@seekrit/cli 0.9.0 → 0.11.0

package/README.md

@@ -86,6 +86,28 @@ seekrit token revoke <tokenId>
 
 See the [service tokens guide](https://seekrit.dev/docs/guides/service-tokens).
 
+## Docker
+
+The CLI also ships as a container image — the full toolchain on a Node runtime,
+for CI runners and agent sandboxes. Multi-arch images (`linux/amd64` +
+`linux/arm64`) are on Docker Hub as
+[`seekritdev/cli`](https://hub.docker.com/r/seekritdev/cli):
+
+```sh
+docker run --rm \
+  -e SEEKRIT_TOKEN=skt_… \
+  -v "$PWD:/work" -w /work \
+  seekritdev/cli run -- ./deploy.sh
+```
+
+The entrypoint is `seekrit`, so pass subcommands directly (e.g.
+`docker run seekritdev/cli secrets list`). It runs unprivileged (`node`) and
+writes config under `$HOME/.config`. Tags: `:latest`, `:<version>` /
+`:<major>.<minor>`, and `:edge` (latest `main`).
+
+For a Node-free runtime image (inject secrets and exec, nothing else), prefer
+the [`seekrit-run`](../run) launcher — `seekritdev/run`.
+
 ## Configuration
 
 Credentials and defaults are read from (highest precedence first) environment
@@ -121,8 +143,8 @@ See the root [README](../../README.md) for the full end-to-end local loop.
 ### Build
 
 The CLI is bundled with [tsdown](https://tsdown.dev). Workspace packages
-(`@seekrit/*`) are inlined so the published package's only runtime dependency is
-`commander`.
+(`@seekrit/*`) are inlined, so the published package's only runtime dependencies
+are `commander`, `zod`, and `@modelcontextprotocol/sdk`.
 
 ```sh
 pnpm build       # bundle to dist/index.js

package/dist/index.js

@@ -586,7 +586,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.9.0";
+var version = "0.11.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -814,6 +814,19 @@ var SeekritClient = class {
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
 	}
+	getLogSink(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
+	}
+	setLogSink(orgId, input) {
+		return this.request("PUT", `/v1/orgs/${orgId}/log-sink`, input);
+	}
+	deleteLogSink(orgId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/log-sink`);
+	}
+	/** Send a synthetic record to the configured endpoint to verify connectivity. */
+	testLogSink(orgId) {
+		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
+	}
 };
 //#endregion
 //#region src/io.ts
@@ -940,6 +953,49 @@ function formatSecrets(values, format) {
 	}
 }
 //#endregion
+//#region src/provisioner.ts
+/**
+* `seekrit provisioner` — helpers for the self-hosted **remote executor**
+* (`seekrit-provisioner`), the daemon that runs a target's provisioning SQL
+* inside the customer's own network so the control plane never sees the database
+* admin credential.
+*
+* The only stateful command is `keygen`: the shared HMAC key authenticates the
+* signed commands the broker sends the daemon. The same base64 value is given to
+* BOTH `--hmac-key` when registering a remote target AND the daemon's
+* `SEEKRIT_PROVISIONER_HMAC_KEY`.
+*/
+function registerProvisionerCommands(program) {
+	program.command("provisioner").description("self-hosted remote executor (seekrit-provisioner) helpers").command("keygen").description("generate a shared HMAC key for a remote provisioning target").action(() => {
+		const key = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+		console.log(toBase64(key));
+		console.error("Give this key to BOTH `--hmac-key` when registering a remote target AND the\ndaemon's SEEKRIT_PROVISIONER_HMAC_KEY. Keep it secret; it authenticates the\nbroker's commands to your provisioner.");
+	});
+}
+/**
+* Resolve the "admin secret" a lease target registration wraps to the broker.
+* Its meaning depends on the executor:
+*
+* - **remote** — the shared HMAC key (base64). The real database admin
+*   credential is NOT sent to seekrit; it is configured on the daemon instead.
+*   Preferred source is `--hmac-key` / `SEEKRIT_PROVISIONER_HMAC_KEY`, with the
+*   older `--admin-url` / provider admin-url env kept as a fallback.
+* - **in_do** — the database admin connection string, which the broker decrypts
+*   transiently to run the SQL itself.
+*
+* `fail()` never returns, so the result is always a non-empty string.
+*/
+function resolveLeaseAdminSecret(opts) {
+	if (opts.executor === "remote") {
+		const key = opts.hmacKey ?? process.env.SEEKRIT_PROVISIONER_HMAC_KEY ?? opts.adminUrl ?? process.env[opts.adminUrlEnv];
+		if (!key) fail("the remote executor needs the shared HMAC key — pass --hmac-key or set SEEKRIT_PROVISIONER_HMAC_KEY (mint one with `seekrit provisioner keygen`)");
+		return key.trim();
+	}
+	const adminUrl = opts.adminUrl ?? process.env[opts.adminUrlEnv];
+	if (!adminUrl) fail(`provide the admin connection string via --admin-url or ${opts.adminUrlEnv}`);
+	return adminUrl;
+}
+//#endregion
 //#region src/target.ts
 /** Resolve the target org from a flag, the committed config, or a lone org. */
 async function resolveOrg(ctx, orgSlug) {
@@ -1061,7 +1117,7 @@ function generateUserName(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1072,8 +1128,12 @@ function registerMysqlCommands(program) {
 			"custom"
 		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
 		const accessLevel = options.access;
-		const adminSecret = options.adminUrl ?? process.env.SEEKRIT_MYSQL_ADMIN_URL;
-		if (!adminSecret) fail(executor === "remote" ? "provide the shared HMAC key via --admin-url or SEEKRIT_MYSQL_ADMIN_URL" : "provide the admin connection string via --admin-url or SEEKRIT_MYSQL_ADMIN_URL");
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_MYSQL_ADMIN_URL"
+		});
 		const config = {
 			provider: "mysql",
 			executor,
@@ -1466,6 +1526,11 @@ z.object({
 	expiresAt: z.iso.datetime().nullish()
 });
 z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
+z.object({
+	endpoint: z.url().max(2048),
+	headers: z.record(z.string().min(1).max(256), z.string().max(4096)).optional(),
+	enabled: z.boolean().default(true)
+});
 z.object({
 	cursor: z.string().optional(),
 	limit: z.coerce.number().int().min(1).max(200).default(50),
@@ -1505,7 +1570,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$1, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$1, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$1, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$1, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -1516,8 +1581,12 @@ function registerPgCommands(program) {
 			"custom"
 		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
 		const accessLevel = options.access;
-		const adminSecret = options.adminUrl ?? process.env.SEEKRIT_PG_ADMIN_URL;
-		if (!adminSecret) fail(executor === "remote" ? "provide the shared HMAC key via --admin-url or SEEKRIT_PG_ADMIN_URL" : "provide the admin connection string via --admin-url or SEEKRIT_PG_ADMIN_URL");
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_PG_ADMIN_URL"
+		});
 		const config = {
 			provider: "postgres",
 			executor,
@@ -2219,6 +2288,7 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 });
 registerPgCommands(program);
 registerMysqlCommands(program);
+registerProvisionerCommands(program);
 registerSshCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
 	const { runMcpServer } = await import("./mcp-BEcV_KpM.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {