npm - @seekrit/cli - Versions diffs - 0.40.0 → 0.42.0 - Mend

@seekrit/cli 0.40.0 → 0.42.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/index.js +602 -9
package/package.json +3 -3

package/dist/index.js CHANGED Viewed

@@ -8,6 +8,43 @@ import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
+//#region ../../packages/core/src/agent-policy.ts
+/** A bare hostname: no scheme, no port, no path, no wildcard. */
+const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
+const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
+/**
+* A path pattern. Must be absolute, because it is matched against a request
+* path — a relative pattern is a mistake that would silently match nothing.
+*/
+const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
+const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
+z.object({
+	host: policyHostSchema,
+	methods: z.array(policyMethodSchema).max(16).default([]),
+	paths: z.array(policyPathSchema).max(64).default([]),
+	allow: z.array(policySecretNameSchema).max(64).default([]),
+	label: z.string().trim().max(120).optional()
+});
+z.object({
+/** `ap1.<body>.<signature>` — opaque to the server. */
+bundle: z.string().min(16).max(256 * 1024) });
+z.object({
+	name: z.string().trim().min(1).max(120),
+	slug: z.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "slug is lowercase letters, digits, and dashes"),
+	/** The environment whose secrets this agent's policy may name. Optional. */
+	environmentId: z.string().trim().min(1).max(64).optional()
+});
+z.object({
+	name: z.string().trim().min(1).max(120).optional(),
+	enabled: z.boolean().optional(),
+	environmentId: z.string().trim().min(1).max(64).nullish()
+});
+z.object({
+	host: policyHostSchema,
+	method: policyMethodSchema,
+	path: z.string().trim().min(1).max(2048),
+	secret: policySecretNameSchema.optional()
+});
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -1188,7 +1225,12 @@ const AUDIT_ACTIONS = [
 	"sync.binding_updated",
 	"sync.binding_deleted",
 	"sync.run_succeeded",
-	"sync.run_failed"
+	"sync.run_failed",
+	"agent.created",
+	"agent.updated",
+	"agent.deleted",
+	"agent.policy_published",
+	"agent.policy_rolled_back"
 ];
 /**
 * Transactional notification emails seekrit can send. Each id is one
@@ -1664,7 +1706,10 @@ const SYNC_PROVIDER_KINDS = [
 	"northflank",
 	"digitalocean",
 	"heroku",
-	"netlify"
+	"netlify",
+	"bunnyshell",
+	"github-actions",
+	"gcp-secret-manager"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1869,6 +1914,82 @@ const netlifyConnectionConfigSchema = z.object({
 	/** Netlify team slug (`acme`) or account id — `{account_id}` accepts either. */
 	accountId: z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Netlify team slug or account ID — no slashes or spaces")
 });
+/**
+* Bunnyshell account scope — empty, as Fly's, Heroku's, and Northflank's are.
+*
+* A Bunnyshell access token (from `environments.bunnyshell.com/access-token`)
+* belongs to a *user* and carries their access to every organization they are
+* in, exactly as a Heroku token does. Unlike Netlify's, that does not force an
+* organization onto the connection, because nothing here is addressed *through*
+* one: both variable collections name their parent by an opaque, globally
+* unique id (`environment` or `project`), so the token plus the destination's
+* id is the whole address. The API offers an `organization` filter, but it
+* narrows a listing — it is not part of an address.
+*/
+const bunnyshellConnectionConfigSchema = z.object({ provider: z.literal("bunnyshell") });
+/**
+* GitHub account scope — empty for github.com, which is the whole point.
+*
+* A GitHub token addresses everything by `{owner}/{repo}` or `{org}`, and those
+* are the destination's business, so there is no account half to state the way
+* Cloudflare and Netlify need one. `baseUrl` is the single exception, and it is
+* not an account scope at all: it names a **GitHub Enterprise Server** install,
+* whose API lives on the customer's own host rather than on `api.github.com`.
+*
+* Left unset for github.com and for Enterprise Cloud (which is `api.github.com`
+* with a different plan behind it). Set only for a self-hosted GHES appliance,
+* where the REST API is at `https://<host>/api/v3`.
+*/
+const githubActionsConnectionConfigSchema = z.object({
+	provider: z.literal("github-actions"),
+	/**
+	* GitHub Enterprise Server API root, e.g. `https://github.acme.com/api/v3`.
+	* Omit for github.com. Must be `https:` — this URL carries the token.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the GitHub Enterprise Server API root, e.g. https://github.acme.com/api/v3").optional()
+});
+/**
+* A Google Cloud project, as `projects/{project}` accepts one: either the
+* project **ID** (`acme-prod`, 6–30 characters, what the console shows) or the
+* project **number** (all digits). Both are accepted because both work, and
+* the id is the one an operator can read off their own dashboard.
+*
+* Validated by shape for the reason Cloudflare's account id is: every Secret
+* Manager URL is built from this string, and a typo would otherwise surface as
+* a 403 from Google hours later inside an alarm, with nobody watching.
+*/
+const gcpProjectSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(value) || /^\d{1,20}$/.test(value), "must be a Google Cloud project ID (e.g. acme-prod) or project number");
+/**
+* Google Cloud project scope — which project's Secret Manager to write.
+*
+* The service account is *not* here, unlike AWS's access key id: a GCP
+* credential is a key JSON that names its own `client_email`, so the identity
+* arrives with the credential the way a Vercel token's does. What the
+* credential cannot say is which project to write, because a service account
+* can be granted access to secrets in projects other than its own — so that is
+* this field, exactly as Cloudflare's account id is.
+*
+* One project per connection. Syncing an environment into two projects means
+* two connections, which also keeps their key grants separate.
+*
+* Global secrets only: v1 addresses `secretmanager.googleapis.com`, not the
+* per-location `secretmanager.<location>.rep.googleapis.com` endpoints that
+* regional secrets live behind. Data residency is expressed instead through the
+* destination's user-managed replication.
+*/
+const gcpSecretManagerConnectionConfigSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	/** Project ID (`acme-prod`) or project number. */
+	projectId: gcpProjectSchema
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1882,7 +2003,10 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	northflankConnectionConfigSchema,
 	digitalOceanConnectionConfigSchema,
 	herokuConnectionConfigSchema,
-	netlifyConnectionConfigSchema
+	netlifyConnectionConfigSchema,
+	bunnyshellConnectionConfigSchema,
+	githubActionsConnectionConfigSchema,
+	gcpSecretManagerConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -2307,6 +2431,292 @@ const netlifyDestinationSchema = z.object({
 	message: "a branch context needs the branch name it applies to",
 	path: ["branch"]
 });
+/**
+* A Bunnyshell resource id, as the platform hands it out.
+*
+* Deliberately loose. Bunnyshell documents no format for these — they are
+* opaque strings from `bns environments list` or the dashboard URL — so
+* asserting a shape here would be inventing a rule the platform never stated,
+* and the failure mode would be seekrit refusing an id that works.
+*
+* Being loose is affordable here in a way it is not on Netlify, where an
+* unresolved `site_id` silently widens a write to the whole team. Both
+* Bunnyshell variable collections name their parent in the **request body** of
+* a create, as a required relation: an id the platform cannot resolve is a 422
+* naming the field, not a write that lands somewhere broader. The listing side
+* is fenced separately — the connector re-checks every variable's own parent
+* before it touches it, so a filter that failed to bite cannot turn into an
+* edit of a neighbouring environment's variables.
+*/
+const bunnyshellIdSchema = z.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Bunnyshell ID — no slashes or spaces");
+/**
+* Variables on one Bunnyshell **environment** — the set every component in it
+* inherits, and the closest match to a seekrit environment.
+*
+* This is the destination for an environment that already exists and stays
+* around: a primary environment, or a long-lived ephemeral one.
+*/
+const bunnyshellEnvironmentDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("environment"),
+	/** Environment ID, as `bns environments list` prints it. */
+	environmentId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Variables on a Bunnyshell **project** — inherited by every environment
+* created in it from then on.
+*
+* Worth thinking about twice, for the reason a Render environment group is:
+* the blast radius is the project, not one environment. It earns its place
+* anyway, because it is the only destination that reaches an environment which
+* *does not exist yet*. Bunnyshell's whole shape is ephemeral environments spun
+* up per branch or per pull request; pushing to the environment cannot seed one
+* that a webhook will create tomorrow, and pushing to the project can.
+*
+* An environment inherits the project's value at creation and may then be
+* overridden at its own scope — so a project binding does not fight an
+* environment binding pointed at the same name, it loses to it.
+*/
+const bunnyshellProjectDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("project"),
+	/** Project ID, as `bns projects list` prints it. */
+	projectId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Where in Bunnyshell a binding writes.
+*
+* Split on `kind` rather than into two providers — the way Render's service and
+* environment group are, and unlike Cloudflare's three — because the two are the
+* same API twice over: `/v1/environment_variables` and `/v1/project_variables`
+* take the same fields, fail the same ways, and differ only in which parent they
+* name. One connector serves both, so one provider does too.
+*
+* `secret` is Bunnyshell's `isSecret`, and means less than Netlify's flag of the
+* same name: Bunnyshell encrypts every variable with an organization key whether
+* or not the flag is set, so this only decides whether the value is obscured in
+* the dashboard and stored encrypted in an exported definition. It is on by
+* default all the same — a value pushed from a secrets manager should not be
+* sitting in plain view of everyone with project access. It applies only to
+* variables seekrit **creates**: an update never sends the flag, so a variable
+* an operator deliberately un-secreted stays that way.
+*/
+const bunnyshellDestinationSchema = z.discriminatedUnion("kind", [bunnyshellEnvironmentDestinationSchema, bunnyshellProjectDestinationSchema]);
+/**
+* Which repositories in an organization can read an org-level secret.
+*
+* GitHub's own enum, unchanged. There is deliberately **no default**: `all` hands
+* the value to every repository in the organization — including ones added
+* tomorrow, and including forks' workflows to the extent the org allows them —
+* and that is not a blast radius a secrets manager should pick on an operator's
+* behalf. Naming it is the point.
+*/
+const GITHUB_ACTIONS_VISIBILITIES = [
+	"all",
+	"private",
+	"selected"
+];
+/**
+* A GitHub account or organization login, matching GitHub's own rule:
+* alphanumeric with single internal hyphens, 39 characters at most.
+*
+* Checked here so the habitual slip — pasting a URL, or `owner/repo` into the
+* owner field — fails at the form rather than as a 404 from an alarm with nobody
+* watching.
+*/
+const githubOwnerSchema = z.string().trim().min(1).max(39).regex(/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/, "must be a GitHub user or organization login — not a URL or an owner/repo pair");
+/**
+* A repository name. GitHub's rules are looser than an owner's: letters,
+* numbers, hyphens, underscores, and periods, up to 100 characters. `.` and `..`
+* are refused outright — they would traverse the API path rather than name a
+* repository.
+*/
+const githubRepoSchema = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "must be a repository name alone (`api`), not `owner/repo` or a URL").refine((value) => value !== "." && value !== "..", "is not a repository name");
+/**
+* A deployment environment name.
+*
+* Deliberately permissive: GitHub allows spaces and most punctuation here, and
+* the dashboard shows names like `prod (eu-west)`. Only the two things that would
+* break the request are refused — an empty name, and the path separators that
+* would let a name escape its URL segment. Everything else is GitHub's to reject.
+*/
+const githubEnvironmentSchema = z.string().trim().min(1).max(255).refine((value) => !value.includes("/") && !value.includes("\\"), "cannot contain a slash — that is a path separator, not part of an environment name");
+/**
+* One repository's Actions secrets.
+*
+* Every workflow in the repository can read these, including one added by a pull
+* request from a collaborator with write access. That is GitHub's model, not a
+* choice this connector makes — but it is the reason `environment` exists below,
+* and the reason to prefer it for anything that touches production.
+*/
+const githubActionsRepoDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("repo"),
+	/** Repository owner — a user or organization login. */
+	owner: githubOwnerSchema,
+	/** Repository name, without the owner. */
+	repo: githubRepoSchema
+});
+/**
+* One deployment environment's Actions secrets — the narrowest scope GitHub has.
+*
+* A job reads these only by declaring `environment: <name>`, which also subjects
+* it to that environment's protection rules: required reviewers, wait timers, and
+* the branch policy. That combination is the closest GitHub gets to "this secret
+* is for production, and reaching it requires approval", and it is the scope to
+* reach for by default.
+*
+* The environment must already exist. This connector will not create one: an
+* environment is a deployment gate, and silently creating an unprotected one
+* because a name was misspelled would quietly remove the protection the operator
+* was relying on.
+*/
+const githubActionsEnvironmentDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("environment"),
+	owner: githubOwnerSchema,
+	repo: githubRepoSchema,
+	/** Environment name, exactly as the repository's Settings → Environments shows it. */
+	environment: githubEnvironmentSchema
+});
+/**
+* An organization's Actions secrets.
+*
+* The widest scope in the product, and the only destination on any provider that
+* can hand a value to repositories nobody named. Read {@link
+* GITHUB_ACTIONS_VISIBILITIES} before using it.
+*
+* `selectedRepositoryIds` takes numeric repository **ids**, not names, because
+* that is what GitHub's API takes. An id is visible at
+* `GET /repos/{owner}/{repo}` as `id`, and in the dashboard nowhere at all —
+* which is friction worth accepting rather than resolving names to ids here: name
+* resolution would mean this connector picking which repository an ambiguous
+* name meant, and getting that wrong widens a secret's reach silently.
+*/
+const githubActionsOrgDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("org"),
+	/** Organization login. */
+	org: githubOwnerSchema,
+	/** Which repositories may read these secrets. Stated, never defaulted. */
+	visibility: z.enum(GITHUB_ACTIONS_VISIBILITIES),
+	/** Numeric repository ids, required when `visibility` is `selected`. */
+	selectedRepositoryIds: z.array(z.number().int().positive()).max(500).optional()
+}).refine((dest) => dest.visibility !== "selected" || dest.selectedRepositoryIds !== void 0 && dest.selectedRepositoryIds.length > 0, {
+	message: "selected visibility needs at least one repository id",
+	path: ["selectedRepositoryIds"]
+}).refine((dest) => dest.visibility === "selected" || dest.selectedRepositoryIds === void 0, {
+	message: "repository ids only apply to selected visibility — remove them, or select it",
+	path: ["selectedRepositoryIds"]
+});
+const githubActionsDestinationSchema = z.discriminatedUnion("kind", [
+	githubActionsRepoDestinationSchema,
+	githubActionsEnvironmentDestinationSchema,
+	githubActionsOrgDestinationSchema
+]);
+/**
+* How a binding lays its secrets out in Secret Manager. The same two shapes the
+* AWS Secrets Manager destination offers, and for the same reasons:
+*
+* - `secret-per-name` — one GCP secret per seekrit secret. The direct
+*   translation, and what Cloud Run's `--set-secrets` and GKE's Secret Manager
+*   CSI driver mount one at a time.
+* - `json-bundle` — every value as one JSON object in a single secret. Costs one
+*   active version instead of fifty, which is the whole billing unit here.
+*/
+const GCP_SECRET_MANAGER_LAYOUTS = ["secret-per-name", "json-bundle"];
+/**
+* Where Google keeps the copies of a secret. Chosen at creation and
+* **immutable** afterwards — changing it means deleting the secret and letting
+* the next run recreate it.
+*
+* - `automatic` — Google picks the locations. One billable replica, and what
+*   you want unless a policy says otherwise.
+* - `user-managed` — the binding names the regions. This is how data residency
+*   is expressed for global secrets, and each region is billed as its own
+*   active version.
+*/
+const GCP_REPLICATION_POLICIES = ["automatic", "user-managed"];
+/**
+* A Secret Manager secret ID. Google's own rule, quoted from the API reference:
+* "a string with a maximum length of 255 characters and can contain uppercase
+* and lowercase letters, numerals, and the hyphen (`-`) and underscore (`_`)
+* characters."
+*
+* Notably **no slashes and no dots**, which is what makes this a different
+* field from AWS's `pathPrefix` rather than the same idea renamed: a Secret
+* Manager namespace is spelled `prod-storefront-DB_URL`, not
+* `prod/storefront/DB_URL`.
+*/
+const gcpSecretIdSchema = z.string().trim().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/, "may contain letters, digits, hyphens, and underscores");
+/**
+* A GCP region for a user-managed replica (`us-east1`, `europe-west4`,
+* `northamerica-northeast1`). Validated by shape rather than against a list,
+* because Google adds regions faster than we ship — a name Secret Manager does
+* not know is refused by Google with a clear message at creation.
+*/
+const gcpLocationSchema = z.string().trim().regex(/^[a-z]+-[a-z]+\d+$/, "must be a GCP region ID, e.g. us-east1");
+/**
+* A Cloud KMS key, as its full resource name — the only form the API accepts:
+* `projects/p/locations/l/keyRings/r/cryptoKeys/k`.
+*
+* Stricter than AWS's `kmsKeyId` (which tolerates five spellings) because
+* Google tolerates exactly one, and because a key in the wrong *location* is
+* rejected at creation: an automatic-replication secret needs a `global` key,
+* and a user-managed replica needs one in its own region.
+*/
+const gcpKmsKeyNameSchema = z.string().trim().max(1024).regex(/^projects\/[^/]+\/locations\/[^/]+\/keyRings\/[^/]+\/cryptoKeys\/[^/]+$/, "must be a full Cloud KMS key name (projects/…/locations/…/keyRings/…/cryptoKeys/…)");
+/**
+* Where inside a project's Secret Manager a binding writes.
+*
+* ## Every push would otherwise cost a version
+*
+* Secret Manager has no "set the value" call — only `addVersion`, which appends.
+* A run pushes the whole environment (never a diff), so changing one secret in
+* an environment of fifty would leave fifty new versions behind, forty-nine of
+* them identical to their predecessors, each one billed for as long as it stays
+* active.
+*
+* So this connector writes a version only when the value actually changed,
+* decided from a keyed digest it keeps in the secret's own **annotations** — see
+* `apps/api/src/lib/sync/connectors/gcp-secret-manager.ts` for why it is keyed
+* and what that costs. `pruneVersions` is the other half of the bill: with it
+* on, the version a push supersedes is destroyed as soon as the new one lands,
+* so a secret keeps exactly one active version.
+*/
+const gcpSecretManagerDestinationSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	layout: z.enum(GCP_SECRET_MANAGER_LAYOUTS).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret ID, e.g.
+	* `prod-storefront-`. Optional, but strongly advised in a project that holds
+	* anything else — without it a binding writes at the root of a namespace it
+	* does not own, and Secret Manager has no folders to hide behind.
+	*/
+	idPrefix: z.string().trim().max(200).regex(/^[A-Za-z0-9_-]*$/, "may contain letters, digits, hyphens, and underscores").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod-storefront-env`. */
+	secretId: gcpSecretIdSchema.optional(),
+	replication: z.enum(GCP_REPLICATION_POLICIES).default("automatic"),
+	/** `user-managed` only: the regions to replicate to. At least one. */
+	locations: z.array(gcpLocationSchema).min(1).max(16).optional(),
+	/** Customer-managed encryption key. Omitted means Google-managed keys. */
+	kmsKeyName: gcpKmsKeyNameSchema.optional(),
+	/** Destroy the version each push supersedes, keeping one active version. */
+	pruneVersions: z.boolean().optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretId !== void 0, {
+	message: "a json-bundle destination needs the ID of the secret to write",
+	path: ["secretId"]
+}).refine((d) => d.replication !== "user-managed" || (d.locations?.length ?? 0) > 0, {
+	message: "user-managed replication needs at least one location",
+	path: ["locations"]
+}).refine((d) => d.kmsKeyName === void 0 || d.replication === "automatic" || (d.locations?.length ?? 0) === 1, {
+	message: "a customer-managed key covers one location — use automatic replication, or a single location",
+	path: ["kmsKeyName"]
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -2320,7 +2730,10 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	northflankDestinationSchema,
 	digitalOceanDestinationSchema,
 	herokuDestinationSchema,
-	netlifyDestinationSchema
+	netlifyDestinationSchema,
+	bunnyshellDestinationSchema,
+	githubActionsDestinationSchema,
+	gcpSecretManagerDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3526,7 +3939,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.40.0";
+var version = "0.42.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -3848,6 +4261,44 @@ var SeekritClient = class {
 	deleteHoneyToken(orgId, honeyTokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/honey-tokens/${honeyTokenId}`);
 	}
+	listAgents(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents`);
+	}
+	createAgent(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents`, input);
+	}
+	getAgent(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}`);
+	}
+	updateAgent(orgId, agentId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/agents/${agentId}`, input);
+	}
+	deleteAgent(orgId, agentId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/agents/${agentId}`);
+	}
+	/** Published versions, newest first. Append-only; nothing here is rewritten. */
+	listAgentPolicies(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/policies`);
+	}
+	/**
+	* Publish a bundle signed in the browser.
+	*
+	* The signing happens client-side (`signAgentPolicy` in `@seekrit/core`) with
+	* the publishing admin's own key, so the API receives an opaque envelope it
+	* cannot forge. A version mismatch answers `409`: the version is inside the
+	* signature, so a concurrent publish has to be re-signed, not patched.
+	*/
+	publishAgentPolicy(orgId, agentId, bundle) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents/${agentId}/policies`, { bundle });
+	}
+	/** Republish an earlier version's bundle as the newest version. */
+	rollbackAgentPolicy(orgId, agentId, version) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents/${agentId}/policies/${version}/rollback`);
+	}
+	/** The caller's own signing thumbprint, for the trust-anchor snippet. */
+	getMyPolicySigner(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/signers/me`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -7643,6 +8094,61 @@ function assertNetlifySite(value) {
 	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(site)) fail(`--netlify-site "${site}" is not a site API ID — Netlify shows it under Project configuration → General → Project information, and it is a UUID, not the site name or its .netlify.app address`);
 	return site;
 }
+/**
+* A Bunnyshell environment or project ID, as the platform hands it out.
+*
+* Checked only for shape, not format: Bunnyshell documents none for these, so
+* asserting one would be inventing a rule and refusing IDs that work. Both
+* variable collections name their parent in the **body** of a create, as a
+* required relation, so an ID Bunnyshell cannot resolve is a 422 naming the
+* field — not a write that lands somewhere wider. That is why this is loose
+* where {@link assertNetlifySite} is strict.
+*/
+function assertBunnyshellId(value, flag) {
+	if (!value) fail(`${flag} is required for bunnyshell (the ID from \`bns\` or the dashboard URL)`);
+	const id = value.trim();
+	if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(id)) fail(`${flag} "${id}" is not a Bunnyshell ID — no slashes or spaces`);
+	return id;
+}
+/**
+* Split `--gh-repo owner/name` into the two halves GitHub's paths need.
+*
+* Taken as one flag rather than two because `owner/name` is how GitHub writes a
+* repository everywhere — in its URLs, in `gh repo view`, in every workflow file —
+* and asking for it in two pieces invites the mistake of pasting the pair into
+* one of them.
+*/
+function assertGithubRepo(value) {
+	if (!value) fail("--gh-repo is required for github-actions (owner/name)");
+	const parts = value.trim().split("/");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) fail(`--gh-repo "${value}" should be owner/name, e.g. acme/storefront`);
+	const [owner, repo] = parts;
+	if (!/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/.test(owner) || owner.length > 39) fail(`--gh-repo owner "${owner}" is not a GitHub login`);
+	if (!/^[A-Za-z0-9._-]+$/.test(repo) || repo === "." || repo === "..") fail(`--gh-repo name "${repo}" is not a repository name`);
+	return {
+		owner,
+		repo
+	};
+}
+/** Parse `--gh-repo-ids 1,2,3` — GitHub's org endpoint takes numeric ids, not names. */
+function assertRepoIds(raw) {
+	const parts = list(raw, "");
+	if (parts.length === 0) fail("--gh-repo-ids is required with `--gh-visibility selected` — numeric repository IDs, which `gh api repos/<owner>/<name> --jq .id` prints");
+	return parts.map((part) => {
+		const id = Number(part);
+		if (!Number.isInteger(id) || id <= 0) fail(`--gh-repo-ids "${part}" is not a repository ID — GitHub takes numeric IDs, not names`);
+		return id;
+	});
+}
+/**
+* What `sync connect` calls the secret it reads from stdin. Only the wording
+* differs — every provider's credential is wrapped the same way.
+*/
+function credentialNoun(provider) {
+	if (provider.startsWith("aws-")) return "secret access key";
+	if (provider === "gcp-secret-manager") return "service-account key JSON";
+	return "API token";
+}
 /** Account-scope config for a connection (never the credential itself). */
 function buildConfig(provider, options) {
 	switch (provider) {
@@ -7686,6 +8192,17 @@ function buildConfig(provider, options) {
 				provider: "netlify",
 				accountId: options.accountId
 			};
+		case "bunnyshell": return { provider: "bunnyshell" };
+		case "github-actions": return {
+			provider: "github-actions",
+			...options.baseUrl ? { baseUrl: options.baseUrl } : {}
+		};
+		case "gcp-secret-manager":
+			if (!options.projectId) fail("--project-id is required for gcp-secret-manager — the project ID (or number) whose Secret Manager to write");
+			return {
+				provider: "gcp-secret-manager",
+				projectId: options.projectId
+			};
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -7819,6 +8336,71 @@ function buildDestination(provider, options) {
 				secret: options.netlifySecret !== false
 			};
 		}
+		case "bunnyshell": {
+			const environmentId = options.bunnyshellEnvironment?.trim();
+			const projectId = options.project?.trim();
+			if (environmentId && projectId) fail("pass --bunnyshell-environment or --project for bunnyshell, not both — a binding writes to one");
+			const secret = options.bunnyshellSecret !== false;
+			if (projectId) return {
+				provider: "bunnyshell",
+				kind: "project",
+				projectId: assertBunnyshellId(projectId, "--project"),
+				secret
+			};
+			return {
+				provider: "bunnyshell",
+				kind: "environment",
+				environmentId: assertBunnyshellId(environmentId, "--bunnyshell-environment"),
+				secret
+			};
+		}
+		case "github-actions": {
+			if (options.ghOrg) {
+				if (options.ghRepo || options.ghEnvironment) fail("--gh-org writes organization secrets — drop --gh-repo and --gh-environment");
+				const visibility = assertMember(options.ghVisibility, GITHUB_ACTIONS_VISIBILITIES, "--gh-visibility", "private");
+				if (visibility !== "selected" && options.ghRepoIds) fail(`--gh-repo-ids only applies to \`--gh-visibility selected\`, not ${visibility}`);
+				return {
+					provider: "github-actions",
+					kind: "org",
+					org: options.ghOrg.trim(),
+					visibility,
+					...visibility === "selected" ? { selectedRepositoryIds: assertRepoIds(options.ghRepoIds) } : {}
+				};
+			}
+			const { owner, repo } = assertGithubRepo(options.ghRepo);
+			const environment = options.ghEnvironment?.trim();
+			if (!environment) return {
+				provider: "github-actions",
+				kind: "repo",
+				owner,
+				repo
+			};
+			return {
+				provider: "github-actions",
+				kind: "environment",
+				owner,
+				repo,
+				environment
+			};
+		}
+		case "gcp-secret-manager": {
+			const layout = assertMember(options.layout, GCP_SECRET_MANAGER_LAYOUTS, "--layout", "secret-per-name");
+			if (layout === "json-bundle" && !options.secretName) fail("--secret-name is required for --layout json-bundle (the one secret to write)");
+			const replication = assertMember(options.gcpReplication, GCP_REPLICATION_POLICIES, "--gcp-replication", "automatic");
+			const locations = options.gcpLocations ? list(options.gcpLocations, "") : [];
+			if (replication === "user-managed" && locations.length === 0) fail("--gcp-locations is required with --gcp-replication user-managed, e.g. us-east1");
+			if (options.gcpKmsKey && replication === "user-managed" && locations.length > 1) fail("--gcp-kms-key covers one location — use automatic replication, or a single --gcp-locations entry");
+			return {
+				provider: "gcp-secret-manager",
+				layout,
+				replication,
+				...options.gcpPrefix ? { idPrefix: options.gcpPrefix } : {},
+				...layout === "json-bundle" && options.secretName ? { secretId: options.secretName } : {},
+				...replication === "user-managed" ? { locations } : {},
+				...options.gcpKmsKey ? { kmsKeyName: options.gcpKmsKey } : {},
+				...options.gcpPruneVersions ? { pruneVersions: true } : {}
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -7837,6 +8419,13 @@ function describeDestination(destination) {
 		case "digitalocean": return `${destination.appId}${destination.kind === "component" ? ` / ${destination.componentName}` : ""} (${destination.scope})`;
 		case "heroku": return destination.app;
 		case "netlify": return `${destination.siteId} (${destination.contexts.map((context) => context === "branch" ? `branch @${destination.branch}` : context).join(", ")})`;
+		case "bunnyshell": return destination.kind === "environment" ? `environment ${destination.environmentId}` : `project ${destination.projectId} (inherited by new environments)`;
+		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
+		case "github-actions": switch (destination.kind) {
+			case "repo": return `${destination.owner}/${destination.repo}`;
+			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
+			case "org": return `org ${destination.org} (${destination.visibility}${destination.selectedRepositoryIds ? `: ${destination.selectedRepositoryIds.length} repos` : ""})`;
+		}
 	}
 }
 /**
@@ -7847,7 +8436,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -7871,11 +8460,11 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com)").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
-		const noun = provider.startsWith("aws-") ? "secret access key" : "API token";
+		const noun = credentialNoun(provider);
 		const credential = (process.stdin.isTTY ? await promptHidden(`${provider} ${noun}: `) : await readStdin()).trim();
 		if (!credential) fail(`no ${noun} given`);
 		const id = randomId("syc");
@@ -8224,7 +8813,11 @@ program.command("login").description("sign in through the browser (or pass a cre
 		} : {},
 		...options.clientId ? { clientId: options.clientId } : {},
 		...options.clientSecret ? { clientSecret: options.clientSecret } : {},
-		...options.devUser ? { devUser: options.devUser } : {},
+		...options.devUser ? {
+			devUser: options.devUser,
+			sessionToken: void 0,
+			token: void 0
+		} : {},
 		...options.apiUrl ? { apiUrl: options.apiUrl } : {}
 	});
 	console.error("credentials saved");

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.40.0",
+  "version": "0.42.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
-    "@seekrit/core": "0.0.1",
+    "@seekrit/api-client": "0.0.1",
     "@seekrit/crypto": "0.0.1",
-    "@seekrit/api-client": "0.0.1"
+    "@seekrit/core": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",