@seekrit/cli 1.7.1 → 1.9.0

package/dist/index.js

@@ -2560,7 +2560,9 @@ const SYNC_PROVIDER_KINDS = [
 	"gcp-secret-manager",
 	"langgraph-platform",
 	"azure-key-vault",
-	"huggingface-spaces"
+	"huggingface-spaces",
+	"openai-vault",
+	"claude-managed-agents"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -2964,6 +2966,25 @@ const azureKeyVaultConnectionConfigSchema = z.object({
 * would invite pointing a connection at a host that silently swallows secrets.
 */
 const huggingfaceSpacesConnectionConfigSchema = z.object({ provider: z.literal("huggingface-spaces") });
+/** The wrapped credential is an OpenAI project API key with vault read/write access. */
+const openaiVaultConnectionConfigSchema = z.object({ provider: z.literal("openai-vault") });
+/**
+* Claude Managed Agents account scope — empty, for Hugging Face's reason.
+*
+* An Anthropic API key belongs to exactly one **workspace**, and vaults are
+* workspace-scoped: the key can reach every vault in its workspace and none
+* outside it. A vault ID is globally unique. So the key plus the destination is
+* the whole address, and the API's `anthropic-workspace-id` header — which
+* exists for credentials that span several workspaces — has nothing to select.
+*
+* There is no `baseUrl`, and adding one would not be enough. Bedrock, Vertex
+* AI, and Foundry do not offer Managed Agents at all. Claude Platform on AWS
+* does, at `aws-external-anthropic.{region}.api.aws` — but it authenticates
+* with SigV4 over an IAM credential, not an API key, so it is a different
+* credential shape and a different connector (one that would reuse
+* `lib/leases/aws-sigv4.ts`), not a different host for this one.
+*/
+const claudeManagedAgentsConnectionConfigSchema = z.object({ provider: z.literal("claude-managed-agents") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -2983,7 +3004,9 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	gcpSecretManagerConnectionConfigSchema,
 	langgraphPlatformConnectionConfigSchema,
 	azureKeyVaultConnectionConfigSchema,
-	huggingfaceSpacesConnectionConfigSchema
+	huggingfaceSpacesConnectionConfigSchema,
+	openaiVaultConnectionConfigSchema,
+	claudeManagedAgentsConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -3808,6 +3831,91 @@ const huggingfaceSpacesDestinationSchema = z.object({
 	/** Space ID as `owner/name`, e.g. `acme/support-demo`. */
 	repoId: huggingfaceRepoIdSchema
 });
+/** One existing OpenAI vault; every credential in this binding gets the same host boundary. */
+const openaiVaultDestinationSchema = z.object({
+	provider: z.literal("openai-vault"),
+	vaultId: z.string().trim().regex(/^vault_[A-Za-z0-9_-]+$/, "must be an OpenAI vault ID"),
+	allowedHosts: z.array(z.string().trim().toLowerCase().max(253).regex(/^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/, "must be an exact hostname without scheme, port, path, or wildcard")).min(1).max(100).refine((hosts) => new Set(hosts).size === hosts.length, "hostnames must be unique")
+});
+/**
+* A vault ID as the Claude Console and API show it: `vlt_` and an opaque
+* alphanumeric tail. Held to that shape because the habitual slip — pasting the
+* vault's display name — is a 404 from inside an alarm, which says nothing
+* about which half of the address was wrong.
+*/
+const claudeVaultIdSchema = z.string().trim().regex(/^vlt_[A-Za-z0-9]{1,128}$/, "must be a vault ID, e.g. vlt_01ABC… — not its display name");
+/** Ceiling on per-name host rules; a vault itself holds at most 20 credentials. */
+const CLAUDE_VAULT_MAX_HOST_RULES = 100;
+/** A hostname of two or more labels whose last label starts with a letter. */
+const CLAUDE_VAULT_HOSTNAME = /^(?:\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const CLAUDE_VAULT_IPV4 = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+/**
+* One host a secret's value may be substituted on, in the three forms the vault
+* API takes: a bare hostname (`api.openai.com`), a `*.`-prefixed wildcard
+* (`*.stripe.com`), or an IPv4 address.
+*
+* The API refuses URLs, ports, paths, and IPv6, so those are refused here too —
+* pasting `https://api.openai.com/v1` is the slip this exists for. Note the
+* wildcard's documented reach: `*.stripe.com` matches every subdomain of
+* `stripe.com` **but not `stripe.com` itself**, so a service reached at its apex
+* needs both entries. A bare TLD wildcard (`*.com`) is refused by shape.
+*/
+const claudeVaultHostSchema = z.string().trim().toLowerCase().max(253).refine((host) => CLAUDE_VAULT_HOSTNAME.test(host) || CLAUDE_VAULT_IPV4.test(host), "must be a bare hostname (api.example.com), a *.example.com wildcard, or an IPv4 address — not a URL");
+/**
+* Where one secret's value may be substituted: a list of hosts, or the literal
+* `"unrestricted"`, which lets it reach any host the agent's *environment*
+* permits. The literal is spelled out rather than implied by an empty list, so
+* the widest setting is never something a binding arrives at by omission.
+*/
+const claudeVaultHostRuleSchema = z.union([z.literal("unrestricted"), z.array(claudeVaultHostSchema).min(1).max(16)]);
+/**
+* Which parts of an outbound request a secret's placeholder is swapped in. The
+* API's own default when the field is omitted is both; seekrit's is `header`,
+* the narrower one — request bodies are often assembled from content the agent
+* is working with, and most services read an API key from a header. It is also
+* what the Claude Console creates by default, so the two agree.
+*/
+const CLAUDE_VAULT_INJECTION_LOCATIONS = [
+	"header",
+	"body",
+	"both"
+];
+/**
+* One **Claude Managed Agents vault**, whose `environment_variable` credentials
+* a binding owns.
+*
+* Like `openai-vault`, a destination where the workload never holds the
+* plaintext either: an agent's sandbox sees an opaque placeholder in the
+* variable, and Anthropic's egress proxy swaps the real value in only on a
+* request to a host the credential names. So every name needs somewhere it is
+* allowed to go, and that is most of this shape:
+*
+*  - `allowedHostsByName` — per destination name, after `nameTransform`. The
+*    right tool: a Stripe key belongs on `api.stripe.com` and nowhere else.
+*  - `allowedHosts` — for every name without its own rule.
+*
+* At least one must be given. A pushed name covered by neither **fails** rather
+* than going out `unrestricted` — the default-deny stance `apps/proxy` takes, so
+* a secret added to the environment later cannot silently widen where values
+* flow. Both levels apply beside the agent environment's own network policy,
+* which must also let the host through; this shape cannot see that policy.
+*/
+const claudeManagedAgentsDestinationSchema = z.object({
+	provider: z.literal("claude-managed-agents"),
+	/** The vault's ID, e.g. `vlt_01ABC…`. */
+	vaultId: claudeVaultIdSchema,
+	/** Hosts for every name without its own entry in `allowedHostsByName`. */
+	allowedHosts: claudeVaultHostRuleSchema.optional(),
+	/** Destination name → the hosts that one value may be substituted on. */
+	allowedHostsByName: z.record(secretNameSchema, claudeVaultHostRuleSchema).optional(),
+	injectionLocation: z.enum(CLAUDE_VAULT_INJECTION_LOCATIONS).default("header")
+}).refine((d) => d.allowedHosts !== void 0 || Object.keys(d.allowedHostsByName ?? {}).length > 0, {
+	message: "name the hosts each secret may be used on — allowedHosts for all of them, allowedHostsByName per name, or \"unrestricted\"",
+	path: ["allowedHosts"]
+}).refine((d) => Object.keys(d.allowedHostsByName ?? {}).length <= CLAUDE_VAULT_MAX_HOST_RULES, {
+	message: `at most ${CLAUDE_VAULT_MAX_HOST_RULES} per-name host rules`,
+	path: ["allowedHostsByName"]
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -3827,7 +3935,9 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	gcpSecretManagerDestinationSchema,
 	langgraphPlatformDestinationSchema,
 	azureKeyVaultDestinationSchema,
-	huggingfaceSpacesDestinationSchema
+	huggingfaceSpacesDestinationSchema,
+	openaiVaultDestinationSchema,
+	claudeManagedAgentsDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -5115,7 +5225,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.7.1";
+var version = "1.9.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 /**
@@ -7679,7 +7789,7 @@ async function syncGrantsForGroupLink(ctx, orgId, envId, envSlug, groupId) {
 //#endregion
 //#region src/kms.ts
 /** Collect a repeatable option into a list. */
-function collect$8(value, acc = []) {
+function collect$9(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -7747,7 +7857,7 @@ async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
 }
 function registerKmsCommands(program) {
 	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$8, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$8, []).action(async (options) => {
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$9, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$9, []).action(async (options) => {
 		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
 		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
@@ -7969,7 +8079,7 @@ function registerKmsCommands(program) {
 //#endregion
 //#region src/recovery.ts
 /** Collect a repeatable option into a list. */
-function collect$7(value, acc = []) {
+function collect$8(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -8066,7 +8176,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$7, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$8, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -8084,7 +8194,7 @@ function registerRecoveryCommands(program) {
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$7, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$8, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -9227,7 +9337,7 @@ function formatSecrets(values, format) {
 * `buildContext()` in any of them silently breaks the promise the feature makes.
 */
 /** Collect a repeatable option into a list. */
-function collect$6(value, acc = []) {
+function collect$7(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -9504,7 +9614,7 @@ function registerArchiveCommands(program) {
 		} catch {}
 		fail("none of the recovery shares in this archive unwrap with that key");
 	});
-	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$6).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$7).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
 		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
 		if (![
 			"dotenv",
@@ -11551,7 +11661,7 @@ function parseTtlSeconds$4(input) {
 	}[m[2] || "s"] ?? 1);
 }
 /** Collect a repeatable option into an array. */
-function collect$5(value, previous) {
+function collect$6(value, previous) {
 	return [...previous, value];
 }
 /** Parse `readWrite@app` → { role, db } for a custom target. */
@@ -11576,7 +11686,7 @@ function resolveAdminUri(uri) {
 function registerMongoCommands(program) {
 	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
 	const target = mongo.command("target").description("manage MongoDB targets");
-	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$5, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$6, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const adminUri = resolveAdminUri(options.uri);
@@ -11738,7 +11848,7 @@ function generateUserName$1(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$4, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$4, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$5, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$5, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -11841,7 +11951,7 @@ function registerMysqlCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$4(value, acc) {
+function collect$5(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -12293,12 +12403,12 @@ function requirePluginDir(explicit) {
 	if (found) return found;
 	fail("could not find the Nomad plugin directory — pass --plugin-dir <path> matching your agent's client.common_plugin_dir");
 }
-function collect$3(value, previous = []) {
+function collect$4(value, previous = []) {
 	return [...previous, value];
 }
 function registerNomadCommands(program) {
 	const nomad = program.command("nomad").description("wire seekrit into Nomad as a secret provider (`seekrit nomad --help`)");
-	nomad.command("init").description("print the agent stanza, plugin config, and job snippet for this client").option("--plugin-dir <path>", "the agent's client.common_plugin_dir").option("--profile <name>", "profile name jobs will reference in `path`", "default").option("--token-file <path>", "where the profile's service token lives").option("--namespace <ns>", "restrict the profile to a Nomad namespace (repeatable)", collect$3).option("--job <id>", "restrict the profile to a Nomad job id (repeatable)", collect$3).option("--config <path>", "plugin config path", DEFAULT_CONFIG_PATH).option("--write", "write the plugin config file instead of printing it").option("--json", "machine-readable output").action((options) => {
+	nomad.command("init").description("print the agent stanza, plugin config, and job snippet for this client").option("--plugin-dir <path>", "the agent's client.common_plugin_dir").option("--profile <name>", "profile name jobs will reference in `path`", "default").option("--token-file <path>", "where the profile's service token lives").option("--namespace <ns>", "restrict the profile to a Nomad namespace (repeatable)", collect$4).option("--job <id>", "restrict the profile to a Nomad job id (repeatable)", collect$4).option("--config <path>", "plugin config path", DEFAULT_CONFIG_PATH).option("--write", "write the plugin config file instead of printing it").option("--json", "machine-readable output").action((options) => {
 		const pluginDir = options.pluginDir ? resolve(options.pluginDir) : detectPluginDir() ?? PLUGIN_DIR_CANDIDATES[0];
 		const profile = options.profile ?? "default";
 		const tokenFile = options.tokenFile ?? `/etc/seekrit/tokens/${profile}`;
@@ -13417,7 +13527,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -13533,7 +13643,7 @@ function registerPgCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$2(value, acc) {
+function collect$3(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -13968,7 +14078,7 @@ function generateUserName(prefix = "tmp") {
 function registerRedisCommands(program) {
 	const redis = program.command("redis").description("temporary Redis credentials (short-lived, zero-knowledge)");
 	const target = redis.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Redis server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-cache").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "redis host").option("--port <port>", "redis port", "6379").option("--db <index>", "logical database index (the /<n> in the URL)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin redis:// (or rediss://) connection string (or set SEEKRIT_REDIS_ADMIN_URL); wrapped locally").option("--create-statement <cmd>", "custom SETUSER template (repeatable)", collect$1, []).option("--revoke-statement <cmd>", "custom DELUSER template (repeatable)", collect$1, []).action(async (options) => {
+	target.command("add").description("register a Redis server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-cache").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "redis host").option("--port <port>", "redis port", "6379").option("--db <index>", "logical database index (the /<n> in the URL)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin redis:// (or rediss://) connection string (or set SEEKRIT_REDIS_ADMIN_URL); wrapped locally").option("--create-statement <cmd>", "custom SETUSER template (repeatable)", collect$2, []).option("--revoke-statement <cmd>", "custom DELUSER template (repeatable)", collect$2, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -14071,7 +14181,7 @@ function registerRedisCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$1(value, acc) {
+function collect$2(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -14270,7 +14380,7 @@ function parseTtlSeconds(input) {
 function registerSshCommands(program) {
 	const ssh = program.command("ssh").description("temporary SSH access (short-lived certificates, zero-knowledge)");
 	const target = ssh.command("target").description("manage SSH CA targets");
-	target.command("add").description("create an SSH certificate authority to issue certs from").requiredOption("--name <name>", "display name, e.g. prod-fleet").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--host <host>", "default host the printed ssh command connects to").option("--user <login>", "default login user (a cert principal)").option("--principal <name>", "allow-list a principal certs may request (repeatable)", collect, []).option("--extension <name>", "cert extension to grant, e.g. permit-pty (repeatable)", collect, []).option("--max-ttl <duration>", "clamp requested cert lifetime, e.g. 8h").action(async (options) => {
+	target.command("add").description("create an SSH certificate authority to issue certs from").requiredOption("--name <name>", "display name, e.g. prod-fleet").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--host <host>", "default host the printed ssh command connects to").option("--user <login>", "default login user (a cert principal)").option("--principal <name>", "allow-list a principal certs may request (repeatable)", collect$1, []).option("--extension <name>", "cert extension to grant, e.g. permit-pty (repeatable)", collect$1, []).option("--max-ttl <duration>", "clamp requested cert lifetime, e.g. 8h").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const ca = await generateSshCaKeyPair(`seekrit-ca:${options.name}`);
@@ -14326,7 +14436,7 @@ function registerSshCommands(program) {
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	ssh.command("lease <target>").description("mint a short-lived SSH certificate; prints a ready-to-run ssh command").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--principal <name>", "login user to request (repeatable; default from target)", collect, []).option("--ttl <duration>", "certificate lifetime, e.g. 30m, 1h, 8h", "1h").option("--out <dir>", "directory to write the key + cert (default: a temp dir)").option("--json", "print key/cert paths and the certificate as JSON").action(async (targetRef, options) => {
+	ssh.command("lease <target>").description("mint a short-lived SSH certificate; prints a ready-to-run ssh command").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--principal <name>", "login user to request (repeatable; default from target)", collect$1, []).option("--ttl <duration>", "certificate lifetime, e.g. 30m, 1h, 8h", "1h").option("--out <dir>", "directory to write the key + cert (default: a temp dir)").option("--json", "print key/cert paths and the certificate as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -14382,7 +14492,7 @@ function registerSshCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect(value, acc) {
+function collect$1(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -14392,6 +14502,36 @@ function collect(value, acc) {
 function list(raw, fallback) {
 	return (raw ?? fallback).split(",").map((item) => item.trim()).filter(Boolean);
 }
+/** Accumulate a repeatable flag, in the order given. */
+function collect(value, acc = []) {
+	return [...acc, value];
+}
+/**
+* One host rule as typed on the command line: a comma-separated host list, or
+* the literal `unrestricted`. The schema does the real validation; this only
+* turns the spelling into the shape it checks.
+*/
+function hostRule(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.toLowerCase() === "unrestricted") return "unrestricted";
+	return list(trimmed, "");
+}
+/**
+* `--allowed-hosts-for NAME=host,host`, repeated — one per destination name.
+* A name given twice is refused rather than merged or last-wins, since either
+* reading would silently widen or narrow what the other occurrence said.
+*/
+function hostRulesByName(entries) {
+	const rules = {};
+	for (const entry of entries ?? []) {
+		const eq = entry.indexOf("=");
+		const name = eq > 0 ? entry.slice(0, eq).trim() : "";
+		if (!name || eq === entry.length - 1) fail(`--allowed-hosts-for takes NAME=host[,host…] (or NAME=unrestricted), not "${entry}"`);
+		if (Object.hasOwn(rules, name)) fail(`--allowed-hosts-for names ${name} twice`);
+		rules[name] = hostRule(entry.slice(eq + 1));
+	}
+	return rules;
+}
 /** Reject list members outside a known set, naming both the strays and the choices. */
 function assertMembers(values, allowed, flag) {
 	const unknown = values.filter((v) => !allowed.includes(v));
@@ -14555,6 +14695,8 @@ function credentialNoun(provider) {
 	if (provider === "langgraph-platform") return "LangSmith API key";
 	if (provider === "azure-key-vault") return "client secret";
 	if (provider === "huggingface-spaces") return "user access token";
+	if (provider === "openai-vault") return "OpenAI project API key";
+	if (provider === "claude-managed-agents") return "Anthropic API key";
 	return "API token";
 }
 /**
@@ -14644,9 +14786,14 @@ function buildConfig(provider, options) {
 			};
 		}
 		case "huggingface-spaces": return { provider: "huggingface-spaces" };
+		case "openai-vault": return { provider: "openai-vault" };
+		case "claude-managed-agents": return { provider: "claude-managed-agents" };
 	}
 }
-/** Where inside the platform a binding writes. */
+/**
+* Where inside the platform a binding writes. Exported for its tests: the
+* flags are the one part of a binding the API cannot see as typed.
+*/
 function buildDestination(provider, options) {
 	switch (provider) {
 		case "vercel": {
@@ -14861,6 +15008,30 @@ function buildDestination(provider, options) {
 			provider: "huggingface-spaces",
 			repoId: assertHuggingfaceSpace(options.hfSpace)
 		};
+		case "openai-vault":
+			if (!options.openaiVault) fail("--openai-vault is required for openai-vault (vault_… ID)");
+			if (!options.openaiHosts) fail("--openai-hosts is required for openai-vault");
+			return {
+				provider: "openai-vault",
+				vaultId: options.openaiVault.trim(),
+				allowedHosts: list(options.openaiHosts, "")
+			};
+		case "claude-managed-agents": {
+			if (!options.vault) fail("--vault is required for claude-managed-agents — the vault ID, e.g. vlt_01ABC…");
+			const byName = hostRulesByName(options.allowedHostsFor);
+			const parsed = claudeManagedAgentsDestinationSchema.safeParse({
+				provider: "claude-managed-agents",
+				vaultId: options.vault,
+				...options.allowedHosts !== void 0 ? { allowedHosts: hostRule(options.allowedHosts) } : {},
+				...Object.keys(byName).length > 0 ? { allowedHostsByName: byName } : {},
+				injectionLocation: assertMember(options.injectionLocation, CLAUDE_VAULT_INJECTION_LOCATIONS, "--injection-location", "header")
+			});
+			if (!parsed.success) {
+				const issue = parsed.error.issues[0];
+				fail(`claude-managed-agents: ${issue?.path.length ? `${issue.path.join(".")}: ` : ""}${issue?.message ?? "invalid destination"} — pass --allowed-hosts <host,…> for every name, and/or --allowed-hosts-for NAME=<host,…> per name`);
+			}
+			return parsed.data;
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -14884,6 +15055,12 @@ function describeDestination(destination) {
 		case "langgraph-platform": return `deployment ${destination.deploymentId}`;
 		case "azure-key-vault": return `${destination.vault}${destination.prefix ? ` (${destination.prefix}*)` : ""}`;
 		case "huggingface-spaces": return `space ${destination.repoId}`;
+		case "openai-vault": return `${destination.vaultId} (${destination.allowedHosts.join(", ")})`;
+		case "claude-managed-agents": {
+			const rules = Object.keys(destination.allowedHostsByName ?? {}).length;
+			const hosts = destination.allowedHosts === void 0 ? "no default hosts" : destination.allowedHosts === "unrestricted" ? "unrestricted by default" : destination.allowedHosts.join(", ");
+			return `vault ${destination.vaultId} (${hosts}${rules ? ` · ${rules} per-name` : ""} · ${destination.injectionLocation})`;
+		}
 		case "github-actions": switch (destination.kind) {
 			case "repo": return `${destination.owner}/${destination.repo}`;
 			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
@@ -14899,7 +15076,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager, azure-key-vault: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version").option("--vault <name>", "azure-key-vault: vault name, e.g. acme-prod").option("--hf-space <owner/name>", "huggingface-spaces: Space ID, e.g. acme/support-demo (its owner and name, not a URL)").option("--name-mode <mode>", `azure-key-vault: ${AZURE_KEY_VAULT_NAME_MODES.join(" | ")} — Key Vault stores no underscores, so DATABASE_URL becomes DATABASE-URL unless you reject instead`);
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager, azure-key-vault: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version").option("--vault <name>", "azure-key-vault: vault name, e.g. acme-prod · claude-managed-agents: vault ID (vlt_…)").option("--allowed-hosts <list>", "claude-managed-agents: hosts every secret may be used on, comma-separated (api.example.com, *.example.com, an IPv4) — or `unrestricted`").option("--allowed-hosts-for <NAME=hosts>", "claude-managed-agents: hosts for one secret, overriding --allowed-hosts (repeatable)", collect).option("--injection-location <where>", `claude-managed-agents: ${CLAUDE_VAULT_INJECTION_LOCATIONS.join(" | ")} — which parts of a request the value is substituted into (default header)`).option("--openai-vault <id>", "openai-vault: existing OpenAI Vault ID (vault_…)").option("--openai-hosts <hosts>", "openai-vault: comma-separated exact HTTPS hostnames").option("--hf-space <owner/name>", "huggingface-spaces: Space ID, e.g. acme/support-demo (its owner and name, not a URL)").option("--name-mode <mode>", `azure-key-vault: ${AZURE_KEY_VAULT_NAME_MODES.join(" | ")} — Key Vault stores no underscores, so DATABASE_URL becomes DATABASE-URL unless you reject instead`);
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.7.1",
+  "version": "1.9.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {