@seekrit/cli 2.0.0 → 2.2.0

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { spawn, spawnSync } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
@@ -7,9 +6,10 @@ import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
 import { basename, dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { connect } from "node:net";
 import { fileURLToPath } from "node:url";
+import { spawn, spawnSync } from "node:child_process";
 import { request } from "node:http";
 /** Default lifetime of a published bundle (7 days), in seconds. */
 const POLICY_DEFAULT_TTL_SECONDS = 604800;
@@ -2086,6 +2086,8 @@ const AUDIT_ACTIONS = [
 	"org.created",
 	"org.updated",
 	"org.member_added",
+	"org.member_role_changed",
+	"app.access_granted",
 	"org.member_removed",
 	"org.member_invited",
 	"org.invite_revoked",
@@ -2308,7 +2310,7 @@ const nameSchema = z.string().trim().min(1).max(128);
 const emailSchema = z.string().trim().toLowerCase().pipe(z.email().max(320));
 /** Env-var style secret name: FOO, DATABASE_URL, apiKey2 … */
 const secretNameSchema = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
-z.enum([
+const orgRoleSchema = z.enum([
 	"owner",
 	"admin",
 	"member"
@@ -2347,7 +2349,20 @@ z.object({
 	name: nameSchema,
 	slug: slugSchema
 });
+/** Compose a group into an application environment (matched by env slug). */
+const appAccessKeySchema = z.object({
+	environmentId: z.string().min(1),
+	userId: z.string().min(1),
+	wrappedDek: z.string().min(1).max(8192)
+});
+const appAccessGrantsSchema = z.array(appAccessKeySchema).max(5e3).optional();
+z.object({
+	userId: z.string().min(1),
+	grants: z.array(appAccessKeySchema).max(5e3)
+});
+z.object({ role: orgRoleSchema });
 z.object({
+	appAccessGrants: appAccessGrantsSchema,
 	groupId: z.string().min(1),
 	/** Precedence among an env's groups (higher wins). Appended if omitted. */
 	position: z.number().int().min(0).optional(),
@@ -2358,6 +2373,11 @@ z.object({
 	})).optional()
 });
 z.object({
+	/** Wrap the new DEK to all persistent app recipients. */
+	userGrants: z.array(z.object({
+		userId: z.string().min(1),
+		wrappedDek: z.string().min(1).max(8192)
+	})).max(5e3).optional(),
 	name: nameSchema,
 	slug: slugSchema,
 	/** Environment DEK wrapped to the creator's public key — created client-side. */
@@ -2419,7 +2439,23 @@ z.object({
 	/** The same DEK wrapped to each of the parent's existing grant-holders. */
 	grants: z.array(grantEnvironmentKeySchema).max(500).default([])
 });
+/**
+* Token creation is client-driven so the server never sees the token secret:
+* the client generates the keypair + token string and submits only the hash
+* and public key.
+*/
+const environmentGrantBatchSchema = z.array(z.object({
+	environmentId: z.string().min(1),
+	wrappedDek: z.string().min(1).max(8192)
+})).max(5e3);
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	grants: environmentGrantBatchSchema
+});
 z.object({
+	/** Commit the token and all default resolve keys together, when supplied. */
+	initialGrants: environmentGrantBatchSchema.optional(),
 	name: nameSchema,
 	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
 	/** SHA-256 hash (base64url) of the full token string. */
@@ -5700,7 +5736,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "2.0.0";
+var version = "2.2.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 /**
@@ -5837,6 +5873,56 @@ var SeekritClient = class {
 	listMembers(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/members`);
 	}
+	updateMemberRole(orgId, userId, role) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/members/${userId}`, { role });
+	}
+	getAppAccess(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/access`);
+	}
+	provisionAppAccess(orgId, appId, userId, grants) {
+		return this.request("POST", `/v1/orgs/${orgId}/apps/${appId}/access`, {
+			userId,
+			grants
+		});
+	}
+	accessRecipients(orgId, target) {
+		const path = "appId" in target ? `apps/${target.appId}` : `groups/${target.groupId}`;
+		return this.request("GET", `/v1/orgs/${orgId}/${path}/access-recipients`);
+	}
+	/** The caller owns the new DEK; only public keys and wrapped blobs cross the API. */
+	async wrapNewEnvironmentAccess(orgId, target, dek) {
+		const { recipients } = await this.accessRecipients(orgId, target);
+		return Promise.all(recipients.map(async (r) => {
+			if (!r.publicKeyJwk) throw new Error(`${r.email} must finish key setup before creating this environment`);
+			return {
+				userId: r.userId,
+				wrappedDek: await wrapDek(dek, r.publicKeyJwk)
+			};
+		}));
+	}
+	async wrapGroupAppAccess(orgId, envId, groupId, getDek) {
+		const { environment } = await this.getEnv(orgId, envId);
+		if (!environment.applicationId) throw new Error("only app environments can compose groups");
+		const { recipients } = await this.accessRecipients(orgId, { appId: environment.applicationId });
+		if (!recipients.length) return [];
+		const { environments } = await this.listGroupEnvs(orgId, groupId);
+		const result = [];
+		for (const env of environments) {
+			const { grants } = await this.listEnvKeys(orgId, env.id);
+			const missing = recipients.filter((r) => !grants.some((g) => g.principalType === "user" && g.principalId === r.userId));
+			if (!missing.length) continue;
+			const dek = await getDek(env.id);
+			for (const recipient of missing) {
+				if (!recipient.publicKeyJwk) throw new Error(`${recipient.email} must finish key setup first`);
+				result.push({
+					environmentId: env.id,
+					userId: recipient.userId,
+					wrappedDek: await wrapDek(dek, recipient.publicKeyJwk)
+				});
+			}
+		}
+		return result;
+	}
 	/**
 	* The org-wide "require a second factor for all members" policy. `configured`
 	* is false when the identity provider isn't wired up (local dev), in which
@@ -6021,6 +6107,46 @@ var SeekritClient = class {
 		return this.request("POST", `/v1/orgs/${orgId}/change-requests/${id}/withdraw`);
 	}
 	/** The calling principal's wrapped DEK for this environment. */
+	getEnvironmentKeyScope(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key-scope`);
+	}
+	async prepareComposedKeyGrants(orgId, envId, principal, getDek) {
+		const scope = await this.getEnvironmentKeyScope(orgId, envId);
+		const grants = [];
+		for (const layer of scope.environments) {
+			if (scope.grants.some((g) => g.environmentId === layer.environmentId && g.principalType === principal.principalType && g.principalId === principal.principalId)) continue;
+			try {
+				const dek = await getDek(layer.environmentId);
+				grants.push({
+					environmentId: layer.environmentId,
+					wrappedDek: await wrapDek(dek, principal.publicKeyJwk)
+				});
+			} catch (error) {
+				if (error instanceof Error && error.message === "unlock cancelled") throw error;
+				throw new Error(`Could not prepare access to ${layer.label}: ${error instanceof Error ? error.message : "key unavailable"}. No keys were granted.`);
+			}
+		}
+		return grants;
+	}
+	grantComposedKeys(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/keys/composed`, input);
+	}
+	/** Sharing an application environment includes the exact layers resolve reads. */
+	async grantEnvironmentAccess(orgId, envId, principal, getDek) {
+		const { environment } = await this.getEnv(orgId, envId);
+		if (environment.applicationId) {
+			const grants = await this.prepareComposedKeyGrants(orgId, envId, principal, getDek);
+			await this.grantComposedKeys(orgId, envId, {
+				principalType: principal.principalType,
+				principalId: principal.principalId,
+				grants
+			});
+		} else await this.grantEnvKey(orgId, envId, {
+			principalType: principal.principalType,
+			principalId: principal.principalId,
+			wrappedDek: await wrapDek(await getDek(envId), principal.publicKeyJwk)
+		});
+	}
 	getMyEnvKey(orgId, envId) {
 		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
 	}
@@ -7154,12 +7280,11 @@ function registerAccessCommands(program) {
 		const ctx = buildContext();
 		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
 		const principal = await resolvePrincipal(ctx, orgId, options);
-		const dek = await getDek(ctx, orgId, envId);
-		await ctx.client.grantEnvKey(orgId, envId, {
+		await ctx.client.grantEnvironmentAccess(orgId, envId, {
 			principalType: principal.type,
 			principalId: principal.id,
-			wrappedDek: await wrapDek(dek, principal.publicKeyJwk)
-		});
+			publicKeyJwk: principal.publicKeyJwk
+		}, (id) => getDek(ctx, orgId, id));
 		console.error(`granted ${label} access to ${principal.id}`);
 	});
 	withEnvTarget(grant.command("list").alias("ls").description("list who holds a key for an environment").option("--json", "print the raw API response")).action(async (options) => {
@@ -9013,6 +9138,7 @@ function registerAppCommands(program) {
 		const wrappedDek = await wrapDek(dek, await principalPublicKeyJwk(ctx));
 		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, orgRef.id, dek);
 		const created = await ctx.client.createEnv(orgRef.id, appRow.id, {
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(orgRef.id, { appId: appRow.id }, dek),
 			name: options.name,
 			slug: options.slug,
 			wrappedDek,
@@ -9038,6 +9164,7 @@ function registerAppCommands(program) {
 		});
 		const syncGrants = await syncGrantsForGroupLink(ctx, target.orgId, target.envId, target.envSlug, group.id);
 		await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+			appAccessGrants: await ctx.client.wrapGroupAppAccess(target.orgId, target.envId, group.id, (id) => getDek(ctx, target.orgId, id)),
 			groupId: group.id,
 			position: options.position === void 0 ? void 0 : Number.parseInt(options.position, 10),
 			syncGrants
@@ -11807,6 +11934,7 @@ function registerGroupCommands(program) {
 		const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
 		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, groupRef.orgId, dek);
 		const created = await ctx.client.createGroupEnv(groupRef.orgId, groupRef.id, {
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(groupRef.orgId, { groupId: groupRef.id }, dek),
 			name: options.name,
 			slug: options.slug,
 			wrappedDek,
@@ -12270,6 +12398,7 @@ async function runInit(options) {
 		const wrappedDek = await wrapDek(dek, await principalPublicKeyJwk(ctx));
 		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, orgRef.id, dek);
 		({environment: env} = await ctx.client.createEnv(orgRef.id, app.id, {
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(orgRef.id, { appId: app.id }, dek),
 			name: titleCase(envSlug),
 			slug: envSlug,
 			wrappedDek,
@@ -15102,6 +15231,303 @@ function registerRotationCommands(program) {
 	});
 }
 //#endregion
+//#region src/run-command.ts
+/** Keep signal handlers installed from provisioning through asynchronous cleanup. */
+async function runCommand(cmd, args, prepare, cleanup) {
+	let child;
+	let forwarded;
+	let result = { code: 1 };
+	const stragglers = /* @__PURE__ */ new Set();
+	const collect = () => {
+		if (process.platform === "win32" || !child?.pid) return;
+		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
+	};
+	const forward = (signal) => {
+		forwarded ??= signal;
+		if (!child || child.exitCode !== null || child.signalCode !== null) return;
+		collect();
+		child.kill(signal);
+		for (const pid of stragglers) try {
+			process.kill(pid, signal);
+		} catch {}
+	};
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	for (const signal of signals) process.on(signal, forward);
+	try {
+		const env = await prepare(() => forwarded !== void 0);
+		if (!forwarded) {
+			const running = spawn(cmd, args, {
+				stdio: "inherit",
+				env
+			});
+			child = running;
+			result = await new Promise((resolve, reject) => {
+				running.once("exit", (code, signal) => resolve({
+					code: code ?? 1,
+					signal: signal ?? void 0
+				}));
+				running.once("error", (err) => reject(/* @__PURE__ */ new Error(`failed to start ${cmd}: ${err.message}`)));
+			});
+		}
+	} finally {
+		try {
+			if (forwarded) {
+				collect();
+				await reapStragglers(stragglers, forwarded);
+			}
+		} finally {
+			try {
+				if (!await cleanup() && result.code === 0) result.code = 1;
+			} finally {
+				for (const signal of signals) process.off(signal, forward);
+			}
+		}
+	}
+	if (!child && forwarded) result.signal = forwarded;
+	return result;
+}
+/**
+* Every live process `seekrit run` is responsible for tearing down, from a
+* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
+* own process group — every other member of that group.
+*
+* Two mechanisms, because each covers the other's blind spot:
+*
+* - The parent-chain walk reaches a process that left our group via
+*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
+*   can touch. But it loses anything whose chain up to `root` has already
+*   broken — teardown kills the middle layers first, and an orphan reparents to
+*   init, out of reach of any walk down from `root`.
+* - Group membership survives exactly that: a pgid outlives the parent that
+*   passed it down. But it misses the ones that left the group.
+*
+* The group half applies only when our pid *is* our pgid, which is the shell-job
+* case: the shell put this command in a new group, so every other member of it
+* descends from us. Nested inside a shell script or a CI runner we are not the
+* leader and the group holds processes we did not start, so there we use the
+* walk alone.
+*
+* Zombies are skipped: they are already dead and waiting to be reaped, so
+* counting them would stall teardown for the full grace period and then report
+* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
+* back to signalling the immediate child.
+*/
+function teardownTargets(root) {
+	const ps = spawnSync("ps", [
+		"-A",
+		"-o",
+		"pid=,ppid=,pgid=,stat="
+	], { encoding: "utf8" });
+	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
+	const childrenOf = /* @__PURE__ */ new Map();
+	const groupOf = /* @__PURE__ */ new Map();
+	const isId = (value) => value !== void 0 && Number.isInteger(value);
+	for (const line of ps.stdout.split("\n")) {
+		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
+		const [id, parent, group] = [
+			pid,
+			ppid,
+			pgid
+		].map(Number);
+		if (!isId(id) || !isId(parent) || !isId(group)) continue;
+		if (stat?.startsWith("Z")) continue;
+		const siblings = childrenOf.get(parent);
+		if (siblings) siblings.push(id);
+		else childrenOf.set(parent, [id]);
+		groupOf.set(id, group);
+	}
+	const found = /* @__PURE__ */ new Set();
+	const queue = [root];
+	const seen = new Set(queue);
+	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
+		if (seen.has(kid)) continue;
+		seen.add(kid);
+		found.add(kid);
+		queue.push(kid);
+	}
+	if (groupOf.get(process.pid) === process.pid) {
+		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
+	}
+	found.delete(process.pid);
+	found.delete(root);
+	return [...found];
+}
+/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** How long a straggler gets to finish shutting down before SIGKILL. */
+const STRAGGLER_GRACE_MS = 2e3;
+/**
+* Once the command has exited, make sure nothing it started outlives us.
+*
+* Anything still alive here has ignored the signal we forwarded *and* lost the
+* parent that launched it, and we are the last process that knows its pid:
+* the tty won't hang it up (it is no longer in the foreground group, and the
+* shell has moved on), so it survives until the machine reboots. That is how
+* `tsx` and the server under it stacked up for days.
+*
+* So escalate rather than trust. SIGTERM first — it costs no extra time and is
+* a rung the SIGINT-only handlers common in dev servers don't catch — then
+* SIGKILL whatever is left after the grace period. Nothing is killed unless it
+* was asked to stop first and declined, and this runs only when we forwarded a
+* termination signal: a command that exits on its own having deliberately left a
+* daemon behind keeps working.
+*/
+async function reapStragglers(pids, signal) {
+	let live = [...pids].filter(isAlive);
+	if (live.length === 0) return;
+	for (const pid of live) try {
+		process.kill(pid, "SIGTERM");
+	} catch {}
+	const deadline = Date.now() + STRAGGLER_GRACE_MS;
+	while (live.length > 0 && Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, 50));
+		live = live.filter(isAlive);
+	}
+	if (live.length === 0) return;
+	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
+	for (const pid of live) try {
+		process.kill(pid, "SIGKILL");
+	} catch {}
+}
+//#endregion
+//#region src/run-leases.ts
+/** Validate all flags before contacting the API or creating any database roles. */
+function parseRunLeaseOptions(bindings = [], ttl) {
+	if (!bindings.length) {
+		if (ttl !== void 0) throw new Error("--lease-ttl requires --lease VAR=target");
+		return;
+	}
+	const names = /* @__PURE__ */ new Set();
+	const parsed = bindings.map((binding) => {
+		const eq = binding.indexOf("=");
+		const variable = binding.slice(0, eq);
+		const target = binding.slice(eq + 1).trim();
+		if (eq < 1 || !secretNameSchema.safeParse(variable).success || !target) throw new Error("--lease requires VAR=target (for example DATABASE_URL=production)");
+		const key = process.platform === "win32" ? variable.toUpperCase() : variable;
+		if (names.has(key)) throw new Error(`duplicate --lease variable ${variable}`);
+		names.add(key);
+		return {
+			variable,
+			target
+		};
+	});
+	const match = /^(\d+)\s*([smhd]?)$/.exec((ttl ?? "30m").trim());
+	const ttlSeconds = match ? Number(match[1]) * ({
+		"": 1,
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[match[2] ?? ""] ?? 1) : NaN;
+	if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 60 || ttlSeconds > 604800) throw new Error("--lease-ttl must be between 1m and 7d (for example 30m)");
+	return {
+		bindings: parsed,
+		ttlSeconds
+	};
+}
+async function prepareRunLeases(options, orgSlug, envFiles = [".env"]) {
+	const dotenvVars = {};
+	overlayEnvFiles(dotenvVars, {}, envFiles);
+	const ctx = tryBuildContext(dotenvVars);
+	if (!ctx) throw new Error("--lease requires authentication; run `seekrit login`");
+	const client = new SeekritClient({
+		baseUrl: ctx.apiUrl,
+		auth: ctx.auth,
+		fetch: (input, init) => fetch(input, {
+			...init,
+			signal: AbortSignal.timeout(15e3)
+		})
+	});
+	return new RunLeases(client, (await resolveOrg({
+		...ctx,
+		client
+	}, orgSlug)).id, options);
+}
+/** Own every successfully minted lease, including partial setup failures. */
+var RunLeases = class {
+	client;
+	orgId;
+	options;
+	active = [];
+	constructor(client, orgId, options) {
+		this.client = client;
+		this.orgId = orgId;
+		this.options = options;
+	}
+	async mint(interrupted) {
+		const values = Object.create(null);
+		if (interrupted()) return values;
+		const { targets } = await this.client.listLeaseTargets(this.orgId);
+		const selected = this.options.bindings.map((binding) => {
+			const matches = targets.filter((t) => t.id === binding.target || t.name === binding.target);
+			const target = matches[0];
+			if (matches.length !== 1 || !target) throw new Error(`--lease target "${binding.target}" is missing or ambiguous; use its ID`);
+			if (target.provider !== "postgres") throw new Error(`--lease target "${target.name}" must be Postgres`);
+			return {
+				binding,
+				target
+			};
+		});
+		for (const { binding, target } of selected) {
+			if (interrupted()) break;
+			const username = `tmp_${randomBytes(12).toString("hex")}`;
+			const { password, verifier } = await generatePostgresCredential();
+			if (interrupted()) break;
+			let minted;
+			try {
+				minted = await this.client.mintLease(this.orgId, {
+					provider: "postgres",
+					targetId: target.id,
+					roleName: username,
+					verifier,
+					ttlSeconds: this.options.ttlSeconds
+				});
+			} catch {
+				throw new Error(`could not create temporary user ${username} on target ${target.name}; command not started. If provisioning completed, broker expiry will attempt cleanup after ${this.options.ttlSeconds}s; check the lease ledger`);
+			}
+			const { lease, connection } = minted;
+			this.active.push({
+				id: lease.id,
+				username,
+				expiresAt: connection.expiresAt
+			});
+			console.error(`seekrit: created temporary user ${username} on ${target.name} · lease ${lease.id} · expires ${connection.expiresAt}`);
+			const url = new URL("postgresql://localhost");
+			url.hostname = connection.host.includes(":") && !connection.host.startsWith("[") ? `[${connection.host}]` : connection.host;
+			url.port = String(connection.port);
+			url.username = connection.username;
+			url.password = password;
+			url.pathname = `/${encodeURIComponent(connection.database)}`;
+			values[binding.variable] = url.href;
+			console.error(`seekrit: injected ${binding.variable}`);
+		}
+		return values;
+	}
+	async revoke() {
+		let ok = true;
+		for (const lease of this.active.splice(0).reverse()) try {
+			await this.client.revokeLease(this.orgId, lease.id);
+			console.error(`seekrit: revoked temporary user ${lease.username} · lease ${lease.id}`);
+		} catch {
+			ok = false;
+			console.error(`seekrit: FAILED to revoke temporary user ${lease.username} · lease ${lease.id}. Run seekrit pg revoke ${lease.id} --org ${this.orgId}; broker expiry will retry at/after ${lease.expiresAt}`);
+		}
+		return ok;
+	}
+};
+//#endregion
 //#region src/ssh.ts
 /**
 * `seekrit ssh` — temporary SSH access via short-lived certificates (Vault-style
@@ -16468,167 +16894,37 @@ async function materializeForRun(options) {
 		};
 	}
 }
-/**
-* Every live process `seekrit run` is responsible for tearing down, from a
-* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
-* own process group — every other member of that group.
-*
-* Two mechanisms, because each covers the other's blind spot:
-*
-* - The parent-chain walk reaches a process that left our group via
-*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
-*   can touch. But it loses anything whose chain up to `root` has already
-*   broken — teardown kills the middle layers first, and an orphan reparents to
-*   init, out of reach of any walk down from `root`.
-* - Group membership survives exactly that: a pgid outlives the parent that
-*   passed it down. But it misses the ones that left the group.
-*
-* The group half applies only when our pid *is* our pgid, which is the shell-job
-* case: the shell put this command in a new group, so every other member of it
-* descends from us. Nested inside a shell script or a CI runner we are not the
-* leader and the group holds processes we did not start, so there we use the
-* walk alone.
-*
-* Zombies are skipped: they are already dead and waiting to be reaped, so
-* counting them would stall teardown for the full grace period and then report
-* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
-* back to signalling the immediate child.
-*/
-function teardownTargets(root) {
-	const ps = spawnSync("ps", [
-		"-A",
-		"-o",
-		"pid=,ppid=,pgid=,stat="
-	], { encoding: "utf8" });
-	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
-	const childrenOf = /* @__PURE__ */ new Map();
-	const groupOf = /* @__PURE__ */ new Map();
-	const isId = (value) => value !== void 0 && Number.isInteger(value);
-	for (const line of ps.stdout.split("\n")) {
-		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
-		const [id, parent, group] = [
-			pid,
-			ppid,
-			pgid
-		].map(Number);
-		if (!isId(id) || !isId(parent) || !isId(group)) continue;
-		if (stat?.startsWith("Z")) continue;
-		const siblings = childrenOf.get(parent);
-		if (siblings) siblings.push(id);
-		else childrenOf.set(parent, [id]);
-		groupOf.set(id, group);
-	}
-	const found = /* @__PURE__ */ new Set();
-	const queue = [root];
-	const seen = new Set(queue);
-	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
-		if (seen.has(kid)) continue;
-		seen.add(kid);
-		found.add(kid);
-		queue.push(kid);
-	}
-	if (groupOf.get(process.pid) === process.pid) {
-		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
-	}
-	found.delete(process.pid);
-	found.delete(root);
-	return [...found];
-}
-/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
-function isAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** How long a straggler gets to finish shutting down before SIGKILL. */
-const STRAGGLER_GRACE_MS = 2e3;
-/**
-* Once the command has exited, make sure nothing it started outlives us.
-*
-* Anything still alive here has ignored the signal we forwarded *and* lost the
-* parent that launched it, and we are the last process that knows its pid:
-* the tty won't hang it up (it is no longer in the foreground group, and the
-* shell has moved on), so it survives until the machine reboots. That is how
-* `tsx` and the server under it stacked up for days.
-*
-* So escalate rather than trust. SIGTERM first — it costs no extra time and is
-* a rung the SIGINT-only handlers common in dev servers don't catch — then
-* SIGKILL whatever is left after the grace period. Nothing is killed unless it
-* was asked to stop first and declined, and this runs only when we forwarded a
-* termination signal: a command that exits on its own having deliberately left a
-* daemon behind keeps working.
-*/
-async function reapStragglers(pids, signal) {
-	let live = [...pids].filter(isAlive);
-	if (live.length === 0) return;
-	for (const pid of live) try {
-		process.kill(pid, "SIGTERM");
-	} catch {}
-	const deadline = Date.now() + STRAGGLER_GRACE_MS;
-	while (live.length > 0 && Date.now() < deadline) {
-		await new Promise((resolve) => setTimeout(resolve, 50));
-		live = live.filter(isAlive);
-	}
-	if (live.length === 0) return;
-	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
-	for (const pid of live) try {
-		process.kill(pid, "SIGKILL");
-	} catch {}
-}
-program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--lease <VAR=target>", "inject a temporary Postgres connection URL (repeatable)", collectList).option("--lease-ttl <duration>", "maximum lease lifetime, 1m–7d (default: 30m)").option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
+	const leaseOptions = parseRunLeaseOptions(options.lease, options.leaseTtl);
 	const { values, provenance, interpolated, unresolvedRefs } = await materializeForRun(options);
-	if (options.explain) {
-		for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
-		printExplain(provenance, {
-			interpolated,
-			unresolved: unresolvedRefs
-		});
-	}
-	const posix = process.platform !== "win32";
-	const child = spawn(cmd, args, {
-		stdio: "inherit",
-		env: {
+	const leases = leaseOptions ? await prepareRunLeases(leaseOptions, options.org, options.envFile) : void 0;
+	const result = await runCommand(cmd, args, async (interrupted) => {
+		const leased = await leases?.mint(interrupted) ?? {};
+		if (options.explain) {
+			for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
+			for (const binding of leaseOptions?.bindings ?? []) provenance[binding.variable] = `lease:${binding.target}`;
+			printExplain(provenance, {
+				interpolated,
+				unresolved: unresolvedRefs
+			});
+		}
+		const env = {
 			...values,
 			...process.env
+		};
+		if (process.platform === "win32") {
+			const leasedNames = new Set(Object.keys(leased).map((name) => name.toUpperCase()));
+			for (const name of Object.keys(env)) if (leasedNames.has(name.toUpperCase())) delete env[name];
 		}
-	});
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	const stragglers = /* @__PURE__ */ new Set();
-	let forwarded;
-	const collect = () => {
-		if (!posix || !child.pid) return;
-		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
-	};
-	const forward = (signal) => {
-		if (child.exitCode !== null || child.signalCode !== null) return;
-		forwarded ??= signal;
-		collect();
-		child.kill(signal);
-		for (const pid of stragglers) try {
-			process.kill(pid, signal);
-		} catch {}
-	};
-	for (const signal of signals) process.on(signal, forward);
-	child.on("exit", async (code, signal) => {
-		if (forwarded) {
-			collect();
-			await reapStragglers(stragglers, forwarded);
-		}
-		for (const s of signals) process.off(s, forward);
-		if (signal) process.kill(process.pid, signal);
-		else process.exit(code ?? 1);
-	});
-	child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
+		return {
+			...env,
+			...leased
+		};
+	}, () => leases?.revoke() ?? Promise.resolve(true));
+	if (result.signal) process.kill(process.pid, result.signal);
+	else process.exit(result.code);
 });
 program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
 	if (![
@@ -16659,42 +16955,43 @@ token.command("create").description("create a service token (runtime, or --admin
 	if (boundToEnv && !(options.app && options.env)) fail("pass both --app and --env to bind a token to an environment");
 	const target = boundToEnv ? await resolveAppEnv(ctx, options) : { orgId: (await resolveOrg(ctx, options.org)).id };
 	const created = await createServiceToken();
+	const granted = boundToEnv && options.grant !== false;
+	const initialGrants = granted && "envId" in target ? await ctx.client.prepareComposedKeyGrants(target.orgId, target.envId, {
+		principalType: "service_token",
+		principalId: created.tokenId,
+		publicKeyJwk: created.publicKeyJwk
+	}, (id) => getDek(ctx, target.orgId, id)) : void 0;
+	const extraGrants = [];
+	if (granted) for (const [groupSlug, envSlug] of Object.entries(options.allow ?? {})) {
+		const groupRef = await resolveGroup(ctx, {
+			org: options.org,
+			group: groupSlug
+		});
+		const { environments } = await ctx.client.listGroupEnvs(target.orgId, groupRef.id);
+		const slice = environments.find((e) => e.slug === envSlug);
+		if (!slice) fail(`group "${groupSlug}" has no "${envSlug}" environment`);
+		extraGrants.push({
+			environmentId: slice.id,
+			wrappedDek: await wrapDek(await getDek(ctx, target.orgId, slice.id), created.publicKeyJwk)
+		});
+	}
 	await ctx.client.createToken(target.orgId, {
 		name: options.name,
 		tokenId: created.tokenId,
 		tokenHash: created.tokenHash,
 		publicKeyJwk: created.publicKeyJwk,
 		role,
-		environmentId: "envId" in target ? target.envId : null
+		environmentId: "envId" in target ? target.envId : null,
+		initialGrants
 	});
-	const grantEnv = async (envId) => {
-		const dek = await getDek(ctx, target.orgId, envId);
-		await ctx.client.grantEnvKey(target.orgId, envId, {
+	for (const extra of extraGrants) try {
+		await ctx.client.grantEnvKey(target.orgId, extra.environmentId, {
 			principalType: "service_token",
 			principalId: created.tokenId,
-			wrappedDek: await wrapDek(dek, created.publicKeyJwk)
+			wrappedDek: extra.wrappedDek
 		});
-	};
-	const granted = boundToEnv && options.grant !== false;
-	if (granted && "envId" in target) {
-		await grantEnv(target.envId);
-		const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
-		for (const g of groups) {
-			const { environments } = await ctx.client.listGroupEnvs(target.orgId, g.groupId);
-			const slice = environments.find((e) => e.slug === target.envSlug);
-			if (!slice) fail(`group "${g.slug}" has no "${target.envSlug}" environment — create it before granting`);
-			await grantEnv(slice.id);
-		}
-		for (const [groupSlug, envSlug] of Object.entries(options.allow ?? {})) {
-			const groupRef = await resolveGroup(ctx, {
-				org: options.org,
-				group: groupSlug
-			});
-			const { environments } = await ctx.client.listGroupEnvs(target.orgId, groupRef.id);
-			const slice = environments.find((e) => e.slug === envSlug);
-			if (!slice) fail(`group "${groupSlug}" has no "${envSlug}" environment`);
-			await grantEnv(slice.id);
-		}
+	} catch (error) {
+		console.error(`Token created with its default environment keys, but extra grant ${extra.environmentId} failed: ${error instanceof Error ? error.message : "unknown error"}`);
 	}
 	const scope = "appSlug" in target ? `${target.appSlug}/${target.envSlug}` : "org-scoped (admin)";
 	console.error(`${role} token created${granted ? " and granted" : ""} for ${scope} — save it now, it is not stored:`);
@@ -16748,7 +17045,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-D7rsPeBQ.js");
+	const { runMcpServer } = await import("./mcp-Dgj-7S9y.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);

package/dist/{mcp-D7rsPeBQ.js → mcp-Dgj-7S9y.js}

@@ -1,6 +1,6 @@
 import { A as signatureKeyRef, B as generateDek, C as version, D as importSigningKey, E as generateSigningKeyMaterial, F as generateEncryptKeyMaterial, H as parseBranchTtl, I as kmsBlobKeyRef, L as kmsDecrypt, M as generatePostgresCredential, N as generateMysqlCredential, O as importVerifyingKey, P as generateDataKey, R as kmsEncrypt, S as writeProjectConfig, T as parseServiceToken, V as toBase64, _ as getDek, a as kmsResolveRecipient, b as tryBuildContext, c as fetchDecryptedSecrets, d as resolveApp, f as resolveAppEnv, g as resolveOrg, h as resolveGroup, i as kmsResolveKey, j as verifyMessage, k as signMessage, l as fetchDecryptedVersion, m as resolveEnvTarget, n as kmsCallerIdentity, o as syncGrantsForGroupLink, p as resolveBranch, r as kmsRecoverMaterial, s as encryptAndSetSecret, t as ensureM2mAdminToken, u as materializeEnv, v as isTokenAuth, w as createServiceToken, x as setFailThrows, y as principalPublicKeyJwk, z as wrapDek } from "./index.js";
-import { spawn } from "node:child_process";
 import { z } from "zod";
+import { spawn } from "node:child_process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 //#region src/mcp.ts
@@ -527,7 +527,8 @@ async function runMcpServer(options = {}) {
 		return (await ctx.client.createEnv(orgRef.id, appRow.id, {
 			name,
 			slug,
-			wrappedDek
+			wrappedDek,
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(orgRef.id, { appId: appRow.id }, dek)
 		})).environment;
 	});
 	tool("create_branch", "Fork an environment into an ephemeral branch (a per-PR / preview config). The branch inherits the parent's secrets by layering at read time — nothing is copied or re-encrypted — and holds only the values you override on it. Generates the branch's data key locally, grants it to the caller, and shares it with the parent's other readers.", { idempotent: false }, {
@@ -595,7 +596,8 @@ async function runMcpServer(options = {}) {
 		return (await ctx.client.createGroupEnv(g.orgId, g.id, {
 			name,
 			slug,
-			wrappedDek
+			wrappedDek,
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(g.orgId, { groupId: g.id }, dek)
 		})).environment;
 	});
 	tool("compose_group", "Compose a group into an application environment (higher position wins on name clashes).", { idempotent: true }, {
@@ -617,6 +619,7 @@ async function runMcpServer(options = {}) {
 		});
 		const syncGrants = await syncGrantsForGroupLink(ctx, target.orgId, target.envId, target.envSlug, g.id);
 		return (await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+			appAccessGrants: await ctx.client.wrapGroupAppAccess(target.orgId, target.envId, g.id, (id) => getDek(ctx, target.orgId, id)),
 			groupId: g.id,
 			position,
 			syncGrants
@@ -819,32 +822,21 @@ async function runMcpServer(options = {}) {
 			env
 		}) : { orgId: (await resolveOrg(ctx, org)).id };
 		const created = await createServiceToken();
+		if (boundToEnv) ensureDecryptable(ctx);
+		const initialGrants = "envId" in target ? await ctx.client.prepareComposedKeyGrants(target.orgId, target.envId, {
+			principalType: "service_token",
+			principalId: created.tokenId,
+			publicKeyJwk: created.publicKeyJwk
+		}, (id) => getDek(ctx, target.orgId, id)) : void 0;
 		await ctx.client.createToken(target.orgId, {
 			name,
 			tokenId: created.tokenId,
 			tokenHash: created.tokenHash,
 			publicKeyJwk: created.publicKeyJwk,
 			role,
-			environmentId: "envId" in target ? target.envId : null
+			environmentId: "envId" in target ? target.envId : null,
+			initialGrants
 		});
-		if (boundToEnv && "envId" in target) {
-			ensureDecryptable(ctx);
-			const grantEnv = async (envId) => {
-				const dek = await getDek(ctx, target.orgId, envId);
-				await ctx.client.grantEnvKey(target.orgId, envId, {
-					principalType: "service_token",
-					principalId: created.tokenId,
-					wrappedDek: await wrapDek(dek, created.publicKeyJwk)
-				});
-			};
-			await grantEnv(target.envId);
-			const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
-			for (const g of groups) {
-				const { environments } = await ctx.client.listGroupEnvs(target.orgId, g.groupId);
-				const slice = environments.find((e) => e.slug === target.envSlug);
-				if (slice) await grantEnv(slice.id);
-			}
-		}
 		return {
 			token: created.token,
 			tokenId: created.tokenId,
@@ -873,7 +865,6 @@ async function runMcpServer(options = {}) {
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
 		const { orgId, envId, label } = await resolveEnvTarget(ctx, o);
-		const dek = await getDek(ctx, orgId, envId);
 		let principalType;
 		let principalId;
 		let publicKeyJwk;
@@ -897,11 +888,11 @@ async function runMcpServer(options = {}) {
 				t.publicKeyJwk
 			];
 		}
-		await ctx.client.grantEnvKey(orgId, envId, {
+		await ctx.client.grantEnvironmentAccess(orgId, envId, {
 			principalType,
 			principalId,
-			wrappedDek: await wrapDek(dek, publicKeyJwk)
-		});
+			publicKeyJwk
+		}, (id) => getDek(ctx, orgId, id));
 		return {
 			ok: true,
 			env: label,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "homepage": "https://seekrit.dev/docs/guides/cli",
   "keywords": [
@@ -46,9 +46,9 @@
     "@types/node": "^26.6.5",
     "tsdown": "^0.23.1",
     "vitest": "^5.0.5",
-    "@seekrit/crypto": "0.0.1",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/core": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",