@seekrit/cli 0.8.0 → 0.10.0

package/dist/index.js

@@ -140,6 +140,75 @@ async function importPrivateKeyPkcs8(pkcs8) {
 	}, true, ["deriveBits"]);
 }
 //#endregion
+//#region ../../packages/crypto/src/mysql.ts
+/**
+* Client-side construction of a MySQL/MariaDB `mysql_native_password`
+* authentication string, for minting *temporary MySQL login credentials*
+* without the password plaintext ever reaching seekrit's control plane OR
+* MySQL itself.
+*
+* The trick mirrors the Postgres SCRAM one (scram.ts): the stored auth string
+* is `*<UPPER(HEX(SHA1(SHA1(password))))>`, and
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'` stores that
+* string verbatim — MySQL does NOT re-hash it. So the flow is:
+*
+*   1. the machine that will connect generates a random password locally,
+*   2. computes this hash locally,
+*   3. sends only the hash to the broker → `CREATE USER … AS '<hash>'`,
+*   4. connects directly to MySQL with the plaintext it never shared.
+*
+* Zero-knowledge at both layers: the control plane relays only the hash, and
+* the hash is NOT sufficient to authenticate. `mysql_native_password` login is
+* a challenge-response — the server proves knowledge of `SHA1(SHA1(password))`
+* against a fresh scramble, and verifying a client requires `SHA1(password)`
+* (the preimage of the first inner hash), which the stored double-SHA1 does not
+* reveal. A dump of `mysql.user` / the query log therefore cannot log in.
+*
+* SHA-1 is available via WebCrypto (`crypto.subtle.digest("SHA-1", …)`) in the
+* browser, the CLI, the MCP server, and Workers — so this runs everywhere the
+* SCRAM helper does, with no hand-rolled hash primitive.
+*/
+const DEFAULT_PASSWORD_LENGTH$1 = 32;
+const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function sha1(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
+}
+function toUpperHex(bytes) {
+	let hex = "";
+	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+	return hex.toUpperCase();
+}
+function randomPassword$1(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+/**
+* Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
+* for a known password. Pass the result straight to
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`.
+*/
+async function mysqlNativePasswordVerifier(password) {
+	return `*${toUpperHex(await sha1(await sha1(utf8Encode(password))))}`;
+}
+/**
+* Mint a fresh random password and its `mysql_native_password` hash in one step
+* — the client-side half of a Vault-style dynamic MySQL credential.
+*/
+async function generateMysqlCredential(options = {}) {
+	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	return {
+		password,
+		verifier: await mysqlNativePasswordVerifier(password)
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/passphrase.ts
 /**
 * User private keys are stored server-side encrypted under a key derived from
@@ -517,7 +586,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.8.0";
+var version = "0.10.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -606,6 +675,12 @@ var SeekritClient = class {
 	setMyKeys(input) {
 		return this.request("PUT", "/v1/me/keys", input);
 	}
+	getMyNotificationPrefs() {
+		return this.request("GET", "/v1/me/notifications");
+	}
+	setMyNotificationPrefs(input) {
+		return this.request("PUT", "/v1/me/notifications", input);
+	}
 	listOrgs() {
 		return this.request("GET", "/v1/orgs");
 	}
@@ -739,6 +814,19 @@ var SeekritClient = class {
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
 	}
+	getLogSink(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
+	}
+	setLogSink(orgId, input) {
+		return this.request("PUT", `/v1/orgs/${orgId}/log-sink`, input);
+	}
+	deleteLogSink(orgId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/log-sink`);
+	}
+	/** Send a synthetic record to the configured endpoint to verify connectivity. */
+	testLogSink(orgId) {
+		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
+	}
 };
 //#endregion
 //#region src/io.ts
@@ -864,7 +952,281 @@ function formatSecrets(values, format) {
 		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
 	}
 }
-z.enum(["postgres", "ssh"]);
+//#endregion
+//#region src/provisioner.ts
+/**
+* `seekrit provisioner` — helpers for the self-hosted **remote executor**
+* (`seekrit-provisioner`), the daemon that runs a target's provisioning SQL
+* inside the customer's own network so the control plane never sees the database
+* admin credential.
+*
+* The only stateful command is `keygen`: the shared HMAC key authenticates the
+* signed commands the broker sends the daemon. The same base64 value is given to
+* BOTH `--hmac-key` when registering a remote target AND the daemon's
+* `SEEKRIT_PROVISIONER_HMAC_KEY`.
+*/
+function registerProvisionerCommands(program) {
+	program.command("provisioner").description("self-hosted remote executor (seekrit-provisioner) helpers").command("keygen").description("generate a shared HMAC key for a remote provisioning target").action(() => {
+		const key = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+		console.log(toBase64(key));
+		console.error("Give this key to BOTH `--hmac-key` when registering a remote target AND the\ndaemon's SEEKRIT_PROVISIONER_HMAC_KEY. Keep it secret; it authenticates the\nbroker's commands to your provisioner.");
+	});
+}
+/**
+* Resolve the "admin secret" a lease target registration wraps to the broker.
+* Its meaning depends on the executor:
+*
+* - **remote** — the shared HMAC key (base64). The real database admin
+*   credential is NOT sent to seekrit; it is configured on the daemon instead.
+*   Preferred source is `--hmac-key` / `SEEKRIT_PROVISIONER_HMAC_KEY`, with the
+*   older `--admin-url` / provider admin-url env kept as a fallback.
+* - **in_do** — the database admin connection string, which the broker decrypts
+*   transiently to run the SQL itself.
+*
+* `fail()` never returns, so the result is always a non-empty string.
+*/
+function resolveLeaseAdminSecret(opts) {
+	if (opts.executor === "remote") {
+		const key = opts.hmacKey ?? process.env.SEEKRIT_PROVISIONER_HMAC_KEY ?? opts.adminUrl ?? process.env[opts.adminUrlEnv];
+		if (!key) fail("the remote executor needs the shared HMAC key — pass --hmac-key or set SEEKRIT_PROVISIONER_HMAC_KEY (mint one with `seekrit provisioner keygen`)");
+		return key.trim();
+	}
+	const adminUrl = opts.adminUrl ?? process.env[opts.adminUrlEnv];
+	if (!adminUrl) fail(`provide the admin connection string via --admin-url or ${opts.adminUrlEnv}`);
+	return adminUrl;
+}
+//#endregion
+//#region src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
+/**
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
+*/
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
+//#endregion
+//#region src/mysql.ts
+/**
+* `seekrit mysql` — temporary MySQL/MariaDB credentials (Vault-style dynamic
+* secrets).
+*
+* Zero-knowledge: minting generates the password and its
+* `mysql_native_password` hash on THIS machine and sends only the hash; the
+* plaintext password never reaches the API or gets stored. Registering a target
+* wraps the admin connection string to the broker's public key locally, so the
+* control plane only ever stores ciphertext.
+*/
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds$2(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid MySQL user name: `tmp_` + lowercase alphanumerics. */
+function generateUserName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerMysqlCommands(program) {
+	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
+	const target = mysql.command("target").description("manage provisioning targets");
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_MYSQL_ADMIN_URL"
+		});
+		const config = {
+			provider: "mysql",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				database: options.database
+			},
+			userHost: options.userHost,
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : {},
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			if (t.provider !== "mysql") continue;
+			const cfg = t.config;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.provider !== "mysql") fail(`target "${targetRef}" is not a MySQL target`);
+		const userName = options.user ?? generateUserName();
+		const ttlSeconds = parseTtlSeconds$2(options.ttl);
+		const { password, verifier } = await generateMysqlCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "mysql",
+			targetId: target.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds
+		});
+		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${userName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "mysql") continue;
+			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+		}
+	});
+	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect$2(value, acc) {
+	acc.push(value);
+	return acc;
+}
+z.enum([
+	"postgres",
+	"mysql",
+	"ssh"
+]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
 * A Postgres role name we are willing to create. Deliberately strict — this
@@ -888,6 +1250,20 @@ const sshPrincipalSchema = z.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "must be 1
 const sshPublicKeySchema = z.string().max(2048).regex(/^ssh-ed25519 [A-Za-z0-9+/=]+( .*)?$/, "must be an ssh-ed25519 public key");
 /** An SSH certificate extension name, e.g. `permit-pty`. */
 const sshExtensionSchema = z.string().regex(/^[a-z0-9-]{1,64}$/);
+/**
+* A MySQL/MariaDB user name we are willing to create. Interpolated into a
+* quoted SQL literal (`'{{name}}'@'%'`), so it is kept strict — plain
+* alphanumerics/underscore, no quotes/whitespace/semicolons to break out.
+*/
+const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+/**
+* A `mysql_native_password` authentication string — `*` followed by 40 upper
+* hex chars (`UPPER(HEX(SHA1(SHA1(password))))`), as produced by
+* @seekrit/crypto `mysqlNativePasswordVerifier`. Stored verbatim by
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`, and its
+* alphabet contains no single quote, so it is safe in a quoted SQL literal.
+*/
+const mysqlNativeVerifierSchema = z.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -898,6 +1274,11 @@ const POSTGRES_GROUP_ROLES = {
 	readonly: "seekrit_readonly",
 	readwrite: "seekrit_readwrite"
 };
+const mysqlAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
 const connectionSchema = z.object({
 	host: z.string().min(1),
 	port: z.number().int().min(1).max(65535),
@@ -917,6 +1298,18 @@ const postgresTargetConfigSchema = z.object({
 	createStatements: z.array(statementSchema).max(16).optional(),
 	revokeStatements: z.array(statementSchema).max(16).optional()
 });
+/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
+const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const mysqlTargetConfigSchema = z.object({
+	provider: z.literal("mysql"),
+	executor: executorModeSchema,
+	accessLevel: mysqlAccessLevelSchema.optional(),
+	connection: connectionSchema,
+	userHost: mysqlHostSchema.optional(),
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema).max(16).optional(),
+	revokeStatements: z.array(statementSchema).max(16).optional()
+});
 const sshTargetConfigSchema = z.object({
 	provider: z.literal("ssh"),
 	executor: z.literal("in_do"),
@@ -929,7 +1322,11 @@ const sshTargetConfigSchema = z.object({
 		user: sshPrincipalSchema.optional()
 	}).optional()
 });
-const leaseTargetConfigSchema = z.discriminatedUnion("provider", [postgresTargetConfigSchema, sshTargetConfigSchema]);
+const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
+	postgresTargetConfigSchema,
+	mysqlTargetConfigSchema,
+	sshTargetConfigSchema
+]);
 z.object({
 	name: z.string().trim().min(1).max(128),
 	config: leaseTargetConfigSchema,
@@ -955,6 +1352,18 @@ const mintPostgresLeaseSchema = z.object({
 	ttlSeconds: ttlSecondsSchema
 });
 /**
+* Client → API: mint a MySQL/MariaDB lease. The client generates the password
+* and its `mysql_native_password` hash locally and sends only the hash — the
+* plaintext password never leaves the requesting machine.
+*/
+const mintMysqlLeaseSchema = z.object({
+	provider: z.literal("mysql"),
+	targetId: z.string().min(1),
+	roleName: mysqlUserNameSchema,
+	verifier: mysqlNativeVerifierSchema,
+	ttlSeconds: ttlSecondsSchema
+});
+/**
 * Client → API: mint an SSH lease. The client generates an ephemeral keypair
 * locally and sends only the public key; the signed certificate comes back in
 * the response. The private key never leaves the requesting machine.
@@ -966,7 +1375,11 @@ const mintSshLeaseSchema = z.object({
 	principals: z.array(sshPrincipalSchema).min(1).max(32),
 	ttlSeconds: ttlSecondsSchema
 });
-z.discriminatedUnion("provider", [mintPostgresLeaseSchema, mintSshLeaseSchema]);
+z.discriminatedUnion("provider", [
+	mintPostgresLeaseSchema,
+	mintMysqlLeaseSchema,
+	mintSshLeaseSchema
+]);
 //#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
@@ -1021,6 +1434,25 @@ function sshHostSetupInstructions(config) {
 	].join("\n");
 }
 //#endregion
+//#region ../../packages/core/src/types.ts
+/**
+* Transactional notification emails seekrit can send. Each id is one
+* user-facing on/off toggle (see `NOTIFICATION_TYPE_META`). These carry only
+* audit-grade metadata — never secret material — and every one is opt-out
+* (defaults on). Kept as a const array so the API, api-client, and dashboard
+* share a single source of truth (mirrors `AUDIT_ACTIONS`).
+*/
+const NOTIFICATION_TYPES = [
+	"token_created",
+	"token_revoked",
+	"env_access_granted",
+	"env_access_revoked",
+	"resolve_denied",
+	"org_welcome",
+	"token_expiring",
+	"lease_expired"
+];
+//#endregion
 //#region ../../packages/core/src/schemas.ts
 /** URL-safe identifier segment: `my-app`, `production`, … */
 const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
@@ -1093,6 +1525,12 @@ z.object({
 	environmentId: z.string().min(1).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
+z.object({
+	endpoint: z.url().max(2048),
+	headers: z.record(z.string().min(1).max(256), z.string().max(4096)).optional(),
+	enabled: z.boolean().default(true)
+});
 z.object({
 	cursor: z.string().optional(),
 	limit: z.coerce.number().int().min(1).max(200).default(50),
@@ -1100,94 +1538,6 @@ z.object({
 	resourceType: z.string().optional()
 });
 //#endregion
-//#region src/target.ts
-/** Resolve the target org from a flag, the committed config, or a lone org. */
-async function resolveOrg(ctx, orgSlug) {
-	const wanted = orgSlug ?? findProjectConfig()?.org;
-	const { orgs } = await ctx.client.listOrgs();
-	if (wanted) {
-		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
-		if (!org) fail(`no accessible org "${wanted}"`);
-		return {
-			id: org.id,
-			slug: org.slug
-		};
-	}
-	const only = orgs[0];
-	if (orgs.length === 1 && only) return {
-		id: only.id,
-		slug: only.slug
-	};
-	fail("specify --org (or run `seekrit init`)");
-}
-/**
-* Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
-*/
-async function resolveEnvTarget(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.env) fail("specify --env");
-	if (opts.group) {
-		const { groups } = await ctx.client.listGroups(org.id);
-		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
-		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
-		return {
-			orgId: org.id,
-			envId: env.id,
-			label: `${group.slug}@${env.slug}`
-		};
-	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		envId: env.id,
-		label: `${app.slug}/${env.slug}`
-	};
-}
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
-	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
-	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
-	return {
-		orgId: org.id,
-		appId: app.id,
-		appSlug: app.slug,
-		envId: env.id,
-		envSlug: env.slug
-	};
-}
-/** Resolve a group by slug within the target org. */
-async function resolveGroup(ctx, opts) {
-	const org = await resolveOrg(ctx, opts.org);
-	if (!opts.group) fail("specify --group");
-	const { groups } = await ctx.client.listGroups(org.id);
-	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
-	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
-	return {
-		orgId: org.id,
-		id: group.id,
-		slug: group.slug
-	};
-}
-//#endregion
 //#region src/pg.ts
 /**
 * `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
@@ -1220,7 +1570,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$1, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$1, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$1, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$1, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1231,8 +1581,12 @@ function registerPgCommands(program) {
 			"custom"
 		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
 		const accessLevel = options.access;
-		const adminSecret = options.adminUrl ?? process.env.SEEKRIT_PG_ADMIN_URL;
-		if (!adminSecret) fail(executor === "remote" ? "provide the shared HMAC key via --admin-url or SEEKRIT_PG_ADMIN_URL" : "provide the admin connection string via --admin-url or SEEKRIT_PG_ADMIN_URL");
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_PG_ADMIN_URL"
+		});
 		const config = {
 			provider: "postgres",
 			executor,
@@ -1933,9 +2287,11 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 	console.error(`${tokenId} revoked`);
 });
 registerPgCommands(program);
+registerMysqlCommands(program);
+registerProvisionerCommands(program);
 registerSshCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-DNUBSbcd.js");
+	const { runMcpServer } = await import("./mcp-BEcV_KpM.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -1949,4 +2305,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { parseServiceToken as _, resolveEnvTarget as a, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveAppEnv as i, isTokenAuth as l, wrapDek as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generatePostgresCredential as v, generateDek as y };
+export { parseServiceToken as _, resolveEnvTarget as a, generateDek as b, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveAppEnv as i, isTokenAuth as l, wrapDek as m, fetchDecryptedSecrets as n, resolveGroup as o, version as p, materializeEnv as r, resolveOrg as s, encryptAndSetSecret as t, tryBuildContext as u, generatePostgresCredential as v, generateMysqlCredential as y };

package/dist/{mcp-DNUBSbcd.js → mcp-BEcV_KpM.js}

@@ -1,4 +1,4 @@
-import { _ as parseServiceToken, a as resolveEnvTarget, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateDek } from "./index.js";
+import { _ as parseServiceToken, a as resolveEnvTarget, b as generateDek, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateMysqlCredential } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -592,6 +592,58 @@ async function runMcpServer() {
 			leaseId
 		};
 	});
+	tool("list_mysql_targets", "List registered MySQL/MariaDB provisioning targets for temporary credentials.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeaseTargets(orgRef.id)).targets.filter((t) => t.provider === "mysql");
+	});
+	tool("create_mysql_lease", "Mint a short-lived MySQL/MariaDB credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its mysql_native_password hash is sent to the API — the plaintext never reaches seekrit or MySQL at rest. The user auto-expires; revoke early with revoke_mysql_lease.", {
+		org: z.string().optional(),
+		target: z.string().describe("target id or name"),
+		user: z.string().optional().describe("user name to create (default: random tmp_ name)"),
+		ttlSeconds: z.number().int().min(60).max(604800).optional().describe("lifetime (default 3600)")
+	}, async ({ org, target, user, ttlSeconds }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { targets } = await ctx.client.listLeaseTargets(orgRef.id);
+		const t = targets.find((x) => x.id === target || x.name === target);
+		if (!t) throw new Error(`no target "${target}" in ${orgRef.slug}`);
+		if (t.provider !== "mysql") throw new Error(`target "${target}" is not a MySQL target`);
+		const userName = user ?? `tmp_${randomLower(12)}`;
+		const { password, verifier } = await generateMysqlCredential();
+		const { lease, connection } = await ctx.client.mintLease(orgRef.id, {
+			provider: "mysql",
+			targetId: t.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds: ttlSeconds ?? 3600
+		});
+		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		return {
+			leaseId: lease.id,
+			url,
+			username: userName,
+			expiresAt: connection.expiresAt,
+			note: "short-lived credential; it auto-expires and the plaintext is not stored anywhere"
+		};
+	});
+	tool("list_mysql_leases", "List MySQL/MariaDB leases (the ledger — never secret material).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeases(orgRef.id)).leases.filter((l) => l.provider === "mysql");
+	});
+	tool("revoke_mysql_lease", "Revoke a MySQL/MariaDB lease now (drops the user immediately).", {
+		org: z.string().optional(),
+		leaseId: z.string()
+	}, async ({ org, leaseId }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		await ctx.client.revokeLease(orgRef.id, leaseId);
+		return {
+			ok: true,
+			leaseId
+		};
+	});
 	tool("configure_project", "Link a directory to an org/app by writing seekrit.json (like `seekrit init`). The environment is chosen by the service token at runtime.", {
 		org: z.string(),
 		app: z.string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {