@seekrit/cli 0.4.0 → 0.6.0

package/dist/index.js

@@ -6,6 +6,7 @@ import { homedir } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
+import { z } from "zod";
 //#region ../../packages/crypto/src/encoding.ts
 const CHUNK = 32768;
 /** Base64url (no padding) — portable across browsers, Workers, and Node. */
@@ -21,6 +22,16 @@ function fromBase64Url(text) {
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
 	return bytes;
 }
+/**
+* Standard base64 (with `+`, `/`, and `=` padding). Most seekrit blobs use
+* base64url, but some external wire formats mandate standard base64 — notably
+* PostgreSQL SCRAM-SHA-256 verifier strings (see scram.ts).
+*/
+function toBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+	return btoa(binary);
+}
 function utf8Encode(text) {
 	return new TextEncoder().encode(text);
 }
@@ -188,6 +199,65 @@ async function decryptPrivateKey(passphrase, blob) {
 		throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
 	}
 }
+const SALT_LENGTH = 16;
+const DEFAULT_PASSWORD_LENGTH = 32;
+const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function hmacSha256(key, message) {
+	const k = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return new Uint8Array(await crypto.subtle.sign("HMAC", k, message));
+}
+async function sha256(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+}
+async function saltPassword(password, salt, iterations) {
+	const material = await crypto.subtle.importKey("raw", utf8Encode(password), "PBKDF2", false, ["deriveBits"]);
+	const bits = await crypto.subtle.deriveBits({
+		name: "PBKDF2",
+		hash: "SHA-256",
+		salt,
+		iterations
+	}, material, 256);
+	return new Uint8Array(bits);
+}
+function randomPassword(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+/**
+* Compute the `SCRAM-SHA-256$<i>:<salt>$<StoredKey>:<ServerKey>` verifier for a
+* known password. Pass the result straight to `CREATE ROLE … PASSWORD`.
+*/
+async function scramSha256Verifier(password, options = {}) {
+	const salt = options.salt ?? crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+	const iterations = options.iterations ?? 4096;
+	const saltedPassword = await saltPassword(password, salt, iterations);
+	const storedKey = await sha256(await hmacSha256(saltedPassword, utf8Encode("Client Key")));
+	const serverKey = await hmacSha256(saltedPassword, utf8Encode("Server Key"));
+	return `SCRAM-SHA-256$${iterations}:${toBase64(salt)}$${toBase64(storedKey)}:${toBase64(serverKey)}`;
+}
+/**
+* Mint a fresh random password and its SCRAM verifier in one step — the
+* client-side half of a Vault-style dynamic Postgres credential.
+*/
+async function generatePostgresCredential(options = {}) {
+	const password = randomPassword(options.length ?? DEFAULT_PASSWORD_LENGTH);
+	const iterations = options.iterations ?? 4096;
+	return {
+		password,
+		verifier: await scramSha256Verifier(password, { iterations }),
+		iterations
+	};
+}
 //#endregion
 //#region ../../packages/crypto/src/token.ts
 /**
@@ -315,7 +385,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.4.0";
+var version = "0.6.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -506,6 +576,29 @@ var SeekritClient = class {
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
+	/** The broker's public key — wrap the admin credential to it before registering a target. */
+	getLeaseBrokerKey(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
+	}
+	listLeaseTargets(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases/targets`);
+	}
+	registerLeaseTarget(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/leases/targets`, input);
+	}
+	deleteLeaseTarget(orgId, targetId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/leases/targets/${targetId}`);
+	}
+	listLeases(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases`);
+	}
+	/** Mint a temporary credential. Send only the client-computed verifier. */
+	mintLease(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/leases`, input);
+	}
+	revokeLease(orgId, leaseId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
+	}
 	listAudit(orgId, query = {}) {
 		const params = new URLSearchParams();
 		if (query.cursor) params.set("cursor", query.cursor);
@@ -640,6 +733,406 @@ function formatSecrets(values, format) {
 		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
 	}
 }
+z.enum(["postgres"]);
+const executorModeSchema = z.enum(["in_do", "remote"]);
+/**
+* A Postgres role name we are willing to create. Deliberately strict — this
+* value is interpolated into a SQL template, so it must be a bare identifier
+* with no way to break out of quoting (no quotes, whitespace, or semicolons).
+*/
+const postgresRoleNameSchema = z.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must be 3–63 chars, lowercase letters/digits/underscore, starting with a letter or underscore");
+/**
+* A SCRAM-SHA-256 verifier string as produced by @seekrit/crypto. Validated so
+* it, too, is safe to interpolate into a quoted SQL literal (the alphabet is
+* base64 + the fixed structural characters, none of which is a single quote).
+*/
+const scramVerifierSchema = z.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
+const postgresAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
+/** The group role each preset's leased credentials inherit. */
+const POSTGRES_GROUP_ROLES = {
+	readonly: "seekrit_readonly",
+	readwrite: "seekrit_readwrite"
+};
+const connectionSchema = z.object({
+	host: z.string().min(1),
+	port: z.number().int().min(1).max(65535),
+	database: z.string().min(1)
+});
+/** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
+const statementSchema = z.string().min(1).max(4e3);
+/** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
+const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
+const leaseTargetConfigSchema = z.object({
+	provider: z.literal("postgres"),
+	executor: executorModeSchema,
+	accessLevel: postgresAccessLevelSchema.optional(),
+	schema: identifierSchema.optional(),
+	connection: connectionSchema,
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema).max(16).optional(),
+	revokeStatements: z.array(statementSchema).max(16).optional()
+});
+z.object({
+	name: z.string().trim().min(1).max(128),
+	config: leaseTargetConfigSchema,
+	/**
+	* The admin/provisioning credential (e.g. a Postgres connection string),
+	* encrypted client-side to the broker's public key (a `wd1.` wrap). The
+	* control plane stores only this ciphertext — it never sees the plaintext.
+	*/
+	wrappedAdminSecret: z.string().min(1)
+});
+z.object({
+	targetId: z.string().min(1),
+	roleName: postgresRoleNameSchema,
+	verifier: scramVerifierSchema,
+	ttlSeconds: z.number().int().min(60).max(3600 * 24 * 7)
+});
+//#endregion
+//#region ../../packages/core/src/providers/postgres.ts
+/**
+* The one-time setup SQL an admin runs to create the shared group role that a
+* read-only / read-write target's leased credentials inherit. Idempotent (safe
+* to re-run). Returns null for custom targets (the admin owns their own SQL).
+*
+* Identifiers are interpolated from admin-supplied config (database/schema) and
+* fixed group-role constants — this SQL is displayed for the admin to run in
+* their own database, not executed by seekrit.
+*/
+function postgresGroupBootstrapSql(config) {
+	if (config.accessLevel !== "readonly" && config.accessLevel !== "readwrite") return null;
+	const group = POSTGRES_GROUP_ROLES[config.accessLevel];
+	const schema = config.schema ?? "public";
+	const db = config.connection.database;
+	const privileges = config.accessLevel === "readonly" ? "SELECT" : "SELECT, INSERT, UPDATE, DELETE";
+	const lines = [
+		`-- Run once as an admin on "${db}". Temporary ${config.accessLevel} credentials inherit this role.`,
+		"DO $$ BEGIN",
+		`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${group}') THEN`,
+		`    CREATE ROLE ${group} NOLOGIN;`,
+		"  END IF;",
+		"END $$;",
+		`GRANT CONNECT ON DATABASE "${db}" TO ${group};`,
+		`GRANT USAGE ON SCHEMA "${schema}" TO ${group};`,
+		`GRANT ${privileges} ON ALL TABLES IN SCHEMA "${schema}" TO ${group};`,
+		`ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT ${privileges} ON TABLES TO ${group};`
+	];
+	if (config.accessLevel === "readwrite") lines.push(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO ${group};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE, SELECT ON SEQUENCES TO ${group};`);
+	return lines.join("\n");
+}
+//#endregion
+//#region ../../packages/core/src/schemas.ts
+/** URL-safe identifier segment: `my-app`, `production`, … */
+const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
+const nameSchema = z.string().trim().min(1).max(128);
+z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
+z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+const principalTypeSchema = z.enum(["user", "service_token"]);
+/** Org-level capability a service token can hold (never `owner`). */
+const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	groupId: z.string().min(1),
+	/** Precedence among an env's groups (higher wins). Appended if omitted. */
+	position: z.number().int().min(0).optional()
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema,
+	/** Environment DEK wrapped to the creator's public key — created client-side. */
+	wrappedDek: z.string().min(1)
+});
+z.object({ 
+/** Opaque versioned ciphertext blob from @seekrit/crypto. */
+ciphertext: z.string().min(1).max(65536) });
+z.object({
+	publicKeyJwk: z.string().min(1),
+	/**
+	* Private key encrypted with a passphrase-derived KEK; opaque to the
+	* server. Self-contained blob (embeds KDF salt + iterations).
+	*/
+	encryptedPrivateKey: z.string().min(1)
+});
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	wrappedDek: z.string().min(1)
+});
+z.object({
+	name: nameSchema,
+	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full token string. */
+	tokenHash: z.string().min(1),
+	publicKeyJwk: z.string().min(1),
+	/**
+	* Org-level capability. Defaults to `member` (a runtime credential); pass
+	* `admin` to mint a headless provisioning token. Only an admin caller may
+	* create an `admin` token, so capability cannot escalate itself.
+	*/
+	role: serviceTokenRoleSchema.default("member"),
+	/**
+	* The application environment this token is bound to (org + app + env).
+	* Optional so org-admin tokens can exist, but required for runtime tokens
+	* that resolve secrets via `GET /v1/resolve`.
+	*/
+	environmentId: z.string().min(1).nullish(),
+	expiresAt: z.iso.datetime().nullish()
+});
+z.object({
+	cursor: z.string().optional(),
+	limit: z.coerce.number().int().min(1).max(200).default(50),
+	action: z.string().optional(),
+	resourceType: z.string().optional()
+});
+//#endregion
+//#region src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
+/**
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
+*/
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
+//#endregion
+//#region src/pg.ts
+/**
+* `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
+*
+* Zero-knowledge: minting generates the password and its SCRAM verifier on THIS
+* machine and sends only the verifier; the plaintext password never reaches the
+* API or gets stored. Registering a target wraps the admin connection string to
+* the broker's public key locally, so the control plane only ever stores
+* ciphertext.
+*/
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid Postgres role name: `tmp_` + lowercase alphanumerics. */
+function generateRoleName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerPgCommands(program) {
+	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
+	const target = pg.command("target").description("manage provisioning targets");
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = options.adminUrl ?? process.env.SEEKRIT_PG_ADMIN_URL;
+		if (!adminSecret) fail(executor === "remote" ? "provide the shared HMAC key via --admin-url or SEEKRIT_PG_ADMIN_URL" : "provide the admin connection string via --admin-url or SEEKRIT_PG_ADMIN_URL");
+		const config = {
+			provider: "postgres",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				database: options.database
+			},
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : { schema: options.schema },
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+		const bootstrap = postgresGroupBootstrapSql(config);
+		if (bootstrap) {
+			console.error("\nRun this once in your database as an admin (safe to re-run):\n");
+			console.log(bootstrap);
+		}
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const bootstrap = postgresGroupBootstrapSql(t.config);
+		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
+		console.log(bootstrap);
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		const roleName = options.role ?? generateRoleName();
+		const ttlSeconds = parseTtlSeconds(options.ttl);
+		const { password, verifier } = await generatePostgresCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			targetId: target.id,
+			roleName,
+			verifier,
+			ttlSeconds
+		});
+		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${roleName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+	});
+	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect(value, acc) {
+	acc.push(value);
+	return acc;
+}
 //#endregion
 //#region src/dotenv.ts
 /**
@@ -741,94 +1234,6 @@ function printExplain(provenance) {
 	for (const name of names) process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}\n`);
 }
 //#endregion
-//#region src/target.ts
-/** Resolve the target org from a flag, the committed config, or a lone org. */
-async function resolveOrg(ctx, orgSlug) {
-	const wanted = orgSlug ?? findProjectConfig()?.org;
-	const { orgs } = await ctx.client.listOrgs();
-	if (wanted) {
-		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
-		if (!org) fail(`no accessible org "${wanted}"`);
-		return {
-			id: org.id,
-			slug: org.slug
-		};
-	}
-	const only = orgs[0];
-	if (orgs.length === 1 && only) return {
-		id: only.id,
-		slug: only.slug
-	};
-	fail("specify --org (or run `seekrit init`)");
-}
-/**
-* Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
-*/
-async function resolveEnvTarget(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.env) fail("specify --env");
-	if (opts.group) {
-		const { groups } = await ctx.client.listGroups(org.id);
-		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
-		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
-		return {
-			orgId: org.id,
-			envId: env.id,
-			label: `${group.slug}@${env.slug}`
-		};
-	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		envId: env.id,
-		label: `${app.slug}/${env.slug}`
-	};
-}
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		appId: app.id,
-		appSlug: app.slug,
-		envId: env.id,
-		envSlug: env.slug
-	};
-}
-/** Resolve a group by slug within the target org. */
-async function resolveGroup(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.group) fail("specify --group");
-	const { groups } = await ctx.client.listGroups(org.id);
-	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-	return {
-		orgId: org.id,
-		id: group.id,
-		slug: group.slug
-	};
-}
-//#endregion
 //#region src/index.ts
 /** Collect repeated `--with group=env` flags into a map. */
 function collectKv(value, acc = {}) {
@@ -1185,8 +1590,9 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 	await ctx.client.revokeToken(orgRef.id, tokenId);
 	console.error(`${tokenId} revoked`);
 });
+registerPgCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-hxTidFyj.js");
+	const { runMcpServer } = await import("./mcp-Dw3hVhbC.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -1199,4 +1605,4 @@ program.parseAsync().catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { parseServiceToken as _, encryptAndSetSecret as a, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveOrg as i, isTokenAuth as l, wrapDek as m, resolveEnvTarget as n, fetchDecryptedSecrets as o, version as p, resolveGroup as r, materializeEnv as s, resolveAppEnv as t, tryBuildContext as u, generateDek as v };
+export { parseServiceToken as _, resolveEnvTarget as a, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveAppEnv as i, isTokenAuth as l, wrapDek as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generatePostgresCredential as v, generateDek as y };

package/dist/{mcp-hxTidFyj.js → mcp-Dw3hVhbC.js}

@@ -1,9 +1,16 @@
-import { _ as parseServiceToken, a as encryptAndSetSecret, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveOrg, l as isTokenAuth, m as wrapDek, n as resolveEnvTarget, o as fetchDecryptedSecrets, p as version, r as resolveGroup, s as materializeEnv, t as resolveAppEnv, u as tryBuildContext, v as generateDek } from "./index.js";
+import { _ as parseServiceToken, a as resolveEnvTarget, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateDek } from "./index.js";
 import { spawn } from "node:child_process";
+import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
 //#region src/mcp.ts
+/** Lowercase-alphanumeric string for a fresh Postgres role name. */
+function randomLower(length) {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	for (const b of crypto.getRandomValues(new Uint8Array(length))) out += alphabet[b % 36];
+	return out;
+}
 function jsonText(data) {
 	return { content: [{
 		type: "text",
@@ -534,6 +541,56 @@ async function runMcpServer() {
 			principalId
 		};
 	});
+	tool("list_pg_targets", "List registered Postgres provisioning targets for temporary credentials.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeaseTargets(orgRef.id)).targets;
+	});
+	tool("create_pg_lease", "Mint a short-lived Postgres credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its SCRAM verifier is sent to the API — the plaintext never reaches seekrit or Postgres at rest. The role auto-expires; revoke early with revoke_pg_lease.", {
+		org: z.string().optional(),
+		target: z.string().describe("target id or name"),
+		role: z.string().optional().describe("role name to create (default: random tmp_ name)"),
+		ttlSeconds: z.number().int().min(60).max(604800).optional().describe("lifetime (default 3600)")
+	}, async ({ org, target, role, ttlSeconds }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { targets } = await ctx.client.listLeaseTargets(orgRef.id);
+		const t = targets.find((x) => x.id === target || x.name === target);
+		if (!t) throw new Error(`no target "${target}" in ${orgRef.slug}`);
+		const roleName = role ?? `tmp_${randomLower(12)}`;
+		const { password, verifier } = await generatePostgresCredential();
+		const { lease, connection } = await ctx.client.mintLease(orgRef.id, {
+			targetId: t.id,
+			roleName,
+			verifier,
+			ttlSeconds: ttlSeconds ?? 3600
+		});
+		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		return {
+			leaseId: lease.id,
+			url,
+			username: roleName,
+			expiresAt: connection.expiresAt,
+			note: "short-lived credential; it auto-expires and the plaintext is not stored anywhere"
+		};
+	});
+	tool("list_pg_leases", "List Postgres leases (the ledger — never secret material).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeases(orgRef.id)).leases;
+	});
+	tool("revoke_pg_lease", "Revoke a Postgres lease now (drops the role immediately).", {
+		org: z.string().optional(),
+		leaseId: z.string()
+	}, async ({ org, leaseId }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		await ctx.client.revokeLease(orgRef.id, leaseId);
+		return {
+			ok: true,
+			leaseId
+		};
+	});
 	tool("configure_project", "Link a directory to an org/app by writing seekrit.json (like `seekrit init`). The environment is chosen by the service token at runtime.", {
 		org: z.string(),
 		app: z.string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {