@seekrit/cli 1.9.3 → 1.9.5

package/README.md

@@ -30,9 +30,11 @@ seekrit login --token skt_…
 #    leaves this machine). Only needed once per account.
 seekrit keys setup
 
-# 3. Link the current directory to an org / app. Writes seekrit.json, which is
-#    safe to commit. The environment comes from the token at runtime.
-seekrit init --org acme --app storefront
+# 3. Set the current directory up. Creates an app named after the project (and a
+#    development environment) if there is none, and writes seekrit.json, which
+#    is safe to commit. With no credential at all it signs up first — add
+#    --org-name "<the real project>" --yes to do that without a prompt.
+seekrit init                               # or: seekrit init --org acme --app storefront
 
 # 4. Work with secrets. A service token names its own environment; on a user
 #    session, add --env production.
@@ -56,7 +58,7 @@ Run `seekrit <command> --help` for full flags. The
 | `login [--token \| --dev-user] [--api-url]` | Save credentials to the global config. |
 | `whoami` | Show the authenticated identity and org membership. |
 | `keys setup` | Generate your keypair and protect it with a passphrase. |
-| `init --org --app` | Link this directory to an org/app (`seekrit.json`). The environment comes from the token. |
+| `init [--org] [--app] [--env] [--from-env] [--invite]` | Set this directory up: sign up if there is no credential, create the app and a `development` environment if missing, write `seekrit.json`. |
 | `org create` / `app create` / `env create` | Create organizations, apps, and environments. |
 | `secrets list` | List secret names (never values). |
 | `secrets get <name> [--raw]` | Decrypt and print one secret value (`--raw` skips `${OTHER_SECRET}` expansion). |

package/dist/index.js

@@ -4,7 +4,7 @@ import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSyn
 import { z } from "zod";
 import { Command } from "commander";
 import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
-import { dirname, join, parse, resolve } from "node:path";
+import { basename, dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
@@ -1062,6 +1062,141 @@ function describeChange(kind, name, restoreFrom) {
 	}
 }
 //#endregion
+//#region ../../packages/core/src/connect.ts
+/** Workload authentication is separate from secret-decryption principals. */
+const workloadPublicKeySchema = z.object({
+	kty: z.literal("EC"),
+	crv: z.literal("P-256"),
+	x: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+	y: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+}).strict();
+const audienceSchema = z.string().min(1).max(256).regex(/^[^\s]+$/);
+/** HTTPS endpoint syntax. Resolved-address safety is enforced by the server runtime. */
+const connectUrlSchema = z.string().max(2048).url().refine((value) => {
+	try {
+		const u = new URL(value);
+		return u.protocol === "https:" && !u.username && !u.password && !u.hash && !u.search && !u.port && u.hostname.length <= 253 && u.hostname.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) && u.hostname.includes(".") && !/^[0-9.]+$/.test(u.hostname) && !u.hostname.endsWith(".") && !/(^|\.)(localhost|local|localdomain|internal|invalid|home|home\.arpa|onion)$/.test(u.hostname);
+	} catch {
+		return false;
+	}
+}, "use a public HTTPS hostname without credentials, query, fragment, or port");
+const federationPolicySchema = z.object({
+	issuer: connectUrlSchema,
+	jwksUri: connectUrlSchema,
+	audience: audienceSchema,
+	subject: z.string().min(1).max(512),
+	claims: z.record(z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/), z.string().min(1).max(512)).refine((claims) => Object.keys(claims).length <= 20 && Object.keys(claims).every((key) => ![
+		"iss",
+		"aud",
+		"sub",
+		"exp",
+		"iat",
+		"nbf"
+	].includes(key))).default({})
+}).strict();
+z.object({
+	name: z.string().trim().min(1).max(100),
+	environmentId: z.string().min(1).max(128),
+	publicKey: workloadPublicKeySchema.optional(),
+	federation: federationPolicySchema.optional(),
+	audiences: z.array(audienceSchema).max(20).default([]),
+	maxTtlSeconds: z.number().int().min(60).max(900).default(300)
+}).strict().refine((v) => !!v.publicKey !== !!v.federation, "choose a public key or a federation policy");
+z.object({
+	enabled: z.boolean().optional(),
+	publicKey: workloadPublicKeySchema.optional()
+}).strict().refine((v) => v.enabled !== void 0 || v.publicKey !== void 0);
+const githubPermissionsSchema = z.record(z.string().regex(/^[a-z_]{1,64}$/), z.enum(["read", "write"])).refine((p) => Object.keys(p).length > 0 && Object.keys(p).length <= 40, "specify between 1 and 40 permissions");
+const githubScopeSchema = z.object({
+	repositoryIds: z.array(z.number().int().positive().max(Number.MAX_SAFE_INTEGER)).min(1).max(100),
+	permissions: githubPermissionsSchema
+}).strict();
+/** Exact paths or explicitly allowed descendants, without URL decoding ambiguity. */
+const connectPathSchema = z.string().min(1).max(1024).refine((path) => /^\/[A-Za-z0-9_./~-]*$/.test(path) && !path.includes("//") && !path.split("/").some((part) => part === "." || part === ".."), "use an absolute API path without encoded characters or dot segments");
+const proxyRuleSchema = z.object({
+	path: connectPathSchema,
+	descendants: z.boolean().default(false),
+	methods: z.array(z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"PATCH",
+		"DELETE",
+		"HEAD"
+	])).min(1).max(6)
+}).strict();
+const staticScopeSchema = z.object({ rules: z.array(proxyRuleSchema).min(1).max(30) }).strict();
+const oauthScopeSchema = z.object({ scopes: z.array(z.string().regex(/^[\x21\x23-\x5b\x5d-\x7e]{1,200}$/)).min(1).max(50).refine((scopes) => new Set(scopes).size === scopes.length, "scopes must be unique") }).strict();
+const oauthConfigSchema = oauthScopeSchema.extend({
+	provider: z.literal("oauth"),
+	grantType: z.enum(["client_credentials", "authorization_code"]),
+	clientId: z.string().min(1).max(512),
+	tokenEndpoint: connectUrlSchema,
+	authorizationEndpoint: connectUrlSchema.optional(),
+	tokenAuthMethod: z.enum(["client_secret_basic", "client_secret_post"]).default("client_secret_basic")
+});
+const customApiConfigSchema = staticScopeSchema.extend({
+	provider: z.literal("custom_api"),
+	origin: connectUrlSchema.refine((value) => {
+		try {
+			return new URL(value).pathname === "/";
+		} catch {
+			return false;
+		}
+	}, "use an origin without a path"),
+	headerName: z.string().regex(/^[A-Za-z][A-Za-z0-9-]{0,63}$/).refine((v) => !/^(accept$|user-agent$|host|cookie|content-|proxy-|forwarded|x-forwarded-|cf-|connection|transfer-encoding|upgrade|trailer|te$)/i.test(v)),
+	headerPrefix: z.string().max(64).regex(/^[\x20-\x7e]*$/).default("Bearer ")
+});
+const connectConfigSchema = z.discriminatedUnion("provider", [
+	customApiConfigSchema,
+	oauthConfigSchema,
+	githubScopeSchema.extend({
+		provider: z.literal("github_app"),
+		appId: z.string().regex(/^[A-Za-z0-9_.-]{1,128}$/),
+		installationId: z.string().regex(/^[1-9][0-9]{0,19}$/)
+	}),
+	staticScopeSchema.extend({
+		provider: z.literal("static_key"),
+		service: z.literal("resend"),
+		rules: z.array(proxyRuleSchema.refine((rule) => rule.path === "/emails" || rule.path.startsWith("/emails/"), "the Resend connector supports only /emails and its descendants")).min(1).max(30)
+	})
+]).refine((v) => v.provider !== "oauth" || v.grantType !== "authorization_code" || !!v.authorizationEndpoint, "authorization-code connections require an authorization endpoint");
+const connectGrantPolicySchema = z.discriminatedUnion("provider", [
+	staticScopeSchema.extend({ provider: z.literal("custom_api") }),
+	oauthScopeSchema.extend({ provider: z.literal("oauth") }),
+	githubScopeSchema.extend({ provider: z.literal("github_app") }),
+	staticScopeSchema.extend({ provider: z.literal("static_key") })
+]);
+z.object({
+	name: z.string().trim().min(1).max(100),
+	config: connectConfigSchema,
+	credentialWrapped: z.string().startsWith("wd1.").max(32e3)
+}).strict();
+z.object({
+	enabled: z.boolean().optional(),
+	credentialWrapped: z.string().startsWith("wd1.").max(32e3).optional()
+}).strict().refine((v) => v.enabled !== void 0 || v.credentialWrapped !== void 0);
+z.object({
+	workloadId: z.string().min(1).max(128),
+	connectionId: z.string().min(1).max(128),
+	policy: connectGrantPolicySchema
+}).strict();
+z.object({
+	path: connectPathSchema,
+	method: z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"PATCH",
+		"DELETE",
+		"HEAD"
+	]).default("GET"),
+	query: z.record(z.string().min(1).max(100), z.string().max(2048)).default({}),
+	/** JSON only; callers cannot inject authorization or forwarding headers. */
+	body: z.string().max(65536).optional()
+}).strict().refine((v) => !["GET", "HEAD"].includes(v.method) || v.body === void 0, "GET and HEAD cannot carry a body");
+z.object({ audience: audienceSchema }).strict();
+//#endregion
 //#region ../../packages/core/src/dotenv.ts
 /**
 * `.env` parsing and serialization — the canonical definition of what a `.env`
@@ -1937,6 +2072,17 @@ function sshHostSetupInstructions(config) {
 //#endregion
 //#region ../../packages/core/src/types.ts
 const AUDIT_ACTIONS = [
+	"workload.created",
+	"workload.updated",
+	"workload.session_issued",
+	"workload.identity_issued",
+	"connect.connection_created",
+	"connect.connection_updated",
+	"connect.grant_created",
+	"connect.grant_revoked",
+	"connect.token_issued",
+	"connect.proxy_requested",
+	"connect.access_denied",
 	"org.created",
 	"org.updated",
 	"org.member_added",
@@ -5540,7 +5686,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.9.3";
+var version = "1.9.5";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 /**
@@ -5945,6 +6091,42 @@ var SeekritClient = class {
 	deleteHoneyToken(orgId, honeyTokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/honey-tokens/${honeyTokenId}`);
 	}
+	getConnect(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/connect`);
+	}
+	getConnectBrokerKey(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/connect/broker-key`);
+	}
+	createWorkload(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/connect/workloads`, input);
+	}
+	updateWorkload(orgId, id, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/connect/workloads/${encodeURIComponent(id)}`, input);
+	}
+	createConnectConnection(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/connect/connections`, input);
+	}
+	updateConnectConnection(orgId, id, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/connect/connections/${encodeURIComponent(id)}`, input);
+	}
+	createConnectGrant(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/connect/grants`, input);
+	}
+	startConnectOAuth(orgId, id) {
+		return this.request("POST", `/v1/orgs/${orgId}/connect/connections/${encodeURIComponent(id)}/oauth/start`, {});
+	}
+	finishConnectOAuth(orgId, id, state, code) {
+		return this.request("POST", `/v1/orgs/${orgId}/connect/connections/${encodeURIComponent(id)}/oauth/finish`, {
+			state,
+			code
+		});
+	}
+	disconnectConnectOAuth(orgId, id) {
+		return this.request("POST", `/v1/orgs/${orgId}/connect/connections/${encodeURIComponent(id)}/oauth/disconnect`, {});
+	}
+	revokeConnectGrant(orgId, id) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/connect/grants/${encodeURIComponent(id)}`);
+	}
 	listAgents(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/agents`);
 	}
@@ -6352,6 +6534,10 @@ async function unauthenticatedPost(baseUrl, path, body, fetchImpl, client) {
 function startCliLogin(baseUrl, input, options = {}) {
 	return unauthenticatedPost(baseUrl, "/v1/cli-login", input, options.fetch ?? ((...args) => fetch(...args)), options.client);
 }
+/** Create a workspace and a machine credential with no existing account. */
+function signup(baseUrl, input, options = {}) {
+	return unauthenticatedPost(baseUrl, "/v1/signup", input, options.fetch ?? ((...args) => fetch(...args)), options.client);
+}
 /** Ask whether a human has authorized the request yet. */
 function pollCliLogin(baseUrl, code, options = {}) {
 	const fetchImpl = options.fetch ?? ((...args) => fetch(...args));
@@ -6500,6 +6686,7 @@ function promptEnter(question) {
 		});
 	});
 }
+/** Ask a yes/no question on the terminal; anything but `y`/`yes` is no. */
 function askYesNo(question) {
 	const rl = createInterface({
 		input: process.stdin,
@@ -6650,6 +6837,23 @@ async function getPolicySigner(ctx) {
 		jwk: policySignerJwk(privateKeyJwk)
 	};
 }
+/**
+* The calling principal's public key JWK — what a freshly generated DEK is
+* wrapped to when creating an environment. Service tokens carry their private
+* key, so the public half is derived from it; users publish theirs at key
+* setup. Shared by `seekrit env create`, `seekrit init`, and the MCP server so
+* a token can create an environment everywhere, not only over MCP.
+*/
+async function principalPublicKeyJwk(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return JSON.stringify(pub);
+	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("this user has no keypair yet — run `seekrit keys setup` first");
+	return user.publicKeyJwk;
+}
 /** Recover one environment's DEK for the current principal. */
 async function getDek(ctx, orgId, envId) {
 	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
@@ -6752,7 +6956,11 @@ async function boundEnvTarget(ctx, opts) {
 	try {
 		({scope} = await ctx.client.resolve(opts.branch ? { branch: opts.branch } : {}));
 	} catch (err) {
-		fail(`specify --env — this token has no environment of its own to fall back to (${err instanceof Error ? err.message : String(err)})`);
+		if (err instanceof SeekritApiError && err.status < 500) {
+			if (opts.env) return null;
+			fail(`specify --env — this token has no environment of its own to fall back to (${err.message})`);
+		}
+		throw err;
 	}
 	const env = scope.branchOf ?? {
 		envId: scope.envId,
@@ -6779,7 +6987,10 @@ async function boundEnvTarget(ctx, opts) {
 * it this way; this is the same rule, in one place, for both.
 */
 async function resolveEnvTarget(ctx, opts) {
-	if (!opts.app && !opts.group && isTokenAuth(ctx)) return boundEnvTarget(ctx, opts);
+	if (!opts.app && !opts.group && isTokenAuth(ctx)) {
+		const bound = await boundEnvTarget(ctx, opts);
+		if (bound) return bound;
+	}
 	const org = await resolveOrg(ctx, opts.org);
 	if (!opts.env) fail("specify --env");
 	if (opts.group) {
@@ -8781,10 +8992,8 @@ function registerAppCommands(program) {
 		const { apps } = await ctx.client.listApps(orgRef.id);
 		const appRow = apps.find((a) => a.slug === options.app || a.id === options.app);
 		if (!appRow) fail(`no app "${options.app}" in ${orgRef.slug}`);
-		const { user } = await ctx.client.me();
-		if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
 		const dek = generateDek();
-		const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
+		const wrappedDek = await wrapDek(dek, await principalPublicKeyJwk(ctx));
 		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, orgRef.id, dek);
 		const created = await ctx.client.createEnv(orgRef.id, appRow.id, {
 			name: options.name,
@@ -11854,74 +12063,6 @@ function registerHoneyTokenCommands(program) {
 	});
 }
 //#endregion
-//#region src/logsink.ts
-/** Collect repeated `--header Name: value` flags into a map. */
-function collectHeader(value, acc = {}) {
-	const sep = value.indexOf(":");
-	if (sep <= 0) fail(`expected "Name: value", got "${value}"`);
-	acc[value.slice(0, sep).trim()] = value.slice(sep + 1).trim();
-	return acc;
-}
-/**
-* The org's OTLP audit-log export — near-real-time shipping of every audit row
-* to a customer SIEM. Header *values* are write-only: they are encrypted at
-* rest and never echoed back, so `show` reports only the header names.
-*/
-function registerLogSinkCommands(program) {
-	const sink = program.command("log-sink").description("stream the audit trail to your own OTLP collector (SIEM)");
-	sink.command("show", { isDefault: true }).description("show the configured log sink and its delivery health").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { sink: config } = await ctx.client.getLogSink(ref.id);
-		emit(options, { sink: config }, () => {
-			if (!config) {
-				console.error("no log sink configured — set one with `seekrit log-sink set`");
-				return;
-			}
-			printFields([
-				["endpoint", config.endpoint],
-				["enabled", config.enabled ? "yes" : "no"],
-				["headers", config.headerNames.length > 0 ? config.headerNames.join(", ") : "none"],
-				["last success", config.lastSuccessAt ?? "never"],
-				["last attempt", config.lastAttemptAt ?? "never"],
-				["last error", config.lastError ?? "none"]
-			]);
-		});
-	});
-	sink.command("set <endpoint>").description("point the audit export at an OTLP/HTTP logs endpoint").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--header <name: value>", "auth header to send (repeatable; values are write-only)", collectHeader).option("--clear-headers", "send no headers at all (drops the stored ones)").option("--disabled", "save the config but stop shipping").action(async (endpoint, options) => {
-		if (options.header && options.clearHeaders) fail("pass either --header or --clear-headers, not both");
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const headers = options.clearHeaders ? {} : options.header;
-		const { sink: config } = await ctx.client.setLogSink(ref.id, {
-			endpoint,
-			headers,
-			enabled: !options.disabled
-		});
-		console.error(`log sink → ${config.endpoint} (${config.enabled ? "enabled" : "disabled"}) — test it with \`seekrit log-sink test\``);
-	});
-	sink.command("test").description("send a probe to the configured endpoint and report the result").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const result = await ctx.client.testLogSink(ref.id);
-		emit(options, result, () => {
-			printFields([
-				["result", result.ok ? "ok" : "failed"],
-				["status", result.status],
-				["error", result.error]
-			]);
-		});
-		if (!result.ok) process.exitCode = 1;
-	});
-	sink.command("rm").alias("delete").description("stop exporting the audit trail and forget the endpoint").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		await confirmDestructive(options.yes, `Remove ${ref.slug}'s audit log export?`);
-		await ctx.client.deleteLogSink(ref.id);
-		console.error("log sink removed");
-	});
-}
-//#endregion
 //#region src/m2m.ts
 /**
 * Resolve M2M client credentials from (in order) the process environment, a
@@ -11997,6 +12138,228 @@ async function ensureM2mAdminToken(dotenvVars = {}) {
 	process.env.SEEKRIT_TOKEN = token;
 	return token;
 }
+/** Lowercase, hyphenated, at most 40 characters — what `slugSchema` accepts. */
+function slugify(name) {
+	return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/g, "") || "workspace";
+}
+/** `acme-storefront` → `Acme Storefront`: a slug-ish name as a human reads it. */
+function titleCase(name) {
+	return name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+/**
+* The project's name, from whichever manifest the directory carries — the
+* package name without its npm scope, the Python or Rust package name, the last
+* segment of a Go module path — falling back to the directory's own name. The
+* manifests are read leniently (a regex, not a parser) because a malformed one
+* should cost the default, not the command.
+*/
+function detectProjectName(dir = process.cwd()) {
+	const read = (file) => {
+		const path = join(dir, file);
+		if (!existsSync(path)) return null;
+		try {
+			return readFileSync(path, "utf8");
+		} catch {
+			return null;
+		}
+	};
+	const pkg = read("package.json");
+	if (pkg) try {
+		const name = JSON.parse(pkg).name;
+		if (typeof name === "string" && name.trim()) return name.replace(/^@[^/]+\//, "");
+	} catch {}
+	const pyName = read("pyproject.toml")?.match(/^\[project\][^[]*?^name\s*=\s*"([^"]+)"/ms)?.[1];
+	if (pyName) return pyName;
+	const cargoName = read("Cargo.toml")?.match(/^\[package\][^[]*?^name\s*=\s*"([^"]+)"/ms)?.[1];
+	if (cargoName) return cargoName;
+	const goModule = read("go.mod")?.match(/^module\s+(\S+)/m)?.[1];
+	if (goModule) return goModule.split("/").pop() ?? goModule;
+	return basename(dir);
+}
+/**
+* What `init` would sign up as, from the flags and the directory. Pure, so the
+* naming rules are testable without a terminal or an API.
+*/
+function planWorkspace(options, project) {
+	const orgName = options.orgName?.trim() || titleCase(project);
+	const orgSlug = options.org ?? slugify(options.orgName?.trim() || project);
+	if (!slugSchema.safeParse(orgSlug).success) fail(`"${orgSlug}" is not a valid org slug (lowercase letters, numbers, and hyphens) — pass --org <slug>`);
+	return {
+		orgName,
+		orgSlug
+	};
+}
+/** Sign up, save the credential, mint the admin token, and return a context. */
+async function signupAndAuthenticate(options, project) {
+	const { orgName, orgSlug } = planWorkspace(options, project);
+	const apiUrl = options.apiUrl ?? process.env.SEEKRIT_API_URL ?? readGlobalConfig().apiUrl ?? "https://api.seekrit.dev";
+	if (!Boolean(options.yes || options.orgName)) {
+		const question = `No credentials found. Create a new workspace "${orgName}" (${orgSlug}) at ${apiUrl}?`;
+		if (!process.stdin.isTTY) fail(`${question} Re-run with --yes, name it with --org-name "<the real project>", or sign in first with \`seekrit login\`.`);
+		if (!await askYesNo(question)) fail("aborted — nothing was created");
+	}
+	let result;
+	try {
+		result = await signup(apiUrl, {
+			orgName,
+			orgSlug
+		}, { client: `cli/${version}` });
+	} catch (err) {
+		if (err instanceof SeekritApiError) fail(`signup failed: ${err.message}`);
+		throw err;
+	}
+	writeGlobalConfig({
+		clientId: result.m2m.clientId,
+		clientSecret: result.m2m.clientSecret,
+		...options.apiUrl ? { apiUrl: options.apiUrl } : {}
+	});
+	console.error(`created workspace ${result.org.slug} (${result.org.name}) — machine credential saved to ~/.config/seekrit/config.json`);
+	await ensureM2mAdminToken();
+	return {
+		ctx: buildContext(),
+		orgSlug: result.org.slug
+	};
+}
+async function runInit(options) {
+	const project = detectProjectName();
+	let ctx = tryBuildContext();
+	let createdOrgSlug;
+	if (!ctx) ({ctx, orgSlug: createdOrgSlug} = await signupAndAuthenticate(options, project));
+	const orgRef = await resolveOrg(ctx, options.org ?? createdOrgSlug);
+	const appSlug = options.app ?? slugify(project);
+	const { apps } = await ctx.client.listApps(orgRef.id);
+	let app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) {
+		if (!slugSchema.safeParse(appSlug).success) fail(`"${appSlug}" is not a valid app slug — pass --app <slug>`);
+		({app} = await ctx.client.createApp(orgRef.id, {
+			name: options.app ? titleCase(options.app) : titleCase(project),
+			slug: appSlug
+		}));
+		console.error(`created app ${app.slug}`);
+	}
+	const { environments } = await ctx.client.listEnvs(orgRef.id, app.id);
+	const envSlug = options.env ?? "development";
+	let env = environments.find((e) => e.slug === envSlug || e.id === envSlug);
+	if (!env && (options.env || environments.length === 0)) {
+		if (!slugSchema.safeParse(envSlug).success) fail(`"${envSlug}" is not a valid environment slug — pass --env <slug>`);
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, await principalPublicKeyJwk(ctx));
+		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, orgRef.id, dek);
+		({environment: env} = await ctx.client.createEnv(orgRef.id, app.id, {
+			name: titleCase(envSlug),
+			slug: envSlug,
+			wrappedDek,
+			recoveryWrappedDek
+		}));
+		console.error(`created environment ${app.slug}/${env.slug} (data key generated locally)`);
+	}
+	const path = writeProjectConfig({
+		org: orgRef.slug,
+		app: app.slug
+	});
+	console.error(`linked ${orgRef.slug}/${app.slug} → ${path}`);
+	if (options.fromEnv) {
+		if (!env) fail(`--from-env needs an environment — pass --env <slug>`);
+		if (!existsSync(options.fromEnv)) fail(`no such file: ${options.fromEnv}`);
+		const entries = parseDotenv(readFileSync(options.fromEnv, "utf8"));
+		const names = Object.keys(entries);
+		if (names.length === 0) fail(`no variables found in ${options.fromEnv}`);
+		const invalid = names.filter((name) => !secretNameSchema.safeParse(name).success);
+		if (invalid.length > 0) fail(`invalid secret name(s): ${invalid.join(", ")} (must match [A-Za-z_][A-Za-z0-9_]*)`);
+		const result = await importSecrets(ctx, orgRef.id, env.id, entries);
+		if (result.queued.length > 0) console.error(`queued ${result.queued.length} change request(s) for ${app.slug}/${env.slug} — nothing is stored until a human approves them`);
+		else console.error(`imported ${names.length} secret(s) from ${options.fromEnv} into ${app.slug}/${env.slug} — delete the file now; the values live here`);
+	}
+	if (options.invite) {
+		const { invite } = await ctx.client.createInvite(orgRef.id, {
+			email: options.invite,
+			role: "admin"
+		});
+		console.error(`invited ${invite.email} as admin — they claim ${orgRef.slug} on first sign-in at the dashboard. Once they have set up keys, grant them the environment: seekrit grant --app ${app.slug} --env ${env?.slug ?? "<env>"} --user ${invite.email}`);
+	}
+	const target = env ? `${app.slug}/${env.slug}` : app.slug;
+	const envFlag = env ? ` --env ${env.slug}` : " --env <slug>";
+	console.error([
+		"",
+		`ready: ${orgRef.slug}/${target}`,
+		`  seekrit secrets set DATABASE_URL${envFlag}        # store a value (prompted, never echoed)`,
+		`  seekrit run${envFlag} -- <your command>            # inject secrets into a process`,
+		...options.invite ? [] : [`  seekrit init --invite you@example.com             # hand the workspace to a human`]
+	].join("\n"));
+}
+function registerInitCommand(program) {
+	program.command("init").description("set this directory up: sign up if needed, create the app and a development environment, write seekrit.json").option("--org <slug>", "organization slug (an existing org, or the one to create)").option("--org-name <name>", "display name for a new workspace — the real project or company (e.g. \"Acme Storefront\")").option("--app <slug>", "application slug (defaults to the project name; created if missing)").option("--env <slug>", "environment to use or create (a new app gets `development`)").option("--from-env <file>", "import a .env file into that environment").option("--invite <email>", "invite a human as admin so they can claim the workspace").option("--api-url <url>", "API base URL").option("-y, --yes", "create a workspace without asking").action(async (options) => {
+		await runInit(options);
+	});
+}
+//#endregion
+//#region src/logsink.ts
+/** Collect repeated `--header Name: value` flags into a map. */
+function collectHeader(value, acc = {}) {
+	const sep = value.indexOf(":");
+	if (sep <= 0) fail(`expected "Name: value", got "${value}"`);
+	acc[value.slice(0, sep).trim()] = value.slice(sep + 1).trim();
+	return acc;
+}
+/**
+* The org's OTLP audit-log export — near-real-time shipping of every audit row
+* to a customer SIEM. Header *values* are write-only: they are encrypted at
+* rest and never echoed back, so `show` reports only the header names.
+*/
+function registerLogSinkCommands(program) {
+	const sink = program.command("log-sink").description("stream the audit trail to your own OTLP collector (SIEM)");
+	sink.command("show", { isDefault: true }).description("show the configured log sink and its delivery health").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { sink: config } = await ctx.client.getLogSink(ref.id);
+		emit(options, { sink: config }, () => {
+			if (!config) {
+				console.error("no log sink configured — set one with `seekrit log-sink set`");
+				return;
+			}
+			printFields([
+				["endpoint", config.endpoint],
+				["enabled", config.enabled ? "yes" : "no"],
+				["headers", config.headerNames.length > 0 ? config.headerNames.join(", ") : "none"],
+				["last success", config.lastSuccessAt ?? "never"],
+				["last attempt", config.lastAttemptAt ?? "never"],
+				["last error", config.lastError ?? "none"]
+			]);
+		});
+	});
+	sink.command("set <endpoint>").description("point the audit export at an OTLP/HTTP logs endpoint").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--header <name: value>", "auth header to send (repeatable; values are write-only)", collectHeader).option("--clear-headers", "send no headers at all (drops the stored ones)").option("--disabled", "save the config but stop shipping").action(async (endpoint, options) => {
+		if (options.header && options.clearHeaders) fail("pass either --header or --clear-headers, not both");
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const headers = options.clearHeaders ? {} : options.header;
+		const { sink: config } = await ctx.client.setLogSink(ref.id, {
+			endpoint,
+			headers,
+			enabled: !options.disabled
+		});
+		console.error(`log sink → ${config.endpoint} (${config.enabled ? "enabled" : "disabled"}) — test it with \`seekrit log-sink test\``);
+	});
+	sink.command("test").description("send a probe to the configured endpoint and report the result").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const result = await ctx.client.testLogSink(ref.id);
+		emit(options, result, () => {
+			printFields([
+				["result", result.ok ? "ok" : "failed"],
+				["status", result.status],
+				["error", result.error]
+			]);
+		});
+		if (!result.ok) process.exitCode = 1;
+	});
+	sink.command("rm").alias("delete").description("stop exporting the audit trail and forget the endpoint").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove ${ref.slug}'s audit log export?`);
+		await ctx.client.deleteLogSink(ref.id);
+		console.error("log sink removed");
+	});
+}
 //#endregion
 //#region src/mongodb.ts
 /**
@@ -12352,7 +12715,7 @@ function collect$5(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.12.4";
+const PROXY_VERSION = "0.12.7";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -12388,7 +12751,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.4";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.7";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -12546,7 +12909,7 @@ const PLUGIN_BIN = "seekrit-nomad-secrets";
 * entry in release-please-config.json), so the pin follows the crate without
 * anyone remembering to move it — the same arrangement `PROXY_VERSION` has.
 */
-const NOMAD_PLUGIN_VERSION = "0.2.2";
+const NOMAD_PLUGIN_VERSION = "0.2.5";
 /** Public artifact host. Mirrors GitHub Releases; public, no egress fees. */
 const DEFAULT_BASE_URL = "https://nomad.seekrit.dev";
 /** Where the plugin reads its node config, matching `config::DEFAULT_CONFIG_PATH`. */
@@ -12633,7 +12996,7 @@ async function fetchBytes(url) {
 * let Nomad fingerprint a half-written executable.
 */
 async function installPlugin(pluginDir, options = {}) {
-	const version = options.version ?? "0.2.2";
+	const version = options.version ?? "0.2.5";
 	const baseUrl = (options.baseUrl ?? "https://nomad.seekrit.dev").replace(/\/+$/, "");
 	const { target, exe } = detectTarget();
 	if (exe !== "") fail("Nomad secret provider plugins are not supported on Windows clients");
@@ -14338,10 +14701,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.4")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.7")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.4";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.7";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -14400,7 +14763,7 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.12.4`,
+			image: options.image ?? `seekritdev/proxy:0.12.7`,
 			publish: Boolean(options.publish)
 		}));
 	});
@@ -15863,18 +16226,7 @@ program.command("keys").description("manage your encryption keys").command("setu
 	});
 	console.error("keys generated and uploaded — your passphrase never leaves this machine");
 });
-program.command("init").description("link this directory to an org/app (environment comes from the token)").requiredOption("--org <slug>", "organization slug").requiredOption("--app <slug>", "application slug").action(async (options) => {
-	const ctx = buildContext();
-	const org = await resolveOrg(ctx, options.org);
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === options.app || a.id === options.app);
-	if (!app) fail(`no app "${options.app}" in ${org.slug}`);
-	const path = writeProjectConfig({
-		org: org.slug,
-		app: app.slug
-	});
-	console.error(`linked ${org.slug}/${app.slug} → ${path} (environment is selected by the service token at runtime)`);
-});
+registerInitCommand(program);
 registerOrgCommands(program);
 registerAppCommands(program);
 registerGroupCommands(program);
@@ -16367,7 +16719,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-ZYu1Q6Ft.js");
+	const { runMcpServer } = await import("./mcp-D7rsPeBQ.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);
@@ -16382,4 +16734,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(describeError(err));
 });
 //#endregion
-export { signatureKeyRef as A, generateDek as B, createServiceToken as C, importSigningKey as D, generateSigningKeyMaterial as E, generateEncryptKeyMaterial as F, parseBranchTtl as H, kmsBlobKeyRef as I, kmsDecrypt as L, generatePostgresCredential as M, generateMysqlCredential as N, importVerifyingKey as O, generateDataKey as P, kmsEncrypt as R, version as S, parseServiceToken as T, toBase64 as V, getDek as _, kmsResolveRecipient as a, setFailThrows as b, fetchDecryptedSecrets as c, resolveApp as d, resolveAppEnv as f, resolveOrg as g, resolveGroup as h, kmsResolveKey as i, verifyMessage as j, signMessage as k, fetchDecryptedVersion as l, resolveEnvTarget as m, kmsCallerIdentity as n, syncGrantsForGroupLink as o, resolveBranch as p, kmsRecoverMaterial as r, encryptAndSetSecret as s, ensureM2mAdminToken as t, materializeEnv as u, isTokenAuth as v, isServiceToken as w, writeProjectConfig as x, tryBuildContext as y, wrapDek as z };
+export { signatureKeyRef as A, generateDek as B, version as C, importSigningKey as D, generateSigningKeyMaterial as E, generateEncryptKeyMaterial as F, parseBranchTtl as H, kmsBlobKeyRef as I, kmsDecrypt as L, generatePostgresCredential as M, generateMysqlCredential as N, importVerifyingKey as O, generateDataKey as P, kmsEncrypt as R, writeProjectConfig as S, parseServiceToken as T, toBase64 as V, getDek as _, kmsResolveRecipient as a, tryBuildContext as b, fetchDecryptedSecrets as c, resolveApp as d, resolveAppEnv as f, resolveOrg as g, resolveGroup as h, kmsResolveKey as i, verifyMessage as j, signMessage as k, fetchDecryptedVersion as l, resolveEnvTarget as m, kmsCallerIdentity as n, syncGrantsForGroupLink as o, resolveBranch as p, kmsRecoverMaterial as r, encryptAndSetSecret as s, ensureM2mAdminToken as t, materializeEnv as u, isTokenAuth as v, createServiceToken as w, setFailThrows as x, principalPublicKeyJwk as y, wrapDek as z };

package/dist/{mcp-ZYu1Q6Ft.js → mcp-D7rsPeBQ.js}

@@ -1,4 +1,4 @@
-import { A as signatureKeyRef, B as generateDek, C as createServiceToken, D as importSigningKey, E as generateSigningKeyMaterial, F as generateEncryptKeyMaterial, H as parseBranchTtl, I as kmsBlobKeyRef, L as kmsDecrypt, M as generatePostgresCredential, N as generateMysqlCredential, O as importVerifyingKey, P as generateDataKey, R as kmsEncrypt, S as version, T as parseServiceToken, V as toBase64, _ as getDek, a as kmsResolveRecipient, b as setFailThrows, c as fetchDecryptedSecrets, d as resolveApp, f as resolveAppEnv, g as resolveOrg, h as resolveGroup, i as kmsResolveKey, j as verifyMessage, k as signMessage, l as fetchDecryptedVersion, m as resolveEnvTarget, n as kmsCallerIdentity, o as syncGrantsForGroupLink, p as resolveBranch, r as kmsRecoverMaterial, s as encryptAndSetSecret, t as ensureM2mAdminToken, u as materializeEnv, v as isTokenAuth, w as isServiceToken, x as writeProjectConfig, y as tryBuildContext, z as wrapDek } from "./index.js";
+import { A as signatureKeyRef, B as generateDek, C as version, D as importSigningKey, E as generateSigningKeyMaterial, F as generateEncryptKeyMaterial, H as parseBranchTtl, I as kmsBlobKeyRef, L as kmsDecrypt, M as generatePostgresCredential, N as generateMysqlCredential, O as importVerifyingKey, P as generateDataKey, R as kmsEncrypt, S as writeProjectConfig, T as parseServiceToken, V as toBase64, _ as getDek, a as kmsResolveRecipient, b as tryBuildContext, c as fetchDecryptedSecrets, d as resolveApp, f as resolveAppEnv, g as resolveOrg, h as resolveGroup, i as kmsResolveKey, j as verifyMessage, k as signMessage, l as fetchDecryptedVersion, m as resolveEnvTarget, n as kmsCallerIdentity, o as syncGrantsForGroupLink, p as resolveBranch, r as kmsRecoverMaterial, s as encryptAndSetSecret, t as ensureM2mAdminToken, u as materializeEnv, v as isTokenAuth, w as createServiceToken, x as setFailThrows, y as principalPublicKeyJwk, z as wrapDek } from "./index.js";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -50,9 +50,18 @@ function serverInstructions() {
 		"Auth comes from SEEKRIT_TOKEN (a skt_… token), SEEKRIT_CLIENT_ID +",
 		"SEEKRIT_CLIENT_SECRET (machine credentials — an admin token is minted and",
 		"cached automatically on first use), or the config saved by `seekrit login`.",
+		"No credential at all? `npx -y @seekrit/cli init --org-name \"<the real project>\" --yes`",
+		"signs up, saves the credential, and creates an app with a development environment.",
 		"Decrypting under a user session (not a token) additionally needs",
 		"SEEKRIT_PASSPHRASE set in this server's env — there's no TTY to prompt on.",
 		"",
+		"NOT THE TOOL WHEN: the value is a throwaway for one local experiment (a shell",
+		"variable is fine — say so); the runtime already injects secrets natively and the",
+		"team uses it (offer seekrit as the source that syncs into it, not a second copy);",
+		"the policy forbids any SaaS holding even ciphertext; or what's being stored is",
+		"user data rather than configuration. An honest \"you don't need this here\" beats",
+		"an install.",
+		"",
 		"Model: org → apps/groups → environments → secrets. Call `whoami` first, then",
 		"`get_started` for the recommended end-to-end recipe. Prefer `run_command` over",
 		"`get_secret reveal:true` — it injects secrets into a subprocess so plaintext",
@@ -119,21 +128,6 @@ function getCtx() {
 function ensureDecryptable(ctx) {
 	if (!isTokenAuth(ctx) && !process.env.SEEKRIT_PASSPHRASE) throw new Error("this operation decrypts data; set SEEKRIT_PASSPHRASE in the MCP server env, or use a service token (SEEKRIT_TOKEN)");
 }
-/**
-* The calling principal's public key JWK — needed to wrap a freshly generated
-* DEK when creating an environment. Service tokens carry their private key, so
-* we derive the public half from it; users publish theirs at key setup.
-*/
-async function principalPublicKeyJwk(ctx) {
-	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
-		const { privateKey } = await parseServiceToken(ctx.auth.token);
-		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
-		return JSON.stringify(pub);
-	}
-	const { user } = await ctx.client.me();
-	if (!user.publicKeyJwk) throw new Error("this user has no keypair yet — run `seekrit keys setup` first");
-	return user.publicKeyJwk;
-}
 /** Run a child command with `env` and capture its output (values never returned). */
 function runChild(cmd, args, env, cwd) {
 	return new Promise((resolve, reject) => {

package/package.json

@@ -1,7 +1,23 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.9.3",
+  "version": "1.9.5",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
+  "homepage": "https://seekrit.dev/docs/guides/cli",
+  "keywords": [
+    "seekrit",
+    "secrets",
+    "secrets-manager",
+    "dotenv",
+    "env",
+    "credentials",
+    "api-keys",
+    "zero-knowledge",
+    "end-to-end-encryption",
+    "mcp",
+    "ai-agents",
+    "credential-broker",
+    "cli"
+  ],
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -22,14 +38,14 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.31.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "commander": "^15.0.0",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
-    "tsdown": "^0.23.0",
-    "vitest": "^5.0.3",
+    "@types/node": "^26.6.5",
+    "tsdown": "^0.23.1",
+    "vitest": "^5.0.5",
     "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
     "@seekrit/crypto": "0.0.1"