<verifier>`.
@@ -2948,7 +3562,7 @@ async function redisSha256Verifier(password) {
 * client-side half of a Vault-style dynamic Redis credential.
 */
 async function generateRedisCredential(options = {}) {
-	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
 	return {
 		password,
 		verifier: await redisSha256Verifier(password)
@@ -2956,7 +3570,6 @@ async function generateRedisCredential(options = {}) {
 }
 const SALT_LENGTH = 16;
 const DEFAULT_PASSWORD_LENGTH = 32;
-const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function hmacSha256(key, message) {
 	const k = await crypto.subtle.importKey("raw", key, {
 		name: "HMAC",
@@ -2977,17 +3590,6 @@ async function saltPassword(password, salt, iterations) {
 	}, material, 256);
 	return new Uint8Array(bits);
 }
-function randomPassword(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the `SCRAM-SHA-256$<i>:<salt>$<StoredKey>:<ServerKey>` verifier for a
 * known password. Pass the result straight to `CREATE ROLE … PASSWORD`.
@@ -3005,7 +3607,7 @@ async function scramSha256Verifier(password, options = {}) {
 * client-side half of a Vault-style dynamic Postgres credential.
 */
 async function generatePostgresCredential(options = {}) {
-	const password = randomPassword(options.length ?? DEFAULT_PASSWORD_LENGTH);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH);
 	const iterations = options.iterations ?? 4096;
 	return {
 		password,
@@ -3295,7 +3897,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.39.0";
+var version = "0.41.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -3727,6 +4329,39 @@ var SeekritClient = class {
 	revokeLease(orgId, leaseId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
 	}
+	/**
+	* The rotator public key (the broker DO's), plus the environments that have
+	* already granted it. Wrap an environment's DEK to this key client-side before
+	* configuring rotation — that wrap IS the grant, and the server can't make it.
+	*/
+	getRotatorKey(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation/rotator-key`);
+	}
+	listRotations(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation`);
+	}
+	getRotation(orgId, rotationId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation/${rotationId}`);
+	}
+	/**
+	* Configure (or replace) a secret's rotation policy. `version` comes back only
+	* when `rotateNow` was set — a rotated secret's new version number, never its
+	* value.
+	*/
+	configureRotation(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/rotation`, input);
+	}
+	updateRotation(orgId, rotationId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/rotation/${rotationId}`, input);
+	}
+	/** Rotate now. Returns the new version — the value stays where it belongs. */
+	rotateSecretNow(orgId, rotationId) {
+		return this.request("POST", `/v1/orgs/${orgId}/rotation/${rotationId}/rotate`);
+	}
+	/** Disable rotation. `rotatorRevoked` reports whether the broker's key grant went too. */
+	disableRotation(orgId, rotationId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/rotation/${rotationId}`);
+	}
 	listAudit(orgId, query = {}) {
 		const params = new URLSearchParams();
 		if (query.cursor) params.set("cursor", query.cursor);
@@ -3783,6 +4418,19 @@ var SeekritClient = class {
 	cancelSubscription(orgId) {
 		return this.request("POST", `/v1/orgs/${orgId}/billing/cancel`);
 	}
+	/**
+	* Redeem a promo code, comping the org onto the plan the code grants.
+	* Admin-only. Casing, spaces, and dashes are normalized server-side, so pass
+	* the code as the user typed it. Returns the refreshed billing view.
+	*
+	* Every invalid code fails the same way regardless of why (unknown, expired,
+	* fully redeemed, already used by this org) — the API deliberately won't
+	* confirm that a code exists. Show the returned message as-is rather than
+	* guessing at a more specific one.
+	*/
+	redeemPromoCode(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/promo`, input);
+	}
 };
 async function unauthenticatedPost(baseUrl, path, body, fetchImpl, client) {
 	const headers = {
@@ -6770,6 +7418,184 @@ function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
 }
+//#endregion
+//#region src/rotation.ts
+/**
+* `seekrit rotation` — managed, scheduled rotation of a stored secret's value.
+*
+* Zero-knowledge: enabling rotation unwraps this environment's DEK **on this
+* machine** and re-wraps it to the rotator public key (the per-org broker
+* Durable Object's), so the control plane only ever relays ciphertext. That wrap
+* is what lets the broker write a new value in place — and it is exactly why the
+* server can't enable rotation on its own.
+*
+* Rotated values are never printed here. Read them like any other secret
+* (`seekrit secrets get NAME`), which decrypts locally.
+*/
+/** Parse a duration like `30m`, `24h`, `90d`, or a bare seconds count. */
+function parseDurationSeconds(input, flag) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid ${flag} "${input}" (try 12h, 7d, 90d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+function formatInterval(seconds) {
+	if (seconds % 86400 === 0) return `${seconds / 86400}d`;
+	if (seconds % 3600 === 0) return `${seconds / 3600}h`;
+	if (seconds % 60 === 0) return `${seconds / 60}m`;
+	return `${seconds}s`;
+}
+/** One policy as a tab-separated line: name, kind, cadence, status, next run. */
+function rotationLine(r) {
+	const status = r.failureCount > 0 ? `${r.status} (${r.failureCount} failed)` : r.status;
+	return [
+		r.id,
+		r.secretName,
+		r.kind,
+		`every ${formatInterval(r.intervalSeconds)}`,
+		status,
+		`next ${r.nextRotateAt}`
+	].join("	");
+}
+/** Find a policy by id, or by secret name when it is unambiguous in the org. */
+async function resolveRotation(ctx, orgId, ref) {
+	const { rotations } = await ctx.client.listRotations(orgId);
+	const byId = rotations.find((r) => r.id === ref);
+	if (byId) return byId;
+	const byName = rotations.filter((r) => r.secretName === ref);
+	if (byName.length === 1) return byName[0];
+	if (byName.length > 1) fail(`"${ref}" rotates in ${byName.length} environments — pass the rotation id instead:\n${byName.map((r) => `  ${r.id}\t${r.environmentId}`).join("\n")}`);
+	fail(`no rotation policy "${ref}"`);
+}
+/** Build the rotation config from the CLI flags for a given kind. */
+function buildConfig$1(kind, options) {
+	const length = Number.parseInt(options.length, 10);
+	if (!Number.isFinite(length)) fail(`invalid --length "${options.length}"`);
+	if (kind === "generated") {
+		const alphabets = [
+			"alphanumeric",
+			"hex",
+			"base64url",
+			"printable"
+		];
+		if (!alphabets.includes(options.alphabet)) fail(`--alphabet must be one of ${alphabets.join(", ")}`);
+		return {
+			kind: "generated",
+			length,
+			alphabet: options.alphabet
+		};
+	}
+	if (!options.username) fail(`--username is required for a ${kind} rotation`);
+	const username = options.username;
+	if (kind === "postgres") return {
+		kind: "postgres",
+		username,
+		passwordLength: length
+	};
+	if (kind === "mysql") return {
+		kind: "mysql",
+		username,
+		passwordLength: length,
+		...options.userHost ? { userHost: options.userHost } : {}
+	};
+	if (kind === "redis") return {
+		kind: "redis",
+		username,
+		passwordLength: length
+	};
+	return fail(`--kind must be generated, postgres, mysql, or redis (got "${kind}")`);
+}
+function registerRotationCommands(program) {
+	const rotation = program.command("rotation").description("managed rotation of stored secret values (scheduled, zero-knowledge)");
+	rotation.command("enable <secretName>").description("configure rotation for an existing secret").option("--org <slug>").option("--app <slug>").option("--group <slug>", "rotate a secret in a group environment").requiredOption("--env <slug>").requiredOption("--kind <kind>", "generated | postgres | mysql | redis").requiredOption("--every <duration>", "rotation cadence, e.g. 24h, 30d").option("--username <name>", "the EXISTING database account to re-key (db kinds)").option("--target <idOrName>", "registered lease target to rotate against (db kinds)").option("--user-host <host>", "MySQL account host part (default %)").option("--length <n>", "generated value length", "32").option("--alphabet <set>", "generated kind only: alphanumeric | hex | base64url | printable", "alphanumeric").option("--now", "rotate immediately as well as on the schedule").action(async (secretName, options) => {
+		const ctx = buildContext();
+		const target = await resolveEnvTarget(ctx, options);
+		const config = buildConfig$1(options.kind, options);
+		const intervalSeconds = parseDurationSeconds(options.every, "--every");
+		let targetId;
+		if (config.kind !== "generated") {
+			if (!options.target) fail(`--target is required for a ${config.kind} rotation`);
+			const { targets } = await ctx.client.listLeaseTargets(target.orgId);
+			const t = targets.find((x) => x.id === options.target || x.name === options.target);
+			if (!t) fail(`no lease target "${options.target}" — register one with \`seekrit ${config.kind === "postgres" ? "pg" : config.kind} target add\``);
+			targetId = t.id;
+		}
+		const { publicKeyJwk, grantedEnvironmentIds } = await ctx.client.getRotatorKey(target.orgId);
+		let wrappedDek;
+		if (!grantedEnvironmentIds.includes(target.envId)) wrappedDek = await wrapDek(await getDek(ctx, target.orgId, target.envId), publicKeyJwk);
+		const { rotation: created, version } = await ctx.client.configureRotation(target.orgId, {
+			environmentId: target.envId,
+			secretName,
+			config,
+			intervalSeconds,
+			...targetId ? { targetId } : {},
+			...wrappedDek ? { wrappedDek } : {},
+			...options.now ? { rotateNow: true } : {}
+		});
+		console.error(`rotating ${created.secretName} in ${target.label} every ${formatInterval(created.intervalSeconds)} (${created.kind})${wrappedDek ? " — rotator key granted" : ""}`);
+		if (version !== void 0) console.error(`rotated now — ${created.secretName} is at version ${version}`);
+		else console.error(`first rotation: ${created.nextRotateAt}`);
+		console.log(created.id);
+	});
+	rotation.command("list").description("list rotation policies (schedules only — never values)").option("--org <slug>").option("--json", "print the full policies as JSON").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { rotations } = await ctx.client.listRotations(org.id);
+		if (options.json) {
+			console.log(JSON.stringify(rotations, null, 2));
+			return;
+		}
+		if (rotations.length === 0) {
+			console.error(`no rotation policies in ${org.slug}`);
+			return;
+		}
+		for (const r of rotations) console.log(rotationLine(r));
+	});
+	rotation.command("show <rotationOrSecret>").description("show one policy, including the last failure if any").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const r = await resolveRotation(ctx, (await resolveOrg(ctx, options.org)).id, ref);
+		console.log(JSON.stringify(r, null, 2));
+	});
+	rotation.command("rotate <rotationOrSecret>").description("rotate now (the same path the scheduler uses)").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		const { version, rotatedAt } = await ctx.client.rotateSecretNow(org.id, r.id);
+		console.error(`rotated ${r.secretName} at ${rotatedAt} — now at version ${version}. Read it with \`seekrit secrets get ${r.secretName}\`.`);
+	});
+	rotation.command("pause <rotationOrSecret>").description("stop rotating, keeping the policy").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		await ctx.client.updateRotation(org.id, r.id, { status: "paused" });
+		console.error(`paused rotation of ${r.secretName}`);
+	});
+	rotation.command("resume <rotationOrSecret>").description("resume rotating (also clears a failed streak)").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		const { rotation: updated } = await ctx.client.updateRotation(org.id, r.id, { status: "active" });
+		console.error(`resumed rotation of ${r.secretName} — next ${updated.nextRotateAt}`);
+	});
+	rotation.command("set-interval <rotationOrSecret>").description("change the cadence").requiredOption("--every <duration>", "new cadence, e.g. 24h, 30d").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		const { rotation: updated } = await ctx.client.updateRotation(org.id, r.id, { intervalSeconds: parseDurationSeconds(options.every, "--every") });
+		console.error(`${updated.secretName} now rotates every ${formatInterval(updated.intervalSeconds)} — next ${updated.nextRotateAt}`);
+	});
+	rotation.command("disable <rotationOrSecret>").description("stop rotating and remove the policy (the secret is untouched)").option("--org <slug>").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const r = await resolveRotation(ctx, org.id, ref);
+		const { rotatorRevoked } = await ctx.client.disableRotation(org.id, r.id);
+		console.error(`disabled rotation of ${r.secretName}${rotatorRevoked ? " — rotator key access revoked for this environment" : ""}`);
+	});
+}
 /**
 * Fetch + decrypt every secret in a single environment.
 *
@@ -7172,6 +7998,77 @@ function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
 }
+/**
+* Netlify names a site by its **API ID**, and only that.
+*
+* Netlify does accept a site's domain where a site appears in a URL path, which
+* makes the strictness here look gratuitous — but the environment variable
+* endpoints take the site as a `?site_id=` query parameter, where Netlify
+* documents no name resolution. A site id it cannot resolve does not fail: the
+* variables land on the **team**, shared by every site in it. Refusing anything
+* but the UUID keeps a slip from writing much wider than was asked.
+*/
+function assertNetlifySite(value) {
+	if (!value) fail("--netlify-site is required for netlify (the site's API ID, a UUID)");
+	const site = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(site)) fail(`--netlify-site "${site}" is not a site API ID — Netlify shows it under Project configuration → General → Project information, and it is a UUID, not the site name or its .netlify.app address`);
+	return site;
+}
+/**
+* A Bunnyshell environment or project ID, as the platform hands it out.
+*
+* Checked only for shape, not format: Bunnyshell documents none for these, so
+* asserting one would be inventing a rule and refusing IDs that work. Both
+* variable collections name their parent in the **body** of a create, as a
+* required relation, so an ID Bunnyshell cannot resolve is a 422 naming the
+* field — not a write that lands somewhere wider. That is why this is loose
+* where {@link assertNetlifySite} is strict.
+*/
+function assertBunnyshellId(value, flag) {
+	if (!value) fail(`${flag} is required for bunnyshell (the ID from \`bns\` or the dashboard URL)`);
+	const id = value.trim();
+	if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(id)) fail(`${flag} "${id}" is not a Bunnyshell ID — no slashes or spaces`);
+	return id;
+}
+/**
+* Split `--gh-repo owner/name` into the two halves GitHub's paths need.
+*
+* Taken as one flag rather than two because `owner/name` is how GitHub writes a
+* repository everywhere — in its URLs, in `gh repo view`, in every workflow file —
+* and asking for it in two pieces invites the mistake of pasting the pair into
+* one of them.
+*/
+function assertGithubRepo(value) {
+	if (!value) fail("--gh-repo is required for github-actions (owner/name)");
+	const parts = value.trim().split("/");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) fail(`--gh-repo "${value}" should be owner/name, e.g. acme/storefront`);
+	const [owner, repo] = parts;
+	if (!/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/.test(owner) || owner.length > 39) fail(`--gh-repo owner "${owner}" is not a GitHub login`);
+	if (!/^[A-Za-z0-9._-]+$/.test(repo) || repo === "." || repo === "..") fail(`--gh-repo name "${repo}" is not a repository name`);
+	return {
+		owner,
+		repo
+	};
+}
+/** Parse `--gh-repo-ids 1,2,3` — GitHub's org endpoint takes numeric ids, not names. */
+function assertRepoIds(raw) {
+	const parts = list(raw, "");
+	if (parts.length === 0) fail("--gh-repo-ids is required with `--gh-visibility selected` — numeric repository IDs, which `gh api repos/<owner>/<name> --jq .id` prints");
+	return parts.map((part) => {
+		const id = Number(part);
+		if (!Number.isInteger(id) || id <= 0) fail(`--gh-repo-ids "${part}" is not a repository ID — GitHub takes numeric IDs, not names`);
+		return id;
+	});
+}
+/**
+* What `sync connect` calls the secret it reads from stdin. Only the wording
+* differs — every provider's credential is wrapped the same way.
+*/
+function credentialNoun(provider) {
+	if (provider.startsWith("aws-")) return "secret access key";
+	if (provider === "gcp-secret-manager") return "service-account key JSON";
+	return "API token";
+}
 /** Account-scope config for a connection (never the credential itself). */
 function buildConfig(provider, options) {
 	switch (provider) {
@@ -7209,6 +8106,23 @@ function buildConfig(provider, options) {
 		case "northflank": return { provider: "northflank" };
 		case "digitalocean": return { provider: "digitalocean" };
 		case "heroku": return { provider: "heroku" };
+		case "netlify":
+			if (!options.accountId) fail("--account-id is required for netlify — the team slug from app.netlify.com/teams/<slug>, or the account ID");
+			return {
+				provider: "netlify",
+				accountId: options.accountId
+			};
+		case "bunnyshell": return { provider: "bunnyshell" };
+		case "github-actions": return {
+			provider: "github-actions",
+			...options.baseUrl ? { baseUrl: options.baseUrl } : {}
+		};
+		case "gcp-secret-manager":
+			if (!options.projectId) fail("--project-id is required for gcp-secret-manager — the project ID (or number) whose Secret Manager to write");
+			return {
+				provider: "gcp-secret-manager",
+				projectId: options.projectId
+			};
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -7330,6 +8244,83 @@ function buildDestination(provider, options) {
 			provider: "heroku",
 			app: assertHerokuApp(options.herokuApp)
 		};
+		case "netlify": {
+			const contexts = assertMembers(list(options.target, "production"), NETLIFY_CONTEXTS, "--target");
+			const branch = options.gitBranch?.trim();
+			if (contexts.includes("branch") && !branch) fail("--git-branch is required with `--target branch` — the branch the values apply to");
+			return {
+				provider: "netlify",
+				siteId: assertNetlifySite(options.netlifySite),
+				contexts,
+				...contexts.includes("branch") && branch ? { branch } : {},
+				secret: options.netlifySecret !== false
+			};
+		}
+		case "bunnyshell": {
+			const environmentId = options.bunnyshellEnvironment?.trim();
+			const projectId = options.project?.trim();
+			if (environmentId && projectId) fail("pass --bunnyshell-environment or --project for bunnyshell, not both — a binding writes to one");
+			const secret = options.bunnyshellSecret !== false;
+			if (projectId) return {
+				provider: "bunnyshell",
+				kind: "project",
+				projectId: assertBunnyshellId(projectId, "--project"),
+				secret
+			};
+			return {
+				provider: "bunnyshell",
+				kind: "environment",
+				environmentId: assertBunnyshellId(environmentId, "--bunnyshell-environment"),
+				secret
+			};
+		}
+		case "github-actions": {
+			if (options.ghOrg) {
+				if (options.ghRepo || options.ghEnvironment) fail("--gh-org writes organization secrets — drop --gh-repo and --gh-environment");
+				const visibility = assertMember(options.ghVisibility, GITHUB_ACTIONS_VISIBILITIES, "--gh-visibility", "private");
+				if (visibility !== "selected" && options.ghRepoIds) fail(`--gh-repo-ids only applies to \`--gh-visibility selected\`, not ${visibility}`);
+				return {
+					provider: "github-actions",
+					kind: "org",
+					org: options.ghOrg.trim(),
+					visibility,
+					...visibility === "selected" ? { selectedRepositoryIds: assertRepoIds(options.ghRepoIds) } : {}
+				};
+			}
+			const { owner, repo } = assertGithubRepo(options.ghRepo);
+			const environment = options.ghEnvironment?.trim();
+			if (!environment) return {
+				provider: "github-actions",
+				kind: "repo",
+				owner,
+				repo
+			};
+			return {
+				provider: "github-actions",
+				kind: "environment",
+				owner,
+				repo,
+				environment
+			};
+		}
+		case "gcp-secret-manager": {
+			const layout = assertMember(options.layout, GCP_SECRET_MANAGER_LAYOUTS, "--layout", "secret-per-name");
+			if (layout === "json-bundle" && !options.secretName) fail("--secret-name is required for --layout json-bundle (the one secret to write)");
+			const replication = assertMember(options.gcpReplication, GCP_REPLICATION_POLICIES, "--gcp-replication", "automatic");
+			const locations = options.gcpLocations ? list(options.gcpLocations, "") : [];
+			if (replication === "user-managed" && locations.length === 0) fail("--gcp-locations is required with --gcp-replication user-managed, e.g. us-east1");
+			if (options.gcpKmsKey && replication === "user-managed" && locations.length > 1) fail("--gcp-kms-key covers one location — use automatic replication, or a single --gcp-locations entry");
+			return {
+				provider: "gcp-secret-manager",
+				layout,
+				replication,
+				...options.gcpPrefix ? { idPrefix: options.gcpPrefix } : {},
+				...layout === "json-bundle" && options.secretName ? { secretId: options.secretName } : {},
+				...replication === "user-managed" ? { locations } : {},
+				...options.gcpKmsKey ? { kmsKeyName: options.gcpKmsKey } : {},
+				...options.gcpPruneVersions ? { pruneVersions: true } : {}
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -7347,6 +8338,14 @@ function describeDestination(destination) {
 		case "northflank": return `${destination.projectId} / ${destination.secretGroupId}`;
 		case "digitalocean": return `${destination.appId}${destination.kind === "component" ? ` / ${destination.componentName}` : ""} (${destination.scope})`;
 		case "heroku": return destination.app;
+		case "netlify": return `${destination.siteId} (${destination.contexts.map((context) => context === "branch" ? `branch @${destination.branch}` : context).join(", ")})`;
+		case "bunnyshell": return destination.kind === "environment" ? `environment ${destination.environmentId}` : `project ${destination.projectId} (inherited by new environments)`;
+		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
+		case "github-actions": switch (destination.kind) {
+			case "repo": return `${destination.owner}/${destination.repo}`;
+			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
+			case "org": return `org ${destination.org} (${destination.visibility}${destination.selectedRepositoryIds ? `: ${destination.selectedRepositoryIds.length} repos` : ""})`;
+		}
 	}
 }
 /**
@@ -7357,7 +8356,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -7381,11 +8380,11 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com)").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
-		const noun = provider.startsWith("aws-") ? "secret access key" : "API token";
+		const noun = credentialNoun(provider);
 		const credential = (process.stdin.isTTY ? await promptHidden(`${provider} ${noun}: `) : await readStdin()).trim();
 		if (!credential) fail(`no ${noun} given`);
 		const id = randomId("syc");
@@ -8249,6 +9248,7 @@ registerAwsCommands(program);
 registerGcpCommands(program);
 registerMongoCommands(program);
 registerKmsCommands(program);
+registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
 	const { runMcpServer } = await import("./mcp-DR-zla_u.js");