@seekrit/cli 0.7.0 → 0.8.0

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
 import { Command } from "commander";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
@@ -259,6 +259,138 @@ async function generatePostgresCredential(options = {}) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/ssh.ts
+/**
+* Client-side SSH certificate authority for minting *temporary SSH access*
+* without any private key ever reaching seekrit's control plane.
+*
+* The model (Vault-style, tier-1 verifier injection — see the `ZkTier` doc in
+* @seekrit/core leases.ts):
+*
+*   1. the machine that will connect generates an ephemeral Ed25519 keypair
+*      locally ({@link generateSshKeyPair}),
+*   2. it sends only the *public* key to the broker,
+*   3. the broker signs a short-lived OpenSSH user *certificate* over that
+*      public key ({@link signSshUserCertificate}) using the CA private key,
+*   4. the consumer connects with `ssh -i <key> -o CertificateFile=<cert>`; the
+*      host trusts the CA (`TrustedUserCAKeys`) and never needs the key on disk.
+*
+* Zero-knowledge end to end: the user private key exists only on the consumer,
+* and a certificate is a public artifact (it authorizes but cannot authenticate
+* without the matching private key). The only secret seekrit stores is the CA
+* private key — wrapped to the broker DO's public key, decrypted transiently in
+* the DO to sign (the same in-DO trade the Postgres admin credential makes).
+*
+* Everything here is WebCrypto Ed25519 + hand-rolled SSH wire encoding, so it
+* runs unchanged in the browser, the CLI, and Workers. No Node-specific crypto.
+*/
+const ED25519 = { name: "Ed25519" };
+/**
+* Serializer for the SSH binary wire types. `string` is a uint32 length prefix
+* followed by that many bytes (a length-delimited byte blob, not text); ints
+* are big-endian. This is the encoding used by public keys, certificates, and
+* the OpenSSH private key container alike.
+*/
+var SshWriter = class {
+	chunks = [];
+	len = 0;
+	bytes(b) {
+		this.chunks.push(b);
+		this.len += b.length;
+		return this;
+	}
+	byte(n) {
+		return this.bytes(new Uint8Array([n & 255]));
+	}
+	uint32(n) {
+		const b = /* @__PURE__ */ new Uint8Array(4);
+		new DataView(b.buffer).setUint32(0, n >>> 0, false);
+		return this.bytes(b);
+	}
+	uint64(n) {
+		const b = /* @__PURE__ */ new Uint8Array(8);
+		new DataView(b.buffer).setBigUint64(0, BigInt(n), false);
+		return this.bytes(b);
+	}
+	string(s) {
+		const b = typeof s === "string" ? utf8Encode(s) : s;
+		return this.uint32(b.length).bytes(b);
+	}
+	build() {
+		const out = new Uint8Array(this.len);
+		let o = 0;
+		for (const c of this.chunks) {
+			out.set(c, o);
+			o += c.length;
+		}
+		return out;
+	}
+};
+function concat(...arrays) {
+	const total = arrays.reduce((n, a) => n + a.length, 0);
+	const out = new Uint8Array(total);
+	let o = 0;
+	for (const a of arrays) {
+		out.set(a, o);
+		o += a.length;
+	}
+	return out;
+}
+/** The `ssh-ed25519` public-key blob: string "ssh-ed25519" ‖ string <32 bytes>. */
+function ed25519PublicKeyBlob(pub) {
+	return new SshWriter().string("ssh-ed25519").string(pub).build();
+}
+function encodeSshPublicKey(pub, comment) {
+	const b64 = toBase64(ed25519PublicKeyBlob(pub));
+	return comment ? `ssh-ed25519 ${b64} ${comment}` : `ssh-ed25519 ${b64}`;
+}
+/**
+* Generate an ephemeral client keypair. The private key is serialized in the
+* `openssh-key-v1` format so `ssh -i` accepts it directly; the public key is
+* what gets certified. Nothing here is ever sent to the control plane except
+* the public key.
+*/
+async function generateSshKeyPair(comment = "seekrit") {
+	const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
+	const pub = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey));
+	const seed = pkcs8.subarray(pkcs8.length - 32);
+	return {
+		publicKeyOpenssh: encodeSshPublicKey(pub, comment),
+		privateKeyOpenssh: encodeOpensshPrivateKey(seed, pub, comment)
+	};
+}
+/**
+* Generate a certificate-authority keypair. The private half is exported as a
+* JWK (so the broker can re-import it to sign); the public half is printed for
+* admins to install on their hosts.
+*/
+async function generateSshCaKeyPair(comment = "seekrit-ca") {
+	const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
+	const pub = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const jwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+	return {
+		privateKeyJwk: JSON.stringify(jwk),
+		publicKeyOpenssh: encodeSshPublicKey(pub, comment)
+	};
+}
+/**
+* Serialize an Ed25519 keypair as an unencrypted `openssh-key-v1` private key.
+* Format (PROTOCOL.key): magic ‖ ciphername "none" ‖ kdfname "none" ‖ empty
+* kdfoptions ‖ nkeys=1 ‖ public-key blob ‖ private section (wrapped as a
+* string). The private section is two equal check-ints, then the key, then the
+* comment, padded with 1,2,3,… to the "none" block size (8).
+*/
+function encodeOpensshPrivateKey(seed, pub, comment) {
+	const check = new DataView(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(4)).buffer).getUint32(0, false);
+	const privSection = new SshWriter().uint32(check).uint32(check).string("ssh-ed25519").string(pub).string(concat(seed, pub)).string(comment).build();
+	const padLen = (8 - privSection.length % 8) % 8;
+	const pad = new Uint8Array(padLen);
+	for (let i = 0; i < padLen; i++) pad[i] = i + 1;
+	const b64 = toBase64(new SshWriter().bytes(utf8Encode("openssh-key-v1")).byte(0).string("none").string("none").string(/* @__PURE__ */ new Uint8Array(0)).uint32(1).string(ed25519PublicKeyBlob(pub)).string(concat(privSection, pad)).build());
+	return `-----BEGIN OPENSSH PRIVATE KEY-----\n${b64.match(/.{1,70}/g)?.join("\n") ?? b64}\n-----END OPENSSH PRIVATE KEY-----\n`;
+}
+//#endregion
 //#region ../../packages/crypto/src/token.ts
 /**
 * Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
@@ -385,7 +517,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.7.0";
+var version = "0.8.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -592,7 +724,6 @@ var SeekritClient = class {
 	listLeases(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases`);
 	}
-	/** Mint a temporary credential. Send only the client-computed verifier. */
 	mintLease(orgId, input) {
 		return this.request("POST", `/v1/orgs/${orgId}/leases`, input);
 	}
@@ -733,7 +864,7 @@ function formatSecrets(values, format) {
 		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
 	}
 }
-z.enum(["postgres"]);
+z.enum(["postgres", "ssh"]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
 * A Postgres role name we are willing to create. Deliberately strict — this
@@ -747,6 +878,16 @@ const postgresRoleNameSchema = z.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must
 * base64 + the fixed structural characters, none of which is a single quote).
 */
 const scramVerifierSchema = z.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
+/**
+* An SSH login principal (a Unix-style username the certificate authorizes).
+* Bounded and restricted to a safe charset — principals are SSH-wire-encoded,
+* not shell-interpolated, so this is sanity/DoS hardening, not an injection gate.
+*/
+const sshPrincipalSchema = z.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "must be 1–64 chars of letters, digits, dot, dash, underscore");
+/** An `ssh-ed25519 <base64> [comment]` public key line (deep-validated on sign). */
+const sshPublicKeySchema = z.string().max(2048).regex(/^ssh-ed25519 [A-Za-z0-9+/=]+( .*)?$/, "must be an ssh-ed25519 public key");
+/** An SSH certificate extension name, e.g. `permit-pty`. */
+const sshExtensionSchema = z.string().regex(/^[a-z0-9-]{1,64}$/);
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -766,7 +907,7 @@ const connectionSchema = z.object({
 const statementSchema = z.string().min(1).max(4e3);
 /** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
 const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
-const leaseTargetConfigSchema = z.object({
+const postgresTargetConfigSchema = z.object({
 	provider: z.literal("postgres"),
 	executor: executorModeSchema,
 	accessLevel: postgresAccessLevelSchema.optional(),
@@ -776,6 +917,19 @@ const leaseTargetConfigSchema = z.object({
 	createStatements: z.array(statementSchema).max(16).optional(),
 	revokeStatements: z.array(statementSchema).max(16).optional()
 });
+const sshTargetConfigSchema = z.object({
+	provider: z.literal("ssh"),
+	executor: z.literal("in_do"),
+	caPublicKey: sshPublicKeySchema,
+	allowedPrincipals: z.array(sshPrincipalSchema).max(64).optional(),
+	extensions: z.array(sshExtensionSchema).max(16).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional(),
+	connection: z.object({
+		host: z.string().min(1).optional(),
+		user: sshPrincipalSchema.optional()
+	}).optional()
+});
+const leaseTargetConfigSchema = z.discriminatedUnion("provider", [postgresTargetConfigSchema, sshTargetConfigSchema]);
 z.object({
 	name: z.string().trim().min(1).max(128),
 	config: leaseTargetConfigSchema,
@@ -786,12 +940,33 @@ z.object({
 	*/
 	wrappedAdminSecret: z.string().min(1)
 });
-z.object({
+/** Requested lease lifetime, shared by all providers. */
+const ttlSecondsSchema = z.number().int().min(60).max(3600 * 24 * 7);
+/**
+* Client → API: mint a Postgres lease. The client generates the password and
+* its SCRAM verifier locally and sends only the verifier — the plaintext
+* password never leaves the requesting machine.
+*/
+const mintPostgresLeaseSchema = z.object({
+	provider: z.literal("postgres"),
 	targetId: z.string().min(1),
 	roleName: postgresRoleNameSchema,
 	verifier: scramVerifierSchema,
-	ttlSeconds: z.number().int().min(60).max(3600 * 24 * 7)
+	ttlSeconds: ttlSecondsSchema
 });
+/**
+* Client → API: mint an SSH lease. The client generates an ephemeral keypair
+* locally and sends only the public key; the signed certificate comes back in
+* the response. The private key never leaves the requesting machine.
+*/
+const mintSshLeaseSchema = z.object({
+	provider: z.literal("ssh"),
+	targetId: z.string().min(1),
+	publicKey: sshPublicKeySchema,
+	principals: z.array(sshPrincipalSchema).min(1).max(32),
+	ttlSeconds: ttlSecondsSchema
+});
+z.discriminatedUnion("provider", [mintPostgresLeaseSchema, mintSshLeaseSchema]);
 //#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
@@ -825,6 +1000,27 @@ function postgresGroupBootstrapSql(config) {
 	return lines.join("\n");
 }
 //#endregion
+//#region ../../packages/core/src/providers/ssh.ts
+/**
+* The one-time host setup an admin runs so a target's certificates are accepted.
+* Analogue of `postgresGroupBootstrapSql` — displayed for the admin to run, not
+* executed by seekrit. Embeds the CA public key so it's copy-paste runnable.
+*/
+function sshHostSetupInstructions(config) {
+	const principals = config.allowedPrincipals?.length ? config.allowedPrincipals : ["<login-user>"];
+	return [
+		"# Run once on each target host so it trusts seekrit-issued certificates.",
+		"# 1. Install the CA public key and trust it for user authentication:",
+		`echo '${config.caPublicKey}' | sudo tee /etc/ssh/seekrit_ca.pub`,
+		"sudo sh -c 'echo \"TrustedUserCAKeys /etc/ssh/seekrit_ca.pub\" >> /etc/ssh/sshd_config'",
+		"# 2. (optional) Restrict which cert principals may log in as which users via",
+		"#    AuthorizedPrincipalsFile, e.g. /etc/ssh/auth_principals/<user> listing:",
+		...principals.map((p) => `#      ${p}`),
+		"# 3. Reload sshd:",
+		"sudo systemctl reload sshd"
+	].join("\n");
+}
+//#endregion
 //#region ../../packages/core/src/schemas.ts
 /** URL-safe identifier segment: `my-app`, `production`, … */
 const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
@@ -1003,7 +1199,7 @@ async function resolveGroup(ctx, opts) {
 * ciphertext.
 */
 /** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds(input) {
+function parseTtlSeconds$1(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
 	return Number(m[1]) * ({
@@ -1024,7 +1220,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$1, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$1, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1072,6 +1268,7 @@ function registerPgCommands(program) {
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
 		for (const t of targets) {
 			const cfg = t.config;
+			if (cfg.provider !== "postgres") continue;
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
@@ -1081,7 +1278,9 @@ function registerPgCommands(program) {
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
 		const t = targets.find((x) => x.id === targetId || x.name === targetId);
 		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const bootstrap = postgresGroupBootstrapSql(t.config);
+		const cfg = t.config;
+		if (cfg.provider !== "postgres") fail("not a postgres target (see `seekrit ssh`)");
+		const bootstrap = postgresGroupBootstrapSql(cfg);
 		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
 		console.log(bootstrap);
 	});
@@ -1097,10 +1296,12 @@ function registerPgCommands(program) {
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
 		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
 		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
 		const roleName = options.role ?? generateRoleName();
-		const ttlSeconds = parseTtlSeconds(options.ttl);
+		const ttlSeconds = parseTtlSeconds$1(options.ttl);
 		const { password, verifier } = await generatePostgresCredential();
 		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "postgres",
 			targetId: target.id,
 			roleName,
 			verifier,
@@ -1129,7 +1330,7 @@ function registerPgCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect(value, acc) {
+function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -1234,6 +1435,147 @@ function printExplain(provenance) {
 	for (const name of names) process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}\n`);
 }
 //#endregion
+//#region src/ssh.ts
+/**
+* `seekrit ssh` — temporary SSH access via short-lived certificates (Vault-style
+* dynamic secrets, the SSH sibling of `seekrit pg`).
+*
+* Zero-knowledge: minting generates an ephemeral keypair on THIS machine and
+* sends only the public key; the broker signs a certificate and returns it (a
+* public artifact). The private key never leaves this machine. Registering a
+* target generates a CA keypair locally and wraps the CA *private* key to the
+* broker's public key, so the control plane only ever stores ciphertext; the CA
+* *public* key is printed for you to install on your hosts.
+*/
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+function registerSshCommands(program) {
+	const ssh = program.command("ssh").description("temporary SSH access (short-lived certificates, zero-knowledge)");
+	const target = ssh.command("target").description("manage SSH CA targets");
+	target.command("add").description("create an SSH certificate authority to issue certs from").requiredOption("--name <name>", "display name, e.g. prod-fleet").option("--org <slug>").option("--host <host>", "default host the printed ssh command connects to").option("--user <login>", "default login user (a cert principal)").option("--principal <name>", "allow-list a principal certs may request (repeatable)", collect, []).option("--extension <name>", "cert extension to grant, e.g. permit-pty (repeatable)", collect, []).option("--max-ttl <duration>", "clamp requested cert lifetime, e.g. 8h").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const ca = await generateSshCaKeyPair(`seekrit-ca:${options.name}`);
+		const config = {
+			provider: "ssh",
+			executor: "in_do",
+			caPublicKey: ca.publicKeyOpenssh,
+			...options.principal.length ? { allowedPrincipals: options.principal } : {},
+			...options.extension.length ? { extensions: options.extension } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds(options.maxTtl) } : {},
+			...options.host || options.user ? { connection: {
+				...options.host ? { host: options.host } : {},
+				...options.user ? { user: options.user } : {}
+			} } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(ca.privateKeyJwk), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered SSH target ${created.name} (${created.id})`);
+		console.error("\nInstall the CA on your hosts, then issue certs with `seekrit ssh lease`:\n");
+		console.log(sshHostSetupInstructions(config));
+	});
+	target.command("list").description("list SSH CA targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "ssh") continue;
+			const where = cfg.connection?.host ?? "-";
+			const principals = cfg.allowedPrincipals?.join(",") ?? "any";
+			console.log(`${t.id}\t${t.name}\t${where}\tprincipals=${principals}`);
+		}
+	});
+	target.command("setup <targetId>").description("reprint the one-time host setup for an SSH target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "ssh") fail("not an ssh target (see `seekrit pg`)");
+		console.log(sshHostSetupInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete an SSH CA target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	ssh.command("lease <target>").description("mint a short-lived SSH certificate; prints a ready-to-run ssh command").option("--org <slug>").option("--principal <name>", "login user to request (repeatable; default from target)", collect, []).option("--ttl <duration>", "certificate lifetime, e.g. 30m, 1h, 8h", "1h").option("--out <dir>", "directory to write the key + cert (default: a temp dir)").option("--json", "print key/cert paths and the certificate as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "ssh") fail(`"${t.name}" is not an ssh target (see \`seekrit pg\`)`);
+		const principals = options.principal.length ? options.principal : cfg.connection?.user ? [cfg.connection.user] : cfg.allowedPrincipals ?? [];
+		if (principals.length === 0) fail("specify at least one --principal");
+		const ttlSeconds = parseTtlSeconds(options.ttl);
+		const keypair = await generateSshKeyPair(`seekrit:${t.name}`);
+		const { ssh: cert } = await ctx.client.mintLease(org.id, {
+			provider: "ssh",
+			targetId: t.id,
+			publicKey: keypair.publicKeyOpenssh,
+			principals,
+			ttlSeconds
+		});
+		const dir = options.out ?? mkdtempSync(join(tmpdir(), "seekrit-ssh-"));
+		if (options.out) mkdirSync(dir, { recursive: true });
+		const keyPath = join(dir, "id_ed25519");
+		const certPath = join(dir, "id_ed25519-cert.pub");
+		writeFileSync(keyPath, keypair.privateKeyOpenssh, { mode: 384 });
+		writeFileSync(certPath, `${cert.certificate}\n`, { mode: 420 });
+		const loginUser = principals[0];
+		const command = `ssh -i ${keyPath} -o CertificateFile=${certPath}${cert.host ? ` ${loginUser}@${cert.host}` : ""}`;
+		console.error(`issued cert for ${principals.join(",")} — expires ${cert.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			keyPath,
+			certPath,
+			certificate: cert.certificate,
+			principals,
+			command,
+			expiresAt: cert.expiresAt
+		}, null, 2));
+		else console.log(command);
+	});
+	ssh.command("leases").description("list SSH leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "ssh") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	ssh.command("revoke <leaseId>").description("mark a lease revoked in the ledger (the cert stays valid until it expires)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued certs remain valid until they expire)`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect(value, acc) {
+	acc.push(value);
+	return acc;
+}
+//#endregion
 //#region src/index.ts
 /** Collect repeated `--with group=env` flags into a map. */
 function collectKv(value, acc = {}) {
@@ -1591,8 +1933,9 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 	console.error(`${tokenId} revoked`);
 });
 registerPgCommands(program);
+registerSshCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-Dw3hVhbC.js");
+	const { runMcpServer } = await import("./mcp-DNUBSbcd.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {

package/dist/{mcp-Dw3hVhbC.js → mcp-DNUBSbcd.js}

@@ -560,6 +560,7 @@ async function runMcpServer() {
 		const roleName = role ?? `tmp_${randomLower(12)}`;
 		const { password, verifier } = await generatePostgresCredential();
 		const { lease, connection } = await ctx.client.mintLease(orgRef.id, {
+			provider: "postgres",
 			targetId: t.id,
 			roleName,
 			verifier,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {