@seekrit/cli 2.1.0 → 2.2.1

package/dist/{mcp-DZoBFmDF.js → mcp-Clul2n4l.js}

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { spawn } from "node:child_process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-//#region src/mcp.ts
+// src/mcp.ts
 /** Lowercase-alphanumeric string for a fresh Postgres role name. */
 function randomLower(length) {
 	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -527,7 +527,8 @@ async function runMcpServer(options = {}) {
 		return (await ctx.client.createEnv(orgRef.id, appRow.id, {
 			name,
 			slug,
-			wrappedDek
+			wrappedDek,
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(orgRef.id, { appId: appRow.id }, dek)
 		})).environment;
 	});
 	tool("create_branch", "Fork an environment into an ephemeral branch (a per-PR / preview config). The branch inherits the parent's secrets by layering at read time — nothing is copied or re-encrypted — and holds only the values you override on it. Generates the branch's data key locally, grants it to the caller, and shares it with the parent's other readers.", { idempotent: false }, {
@@ -595,7 +596,8 @@ async function runMcpServer(options = {}) {
 		return (await ctx.client.createGroupEnv(g.orgId, g.id, {
 			name,
 			slug,
-			wrappedDek
+			wrappedDek,
+			userGrants: await ctx.client.wrapNewEnvironmentAccess(g.orgId, { groupId: g.id }, dek)
 		})).environment;
 	});
 	tool("compose_group", "Compose a group into an application environment (higher position wins on name clashes).", { idempotent: true }, {
@@ -617,6 +619,7 @@ async function runMcpServer(options = {}) {
 		});
 		const syncGrants = await syncGrantsForGroupLink(ctx, target.orgId, target.envId, target.envSlug, g.id);
 		return (await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+			appAccessGrants: await ctx.client.wrapGroupAppAccess(target.orgId, target.envId, g.id, (id) => getDek(ctx, target.orgId, id)),
 			groupId: g.id,
 			position,
 			syncGrants
@@ -819,32 +822,21 @@ async function runMcpServer(options = {}) {
 			env
 		}) : { orgId: (await resolveOrg(ctx, org)).id };
 		const created = await createServiceToken();
+		if (boundToEnv) ensureDecryptable(ctx);
+		const initialGrants = "envId" in target ? await ctx.client.prepareComposedKeyGrants(target.orgId, target.envId, {
+			principalType: "service_token",
+			principalId: created.tokenId,
+			publicKeyJwk: created.publicKeyJwk
+		}, (id) => getDek(ctx, target.orgId, id)) : void 0;
 		await ctx.client.createToken(target.orgId, {
 			name,
 			tokenId: created.tokenId,
 			tokenHash: created.tokenHash,
 			publicKeyJwk: created.publicKeyJwk,
 			role,
-			environmentId: "envId" in target ? target.envId : null
+			environmentId: "envId" in target ? target.envId : null,
+			initialGrants
 		});
-		if (boundToEnv && "envId" in target) {
-			ensureDecryptable(ctx);
-			const grantEnv = async (envId) => {
-				const dek = await getDek(ctx, target.orgId, envId);
-				await ctx.client.grantEnvKey(target.orgId, envId, {
-					principalType: "service_token",
-					principalId: created.tokenId,
-					wrappedDek: await wrapDek(dek, created.publicKeyJwk)
-				});
-			};
-			await grantEnv(target.envId);
-			const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
-			for (const g of groups) {
-				const { environments } = await ctx.client.listGroupEnvs(target.orgId, g.groupId);
-				const slice = environments.find((e) => e.slug === target.envSlug);
-				if (slice) await grantEnv(slice.id);
-			}
-		}
 		return {
 			token: created.token,
 			tokenId: created.tokenId,
@@ -873,7 +865,6 @@ async function runMcpServer(options = {}) {
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
 		const { orgId, envId, label } = await resolveEnvTarget(ctx, o);
-		const dek = await getDek(ctx, orgId, envId);
 		let principalType;
 		let principalId;
 		let publicKeyJwk;
@@ -897,11 +888,11 @@ async function runMcpServer(options = {}) {
 				t.publicKeyJwk
 			];
 		}
-		await ctx.client.grantEnvKey(orgId, envId, {
+		await ctx.client.grantEnvironmentAccess(orgId, envId, {
 			principalType,
 			principalId,
-			wrappedDek: await wrapDek(dek, publicKeyJwk)
-		});
+			publicKeyJwk
+		}, (id) => getDek(ctx, orgId, id));
 		return {
 			ok: true,
 			env: label,
@@ -1032,5 +1023,4 @@ async function runMcpServer(options = {}) {
 	});
 	await server.connect(new StdioServerTransport());
 }
-//#endregion
 export { runMcpServer };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "homepage": "https://seekrit.dev/docs/guides/cli",
   "keywords": [
@@ -38,13 +38,13 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "commander": "^15.0.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",
-    "tsdown": "^0.23.1",
+    "tsdown": "^0.23.3",
     "vitest": "^5.0.5",
     "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",