@seekrit/cli 2.6.0 → 2.7.0

package/dist/index.js

@@ -1752,6 +1752,229 @@ function prettyJsonOrRaw(value) {
 	const inspection = inspectJsonValue(value);
 	return inspection.kind === "json" ? inspection.pretty : value;
 }
+// ../../packages/core/src/managed-providers/aws-cache.ts
+const cacheRegionSchema = z$1.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/);
+const cacheGroupSchema = z$1.string().min(1).max(128).regex(/^[a-zA-Z][a-zA-Z0-9-]*$/);
+const cacheAccessSchema = z$1.string().min(1).max(4096).refine((value) => /^on(?:\s|$)/.test(value) && !/(?:^|\s)(?:nopass|resetpass|[>#<])/.test(value), "ACL must enable the user and must not contain password directives");
+// ../../packages/core/src/managed-providers/common.ts
+const managedEndpointSchema = z$1.string().url().max(2048).refine((value) => {
+	try {
+		const url = new URL(value);
+		url.port = "";
+		return connectUrlSchema.safeParse(url.toString()).success;
+	} catch {
+		return false;
+	}
+}, "use a public HTTPS endpoint without embedded credentials, query, or fragment");
+const managedTtlSchema = z$1.number().int().min(60).max(604800).optional();
+const nameSchema$1 = z$1.string().min(1).max(128).regex(/^[a-zA-Z_][a-zA-Z0-9_-]*$/);
+// ../../packages/core/src/managed-providers/memorydb.ts
+const memorydbTargetConfigSchema = z$1.object({
+	provider: z$1.literal("memorydb"),
+	executor: z$1.literal("in_do"),
+	region: cacheRegionSchema,
+	aclName: cacheGroupSchema,
+	accessString: cacheAccessSchema,
+	maxTtlSeconds: managedTtlSchema
+}).strict();
+// ../../packages/core/src/managed-providers/elasticache.ts
+const elasticacheTargetConfigSchema = z$1.object({
+	provider: z$1.literal("elasticache"),
+	executor: z$1.literal("in_do"),
+	region: cacheRegionSchema,
+	userGroupId: cacheGroupSchema,
+	engine: z$1.enum(["redis", "valkey"]).default("redis"),
+	accessString: cacheAccessSchema,
+	maxTtlSeconds: managedTtlSchema
+}).strict();
+// ../../packages/core/src/managed-providers/snowflake.ts
+const identifier = z$1.string().regex(/^[a-zA-Z_][a-zA-Z0-9_$]{0,254}$/).transform((value) => value.toUpperCase());
+const snowflakeTargetConfigSchema = z$1.object({
+	provider: z$1.literal("snowflake"),
+	executor: z$1.literal("in_do"),
+	account: z$1.string().min(1).max(200).regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$/i),
+	adminRole: identifier.default("USERADMIN"),
+	roles: z$1.array(identifier).min(1).max(50),
+	warehouse: identifier.optional(),
+	networkPolicy: identifier.optional(),
+	maxTtlSeconds: managedTtlSchema
+}).strict();
+// ../../packages/core/src/managed-providers/couchbase.ts
+const resourceName = z$1.string().min(1).max(255);
+const access = z$1.object({
+	privileges: z$1.array(z$1.enum(["data_reader", "data_writer"])).min(1).max(2),
+	resources: z$1.object({ buckets: z$1.array(z$1.object({
+		name: resourceName,
+		scopes: z$1.array(z$1.object({
+			name: resourceName,
+			collections: z$1.array(resourceName).min(1).max(100).optional()
+		}).strict()).min(1).max(100).optional()
+	}).strict()).min(1).max(100) }).strict()
+}).strict();
+const couchbaseTargetConfigSchema = z$1.object({
+	provider: z$1.literal("couchbase"),
+	executor: z$1.literal("in_do"),
+	organizationId: z$1.string().uuid(),
+	projectId: z$1.string().uuid(),
+	clusterId: z$1.string().uuid(),
+	credentialType: z$1.enum(["basic", "advanced"]).default("basic"),
+	access: z$1.array(access).min(1).max(100).optional(),
+	userRoles: z$1.array(resourceName).min(1).max(100).optional(),
+	maxTtlSeconds: managedTtlSchema
+}).strict().superRefine((value, ctx) => {
+	if (value.credentialType === "basic" ? !value.access || !!value.userRoles : !value.userRoles || !!value.access) ctx.addIssue({
+		code: "custom",
+		message: "basic credentials require access only; advanced credentials require userRoles only"
+	});
+});
+// ../../packages/core/src/managed-providers/mongodb-atlas.ts
+const mongoAtlasTargetConfigSchema = z$1.object({
+	provider: z$1.literal("mongodb-atlas"),
+	executor: z$1.literal("in_do"),
+	projectId: z$1.string().regex(/^[a-f0-9]{24}$/),
+	roles: z$1.array(z$1.object({
+		roleName: z$1.string().min(1).max(128),
+		databaseName: z$1.string().min(1).max(64),
+		collectionName: z$1.string().min(1).max(128).optional()
+	}).strict()).min(1).max(100),
+	clusters: z$1.array(z$1.string().min(1).max(64)).min(1).max(100),
+	maxTtlSeconds: managedTtlSchema
+}).strict();
+// ../../packages/core/src/managed-providers/milvus.ts
+const milvusTargetConfigSchema = z$1.object({
+	provider: z$1.literal("milvus"),
+	executor: z$1.literal("in_do"),
+	endpoint: managedEndpointSchema,
+	roles: z$1.array(z$1.string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,127}$/)).min(1).max(50),
+	maxTtlSeconds: managedTtlSchema
+}).strict();
+// ../../packages/core/src/managed-providers/rabbitmq.ts
+const rabbitmqTargetConfigSchema = z$1.object({
+	provider: z$1.literal("rabbitmq"),
+	executor: z$1.literal("in_do"),
+	endpoint: managedEndpointSchema,
+	vhost: z$1.string().min(1).max(255),
+	configure: z$1.string().max(2048).default("^$"),
+	write: z$1.string().max(2048).default("^$"),
+	read: z$1.string().max(2048).default("^$"),
+	maxTtlSeconds: managedTtlSchema
+}).strict();
+// ../../packages/core/src/managed-providers/clickhouse.ts
+const clickhouseTargetConfigSchema = z$1.object({
+	provider: z$1.literal("clickhouse"),
+	executor: z$1.literal("in_do"),
+	endpoint: managedEndpointSchema,
+	roles: z$1.array(nameSchema$1).min(1).max(50),
+	database: nameSchema$1.optional(),
+	cluster: nameSchema$1.optional(),
+	maxTtlSeconds: managedTtlSchema
+}).strict();
+// ../../packages/core/src/managed-providers/elasticsearch.ts
+const role = z$1.object({
+	cluster: z$1.array(z$1.string().min(1).max(100)).max(100).default([]),
+	indices: z$1.array(z$1.object({
+		names: z$1.array(z$1.string().min(1).max(256)).min(1).max(100),
+		privileges: z$1.array(z$1.string().min(1).max(100)).min(1).max(100),
+		allow_restricted_indices: z$1.literal(false).optional()
+	}).strict()).max(100).default([])
+}).strict();
+const elasticsearchTargetConfigSchema = z$1.object({
+	provider: z$1.literal("elasticsearch"),
+	executor: z$1.literal("in_do"),
+	endpoint: managedEndpointSchema,
+	credentialType: z$1.enum(["user", "api_key"]).default("user"),
+	roles: z$1.array(z$1.string().min(1).max(128)).min(1).max(100).optional(),
+	roleDescriptors: z$1.record(z$1.string().min(1).max(128), role).refine((value) => Object.keys(value).length > 0 && Object.keys(value).length <= 20, "supply explicit key permissions").optional(),
+	maxTtlSeconds: managedTtlSchema
+}).strict().superRefine((value, ctx) => {
+	if (value.credentialType === "user" && !value.roles?.length) ctx.addIssue({
+		code: "custom",
+		path: ["roles"],
+		message: "select at least one user role"
+	});
+	if (value.credentialType === "api_key" && !value.roleDescriptors) ctx.addIssue({
+		code: "custom",
+		path: ["roleDescriptors"],
+		message: "supply explicit key permissions"
+	});
+});
+// ../../packages/core/src/managed-leases.ts
+/** Providers whose credential is generated by the broker or upstream service. */
+const MANAGED_LEASE_KINDS = [
+	"openrouter",
+	"tailscale",
+	"elasticsearch",
+	"clickhouse",
+	"rabbitmq",
+	"milvus",
+	"mongodb-atlas",
+	"couchbase",
+	"snowflake",
+	"elasticache",
+	"memorydb"
+];
+const openRouterTargetConfigSchema = z$1.object({
+	provider: z$1.literal("openrouter"),
+	executor: z$1.literal("in_do"),
+	workspaceId: z$1.string().uuid().optional(),
+	creditLimit: z$1.number().finite().nonnegative(),
+	limitReset: z$1.enum([
+		"daily",
+		"weekly",
+		"monthly"
+	]).optional(),
+	includeByokInLimit: z$1.boolean().optional(),
+	maxTtlSeconds: z$1.number().int().min(60).max(604800).optional()
+}).strict();
+const tailscaleTargetConfigSchema = z$1.object({
+	provider: z$1.literal("tailscale"),
+	executor: z$1.literal("in_do"),
+	tailnet: z$1.string().min(1).max(253).regex(/^[a-zA-Z0-9@._-]+$/),
+	credentialType: z$1.enum([
+		"auth",
+		"client",
+		"federated"
+	]),
+	tags: z$1.array(z$1.string().regex(/^tag:[a-zA-Z0-9_-]+$/)).max(100).default([]),
+	reusable: z$1.boolean().default(false),
+	ephemeral: z$1.boolean().default(true),
+	preauthorized: z$1.boolean().default(false),
+	scopes: z$1.array(z$1.string().min(1).max(128)).max(100).default([]),
+	issuer: z$1.string().url().optional(),
+	audience: z$1.string().min(1).max(2048).optional(),
+	subject: z$1.string().min(1).max(2048).optional(),
+	maxTtlSeconds: z$1.number().int().min(60).max(604800).optional()
+}).strict().superRefine((value, ctx) => {
+	if (value.credentialType !== "auth" && !value.scopes.length) ctx.addIssue({
+		code: "custom",
+		path: ["scopes"],
+		message: "select at least one scope"
+	});
+	if (value.credentialType === "federated" && (!value.issuer?.startsWith("https://") || !value.audience || !value.subject)) ctx.addIssue({
+		code: "custom",
+		path: ["issuer"],
+		message: "federation requires HTTPS issuer, audience, and subject"
+	});
+});
+const managedTargetConfigSchema = z$1.discriminatedUnion("provider", [
+	clickhouseTargetConfigSchema,
+	rabbitmqTargetConfigSchema,
+	milvusTargetConfigSchema,
+	mongoAtlasTargetConfigSchema,
+	couchbaseTargetConfigSchema,
+	snowflakeTargetConfigSchema,
+	elasticacheTargetConfigSchema,
+	memorydbTargetConfigSchema,
+	openRouterTargetConfigSchema,
+	tailscaleTargetConfigSchema,
+	elasticsearchTargetConfigSchema
+]);
+function isManagedLeaseKind(value) {
+	return MANAGED_LEASE_KINDS.includes(value);
+}
+function isManagedTarget(value) {
+	return isManagedLeaseKind(value.provider);
+}
 z$1.enum([
 	"postgres",
 	"mysql",
@@ -1759,7 +1982,8 @@ z$1.enum([
 	"redis",
 	"aws",
 	"gcp",
-	"mongodb"
+	"mongodb",
+	...MANAGED_LEASE_KINDS
 ]);
 const executorModeSchema = z$1.enum(["in_do", "remote"]);
 /**
@@ -1994,7 +2218,8 @@ const leaseTargetConfigSchema = z$1.discriminatedUnion("provider", [
 	sshTargetConfigSchema,
 	awsTargetConfigSchema,
 	gcpTargetConfigSchema,
-	mongoTargetConfigSchema
+	mongoTargetConfigSchema,
+	...managedTargetConfigSchema.options
 ]);
 z$1.object({
 	name: z$1.string().trim().min(1).max(128),
@@ -2100,6 +2325,18 @@ const mintMongoLeaseSchema = z$1.object({
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: ttlSecondsSchema
 });
+const mintManagedLeaseSchema = z$1.object({
+	provider: z$1.enum(MANAGED_LEASE_KINDS),
+	targetId: z$1.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema.refine((value) => {
+		try {
+			return !("d" in JSON.parse(value));
+		} catch {
+			return false;
+		}
+	}, "send only a public key"),
+	ttlSeconds: ttlSecondsSchema
+});
 z$1.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
@@ -2107,9 +2344,9 @@ z$1.discriminatedUnion("provider", [
 	mintSshLeaseSchema,
 	mintAwsLeaseSchema,
 	mintGcpLeaseSchema,
-	mintMongoLeaseSchema
+	mintMongoLeaseSchema,
+	mintManagedLeaseSchema
 ]);
-// ../../packages/core/src/providers/aws.ts
 /**
 * The one-time IAM setup an admin performs so seekrit can assume the target
 * role. Analogue of `sshHostSetupInstructions` / `postgresGroupBootstrapSql` —
@@ -2136,7 +2373,6 @@ function awsTrustPolicyInstructions(config) {
 		`# on ${config.roleArn}. seekrit only ever calls AssumeRole on this role.`
 	].join("\n");
 }
-// ../../packages/core/src/providers/gcp.ts
 /**
 * The one-time IAM setup an admin performs so seekrit can impersonate the target
 * service account. Analogue of `awsTrustPolicyInstructions` — printed for the
@@ -2158,7 +2394,6 @@ function gcpSetupInstructions(config) {
 		"gcloud services enable iamcredentials.googleapis.com"
 	].join("\n");
 }
-// ../../packages/core/src/providers/mongodb.ts
 /**
 * The one-time setup an admin performs so seekrit can provision users: create a
 * dedicated provisioning user with `userAdmin` on the target database (or
@@ -2183,7 +2418,6 @@ function mongoAdminSetupInstructions(config) {
 		`//   --uri "mongodb://seekrit_provisioner:<pwd>@${config.connection.host}:${config.connection.port}/?authSource=${authSource}"`
 	].join("\n");
 }
-// ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
 * read-only / read-write target's leased credentials inherit. Idempotent (safe
@@ -2214,7 +2448,6 @@ function postgresGroupBootstrapSql(config) {
 	if (config.accessLevel === "readwrite") lines.push(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO ${group};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE, SELECT ON SEQUENCES TO ${group};`);
 	return lines.join("\n");
 }
-// ../../packages/core/src/providers/ssh.ts
 /**
 * The one-time host setup an admin runs so a target's certificates are accepted.
 * Analogue of `postgresGroupBootstrapSql` — displayed for the admin to run, not
@@ -5052,6 +5285,19 @@ async function decryptDataKey(material, wrapped) {
 		throw new SeekritCryptoError("DECRYPT_FAILED", "data key unwrap failed: wrong key or tampered blob");
 	}
 }
+// ../../packages/crypto/src/managed-credential.ts
+const generateCredentialRecipientKeyPair = generateKeyPair;
+/** Only called on the consumer; the API receives the wrapped bytes. */
+async function unwrapManagedCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	try {
+		const result = JSON.parse(new TextDecoder().decode(bytes));
+		if (!result || typeof result !== "object" || Array.isArray(result) || !Object.values(result).every((value) => typeof value === "string")) throw new Error();
+		return result;
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "invalid managed credential");
+	}
+}
 // ../../packages/crypto/src/random.ts
 const ALPHABETS = {
 	alphanumeric: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
@@ -5894,7 +6140,7 @@ async function createAgentTaskToken() {
 	};
 }
 // package.json
-var version = "2.6.0";
+var version = "2.7.0";
 // ../../packages/api-client/src/index.ts
 /**
 * The proposer's note travels as a header, not a body field: an unprotected
@@ -12619,6 +12865,81 @@ function registerDoctorCommand(program) {
 		if (checks.some((c) => c.status === "fail")) process.exitCode = 1;
 	});
 }
+// src/dynamic.ts
+function dynamicTtl(value) {
+	const match = /^(\d+)([smhd]?)$/.exec(value);
+	if (!match) throw new Error("invalid TTL (use 15m, 1h, or 1d)");
+	const seconds = Number(match[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[match[2] || "s"] ?? 1);
+	if (!Number.isSafeInteger(seconds) || seconds < 60 || seconds > 604800) throw new Error("TTL must be 1 minute–7 days");
+	return seconds;
+}
+function registerDynamicCommands(program) {
+	const dynamic = program.command("dynamic").description("manage provider-issued temporary credentials");
+	const targets = dynamic.command("target").description("manage dynamic credential targets");
+	targets.command("add").requiredOption("--name <name>", "target name").requiredOption("--config <file>", "non-secret provider configuration JSON").option("--org <slug>", "organization").description("register a target; read its admin credential from stdin and encrypt it locally").action(async (options) => {
+		const config = managedTargetConfigSchema.parse(JSON.parse(readFileSync(options.config, "utf8")));
+		if (process.stdin.isTTY) fail("pipe the admin credential on stdin");
+		const secret = (await readStdin()).trim();
+		if (!secret) fail("admin credential is empty");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(secret), publicKeyJwk);
+		const { target } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.log(JSON.stringify(target));
+	});
+	targets.command("list").option("--org <slug>", "organization").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		console.log(JSON.stringify(targets.filter((target) => isManagedTarget(target))));
+	});
+	dynamic.command("lease <target>").option("--ttl <duration>", "credential lifetime", "1h").option("--org <slug>", "organization").description("mint and decrypt a credential locally; outputs JSON once").action(async (reference, options) => {
+		const ttlSeconds = dynamicTtl(options.ttl);
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const matches = targets.filter((target) => target.id === reference || target.name === reference);
+		if (matches.length !== 1) fail("target must identify exactly one registered target");
+		const target = matches[0];
+		if (!target) fail("target not found");
+		const config = managedTargetConfigSchema.parse(target.config);
+		const recipient = await generateCredentialRecipientKeyPair();
+		const result = await ctx.client.mintLease(org.id, {
+			provider: config.provider,
+			targetId: target.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		try {
+			const credential = await unwrapManagedCredential(result.credential.wrappedCredential, recipient.privateKeyJwk);
+			console.log(JSON.stringify({
+				leaseId: result.lease.id,
+				expiresAt: result.credential.expiresAt,
+				credential
+			}));
+		} catch (error) {
+			await ctx.client.revokeLease(org.id, result.lease.id);
+			throw error;
+		}
+	});
+	dynamic.command("revoke <leaseId>").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation prompt").description("revoke a temporary credential now").action(async (leaseId, options) => {
+		await confirmDestructive(options.yes, `Revoke temporary credential ${leaseId}?`);
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.log(JSON.stringify({ revoked: leaseId }));
+	});
+}
 // src/gcp.ts
 /**
 * `seekrit gcp` — temporary GCP credentials via IAM Credentials
@@ -18475,6 +18796,7 @@ registerHermesCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);
+registerDynamicCommands(program);
 registerIdentityCommands(program);
 registerMongoCommands(program);
 registerKmsCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "CLI for seekrit (https://seekrit.dev), a zero-knowledge secrets manager and credential broker for AI agents — inject decrypted secrets into any command.",
   "homepage": "https://seekrit.dev/docs/guides/cli",
   "keywords": [