@seekrit/cli 1.7.0 → 1.7.1

package/dist/index.js

@@ -2174,7 +2174,12 @@ z.object({
 z.object({
 	groupId: z.string().min(1),
 	/** Precedence among an env's groups (higher wins). Appended if omitted. */
-	position: z.number().int().min(0).optional()
+	position: z.number().int().min(0).optional(),
+	/** Client-wrapped group DEK for each sync connection newly reading this group. */
+	syncGrants: z.array(z.object({
+		connectionId: z.string().min(1),
+		wrappedDek: z.string().min(1)
+	})).optional()
 });
 z.object({
 	name: nameSchema,
@@ -5110,7 +5115,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.7.0";
+var version = "1.7.1";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 /**
@@ -7646,6 +7651,32 @@ function registerEnvDiff(env) {
 	});
 }
 //#endregion
+//#region src/group-sync-grants.ts
+/** Wrap a newly composed group layer for connections already syncing the app env or its branches. */
+async function syncGrantsForGroupLink(ctx, orgId, envId, envSlug, groupId) {
+	const [{ groups }, { bindings }, { branches }] = await Promise.all([
+		ctx.client.listEnvGroups(orgId, envId),
+		ctx.client.listSyncBindings(orgId),
+		ctx.client.listBranches(orgId, envId)
+	]);
+	if (groups.some((group) => group.groupId === groupId)) return void 0;
+	const targets = /* @__PURE__ */ new Set([envId, ...branches.map((branch) => branch.id)]);
+	const connectionIds = new Set(bindings.filter((binding) => targets.has(binding.environmentId)).map((b) => b.connectionId));
+	if (connectionIds.size === 0) return void 0;
+	const [{ environments }, { connections }] = await Promise.all([ctx.client.listGroupEnvs(orgId, groupId), ctx.client.listSyncConnections(orgId)]);
+	const groupEnv = environments.find((entry) => entry.slug === envSlug);
+	if (!groupEnv) fail(`create a ${envSlug} environment in this group before composing it`);
+	const dek = await getDek(ctx, orgId, groupEnv.id);
+	return Promise.all([...connectionIds].map(async (connectionId) => {
+		const connection = connections.find((entry) => entry.id === connectionId);
+		if (!connection) fail("a sync connection could not be found; refresh and retry");
+		return {
+			connectionId,
+			wrappedDek: await wrapDek(dek, connection.publicKeyJwk)
+		};
+	}));
+}
+//#endregion
 //#region src/kms.ts
 /** Collect a repeatable option into a list. */
 function collect$8(value, acc = []) {
@@ -8308,9 +8339,11 @@ function registerAppCommands(program) {
 			org: options.org,
 			group: options.group
 		});
+		const syncGrants = await syncGrantsForGroupLink(ctx, target.orgId, target.envId, target.envSlug, group.id);
 		await ctx.client.linkEnvGroup(target.orgId, target.envId, {
 			groupId: group.id,
-			position: options.position === void 0 ? void 0 : Number.parseInt(options.position, 10)
+			position: options.position === void 0 ? void 0 : Number.parseInt(options.position, 10),
+			syncGrants
 		});
 		console.error(`composed ${group.slug} into ${target.appSlug}/${target.envSlug}`);
 	});
@@ -11848,7 +11881,7 @@ function collect$4(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.12.1";
+const PROXY_VERSION = "0.12.2";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -11884,7 +11917,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.1";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.2";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -12042,7 +12075,7 @@ const PLUGIN_BIN = "seekrit-nomad-secrets";
 * entry in release-please-config.json), so the pin follows the crate without
 * anyone remembering to move it — the same arrangement `PROXY_VERSION` has.
 */
-const NOMAD_PLUGIN_VERSION = "0.2.0";
+const NOMAD_PLUGIN_VERSION = "0.2.1";
 /** Public artifact host. Mirrors GitHub Releases; public, no egress fees. */
 const DEFAULT_BASE_URL = "https://nomad.seekrit.dev";
 /** Where the plugin reads its node config, matching `config::DEFAULT_CONFIG_PATH`. */
@@ -12129,7 +12162,7 @@ async function fetchBytes(url) {
 * let Nomad fingerprint a half-written executable.
 */
 async function installPlugin(pluginDir, options = {}) {
-	const version = options.version ?? "0.2.0";
+	const version = options.version ?? "0.2.1";
 	const baseUrl = (options.baseUrl ?? "https://nomad.seekrit.dev").replace(/\/+$/, "");
 	const { target, exe } = detectTarget();
 	if (exe !== "") fail("Nomad secret provider plugins are not supported on Windows clients");
@@ -13834,10 +13867,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.1")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.2")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.1";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.2";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -13896,7 +13929,7 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.12.1`,
+			image: options.image ?? `seekritdev/proxy:0.12.2`,
 			publish: Boolean(options.publish)
 		}));
 	});
@@ -15796,7 +15829,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-C2YR45UJ.js");
+	const { runMcpServer } = await import("./mcp-ZYu1Q6Ft.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);
@@ -15811,4 +15844,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(describeError(err));
 });
 //#endregion
-export { verifyMessage as A, toBase64 as B, isServiceToken as C, importVerifyingKey as D, importSigningKey as E, kmsBlobKeyRef as F, kmsDecrypt as I, kmsEncrypt as L, generateMysqlCredential as M, generateDataKey as N, signMessage as O, generateEncryptKeyMaterial as P, wrapDek as R, createServiceToken as S, generateSigningKeyMaterial as T, parseBranchTtl as V, isTokenAuth as _, kmsResolveRecipient as a, writeProjectConfig as b, fetchDecryptedVersion as c, resolveAppEnv as d, resolveBranch as f, getDek as g, resolveOrg as h, kmsResolveKey as i, generatePostgresCredential as j, signatureKeyRef as k, materializeEnv as l, resolveGroup as m, kmsCallerIdentity as n, encryptAndSetSecret as o, resolveEnvTarget as p, kmsRecoverMaterial as r, fetchDecryptedSecrets as s, ensureM2mAdminToken as t, resolveApp as u, tryBuildContext as v, parseServiceToken as w, version as x, setFailThrows as y, generateDek as z };
+export { signatureKeyRef as A, generateDek as B, createServiceToken as C, importSigningKey as D, generateSigningKeyMaterial as E, generateEncryptKeyMaterial as F, parseBranchTtl as H, kmsBlobKeyRef as I, kmsDecrypt as L, generatePostgresCredential as M, generateMysqlCredential as N, importVerifyingKey as O, generateDataKey as P, kmsEncrypt as R, version as S, parseServiceToken as T, toBase64 as V, getDek as _, kmsResolveRecipient as a, setFailThrows as b, fetchDecryptedSecrets as c, resolveApp as d, resolveAppEnv as f, resolveOrg as g, resolveGroup as h, kmsResolveKey as i, verifyMessage as j, signMessage as k, fetchDecryptedVersion as l, resolveEnvTarget as m, kmsCallerIdentity as n, syncGrantsForGroupLink as o, resolveBranch as p, kmsRecoverMaterial as r, encryptAndSetSecret as s, ensureM2mAdminToken as t, materializeEnv as u, isTokenAuth as v, isServiceToken as w, writeProjectConfig as x, tryBuildContext as y, wrapDek as z };

package/dist/{mcp-C2YR45UJ.js → mcp-ZYu1Q6Ft.js}

@@ -1,4 +1,4 @@
-import { A as verifyMessage, B as toBase64, C as isServiceToken, D as importVerifyingKey, E as importSigningKey, F as kmsBlobKeyRef, I as kmsDecrypt, L as kmsEncrypt, M as generateMysqlCredential, N as generateDataKey, O as signMessage, P as generateEncryptKeyMaterial, R as wrapDek, S as createServiceToken, T as generateSigningKeyMaterial, V as parseBranchTtl, _ as isTokenAuth, a as kmsResolveRecipient, b as writeProjectConfig, c as fetchDecryptedVersion, d as resolveAppEnv, f as resolveBranch, g as getDek, h as resolveOrg, i as kmsResolveKey, j as generatePostgresCredential, k as signatureKeyRef, l as materializeEnv, m as resolveGroup, n as kmsCallerIdentity, o as encryptAndSetSecret, p as resolveEnvTarget, r as kmsRecoverMaterial, s as fetchDecryptedSecrets, t as ensureM2mAdminToken, u as resolveApp, v as tryBuildContext, w as parseServiceToken, x as version, y as setFailThrows, z as generateDek } from "./index.js";
+import { A as signatureKeyRef, B as generateDek, C as createServiceToken, D as importSigningKey, E as generateSigningKeyMaterial, F as generateEncryptKeyMaterial, H as parseBranchTtl, I as kmsBlobKeyRef, L as kmsDecrypt, M as generatePostgresCredential, N as generateMysqlCredential, O as importVerifyingKey, P as generateDataKey, R as kmsEncrypt, S as version, T as parseServiceToken, V as toBase64, _ as getDek, a as kmsResolveRecipient, b as setFailThrows, c as fetchDecryptedSecrets, d as resolveApp, f as resolveAppEnv, g as resolveOrg, h as resolveGroup, i as kmsResolveKey, j as verifyMessage, k as signMessage, l as fetchDecryptedVersion, m as resolveEnvTarget, n as kmsCallerIdentity, o as syncGrantsForGroupLink, p as resolveBranch, r as kmsRecoverMaterial, s as encryptAndSetSecret, t as ensureM2mAdminToken, u as materializeEnv, v as isTokenAuth, w as isServiceToken, x as writeProjectConfig, y as tryBuildContext, z as wrapDek } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -621,9 +621,11 @@ async function runMcpServer(options = {}) {
 			org,
 			group
 		});
+		const syncGrants = await syncGrantsForGroupLink(ctx, target.orgId, target.envId, target.envSlug, g.id);
 		return (await ctx.client.linkEnvGroup(target.orgId, target.envId, {
 			groupId: g.id,
-			position
+			position,
+			syncGrants
 		})).group;
 	});
 	tool("uncompose_group", "Remove a composed group from an application environment.", { idempotent: true }, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -24,12 +24,12 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "commander": "^15.0.0",
-    "zod": "^4.6.2"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.1",
     "tsdown": "^0.23.0",
-    "vitest": "^4.1.11",
+    "vitest": "^5.0.1",
     "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
     "@seekrit/crypto": "0.0.1"