@seekrit/cli 1.9.5 → 2.0.0

package/dist/index.js

@@ -5591,11 +5591,13 @@ function encodeOpensshPrivateKey(seed, pub, comment) {
 //#region ../../packages/crypto/src/token.ts
 /**
 * Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
-* principals: the token string itself carries the private key, so the server
-* never holds it. The server stores only the SHA-256 hash of the full token
-* (for authentication) and the public key (for wrapping DEK grants).
+* principals. One local bundle holds independent authentication and decryption
+* material. Only serviceTokenAuth(token) may be sent to the API; the private
+* key stays local. The server stores the auth credential hash and public key.
 *
-* Format: `skt_<token id>_<private key pkcs8, base64url>`
+* Bundle: `skt_<id>_v2.<32-byte auth secret>.<private key pkcs8, base64url>`
+* Wire:   `skt_<id>_v2.<32-byte auth secret>`
+* Legacy bundles remain readable offline but must never be transmitted.
 */
 const TOKEN_PREFIX = "skt";
 const CLI_SESSION_PREFIX = "skc";
@@ -5625,11 +5627,11 @@ async function createServiceToken() {
 	const { publicKeyJwk, privateKeyJwk } = await generateKeyPair();
 	const pkcs8 = await exportPrivateKeyPkcs8(await importPrivateKey(privateKeyJwk));
 	const tokenId = randomTokenId();
-	const token = `${tokenId}_${toBase64Url(pkcs8)}`;
+	const token = `${tokenId}_v2.${toBase64Url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)))}.${toBase64Url(pkcs8)}`;
 	return {
 		token,
 		tokenId,
-		tokenHash: await hashToken(token),
+		tokenHash: await hashToken(serviceTokenAuth(token)),
 		publicKeyJwk
 	};
 }
@@ -5642,8 +5644,8 @@ async function createHoneyToken() {
 	};
 }
 async function parseServiceToken(token) {
-	const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
-	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
+	const match = /^(skt_[0-9A-Za-z]+)_(?:v2\.[A-Za-z0-9_-]{43}\.)?([A-Za-z0-9_-]+)$/.exec(token);
+	if (!match || match[0] !== token) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
 	const [, tokenId, keyB64] = match;
 	try {
 		return {
@@ -5654,6 +5656,18 @@ async function parseServiceToken(token) {
 		throw new SeekritCryptoError("MALFORMED_TOKEN", "service token private key is corrupted");
 	}
 }
+/** Extract only the independent auth credential. Never fall back to a raw token. */
+function serviceTokenAuth(token) {
+	const match = /^(skt_[0-9A-Za-z]+_v2\.[A-Za-z0-9_-]{43})(?:\.[A-Za-z0-9_-]+)?$/.exec(token);
+	const auth = match?.[1];
+	if (!match || match[0] !== token || !auth) throw new SeekritCryptoError("MALFORMED_TOKEN", "a v2 service token is required for API access; replace legacy tokens in the dashboard");
+	return auth;
+}
+/** Preserve human/session credentials while stripping service-token private keys. */
+function apiBearerToken(token) {
+	const value = token.trim();
+	return isServiceToken(value) ? serviceTokenAuth(value) : token;
+}
 function isServiceToken(value) {
 	return value.startsWith(`${TOKEN_PREFIX}_`);
 }
@@ -5686,7 +5700,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.9.5";
+var version = "2.0.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 /**
@@ -5725,13 +5739,15 @@ var SeekritClient = class {
 			...extraHeaders
 		};
 		if (this.client) headers["x-seekrit-client"] = this.client;
-		if (this.auth.type === "bearer") headers.authorization = `Bearer ${this.auth.token}`;
+		if (this.auth.type === "bearer") headers.authorization = `Bearer ${apiBearerToken(this.auth.token)}`;
 		else if (this.auth.type === "dynamic") {
 			const token = await this.auth.getToken();
 			if (!token) throw new SeekritApiError(401, "unauthorized", "session expired");
-			headers.authorization = `Bearer ${token}`;
-		} else if (this.auth.type === "m2m") headers.authorization = `Basic ${btoa(`${this.auth.clientId}:${this.auth.clientSecret}`)}`;
-		else headers["x-seekrit-dev-user"] = this.auth.email;
+			headers.authorization = `Bearer ${apiBearerToken(token)}`;
+		} else if (this.auth.type === "m2m") {
+			if (isServiceToken(this.auth.clientId.trim()) || isServiceToken(this.auth.clientSecret.trim())) throw new Error("service tokens must use bearer authentication, not machine client credentials");
+			headers.authorization = `Basic ${btoa(`${this.auth.clientId}:${this.auth.clientSecret}`)}`;
+		} else headers["x-seekrit-dev-user"] = this.auth.email;
 		if (body !== void 0) headers["content-type"] = "application/json";
 		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
 			method,
@@ -6205,6 +6221,7 @@ var SeekritClient = class {
 	* identity are three different answers.
 	*/
 	introspectAgentTask(token) {
+		if (!token.startsWith("skd_")) throw new Error("expected a dispatched task token");
 		return this.request("POST", "/v1/tasks/introspect", { token });
 	}
 	/** End a run's authority now. Idempotent. */
@@ -9350,7 +9367,7 @@ const OFFLINE_DECRYPTOR_HTML = `<!doctype html>
 
   /** skt_<id>_<pkcs8 base64url>: a service token carries its own private key. */
   async function importToken(token) {
-    var match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(String(token).trim());
+    var match = /^(skt_[0-9A-Za-z]+)_(?:v2\\.[A-Za-z0-9_-]{43}\\.)?([A-Za-z0-9_-]+)$/.exec(String(token).trim());
     if (!match) throw new Error("not a valid seekrit service token");
     var privateKey = await crypto.subtle.importKey(
       "pkcs8",
@@ -12130,8 +12147,15 @@ async function ensureM2mAdminToken(dotenvVars = {}) {
 	if (!creds) return null;
 	const cached = readCachedM2mToken(creds.clientId);
 	if (cached) {
-		process.env.SEEKRIT_TOKEN = cached;
-		return cached;
+		let usable = false;
+		try {
+			serviceTokenAuth(cached);
+			usable = true;
+		} catch {}
+		if (usable) {
+			process.env.SEEKRIT_TOKEN = cached;
+			return cached;
+		}
 	}
 	const token = await mintAdminToken(process.env.SEEKRIT_API_URL ?? dotenvVars.SEEKRIT_API_URL ?? readGlobalConfig().apiUrl ?? "https://api.seekrit.dev", creds);
 	cacheM2mToken(creds.clientId, token);
@@ -12715,7 +12739,7 @@ function collect$5(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.12.7";
+const PROXY_VERSION = "0.13.0";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -12751,7 +12775,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.7";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.13.0";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -12909,7 +12933,7 @@ const PLUGIN_BIN = "seekrit-nomad-secrets";
 * entry in release-please-config.json), so the pin follows the crate without
 * anyone remembering to move it — the same arrangement `PROXY_VERSION` has.
 */
-const NOMAD_PLUGIN_VERSION = "0.2.5";
+const NOMAD_PLUGIN_VERSION = "0.3.0";
 /** Public artifact host. Mirrors GitHub Releases; public, no egress fees. */
 const DEFAULT_BASE_URL = "https://nomad.seekrit.dev";
 /** Where the plugin reads its node config, matching `config::DEFAULT_CONFIG_PATH`. */
@@ -12996,7 +13020,7 @@ async function fetchBytes(url) {
 * let Nomad fingerprint a half-written executable.
 */
 async function installPlugin(pluginDir, options = {}) {
-	const version = options.version ?? "0.2.5";
+	const version = options.version ?? "0.3.0";
 	const baseUrl = (options.baseUrl ?? "https://nomad.seekrit.dev").replace(/\/+$/, "");
 	const { target, exe } = detectTarget();
 	if (exe !== "") fail("Nomad secret provider plugins are not supported on Windows clients");
@@ -14701,10 +14725,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.7")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.13.0")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.7";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.13.0";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -14763,7 +14787,7 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.12.7`,
+			image: options.image ?? `seekritdev/proxy:0.13.0`,
 			publish: Boolean(options.publish)
 		}));
 	});
@@ -16622,6 +16646,11 @@ program.command("export").description("print decrypted secrets (dotenv, json, or
 registerAccessCommands(program);
 registerHoneyTokenCommands(program);
 const token = program.command("token").description("manage service tokens (CI, docker, agents)");
+token.command("auth").description("print only the v2 authentication component for a manual API request").action(() => {
+	const ctx = buildContext();
+	if (ctx.auth.type !== "bearer" || !isServiceToken(ctx.auth.token)) fail("token auth requires a v2 service token in SEEKRIT_TOKEN or your saved configuration");
+	console.log(serviceTokenAuth(ctx.auth.token));
+});
 token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
 	const ctx = buildContext();
 	const role = options.admin ? "admin" : "member";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.9.5",
+  "version": "2.0.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "homepage": "https://seekrit.dev/docs/guides/cli",
   "keywords": [
@@ -46,9 +46,9 @@
     "@types/node": "^26.6.5",
     "tsdown": "^0.23.1",
     "vitest": "^5.0.5",
+    "@seekrit/crypto": "0.0.1",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/core": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",