@seekrit/cli 2.1.0 → 2.2.0

package/dist/index.js

@@ -2086,6 +2086,8 @@ const AUDIT_ACTIONS = [
 	"org.created",
 	"org.updated",
 	"org.member_added",
+	"org.member_role_changed",
+	"app.access_granted",
 	"org.member_removed",
 	"org.member_invited",
 	"org.invite_revoked",
@@ -2308,7 +2310,7 @@ const nameSchema = z.string().trim().min(1).max(128);
 const emailSchema = z.string().trim().toLowerCase().pipe(z.email().max(320));
 /** Env-var style secret name: FOO, DATABASE_URL, apiKey2 … */
 const secretNameSchema = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
-z.enum([
+const orgRoleSchema = z.enum([
 	"owner",
 	"admin",
 	"member"
@@ -2347,7 +2349,20 @@ z.object({
 	name: nameSchema,
 	slug: slugSchema
 });
+/** Compose a group into an application environment (matched by env slug). */
+const appAccessKeySchema = z.object({
+	environmentId: z.string().min(1),
+	userId: z.string().min(1),
+	wrappedDek: z.string().min(1).max(8192)
+});
+const appAccessGrantsSchema = z.array(appAccessKeySchema).max(5e3).optional();
 z.object({
+	userId: z.string().min(1),
+	grants: z.array(appAccessKeySchema).max(5e3)
+});
+z.object({ role: orgRoleSchema });
+z.object({
+	appAccessGrants: appAccessGrantsSchema,
 	groupId: z.string().min(1),
 	/** Precedence among an env's groups (higher wins). Appended if omitted. */
 	position: z.number().int().min(0).optional(),
@@ -2358,6 +2373,11 @@ z.object({
 	})).optional()
 });
 z.object({
+	/** Wrap the new DEK to all persistent app recipients. */
+	userGrants: z.array(z.object({
+		userId: z.string().min(1),
+		wrappedDek: z.string().min(1).max(8192)
+	})).max(5e3).optional(),
 	name: nameSchema,
 	slug: slugSchema,
 	/** Environment DEK wrapped to the creator's public key — created client-side. */
@@ -2419,7 +2439,23 @@ z.object({
 	/** The same DEK wrapped to each of the parent's existing grant-holders. */
 	grants: z.array(grantEnvironmentKeySchema).max(500).default([])
 });
+/**
+* Token creation is client-driven so the server never sees the token secret:
+* the client generates the keypair + token string and submits only the hash
+* and public key.
+*/
+const environmentGrantBatchSchema = z.array(z.object({
+	environmentId: z.string().min(1),
+	wrappedDek: z.string().min(1).max(8192)
+})).max(5e3);
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	grants: environmentGrantBatchSchema
+});
 z.object({
+	/** Commit the token and all default resolve keys together, when supplied. */
+	initialGrants: environmentGrantBatchSchema.optional(),
 	name: nameSchema,
 	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
 	/** SHA-256 hash (base64url) of the full token string. */
@@ -5700,7 +5736,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "2.1.0";
+var version = "2.2.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 /**
@@ -5837,6 +5873,56 @@ var SeekritClient = class {
 	listMembers(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/members`);
 	}
+	updateMemberRole(orgId, userId, role) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/members/${userId}`, { role });
+	}
+	getAppAccess(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/access`);
+	}
+	provisionAppAccess(orgId, appId, userId, grants) {
+		return this.request("POST", `/v1/orgs/${orgId}/apps/${appId}/access`, {
+			userId,
+			grants
+		});
+	}
+	accessRecipients(orgId, target) {
+		const path = "appId" in target ? `apps/${target.appId}` : `groups/${target.groupId}`;
+		return this.request("GET", `/v1/orgs/${orgId}/${path}/access-recipients`);
+	}
+	/** The caller owns the new DEK; only public keys and wrapped blobs cross the API. */
+	async wrapNewEnvironmentAccess(orgId, target, dek) {
+		const { recipients } = await this.accessRecipients(orgId, target);
+		return Promise.all(recipients.map(async (r) => {
+			if (!r.publicKeyJwk) throw new Error(`${r.email} must finish key setup before creating this environment`);
+			return {
+				userId: r.userId,
+				wrappedDek: await wrapDek(dek, r.publicKeyJwk)
+			};
+		}));
+	}
+	async wrapGroupAppAccess(orgId, envId, groupId, getDek) {
+		const { environment } = await this.getEnv(orgId, envId);
+		if (!environment.applicationId) throw new Error("only app environments can compose groups");
+		const { recipients } = await this.accessRecipients(orgId, { appId: environment.applicationId });
+		if (!recipients.length) return [];
+		const { environments } = await this.listGroupEnvs(orgId, groupId);
+		const result = [];
+		for (const env of environments) {
+			const { grants } = await this.listEnvKeys(orgId, env.id);
+			const missing = recipients.filter((r) => !grants.some((g) => g.principalType === "user" && g.principalId === r.userId));
+			if (!missing.length) continue;
+			const dek = await getDek(env.id);
+			for (const recipient of missing) {
+				if (!recipient.publicKeyJwk) throw new Error(`${recipient.email} must finish key setup first`);
+				result.push({
+					environmentId: env.id,
+					userId: recipient.userId,
+					wrappedDek: await wrapDek(dek, recipient.publicKeyJwk)
+				});
+			}
+		}
+		return result;
+	}
 	/**
 	* The org-wide "require a second factor for all members" policy. `configured`
 	* is false when the identity provider isn't wired up (local dev), in which
@@ -6021,6 +6107,46 @@ var SeekritClient = class {
 		return this.request("POST", `/v1/orgs/${orgId}/change-requests/${id}/withdraw`);
 	}
 	/** The calling principal's wrapped DEK for this environment. */
+	getEnvironmentKeyScope(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key-scope`);
+	}
+	async prepareComposedKeyGrants(orgId, envId, principal, getDek) {
+		const scope = await this.getEnvironmentKeyScope(orgId, envId);
+		const grants = [];
+		for (const layer of scope.environments) {
+			if (scope.grants.some((g) => g.environmentId === layer.environmentId && g.principalType === principal.principalType && g.principalId === principal.principalId)) continue;
+			try {
+				const dek = await getDek(layer.environmentId);
+				grants.push({
+					environmentId: layer.environmentId,
+					wrappedDek: await wrapDek(dek, principal.publicKeyJwk)
+				});
+			} catch (error) {
+				if (error instanceof Error && error.message === "unlock cancelled") throw error;
+				throw new Error(`Could not prepare access to ${layer.label}: ${error instanceof Error ? error.message : "key unavailable"}. No keys were granted.`);
+			}
+		}
+		return grants;
+	}
+	grantComposedKeys(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/keys/composed`, input);
+	}
+	/** Sharing an application environment includes the exact layers resolve reads. */
+	async grantEnvironmentAccess(orgId, envId, principal, getDek) {
+		const { environment } = await this.getEnv(orgId, envId);
+		if (environment.applicationId) {
+			const grants = await this.prepareComposedKeyGrants(orgId, envId, principal, getDek);
+			await this.grantComposedKeys(orgId, envId, {
+				principalType: principal.principalType,
+				principalId: principal.principalId,
+				grants
+			});
+		} else await this.grantEnvKey(orgId, envId, {
+			principalType: principal.principalType,
+			principalId: principal.principalId,
+			wrappedDek: await wrapDek(await getDek(envId), principal.publicKeyJwk)
+		});
+	}
 	getMyEnvKey(orgId, envId) {
 		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
 	}
@@ -7154,12 +7280,11 @@ function registerAccessCommands(program) {
 		const ctx = buildContext();
 		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
 		const principal = await resolvePrincipal(ctx, orgId, options);
-		const dek = await getDek(ctx, orgId, envId);
-		await ctx.client.grantEnvKey(orgId, envId, {
+		await ctx.client.grantEnvironmentAccess(orgId, envId, {
 			principalType: principal.type,
 			principalId: principal.id,
-			wrappedDek: await wrapDek(dek, principal.publicKeyJwk)
-		});
+			publicKeyJwk: principal.publicKeyJwk
+		}, (id) => getDek(ctx, orgId, id));
 		console.error(`granted ${label} access to ${principal.id}`);
 	});
 	withEnvTarget(grant.command("list").alias("ls").description("list who holds a key for an environment").option("--json", "print the raw API response")).action(async (options) => {
@@ -9013,6 +9138,7 @@ function registerAppCommands(program) {
 		const wrappedDek = await wrapDek(dek, await principalPublicKeyJwk(ctx));
 		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, orgRef.id, dek);
 		const created = await ctx.client.createEnv(orgRef.id, appRow.id, {
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(orgRef.id, { appId: appRow.id }, dek),
 			name: options.name,
 			slug: options.slug,
 			wrappedDek,
@@ -9038,6 +9164,7 @@ function registerAppCommands(program) {
 		});
 		const syncGrants = await syncGrantsForGroupLink(ctx, target.orgId, target.envId, target.envSlug, group.id);
 		await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+			appAccessGrants: await ctx.client.wrapGroupAppAccess(target.orgId, target.envId, group.id, (id) => getDek(ctx, target.orgId, id)),
 			groupId: group.id,
 			position: options.position === void 0 ? void 0 : Number.parseInt(options.position, 10),
 			syncGrants
@@ -11807,6 +11934,7 @@ function registerGroupCommands(program) {
 		const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
 		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, groupRef.orgId, dek);
 		const created = await ctx.client.createGroupEnv(groupRef.orgId, groupRef.id, {
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(groupRef.orgId, { groupId: groupRef.id }, dek),
 			name: options.name,
 			slug: options.slug,
 			wrappedDek,
@@ -12270,6 +12398,7 @@ async function runInit(options) {
 		const wrappedDek = await wrapDek(dek, await principalPublicKeyJwk(ctx));
 		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, orgRef.id, dek);
 		({environment: env} = await ctx.client.createEnv(orgRef.id, app.id, {
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(orgRef.id, { appId: app.id }, dek),
 			name: titleCase(envSlug),
 			slug: envSlug,
 			wrappedDek,
@@ -16826,42 +16955,43 @@ token.command("create").description("create a service token (runtime, or --admin
 	if (boundToEnv && !(options.app && options.env)) fail("pass both --app and --env to bind a token to an environment");
 	const target = boundToEnv ? await resolveAppEnv(ctx, options) : { orgId: (await resolveOrg(ctx, options.org)).id };
 	const created = await createServiceToken();
+	const granted = boundToEnv && options.grant !== false;
+	const initialGrants = granted && "envId" in target ? await ctx.client.prepareComposedKeyGrants(target.orgId, target.envId, {
+		principalType: "service_token",
+		principalId: created.tokenId,
+		publicKeyJwk: created.publicKeyJwk
+	}, (id) => getDek(ctx, target.orgId, id)) : void 0;
+	const extraGrants = [];
+	if (granted) for (const [groupSlug, envSlug] of Object.entries(options.allow ?? {})) {
+		const groupRef = await resolveGroup(ctx, {
+			org: options.org,
+			group: groupSlug
+		});
+		const { environments } = await ctx.client.listGroupEnvs(target.orgId, groupRef.id);
+		const slice = environments.find((e) => e.slug === envSlug);
+		if (!slice) fail(`group "${groupSlug}" has no "${envSlug}" environment`);
+		extraGrants.push({
+			environmentId: slice.id,
+			wrappedDek: await wrapDek(await getDek(ctx, target.orgId, slice.id), created.publicKeyJwk)
+		});
+	}
 	await ctx.client.createToken(target.orgId, {
 		name: options.name,
 		tokenId: created.tokenId,
 		tokenHash: created.tokenHash,
 		publicKeyJwk: created.publicKeyJwk,
 		role,
-		environmentId: "envId" in target ? target.envId : null
+		environmentId: "envId" in target ? target.envId : null,
+		initialGrants
 	});
-	const grantEnv = async (envId) => {
-		const dek = await getDek(ctx, target.orgId, envId);
-		await ctx.client.grantEnvKey(target.orgId, envId, {
+	for (const extra of extraGrants) try {
+		await ctx.client.grantEnvKey(target.orgId, extra.environmentId, {
 			principalType: "service_token",
 			principalId: created.tokenId,
-			wrappedDek: await wrapDek(dek, created.publicKeyJwk)
+			wrappedDek: extra.wrappedDek
 		});
-	};
-	const granted = boundToEnv && options.grant !== false;
-	if (granted && "envId" in target) {
-		await grantEnv(target.envId);
-		const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
-		for (const g of groups) {
-			const { environments } = await ctx.client.listGroupEnvs(target.orgId, g.groupId);
-			const slice = environments.find((e) => e.slug === target.envSlug);
-			if (!slice) fail(`group "${g.slug}" has no "${target.envSlug}" environment — create it before granting`);
-			await grantEnv(slice.id);
-		}
-		for (const [groupSlug, envSlug] of Object.entries(options.allow ?? {})) {
-			const groupRef = await resolveGroup(ctx, {
-				org: options.org,
-				group: groupSlug
-			});
-			const { environments } = await ctx.client.listGroupEnvs(target.orgId, groupRef.id);
-			const slice = environments.find((e) => e.slug === envSlug);
-			if (!slice) fail(`group "${groupSlug}" has no "${envSlug}" environment`);
-			await grantEnv(slice.id);
-		}
+	} catch (error) {
+		console.error(`Token created with its default environment keys, but extra grant ${extra.environmentId} failed: ${error instanceof Error ? error.message : "unknown error"}`);
 	}
 	const scope = "appSlug" in target ? `${target.appSlug}/${target.envSlug}` : "org-scoped (admin)";
 	console.error(`${role} token created${granted ? " and granted" : ""} for ${scope} — save it now, it is not stored:`);
@@ -16915,7 +17045,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-DZoBFmDF.js");
+	const { runMcpServer } = await import("./mcp-Dgj-7S9y.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);

package/dist/{mcp-DZoBFmDF.js → mcp-Dgj-7S9y.js}

@@ -527,7 +527,8 @@ async function runMcpServer(options = {}) {
 		return (await ctx.client.createEnv(orgRef.id, appRow.id, {
 			name,
 			slug,
-			wrappedDek
+			wrappedDek,
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(orgRef.id, { appId: appRow.id }, dek)
 		})).environment;
 	});
 	tool("create_branch", "Fork an environment into an ephemeral branch (a per-PR / preview config). The branch inherits the parent's secrets by layering at read time — nothing is copied or re-encrypted — and holds only the values you override on it. Generates the branch's data key locally, grants it to the caller, and shares it with the parent's other readers.", { idempotent: false }, {
@@ -595,7 +596,8 @@ async function runMcpServer(options = {}) {
 		return (await ctx.client.createGroupEnv(g.orgId, g.id, {
 			name,
 			slug,
-			wrappedDek
+			wrappedDek,
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(g.orgId, { groupId: g.id }, dek)
 		})).environment;
 	});
 	tool("compose_group", "Compose a group into an application environment (higher position wins on name clashes).", { idempotent: true }, {
@@ -617,6 +619,7 @@ async function runMcpServer(options = {}) {
 		});
 		const syncGrants = await syncGrantsForGroupLink(ctx, target.orgId, target.envId, target.envSlug, g.id);
 		return (await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+			appAccessGrants: await ctx.client.wrapGroupAppAccess(target.orgId, target.envId, g.id, (id) => getDek(ctx, target.orgId, id)),
 			groupId: g.id,
 			position,
 			syncGrants
@@ -819,32 +822,21 @@ async function runMcpServer(options = {}) {
 			env
 		}) : { orgId: (await resolveOrg(ctx, org)).id };
 		const created = await createServiceToken();
+		if (boundToEnv) ensureDecryptable(ctx);
+		const initialGrants = "envId" in target ? await ctx.client.prepareComposedKeyGrants(target.orgId, target.envId, {
+			principalType: "service_token",
+			principalId: created.tokenId,
+			publicKeyJwk: created.publicKeyJwk
+		}, (id) => getDek(ctx, target.orgId, id)) : void 0;
 		await ctx.client.createToken(target.orgId, {
 			name,
 			tokenId: created.tokenId,
 			tokenHash: created.tokenHash,
 			publicKeyJwk: created.publicKeyJwk,
 			role,
-			environmentId: "envId" in target ? target.envId : null
+			environmentId: "envId" in target ? target.envId : null,
+			initialGrants
 		});
-		if (boundToEnv && "envId" in target) {
-			ensureDecryptable(ctx);
-			const grantEnv = async (envId) => {
-				const dek = await getDek(ctx, target.orgId, envId);
-				await ctx.client.grantEnvKey(target.orgId, envId, {
-					principalType: "service_token",
-					principalId: created.tokenId,
-					wrappedDek: await wrapDek(dek, created.publicKeyJwk)
-				});
-			};
-			await grantEnv(target.envId);
-			const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
-			for (const g of groups) {
-				const { environments } = await ctx.client.listGroupEnvs(target.orgId, g.groupId);
-				const slice = environments.find((e) => e.slug === target.envSlug);
-				if (slice) await grantEnv(slice.id);
-			}
-		}
 		return {
 			token: created.token,
 			tokenId: created.tokenId,
@@ -873,7 +865,6 @@ async function runMcpServer(options = {}) {
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
 		const { orgId, envId, label } = await resolveEnvTarget(ctx, o);
-		const dek = await getDek(ctx, orgId, envId);
 		let principalType;
 		let principalId;
 		let publicKeyJwk;
@@ -897,11 +888,11 @@ async function runMcpServer(options = {}) {
 				t.publicKeyJwk
 			];
 		}
-		await ctx.client.grantEnvKey(orgId, envId, {
+		await ctx.client.grantEnvironmentAccess(orgId, envId, {
 			principalType,
 			principalId,
-			wrappedDek: await wrapDek(dek, publicKeyJwk)
-		});
+			publicKeyJwk
+		}, (id) => getDek(ctx, orgId, id));
 		return {
 			ok: true,
 			env: label,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "homepage": "https://seekrit.dev/docs/guides/cli",
   "keywords": [