@seekrit/cli 1.6.2 → 1.6.4

package/dist/index.js

@@ -12,10 +12,10 @@ import { connect } from "node:net";
 import { fileURLToPath } from "node:url";
 import { request } from "node:http";
 /** Default lifetime of a published bundle (7 days), in seconds. */
-const POLICY_DEFAULT_TTL_SECONDS = 10080 * 60;
+const POLICY_DEFAULT_TTL_SECONDS = 604800;
 /** Bounds on a bundle's lifetime: an hour at the short end, 90 days at the long. */
 const POLICY_MIN_TTL_SECONDS = 3600;
-const POLICY_MAX_TTL_SECONDS = 2160 * 60 * 60;
+const POLICY_MAX_TTL_SECONDS = 7776e3;
 /** A bare hostname: no scheme, no port, no path, no wildcard. */
 const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
 const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
@@ -34,7 +34,7 @@ const agentPolicyRuleSchema = z.object({
 });
 z.object({ 
 /** `ap1.<body>.<signature>` — opaque to the server. */
-bundle: z.string().min(16).max(256 * 1024) });
+bundle: z.string().min(16).max(262144) });
 z.object({
 	name: z.string().trim().min(1).max(120),
 	slug: z.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "slug is lowercase letters, digits, and dashes"),
@@ -521,7 +521,7 @@ function countApplicable(proposals) {
 * to bound one run; something that needs longer wants a policy change, not a
 * longer ticket.
 */
-const TASK_MAX_TTL_SECONDS = 720 * 60;
+const TASK_MAX_TTL_SECONDS = 43200;
 /** An EC P-256 public JWK, for a sender-constraint proof key. */
 const taskProofJwkSchema = z.object({
 	kty: z.literal("EC"),
@@ -707,14 +707,16 @@ async function verifyArchive(archive, options = {}) {
 	if (options.skipSignature) {
 		signature = "unverifiable";
 		signatureNote = "signature checking was skipped";
-	} else if (archive.signature) if (options.expectKeyId && options.expectKeyId !== archive.signature.keyId) {
-		signature = "invalid";
-		signatureNote = `signed by key ${archive.signature.keyId}, expected ${options.expectKeyId}`;
-	} else try {
-		signature = await verifySignature(archive.manifest, archive.signature) ? "valid" : "invalid";
-	} catch (err) {
-		signature = "unverifiable";
-		signatureNote = err instanceof Error ? err.message : String(err);
+	} else if (archive.signature) {
+		if (options.expectKeyId && options.expectKeyId !== archive.signature.keyId) {
+			signature = "invalid";
+			signatureNote = `signed by key ${archive.signature.keyId}, expected ${options.expectKeyId}`;
+		} else try {
+			signature = await verifySignature(archive.manifest, archive.signature) ? "valid" : "invalid";
+		} catch (err) {
+			signature = "unverifiable";
+			signatureNote = err instanceof Error ? err.message : String(err);
+		}
 	}
 	return {
 		ok: badSections.length === 0 && missingSections.length === 0 && undeclaredSections.length === 0 && manifestDigestOk && signature === "valid",
@@ -1001,7 +1003,7 @@ const SUBSCRIPTION_STATUSES = [
 *   composition (matched by slug) and have no single parent to overlay.
 */
 /** Longest life a branch may be given. Bounds sprawl even if nobody cleans up. */
-const MAX_BRANCH_TTL_SECONDS = 720 * 60 * 60;
+const MAX_BRANCH_TTL_SECONDS = 2592e3;
 /**
 * Parse a human TTL — `30m`, `12h`, `7d`, `2w`, or bare seconds — into seconds.
 * Returns null for anything unparseable, so callers can report the input back.
@@ -1610,13 +1612,13 @@ const sshTargetConfigSchema = z.object({
 	caPublicKey: sshPublicKeySchema,
 	allowedPrincipals: z.array(sshPrincipalSchema).max(64).optional(),
 	extensions: z.array(sshExtensionSchema).max(16).optional(),
-	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(604800).optional(),
 	connection: z.object({
 		host: z.string().min(1).optional(),
 		user: sshPrincipalSchema.optional()
 	}).optional()
 });
-const AWS_MAX_TTL_SECONDS = 3600 * 12;
+const AWS_MAX_TTL_SECONDS = 43200;
 const awsTargetConfigSchema = z.object({
 	provider: z.literal("aws"),
 	executor: z.literal("in_do"),
@@ -1626,7 +1628,7 @@ const awsTargetConfigSchema = z.object({
 	sessionPolicy: z.string().min(1).max(4e3).optional(),
 	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
 });
-const GCP_MAX_TTL_SECONDS = 3600 * 12;
+const GCP_MAX_TTL_SECONDS = 43200;
 const gcpTargetConfigSchema = z.object({
 	provider: z.literal("gcp"),
 	executor: z.literal("in_do"),
@@ -1643,7 +1645,7 @@ const mongoTargetConfigSchema = z.object({
 	authSource: mongoDatabaseNameSchema.optional(),
 	roles: z.array(mongoRoleSchema).min(1).max(32).optional(),
 	tls: z.boolean().optional(),
-	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional()
+	maxTtlSeconds: z.number().int().min(60).max(604800).optional()
 });
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
@@ -1665,7 +1667,7 @@ z.object({
 	wrappedAdminSecret: z.string().min(1)
 });
 /** Requested lease lifetime, shared by all providers. */
-const ttlSecondsSchema = z.number().int().min(60).max(3600 * 24 * 7);
+const ttlSecondsSchema = z.number().int().min(60).max(604800);
 /**
 * Client → API: mint a Postgres lease. The client generates the password and
 * its SCRAM verifier locally and sends only the verifier — the plaintext
@@ -2376,7 +2378,7 @@ const rotationAlphabetSchema = z.enum([
 	"base64url",
 	"printable"
 ]);
-const rotationIntervalSchema = z.number().int().min(300).max(3600 * 24 * 365);
+const rotationIntervalSchema = z.number().int().min(300).max(31536e3);
 /**
 * A database user name we are willing to *re-key*. Deliberately more permissive
 * than the lease providers' name schemas — those name accounts seekrit creates,
@@ -5053,7 +5055,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.6.2";
+var version = "1.6.4";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -7063,7 +7065,7 @@ function registerPolicyCommands(policy) {
 const KEY_DOMAIN = "seekrit-lkg-cache-v1";
 const TOKEN_DOMAIN = "seekrit-token-fp-v1";
 /** 24h: long enough to ride out an outage, short enough to bound the tail. */
-const DEFAULT_MAX_AGE_MS = 1440 * 60 * 1e3;
+const DEFAULT_MAX_AGE_MS = 864e5;
 /**
 * Derive the key for one resolve request. Overrides are sorted, so flag order
 * never splits the cache. Byte-for-byte identical to `CacheKey::new` in
@@ -9126,8 +9128,12 @@ function envLabel(archive, env) {
 }
 /** Filesystem path for an environment's output file, mirroring its label. */
 function envPath(archive, env, extension) {
-	if (env.groupId) return join("groups", archive.data.groups.find((g) => g.id === env.groupId)?.slug ?? env.groupId, `${env.slug}.${extension}`);
-	return join("apps", archive.data.applications.find((a) => a.id === env.applicationId)?.slug ?? env.applicationId ?? "unknown", `${env.slug}.${extension}`);
+	if (env.groupId) {
+		const group = archive.data.groups.find((g) => g.id === env.groupId);
+		return join("groups", group?.slug ?? env.groupId, `${env.slug}.${extension}`);
+	}
+	const app = archive.data.applications.find((a) => a.id === env.applicationId);
+	return join("apps", app?.slug ?? env.applicationId ?? "unknown", `${env.slug}.${extension}`);
 }
 /**
 * Recover a private key to open the archive with, from (in order) a service
@@ -9545,7 +9551,7 @@ function registerAwsCommands(program) {
 		const cfg = t.config;
 		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
 		const ttlSeconds = parseTtlSeconds$6(options.ttl);
-		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
+		if (ttlSeconds < 900) fail(`--ttl must be at least 15m (STS minimum)`);
 		const recipient = await generateAwsRecipientKeyPair();
 		const { aws: leased } = await ctx.client.mintLease(org.id, {
 			provider: "aws",
@@ -11951,11 +11957,12 @@ function checkPlugin(pluginDir, opts = {}) {
 		detail: fingerprintOk ? String(fingerprintBody?.version ?? "") : (fingerprint.stderr || fingerprint.stdout || "no output").trim()
 	});
 	if (!fingerprintOk) return steps;
-	const fetch = spawnSync(bin, [...opts.config ? [
+	const argv = opts.config ? [
 		"--config",
 		opts.config,
 		"fetch"
-	] : ["fetch"], opts.path ?? ""], {
+	] : ["fetch"];
+	const fetch = spawnSync(bin, [...argv, opts.path ?? ""], {
 		encoding: "utf8",
 		timeout: 6e4,
 		env: {
@@ -15525,7 +15532,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-CjHg4P-V.js");
+	const { runMcpServer } = await import("./mcp-BvXwiGRv.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);

package/dist/{mcp-CjHg4P-V.js → mcp-BvXwiGRv.js}

@@ -438,7 +438,8 @@ async function runMcpServer(options = {}) {
 		const k = await kmsResolveKey(ctx, orgRef.id, key);
 		if (k.purpose !== "sign") throw new Error(`${k.name} is a ${k.purpose} key`);
 		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
-		return { signature: await signMessage(await importSigningKey(material), {
+		const privateKey = await importSigningKey(material);
+		return { signature: await signMessage(privateKey, {
 			keyId: k.id,
 			version: currentVersion
 		}, message) };
@@ -527,7 +528,8 @@ async function runMcpServer(options = {}) {
 		const { apps } = await ctx.client.listApps(orgRef.id);
 		const appRow = apps.find((a) => a.slug === app || a.id === app);
 		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
-		const wrappedDek = await wrapDek(generateDek(), await principalPublicKeyJwk(ctx));
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, await principalPublicKeyJwk(ctx));
 		return (await ctx.client.createEnv(orgRef.id, appRow.id, {
 			name,
 			slug,
@@ -594,7 +596,8 @@ async function runMcpServer(options = {}) {
 			org,
 			group
 		});
-		const wrappedDek = await wrapDek(generateDek(), await principalPublicKeyJwk(ctx));
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, await principalPublicKeyJwk(ctx));
 		return (await ctx.client.createGroupEnv(g.orgId, g.id, {
 			name,
 			slug,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,8 +27,8 @@
     "zod": "^4.6.2"
   },
   "devDependencies": {
-    "@types/node": "^26.1.0",
-    "tsdown": "^0.22.3",
+    "@types/node": "^26.5.1",
+    "tsdown": "^0.23.0",
     "vitest": "^4.1.11",
     "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",