@seekrit/cli 2.0.0 → 2.1.0

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { spawn, spawnSync } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
@@ -7,9 +6,10 @@ import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
 import { basename, dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { connect } from "node:net";
 import { fileURLToPath } from "node:url";
+import { spawn, spawnSync } from "node:child_process";
 import { request } from "node:http";
 /** Default lifetime of a published bundle (7 days), in seconds. */
 const POLICY_DEFAULT_TTL_SECONDS = 604800;
@@ -5700,7 +5700,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "2.0.0";
+var version = "2.1.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 /**
@@ -15102,6 +15102,303 @@ function registerRotationCommands(program) {
 	});
 }
 //#endregion
+//#region src/run-command.ts
+/** Keep signal handlers installed from provisioning through asynchronous cleanup. */
+async function runCommand(cmd, args, prepare, cleanup) {
+	let child;
+	let forwarded;
+	let result = { code: 1 };
+	const stragglers = /* @__PURE__ */ new Set();
+	const collect = () => {
+		if (process.platform === "win32" || !child?.pid) return;
+		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
+	};
+	const forward = (signal) => {
+		forwarded ??= signal;
+		if (!child || child.exitCode !== null || child.signalCode !== null) return;
+		collect();
+		child.kill(signal);
+		for (const pid of stragglers) try {
+			process.kill(pid, signal);
+		} catch {}
+	};
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	for (const signal of signals) process.on(signal, forward);
+	try {
+		const env = await prepare(() => forwarded !== void 0);
+		if (!forwarded) {
+			const running = spawn(cmd, args, {
+				stdio: "inherit",
+				env
+			});
+			child = running;
+			result = await new Promise((resolve, reject) => {
+				running.once("exit", (code, signal) => resolve({
+					code: code ?? 1,
+					signal: signal ?? void 0
+				}));
+				running.once("error", (err) => reject(/* @__PURE__ */ new Error(`failed to start ${cmd}: ${err.message}`)));
+			});
+		}
+	} finally {
+		try {
+			if (forwarded) {
+				collect();
+				await reapStragglers(stragglers, forwarded);
+			}
+		} finally {
+			try {
+				if (!await cleanup() && result.code === 0) result.code = 1;
+			} finally {
+				for (const signal of signals) process.off(signal, forward);
+			}
+		}
+	}
+	if (!child && forwarded) result.signal = forwarded;
+	return result;
+}
+/**
+* Every live process `seekrit run` is responsible for tearing down, from a
+* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
+* own process group — every other member of that group.
+*
+* Two mechanisms, because each covers the other's blind spot:
+*
+* - The parent-chain walk reaches a process that left our group via
+*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
+*   can touch. But it loses anything whose chain up to `root` has already
+*   broken — teardown kills the middle layers first, and an orphan reparents to
+*   init, out of reach of any walk down from `root`.
+* - Group membership survives exactly that: a pgid outlives the parent that
+*   passed it down. But it misses the ones that left the group.
+*
+* The group half applies only when our pid *is* our pgid, which is the shell-job
+* case: the shell put this command in a new group, so every other member of it
+* descends from us. Nested inside a shell script or a CI runner we are not the
+* leader and the group holds processes we did not start, so there we use the
+* walk alone.
+*
+* Zombies are skipped: they are already dead and waiting to be reaped, so
+* counting them would stall teardown for the full grace period and then report
+* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
+* back to signalling the immediate child.
+*/
+function teardownTargets(root) {
+	const ps = spawnSync("ps", [
+		"-A",
+		"-o",
+		"pid=,ppid=,pgid=,stat="
+	], { encoding: "utf8" });
+	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
+	const childrenOf = /* @__PURE__ */ new Map();
+	const groupOf = /* @__PURE__ */ new Map();
+	const isId = (value) => value !== void 0 && Number.isInteger(value);
+	for (const line of ps.stdout.split("\n")) {
+		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
+		const [id, parent, group] = [
+			pid,
+			ppid,
+			pgid
+		].map(Number);
+		if (!isId(id) || !isId(parent) || !isId(group)) continue;
+		if (stat?.startsWith("Z")) continue;
+		const siblings = childrenOf.get(parent);
+		if (siblings) siblings.push(id);
+		else childrenOf.set(parent, [id]);
+		groupOf.set(id, group);
+	}
+	const found = /* @__PURE__ */ new Set();
+	const queue = [root];
+	const seen = new Set(queue);
+	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
+		if (seen.has(kid)) continue;
+		seen.add(kid);
+		found.add(kid);
+		queue.push(kid);
+	}
+	if (groupOf.get(process.pid) === process.pid) {
+		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
+	}
+	found.delete(process.pid);
+	found.delete(root);
+	return [...found];
+}
+/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** How long a straggler gets to finish shutting down before SIGKILL. */
+const STRAGGLER_GRACE_MS = 2e3;
+/**
+* Once the command has exited, make sure nothing it started outlives us.
+*
+* Anything still alive here has ignored the signal we forwarded *and* lost the
+* parent that launched it, and we are the last process that knows its pid:
+* the tty won't hang it up (it is no longer in the foreground group, and the
+* shell has moved on), so it survives until the machine reboots. That is how
+* `tsx` and the server under it stacked up for days.
+*
+* So escalate rather than trust. SIGTERM first — it costs no extra time and is
+* a rung the SIGINT-only handlers common in dev servers don't catch — then
+* SIGKILL whatever is left after the grace period. Nothing is killed unless it
+* was asked to stop first and declined, and this runs only when we forwarded a
+* termination signal: a command that exits on its own having deliberately left a
+* daemon behind keeps working.
+*/
+async function reapStragglers(pids, signal) {
+	let live = [...pids].filter(isAlive);
+	if (live.length === 0) return;
+	for (const pid of live) try {
+		process.kill(pid, "SIGTERM");
+	} catch {}
+	const deadline = Date.now() + STRAGGLER_GRACE_MS;
+	while (live.length > 0 && Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, 50));
+		live = live.filter(isAlive);
+	}
+	if (live.length === 0) return;
+	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
+	for (const pid of live) try {
+		process.kill(pid, "SIGKILL");
+	} catch {}
+}
+//#endregion
+//#region src/run-leases.ts
+/** Validate all flags before contacting the API or creating any database roles. */
+function parseRunLeaseOptions(bindings = [], ttl) {
+	if (!bindings.length) {
+		if (ttl !== void 0) throw new Error("--lease-ttl requires --lease VAR=target");
+		return;
+	}
+	const names = /* @__PURE__ */ new Set();
+	const parsed = bindings.map((binding) => {
+		const eq = binding.indexOf("=");
+		const variable = binding.slice(0, eq);
+		const target = binding.slice(eq + 1).trim();
+		if (eq < 1 || !secretNameSchema.safeParse(variable).success || !target) throw new Error("--lease requires VAR=target (for example DATABASE_URL=production)");
+		const key = process.platform === "win32" ? variable.toUpperCase() : variable;
+		if (names.has(key)) throw new Error(`duplicate --lease variable ${variable}`);
+		names.add(key);
+		return {
+			variable,
+			target
+		};
+	});
+	const match = /^(\d+)\s*([smhd]?)$/.exec((ttl ?? "30m").trim());
+	const ttlSeconds = match ? Number(match[1]) * ({
+		"": 1,
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[match[2] ?? ""] ?? 1) : NaN;
+	if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 60 || ttlSeconds > 604800) throw new Error("--lease-ttl must be between 1m and 7d (for example 30m)");
+	return {
+		bindings: parsed,
+		ttlSeconds
+	};
+}
+async function prepareRunLeases(options, orgSlug, envFiles = [".env"]) {
+	const dotenvVars = {};
+	overlayEnvFiles(dotenvVars, {}, envFiles);
+	const ctx = tryBuildContext(dotenvVars);
+	if (!ctx) throw new Error("--lease requires authentication; run `seekrit login`");
+	const client = new SeekritClient({
+		baseUrl: ctx.apiUrl,
+		auth: ctx.auth,
+		fetch: (input, init) => fetch(input, {
+			...init,
+			signal: AbortSignal.timeout(15e3)
+		})
+	});
+	return new RunLeases(client, (await resolveOrg({
+		...ctx,
+		client
+	}, orgSlug)).id, options);
+}
+/** Own every successfully minted lease, including partial setup failures. */
+var RunLeases = class {
+	client;
+	orgId;
+	options;
+	active = [];
+	constructor(client, orgId, options) {
+		this.client = client;
+		this.orgId = orgId;
+		this.options = options;
+	}
+	async mint(interrupted) {
+		const values = Object.create(null);
+		if (interrupted()) return values;
+		const { targets } = await this.client.listLeaseTargets(this.orgId);
+		const selected = this.options.bindings.map((binding) => {
+			const matches = targets.filter((t) => t.id === binding.target || t.name === binding.target);
+			const target = matches[0];
+			if (matches.length !== 1 || !target) throw new Error(`--lease target "${binding.target}" is missing or ambiguous; use its ID`);
+			if (target.provider !== "postgres") throw new Error(`--lease target "${target.name}" must be Postgres`);
+			return {
+				binding,
+				target
+			};
+		});
+		for (const { binding, target } of selected) {
+			if (interrupted()) break;
+			const username = `tmp_${randomBytes(12).toString("hex")}`;
+			const { password, verifier } = await generatePostgresCredential();
+			if (interrupted()) break;
+			let minted;
+			try {
+				minted = await this.client.mintLease(this.orgId, {
+					provider: "postgres",
+					targetId: target.id,
+					roleName: username,
+					verifier,
+					ttlSeconds: this.options.ttlSeconds
+				});
+			} catch {
+				throw new Error(`could not create temporary user ${username} on target ${target.name}; command not started. If provisioning completed, broker expiry will attempt cleanup after ${this.options.ttlSeconds}s; check the lease ledger`);
+			}
+			const { lease, connection } = minted;
+			this.active.push({
+				id: lease.id,
+				username,
+				expiresAt: connection.expiresAt
+			});
+			console.error(`seekrit: created temporary user ${username} on ${target.name} · lease ${lease.id} · expires ${connection.expiresAt}`);
+			const url = new URL("postgresql://localhost");
+			url.hostname = connection.host.includes(":") && !connection.host.startsWith("[") ? `[${connection.host}]` : connection.host;
+			url.port = String(connection.port);
+			url.username = connection.username;
+			url.password = password;
+			url.pathname = `/${encodeURIComponent(connection.database)}`;
+			values[binding.variable] = url.href;
+			console.error(`seekrit: injected ${binding.variable}`);
+		}
+		return values;
+	}
+	async revoke() {
+		let ok = true;
+		for (const lease of this.active.splice(0).reverse()) try {
+			await this.client.revokeLease(this.orgId, lease.id);
+			console.error(`seekrit: revoked temporary user ${lease.username} · lease ${lease.id}`);
+		} catch {
+			ok = false;
+			console.error(`seekrit: FAILED to revoke temporary user ${lease.username} · lease ${lease.id}. Run seekrit pg revoke ${lease.id} --org ${this.orgId}; broker expiry will retry at/after ${lease.expiresAt}`);
+		}
+		return ok;
+	}
+};
+//#endregion
 //#region src/ssh.ts
 /**
 * `seekrit ssh` — temporary SSH access via short-lived certificates (Vault-style
@@ -16468,167 +16765,37 @@ async function materializeForRun(options) {
 		};
 	}
 }
-/**
-* Every live process `seekrit run` is responsible for tearing down, from a
-* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
-* own process group — every other member of that group.
-*
-* Two mechanisms, because each covers the other's blind spot:
-*
-* - The parent-chain walk reaches a process that left our group via
-*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
-*   can touch. But it loses anything whose chain up to `root` has already
-*   broken — teardown kills the middle layers first, and an orphan reparents to
-*   init, out of reach of any walk down from `root`.
-* - Group membership survives exactly that: a pgid outlives the parent that
-*   passed it down. But it misses the ones that left the group.
-*
-* The group half applies only when our pid *is* our pgid, which is the shell-job
-* case: the shell put this command in a new group, so every other member of it
-* descends from us. Nested inside a shell script or a CI runner we are not the
-* leader and the group holds processes we did not start, so there we use the
-* walk alone.
-*
-* Zombies are skipped: they are already dead and waiting to be reaped, so
-* counting them would stall teardown for the full grace period and then report
-* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
-* back to signalling the immediate child.
-*/
-function teardownTargets(root) {
-	const ps = spawnSync("ps", [
-		"-A",
-		"-o",
-		"pid=,ppid=,pgid=,stat="
-	], { encoding: "utf8" });
-	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
-	const childrenOf = /* @__PURE__ */ new Map();
-	const groupOf = /* @__PURE__ */ new Map();
-	const isId = (value) => value !== void 0 && Number.isInteger(value);
-	for (const line of ps.stdout.split("\n")) {
-		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
-		const [id, parent, group] = [
-			pid,
-			ppid,
-			pgid
-		].map(Number);
-		if (!isId(id) || !isId(parent) || !isId(group)) continue;
-		if (stat?.startsWith("Z")) continue;
-		const siblings = childrenOf.get(parent);
-		if (siblings) siblings.push(id);
-		else childrenOf.set(parent, [id]);
-		groupOf.set(id, group);
-	}
-	const found = /* @__PURE__ */ new Set();
-	const queue = [root];
-	const seen = new Set(queue);
-	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
-		if (seen.has(kid)) continue;
-		seen.add(kid);
-		found.add(kid);
-		queue.push(kid);
-	}
-	if (groupOf.get(process.pid) === process.pid) {
-		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
-	}
-	found.delete(process.pid);
-	found.delete(root);
-	return [...found];
-}
-/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
-function isAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** How long a straggler gets to finish shutting down before SIGKILL. */
-const STRAGGLER_GRACE_MS = 2e3;
-/**
-* Once the command has exited, make sure nothing it started outlives us.
-*
-* Anything still alive here has ignored the signal we forwarded *and* lost the
-* parent that launched it, and we are the last process that knows its pid:
-* the tty won't hang it up (it is no longer in the foreground group, and the
-* shell has moved on), so it survives until the machine reboots. That is how
-* `tsx` and the server under it stacked up for days.
-*
-* So escalate rather than trust. SIGTERM first — it costs no extra time and is
-* a rung the SIGINT-only handlers common in dev servers don't catch — then
-* SIGKILL whatever is left after the grace period. Nothing is killed unless it
-* was asked to stop first and declined, and this runs only when we forwarded a
-* termination signal: a command that exits on its own having deliberately left a
-* daemon behind keeps working.
-*/
-async function reapStragglers(pids, signal) {
-	let live = [...pids].filter(isAlive);
-	if (live.length === 0) return;
-	for (const pid of live) try {
-		process.kill(pid, "SIGTERM");
-	} catch {}
-	const deadline = Date.now() + STRAGGLER_GRACE_MS;
-	while (live.length > 0 && Date.now() < deadline) {
-		await new Promise((resolve) => setTimeout(resolve, 50));
-		live = live.filter(isAlive);
-	}
-	if (live.length === 0) return;
-	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
-	for (const pid of live) try {
-		process.kill(pid, "SIGKILL");
-	} catch {}
-}
-program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--lease <VAR=target>", "inject a temporary Postgres connection URL (repeatable)", collectList).option("--lease-ttl <duration>", "maximum lease lifetime, 1m–7d (default: 30m)").option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
+	const leaseOptions = parseRunLeaseOptions(options.lease, options.leaseTtl);
 	const { values, provenance, interpolated, unresolvedRefs } = await materializeForRun(options);
-	if (options.explain) {
-		for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
-		printExplain(provenance, {
-			interpolated,
-			unresolved: unresolvedRefs
-		});
-	}
-	const posix = process.platform !== "win32";
-	const child = spawn(cmd, args, {
-		stdio: "inherit",
-		env: {
+	const leases = leaseOptions ? await prepareRunLeases(leaseOptions, options.org, options.envFile) : void 0;
+	const result = await runCommand(cmd, args, async (interrupted) => {
+		const leased = await leases?.mint(interrupted) ?? {};
+		if (options.explain) {
+			for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
+			for (const binding of leaseOptions?.bindings ?? []) provenance[binding.variable] = `lease:${binding.target}`;
+			printExplain(provenance, {
+				interpolated,
+				unresolved: unresolvedRefs
+			});
+		}
+		const env = {
 			...values,
 			...process.env
+		};
+		if (process.platform === "win32") {
+			const leasedNames = new Set(Object.keys(leased).map((name) => name.toUpperCase()));
+			for (const name of Object.keys(env)) if (leasedNames.has(name.toUpperCase())) delete env[name];
 		}
-	});
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	const stragglers = /* @__PURE__ */ new Set();
-	let forwarded;
-	const collect = () => {
-		if (!posix || !child.pid) return;
-		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
-	};
-	const forward = (signal) => {
-		if (child.exitCode !== null || child.signalCode !== null) return;
-		forwarded ??= signal;
-		collect();
-		child.kill(signal);
-		for (const pid of stragglers) try {
-			process.kill(pid, signal);
-		} catch {}
-	};
-	for (const signal of signals) process.on(signal, forward);
-	child.on("exit", async (code, signal) => {
-		if (forwarded) {
-			collect();
-			await reapStragglers(stragglers, forwarded);
-		}
-		for (const s of signals) process.off(s, forward);
-		if (signal) process.kill(process.pid, signal);
-		else process.exit(code ?? 1);
-	});
-	child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
+		return {
+			...env,
+			...leased
+		};
+	}, () => leases?.revoke() ?? Promise.resolve(true));
+	if (result.signal) process.kill(process.pid, result.signal);
+	else process.exit(result.code);
 });
 program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
 	if (![
@@ -16748,7 +16915,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-D7rsPeBQ.js");
+	const { runMcpServer } = await import("./mcp-DZoBFmDF.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "homepage": "https://seekrit.dev/docs/guides/cli",
   "keywords": [
@@ -46,9 +46,9 @@
     "@types/node": "^26.6.5",
     "tsdown": "^0.23.1",
     "vitest": "^5.0.5",
-    "@seekrit/crypto": "0.0.1",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/core": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",

package/dist/{mcp-D7rsPeBQ.js → mcp-DZoBFmDF.js}

@@ -1,6 +1,6 @@
 import { A as signatureKeyRef, B as generateDek, C as version, D as importSigningKey, E as generateSigningKeyMaterial, F as generateEncryptKeyMaterial, H as parseBranchTtl, I as kmsBlobKeyRef, L as kmsDecrypt, M as generatePostgresCredential, N as generateMysqlCredential, O as importVerifyingKey, P as generateDataKey, R as kmsEncrypt, S as writeProjectConfig, T as parseServiceToken, V as toBase64, _ as getDek, a as kmsResolveRecipient, b as tryBuildContext, c as fetchDecryptedSecrets, d as resolveApp, f as resolveAppEnv, g as resolveOrg, h as resolveGroup, i as kmsResolveKey, j as verifyMessage, k as signMessage, l as fetchDecryptedVersion, m as resolveEnvTarget, n as kmsCallerIdentity, o as syncGrantsForGroupLink, p as resolveBranch, r as kmsRecoverMaterial, s as encryptAndSetSecret, t as ensureM2mAdminToken, u as materializeEnv, v as isTokenAuth, w as createServiceToken, x as setFailThrows, y as principalPublicKeyJwk, z as wrapDek } from "./index.js";
-import { spawn } from "node:child_process";
 import { z } from "zod";
+import { spawn } from "node:child_process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 //#region src/mcp.ts