@seekrit/cli 0.7.0 → 0.9.0

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
 import { Command } from "commander";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
@@ -140,6 +140,75 @@ async function importPrivateKeyPkcs8(pkcs8) {
 	}, true, ["deriveBits"]);
 }
 //#endregion
+//#region ../../packages/crypto/src/mysql.ts
+/**
+* Client-side construction of a MySQL/MariaDB `mysql_native_password`
+* authentication string, for minting *temporary MySQL login credentials*
+* without the password plaintext ever reaching seekrit's control plane OR
+* MySQL itself.
+*
+* The trick mirrors the Postgres SCRAM one (scram.ts): the stored auth string
+* is `*<UPPER(HEX(SHA1(SHA1(password))))>`, and
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'` stores that
+* string verbatim — MySQL does NOT re-hash it. So the flow is:
+*
+*   1. the machine that will connect generates a random password locally,
+*   2. computes this hash locally,
+*   3. sends only the hash to the broker → `CREATE USER … AS '<hash>'`,
+*   4. connects directly to MySQL with the plaintext it never shared.
+*
+* Zero-knowledge at both layers: the control plane relays only the hash, and
+* the hash is NOT sufficient to authenticate. `mysql_native_password` login is
+* a challenge-response — the server proves knowledge of `SHA1(SHA1(password))`
+* against a fresh scramble, and verifying a client requires `SHA1(password)`
+* (the preimage of the first inner hash), which the stored double-SHA1 does not
+* reveal. A dump of `mysql.user` / the query log therefore cannot log in.
+*
+* SHA-1 is available via WebCrypto (`crypto.subtle.digest("SHA-1", …)`) in the
+* browser, the CLI, the MCP server, and Workers — so this runs everywhere the
+* SCRAM helper does, with no hand-rolled hash primitive.
+*/
+const DEFAULT_PASSWORD_LENGTH$1 = 32;
+const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function sha1(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
+}
+function toUpperHex(bytes) {
+	let hex = "";
+	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+	return hex.toUpperCase();
+}
+function randomPassword$1(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+/**
+* Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
+* for a known password. Pass the result straight to
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`.
+*/
+async function mysqlNativePasswordVerifier(password) {
+	return `*${toUpperHex(await sha1(await sha1(utf8Encode(password))))}`;
+}
+/**
+* Mint a fresh random password and its `mysql_native_password` hash in one step
+* — the client-side half of a Vault-style dynamic MySQL credential.
+*/
+async function generateMysqlCredential(options = {}) {
+	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	return {
+		password,
+		verifier: await mysqlNativePasswordVerifier(password)
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/passphrase.ts
 /**
 * User private keys are stored server-side encrypted under a key derived from
@@ -259,6 +328,138 @@ async function generatePostgresCredential(options = {}) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/ssh.ts
+/**
+* Client-side SSH certificate authority for minting *temporary SSH access*
+* without any private key ever reaching seekrit's control plane.
+*
+* The model (Vault-style, tier-1 verifier injection — see the `ZkTier` doc in
+* @seekrit/core leases.ts):
+*
+*   1. the machine that will connect generates an ephemeral Ed25519 keypair
+*      locally ({@link generateSshKeyPair}),
+*   2. it sends only the *public* key to the broker,
+*   3. the broker signs a short-lived OpenSSH user *certificate* over that
+*      public key ({@link signSshUserCertificate}) using the CA private key,
+*   4. the consumer connects with `ssh -i <key> -o CertificateFile=<cert>`; the
+*      host trusts the CA (`TrustedUserCAKeys`) and never needs the key on disk.
+*
+* Zero-knowledge end to end: the user private key exists only on the consumer,
+* and a certificate is a public artifact (it authorizes but cannot authenticate
+* without the matching private key). The only secret seekrit stores is the CA
+* private key — wrapped to the broker DO's public key, decrypted transiently in
+* the DO to sign (the same in-DO trade the Postgres admin credential makes).
+*
+* Everything here is WebCrypto Ed25519 + hand-rolled SSH wire encoding, so it
+* runs unchanged in the browser, the CLI, and Workers. No Node-specific crypto.
+*/
+const ED25519 = { name: "Ed25519" };
+/**
+* Serializer for the SSH binary wire types. `string` is a uint32 length prefix
+* followed by that many bytes (a length-delimited byte blob, not text); ints
+* are big-endian. This is the encoding used by public keys, certificates, and
+* the OpenSSH private key container alike.
+*/
+var SshWriter = class {
+	chunks = [];
+	len = 0;
+	bytes(b) {
+		this.chunks.push(b);
+		this.len += b.length;
+		return this;
+	}
+	byte(n) {
+		return this.bytes(new Uint8Array([n & 255]));
+	}
+	uint32(n) {
+		const b = /* @__PURE__ */ new Uint8Array(4);
+		new DataView(b.buffer).setUint32(0, n >>> 0, false);
+		return this.bytes(b);
+	}
+	uint64(n) {
+		const b = /* @__PURE__ */ new Uint8Array(8);
+		new DataView(b.buffer).setBigUint64(0, BigInt(n), false);
+		return this.bytes(b);
+	}
+	string(s) {
+		const b = typeof s === "string" ? utf8Encode(s) : s;
+		return this.uint32(b.length).bytes(b);
+	}
+	build() {
+		const out = new Uint8Array(this.len);
+		let o = 0;
+		for (const c of this.chunks) {
+			out.set(c, o);
+			o += c.length;
+		}
+		return out;
+	}
+};
+function concat(...arrays) {
+	const total = arrays.reduce((n, a) => n + a.length, 0);
+	const out = new Uint8Array(total);
+	let o = 0;
+	for (const a of arrays) {
+		out.set(a, o);
+		o += a.length;
+	}
+	return out;
+}
+/** The `ssh-ed25519` public-key blob: string "ssh-ed25519" ‖ string <32 bytes>. */
+function ed25519PublicKeyBlob(pub) {
+	return new SshWriter().string("ssh-ed25519").string(pub).build();
+}
+function encodeSshPublicKey(pub, comment) {
+	const b64 = toBase64(ed25519PublicKeyBlob(pub));
+	return comment ? `ssh-ed25519 ${b64} ${comment}` : `ssh-ed25519 ${b64}`;
+}
+/**
+* Generate an ephemeral client keypair. The private key is serialized in the
+* `openssh-key-v1` format so `ssh -i` accepts it directly; the public key is
+* what gets certified. Nothing here is ever sent to the control plane except
+* the public key.
+*/
+async function generateSshKeyPair(comment = "seekrit") {
+	const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
+	const pub = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey));
+	const seed = pkcs8.subarray(pkcs8.length - 32);
+	return {
+		publicKeyOpenssh: encodeSshPublicKey(pub, comment),
+		privateKeyOpenssh: encodeOpensshPrivateKey(seed, pub, comment)
+	};
+}
+/**
+* Generate a certificate-authority keypair. The private half is exported as a
+* JWK (so the broker can re-import it to sign); the public half is printed for
+* admins to install on their hosts.
+*/
+async function generateSshCaKeyPair(comment = "seekrit-ca") {
+	const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
+	const pub = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const jwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+	return {
+		privateKeyJwk: JSON.stringify(jwk),
+		publicKeyOpenssh: encodeSshPublicKey(pub, comment)
+	};
+}
+/**
+* Serialize an Ed25519 keypair as an unencrypted `openssh-key-v1` private key.
+* Format (PROTOCOL.key): magic ‖ ciphername "none" ‖ kdfname "none" ‖ empty
+* kdfoptions ‖ nkeys=1 ‖ public-key blob ‖ private section (wrapped as a
+* string). The private section is two equal check-ints, then the key, then the
+* comment, padded with 1,2,3,… to the "none" block size (8).
+*/
+function encodeOpensshPrivateKey(seed, pub, comment) {
+	const check = new DataView(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(4)).buffer).getUint32(0, false);
+	const privSection = new SshWriter().uint32(check).uint32(check).string("ssh-ed25519").string(pub).string(concat(seed, pub)).string(comment).build();
+	const padLen = (8 - privSection.length % 8) % 8;
+	const pad = new Uint8Array(padLen);
+	for (let i = 0; i < padLen; i++) pad[i] = i + 1;
+	const b64 = toBase64(new SshWriter().bytes(utf8Encode("openssh-key-v1")).byte(0).string("none").string("none").string(/* @__PURE__ */ new Uint8Array(0)).uint32(1).string(ed25519PublicKeyBlob(pub)).string(concat(privSection, pad)).build());
+	return `-----BEGIN OPENSSH PRIVATE KEY-----\n${b64.match(/.{1,70}/g)?.join("\n") ?? b64}\n-----END OPENSSH PRIVATE KEY-----\n`;
+}
+//#endregion
 //#region ../../packages/crypto/src/token.ts
 /**
 * Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
@@ -385,7 +586,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.7.0";
+var version = "0.9.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -474,6 +675,12 @@ var SeekritClient = class {
 	setMyKeys(input) {
 		return this.request("PUT", "/v1/me/keys", input);
 	}
+	getMyNotificationPrefs() {
+		return this.request("GET", "/v1/me/notifications");
+	}
+	setMyNotificationPrefs(input) {
+		return this.request("PUT", "/v1/me/notifications", input);
+	}
 	listOrgs() {
 		return this.request("GET", "/v1/orgs");
 	}
@@ -592,7 +799,6 @@ var SeekritClient = class {
 	listLeases(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases`);
 	}
-	/** Mint a temporary credential. Send only the client-computed verifier. */
 	mintLease(orgId, input) {
 		return this.request("POST", `/v1/orgs/${orgId}/leases`, input);
 	}
@@ -733,7 +939,234 @@ function formatSecrets(values, format) {
 		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
 	}
 }
-z.enum(["postgres"]);
+//#endregion
+//#region src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
+/**
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
+*/
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
+//#endregion
+//#region src/mysql.ts
+/**
+* `seekrit mysql` — temporary MySQL/MariaDB credentials (Vault-style dynamic
+* secrets).
+*
+* Zero-knowledge: minting generates the password and its
+* `mysql_native_password` hash on THIS machine and sends only the hash; the
+* plaintext password never reaches the API or gets stored. Registering a target
+* wraps the admin connection string to the broker's public key locally, so the
+* control plane only ever stores ciphertext.
+*/
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds$2(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid MySQL user name: `tmp_` + lowercase alphanumerics. */
+function generateUserName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerMysqlCommands(program) {
+	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
+	const target = mysql.command("target").description("manage provisioning targets");
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = options.adminUrl ?? process.env.SEEKRIT_MYSQL_ADMIN_URL;
+		if (!adminSecret) fail(executor === "remote" ? "provide the shared HMAC key via --admin-url or SEEKRIT_MYSQL_ADMIN_URL" : "provide the admin connection string via --admin-url or SEEKRIT_MYSQL_ADMIN_URL");
+		const config = {
+			provider: "mysql",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				database: options.database
+			},
+			userHost: options.userHost,
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : {},
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			if (t.provider !== "mysql") continue;
+			const cfg = t.config;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.provider !== "mysql") fail(`target "${targetRef}" is not a MySQL target`);
+		const userName = options.user ?? generateUserName();
+		const ttlSeconds = parseTtlSeconds$2(options.ttl);
+		const { password, verifier } = await generateMysqlCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "mysql",
+			targetId: target.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds
+		});
+		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${userName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "mysql") continue;
+			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+		}
+	});
+	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect$2(value, acc) {
+	acc.push(value);
+	return acc;
+}
+z.enum([
+	"postgres",
+	"mysql",
+	"ssh"
+]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
 * A Postgres role name we are willing to create. Deliberately strict — this
@@ -747,6 +1180,30 @@ const postgresRoleNameSchema = z.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must
 * base64 + the fixed structural characters, none of which is a single quote).
 */
 const scramVerifierSchema = z.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
+/**
+* An SSH login principal (a Unix-style username the certificate authorizes).
+* Bounded and restricted to a safe charset — principals are SSH-wire-encoded,
+* not shell-interpolated, so this is sanity/DoS hardening, not an injection gate.
+*/
+const sshPrincipalSchema = z.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "must be 1–64 chars of letters, digits, dot, dash, underscore");
+/** An `ssh-ed25519 <base64> [comment]` public key line (deep-validated on sign). */
+const sshPublicKeySchema = z.string().max(2048).regex(/^ssh-ed25519 [A-Za-z0-9+/=]+( .*)?$/, "must be an ssh-ed25519 public key");
+/** An SSH certificate extension name, e.g. `permit-pty`. */
+const sshExtensionSchema = z.string().regex(/^[a-z0-9-]{1,64}$/);
+/**
+* A MySQL/MariaDB user name we are willing to create. Interpolated into a
+* quoted SQL literal (`'{{name}}'@'%'`), so it is kept strict — plain
+* alphanumerics/underscore, no quotes/whitespace/semicolons to break out.
+*/
+const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+/**
+* A `mysql_native_password` authentication string — `*` followed by 40 upper
+* hex chars (`UPPER(HEX(SHA1(SHA1(password))))`), as produced by
+* @seekrit/crypto `mysqlNativePasswordVerifier`. Stored verbatim by
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`, and its
+* alphabet contains no single quote, so it is safe in a quoted SQL literal.
+*/
+const mysqlNativeVerifierSchema = z.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -757,6 +1214,11 @@ const POSTGRES_GROUP_ROLES = {
 	readonly: "seekrit_readonly",
 	readwrite: "seekrit_readwrite"
 };
+const mysqlAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
 const connectionSchema = z.object({
 	host: z.string().min(1),
 	port: z.number().int().min(1).max(65535),
@@ -766,7 +1228,7 @@ const connectionSchema = z.object({
 const statementSchema = z.string().min(1).max(4e3);
 /** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
 const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
-const leaseTargetConfigSchema = z.object({
+const postgresTargetConfigSchema = z.object({
 	provider: z.literal("postgres"),
 	executor: executorModeSchema,
 	accessLevel: postgresAccessLevelSchema.optional(),
@@ -776,6 +1238,35 @@ const leaseTargetConfigSchema = z.object({
 	createStatements: z.array(statementSchema).max(16).optional(),
 	revokeStatements: z.array(statementSchema).max(16).optional()
 });
+/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
+const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const mysqlTargetConfigSchema = z.object({
+	provider: z.literal("mysql"),
+	executor: executorModeSchema,
+	accessLevel: mysqlAccessLevelSchema.optional(),
+	connection: connectionSchema,
+	userHost: mysqlHostSchema.optional(),
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema).max(16).optional(),
+	revokeStatements: z.array(statementSchema).max(16).optional()
+});
+const sshTargetConfigSchema = z.object({
+	provider: z.literal("ssh"),
+	executor: z.literal("in_do"),
+	caPublicKey: sshPublicKeySchema,
+	allowedPrincipals: z.array(sshPrincipalSchema).max(64).optional(),
+	extensions: z.array(sshExtensionSchema).max(16).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional(),
+	connection: z.object({
+		host: z.string().min(1).optional(),
+		user: sshPrincipalSchema.optional()
+	}).optional()
+});
+const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
+	postgresTargetConfigSchema,
+	mysqlTargetConfigSchema,
+	sshTargetConfigSchema
+]);
 z.object({
 	name: z.string().trim().min(1).max(128),
 	config: leaseTargetConfigSchema,
@@ -786,12 +1277,49 @@ z.object({
 	*/
 	wrappedAdminSecret: z.string().min(1)
 });
-z.object({
+/** Requested lease lifetime, shared by all providers. */
+const ttlSecondsSchema = z.number().int().min(60).max(3600 * 24 * 7);
+/**
+* Client → API: mint a Postgres lease. The client generates the password and
+* its SCRAM verifier locally and sends only the verifier — the plaintext
+* password never leaves the requesting machine.
+*/
+const mintPostgresLeaseSchema = z.object({
+	provider: z.literal("postgres"),
 	targetId: z.string().min(1),
 	roleName: postgresRoleNameSchema,
 	verifier: scramVerifierSchema,
-	ttlSeconds: z.number().int().min(60).max(3600 * 24 * 7)
+	ttlSeconds: ttlSecondsSchema
+});
+/**
+* Client → API: mint a MySQL/MariaDB lease. The client generates the password
+* and its `mysql_native_password` hash locally and sends only the hash — the
+* plaintext password never leaves the requesting machine.
+*/
+const mintMysqlLeaseSchema = z.object({
+	provider: z.literal("mysql"),
+	targetId: z.string().min(1),
+	roleName: mysqlUserNameSchema,
+	verifier: mysqlNativeVerifierSchema,
+	ttlSeconds: ttlSecondsSchema
 });
+/**
+* Client → API: mint an SSH lease. The client generates an ephemeral keypair
+* locally and sends only the public key; the signed certificate comes back in
+* the response. The private key never leaves the requesting machine.
+*/
+const mintSshLeaseSchema = z.object({
+	provider: z.literal("ssh"),
+	targetId: z.string().min(1),
+	publicKey: sshPublicKeySchema,
+	principals: z.array(sshPrincipalSchema).min(1).max(32),
+	ttlSeconds: ttlSecondsSchema
+});
+z.discriminatedUnion("provider", [
+	mintPostgresLeaseSchema,
+	mintMysqlLeaseSchema,
+	mintSshLeaseSchema
+]);
 //#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
@@ -825,6 +1353,46 @@ function postgresGroupBootstrapSql(config) {
 	return lines.join("\n");
 }
 //#endregion
+//#region ../../packages/core/src/providers/ssh.ts
+/**
+* The one-time host setup an admin runs so a target's certificates are accepted.
+* Analogue of `postgresGroupBootstrapSql` — displayed for the admin to run, not
+* executed by seekrit. Embeds the CA public key so it's copy-paste runnable.
+*/
+function sshHostSetupInstructions(config) {
+	const principals = config.allowedPrincipals?.length ? config.allowedPrincipals : ["<login-user>"];
+	return [
+		"# Run once on each target host so it trusts seekrit-issued certificates.",
+		"# 1. Install the CA public key and trust it for user authentication:",
+		`echo '${config.caPublicKey}' | sudo tee /etc/ssh/seekrit_ca.pub`,
+		"sudo sh -c 'echo \"TrustedUserCAKeys /etc/ssh/seekrit_ca.pub\" >> /etc/ssh/sshd_config'",
+		"# 2. (optional) Restrict which cert principals may log in as which users via",
+		"#    AuthorizedPrincipalsFile, e.g. /etc/ssh/auth_principals/<user> listing:",
+		...principals.map((p) => `#      ${p}`),
+		"# 3. Reload sshd:",
+		"sudo systemctl reload sshd"
+	].join("\n");
+}
+//#endregion
+//#region ../../packages/core/src/types.ts
+/**
+* Transactional notification emails seekrit can send. Each id is one
+* user-facing on/off toggle (see `NOTIFICATION_TYPE_META`). These carry only
+* audit-grade metadata — never secret material — and every one is opt-out
+* (defaults on). Kept as a const array so the API, api-client, and dashboard
+* share a single source of truth (mirrors `AUDIT_ACTIONS`).
+*/
+const NOTIFICATION_TYPES = [
+	"token_created",
+	"token_revoked",
+	"env_access_granted",
+	"env_access_revoked",
+	"resolve_denied",
+	"org_welcome",
+	"token_expiring",
+	"lease_expired"
+];
+//#endregion
 //#region ../../packages/core/src/schemas.ts
 /** URL-safe identifier segment: `my-app`, `production`, … */
 const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
@@ -897,6 +1465,7 @@ z.object({
 	environmentId: z.string().min(1).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
 z.object({
 	cursor: z.string().optional(),
 	limit: z.coerce.number().int().min(1).max(200).default(50),
@@ -904,94 +1473,6 @@ z.object({
 	resourceType: z.string().optional()
 });
 //#endregion
-//#region src/target.ts
-/** Resolve the target org from a flag, the committed config, or a lone org. */
-async function resolveOrg(ctx, orgSlug) {
-	const wanted = orgSlug ?? findProjectConfig()?.org;
-	const { orgs } = await ctx.client.listOrgs();
-	if (wanted) {
-		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
-		if (!org) fail(`no accessible org "${wanted}"`);
-		return {
-			id: org.id,
-			slug: org.slug
-		};
-	}
-	const only = orgs[0];
-	if (orgs.length === 1 && only) return {
-		id: only.id,
-		slug: only.slug
-	};
-	fail("specify --org (or run `seekrit init`)");
-}
-/**
-* Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
-*/
-async function resolveEnvTarget(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.env) fail("specify --env");
-	if (opts.group) {
-		const { groups } = await ctx.client.listGroups(org.id);
-		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
-		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
-		return {
-			orgId: org.id,
-			envId: env.id,
-			label: `${group.slug}@${env.slug}`
-		};
-	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		envId: env.id,
-		label: `${app.slug}/${env.slug}`
-	};
-}
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		appId: app.id,
-		appSlug: app.slug,
-		envId: env.id,
-		envSlug: env.slug
-	};
-}
-/** Resolve a group by slug within the target org. */
-async function resolveGroup(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.group) fail("specify --group");
-	const { groups } = await ctx.client.listGroups(org.id);
-	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-	return {
-		orgId: org.id,
-		id: group.id,
-		slug: group.slug
-	};
-}
-//#endregion
 //#region src/pg.ts
 /**
 * `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
@@ -1003,7 +1484,7 @@ async function resolveGroup(ctx, opts) {
 * ciphertext.
 */
 /** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds(input) {
+function parseTtlSeconds$1(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
 	return Number(m[1]) * ({
@@ -1024,7 +1505,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$1, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$1, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1072,6 +1553,7 @@ function registerPgCommands(program) {
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
 		for (const t of targets) {
 			const cfg = t.config;
+			if (cfg.provider !== "postgres") continue;
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
@@ -1081,7 +1563,9 @@ function registerPgCommands(program) {
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
 		const t = targets.find((x) => x.id === targetId || x.name === targetId);
 		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const bootstrap = postgresGroupBootstrapSql(t.config);
+		const cfg = t.config;
+		if (cfg.provider !== "postgres") fail("not a postgres target (see `seekrit ssh`)");
+		const bootstrap = postgresGroupBootstrapSql(cfg);
 		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
 		console.log(bootstrap);
 	});
@@ -1097,10 +1581,12 @@ function registerPgCommands(program) {
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
 		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
 		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
 		const roleName = options.role ?? generateRoleName();
-		const ttlSeconds = parseTtlSeconds(options.ttl);
+		const ttlSeconds = parseTtlSeconds$1(options.ttl);
 		const { password, verifier } = await generatePostgresCredential();
 		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "postgres",
 			targetId: target.id,
 			roleName,
 			verifier,
@@ -1129,7 +1615,7 @@ function registerPgCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect(value, acc) {
+function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -1234,6 +1720,147 @@ function printExplain(provenance) {
 	for (const name of names) process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}\n`);
 }
 //#endregion
+//#region src/ssh.ts
+/**
+* `seekrit ssh` — temporary SSH access via short-lived certificates (Vault-style
+* dynamic secrets, the SSH sibling of `seekrit pg`).
+*
+* Zero-knowledge: minting generates an ephemeral keypair on THIS machine and
+* sends only the public key; the broker signs a certificate and returns it (a
+* public artifact). The private key never leaves this machine. Registering a
+* target generates a CA keypair locally and wraps the CA *private* key to the
+* broker's public key, so the control plane only ever stores ciphertext; the CA
+* *public* key is printed for you to install on your hosts.
+*/
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+function registerSshCommands(program) {
+	const ssh = program.command("ssh").description("temporary SSH access (short-lived certificates, zero-knowledge)");
+	const target = ssh.command("target").description("manage SSH CA targets");
+	target.command("add").description("create an SSH certificate authority to issue certs from").requiredOption("--name <name>", "display name, e.g. prod-fleet").option("--org <slug>").option("--host <host>", "default host the printed ssh command connects to").option("--user <login>", "default login user (a cert principal)").option("--principal <name>", "allow-list a principal certs may request (repeatable)", collect, []).option("--extension <name>", "cert extension to grant, e.g. permit-pty (repeatable)", collect, []).option("--max-ttl <duration>", "clamp requested cert lifetime, e.g. 8h").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const ca = await generateSshCaKeyPair(`seekrit-ca:${options.name}`);
+		const config = {
+			provider: "ssh",
+			executor: "in_do",
+			caPublicKey: ca.publicKeyOpenssh,
+			...options.principal.length ? { allowedPrincipals: options.principal } : {},
+			...options.extension.length ? { extensions: options.extension } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds(options.maxTtl) } : {},
+			...options.host || options.user ? { connection: {
+				...options.host ? { host: options.host } : {},
+				...options.user ? { user: options.user } : {}
+			} } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(ca.privateKeyJwk), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered SSH target ${created.name} (${created.id})`);
+		console.error("\nInstall the CA on your hosts, then issue certs with `seekrit ssh lease`:\n");
+		console.log(sshHostSetupInstructions(config));
+	});
+	target.command("list").description("list SSH CA targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "ssh") continue;
+			const where = cfg.connection?.host ?? "-";
+			const principals = cfg.allowedPrincipals?.join(",") ?? "any";
+			console.log(`${t.id}\t${t.name}\t${where}\tprincipals=${principals}`);
+		}
+	});
+	target.command("setup <targetId>").description("reprint the one-time host setup for an SSH target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "ssh") fail("not an ssh target (see `seekrit pg`)");
+		console.log(sshHostSetupInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete an SSH CA target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	ssh.command("lease <target>").description("mint a short-lived SSH certificate; prints a ready-to-run ssh command").option("--org <slug>").option("--principal <name>", "login user to request (repeatable; default from target)", collect, []).option("--ttl <duration>", "certificate lifetime, e.g. 30m, 1h, 8h", "1h").option("--out <dir>", "directory to write the key + cert (default: a temp dir)").option("--json", "print key/cert paths and the certificate as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "ssh") fail(`"${t.name}" is not an ssh target (see \`seekrit pg\`)`);
+		const principals = options.principal.length ? options.principal : cfg.connection?.user ? [cfg.connection.user] : cfg.allowedPrincipals ?? [];
+		if (principals.length === 0) fail("specify at least one --principal");
+		const ttlSeconds = parseTtlSeconds(options.ttl);
+		const keypair = await generateSshKeyPair(`seekrit:${t.name}`);
+		const { ssh: cert } = await ctx.client.mintLease(org.id, {
+			provider: "ssh",
+			targetId: t.id,
+			publicKey: keypair.publicKeyOpenssh,
+			principals,
+			ttlSeconds
+		});
+		const dir = options.out ?? mkdtempSync(join(tmpdir(), "seekrit-ssh-"));
+		if (options.out) mkdirSync(dir, { recursive: true });
+		const keyPath = join(dir, "id_ed25519");
+		const certPath = join(dir, "id_ed25519-cert.pub");
+		writeFileSync(keyPath, keypair.privateKeyOpenssh, { mode: 384 });
+		writeFileSync(certPath, `${cert.certificate}\n`, { mode: 420 });
+		const loginUser = principals[0];
+		const command = `ssh -i ${keyPath} -o CertificateFile=${certPath}${cert.host ? ` ${loginUser}@${cert.host}` : ""}`;
+		console.error(`issued cert for ${principals.join(",")} — expires ${cert.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			keyPath,
+			certPath,
+			certificate: cert.certificate,
+			principals,
+			command,
+			expiresAt: cert.expiresAt
+		}, null, 2));
+		else console.log(command);
+	});
+	ssh.command("leases").description("list SSH leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "ssh") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	ssh.command("revoke <leaseId>").description("mark a lease revoked in the ledger (the cert stays valid until it expires)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued certs remain valid until they expire)`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect(value, acc) {
+	acc.push(value);
+	return acc;
+}
+//#endregion
 //#region src/index.ts
 /** Collect repeated `--with group=env` flags into a map. */
 function collectKv(value, acc = {}) {
@@ -1591,8 +2218,10 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 	console.error(`${tokenId} revoked`);
 });
 registerPgCommands(program);
+registerMysqlCommands(program);
+registerSshCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-Dw3hVhbC.js");
+	const { runMcpServer } = await import("./mcp-BEcV_KpM.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -1606,4 +2235,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { parseServiceToken as _, resolveEnvTarget as a, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveAppEnv as i, isTokenAuth as l, wrapDek as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generatePostgresCredential as v, generateDek as y };
+export { parseServiceToken as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveAppEnv as i, isTokenAuth as l, wrapDek as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generatePostgresCredential as v, generateMysqlCredential as y };

package/dist/{mcp-Dw3hVhbC.js → mcp-BEcV_KpM.js}

@@ -1,4 +1,4 @@
-import { _ as parseServiceToken, a as resolveEnvTarget, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateDek } from "./index.js";
+import { _ as parseServiceToken, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateMysqlCredential } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -560,6 +560,7 @@ async function runMcpServer() {
 		const roleName = role ?? `tmp_${randomLower(12)}`;
 		const { password, verifier } = await generatePostgresCredential();
 		const { lease, connection } = await ctx.client.mintLease(orgRef.id, {
+			provider: "postgres",
 			targetId: t.id,
 			roleName,
 			verifier,
@@ -591,6 +592,58 @@ async function runMcpServer() {
 			leaseId
 		};
 	});
+	tool("list_mysql_targets", "List registered MySQL/MariaDB provisioning targets for temporary credentials.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeaseTargets(orgRef.id)).targets.filter((t) => t.provider === "mysql");
+	});
+	tool("create_mysql_lease", "Mint a short-lived MySQL/MariaDB credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its mysql_native_password hash is sent to the API — the plaintext never reaches seekrit or MySQL at rest. The user auto-expires; revoke early with revoke_mysql_lease.", {
+		org: z.string().optional(),
+		target: z.string().describe("target id or name"),
+		user: z.string().optional().describe("user name to create (default: random tmp_ name)"),
+		ttlSeconds: z.number().int().min(60).max(604800).optional().describe("lifetime (default 3600)")
+	}, async ({ org, target, user, ttlSeconds }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { targets } = await ctx.client.listLeaseTargets(orgRef.id);
+		const t = targets.find((x) => x.id === target || x.name === target);
+		if (!t) throw new Error(`no target "${target}" in ${orgRef.slug}`);
+		if (t.provider !== "mysql") throw new Error(`target "${target}" is not a MySQL target`);
+		const userName = user ?? `tmp_${randomLower(12)}`;
+		const { password, verifier } = await generateMysqlCredential();
+		const { lease, connection } = await ctx.client.mintLease(orgRef.id, {
+			provider: "mysql",
+			targetId: t.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds: ttlSeconds ?? 3600
+		});
+		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		return {
+			leaseId: lease.id,
+			url,
+			username: userName,
+			expiresAt: connection.expiresAt,
+			note: "short-lived credential; it auto-expires and the plaintext is not stored anywhere"
+		};
+	});
+	tool("list_mysql_leases", "List MySQL/MariaDB leases (the ledger — never secret material).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeases(orgRef.id)).leases.filter((l) => l.provider === "mysql");
+	});
+	tool("revoke_mysql_lease", "Revoke a MySQL/MariaDB lease now (drops the user immediately).", {
+		org: z.string().optional(),
+		leaseId: z.string()
+	}, async ({ org, leaseId }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		await ctx.client.revokeLease(orgRef.id, leaseId);
+		return {
+			ok: true,
+			leaseId
+		};
+	});
 	tool("configure_project", "Link a directory to an org/app by writing seekrit.json (like `seekrit init`). The environment is chosen by the service token at runtime.", {
 		org: z.string(),
 		app: z.string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {