@seekrit/cli 2.7.0 → 2.8.0

package/dist/index.js

@@ -169,7 +169,7 @@ async function policySignerThumbprint(jwk) {
 		x: jwk.x,
 		y: jwk.y
 	});
-	const digest = await crypto.subtle.digest("SHA-256", utf8(canonical));
+	const digest = await crypto.subtle.digest("SHA-256", utf8$1(canonical));
 	return base64url$1(new Uint8Array(digest));
 }
 /**
@@ -184,7 +184,7 @@ async function policySignerThumbprint(jwk) {
 */
 async function signAgentPolicy(privateKey, signerJwk, draft) {
 	const kid = await policySignerThumbprint(signerJwk);
-	const bytes = utf8(canonicalizeAgentPolicy({
+	const bytes = utf8$1(canonicalizeAgentPolicy({
 		...draft,
 		signer: {
 			kid,
@@ -380,7 +380,7 @@ function normalizeRule(rule) {
 		label: rule.label?.trim() || void 0
 	};
 }
-function utf8(text) {
+function utf8$1(text) {
 	return new TextEncoder().encode(text);
 }
 function utf8Decode$1(bytes) {
@@ -1370,6 +1370,16 @@ z$1.object({
 	body: z$1.string().max(65536).optional()
 }).strict().refine((v) => !["GET", "HEAD"].includes(v.method) || v.body === void 0, "GET and HEAD cannot carry a body");
 z$1.object({ audience: audienceSchema }).strict();
+// ../../packages/core/src/customer-provisioner.ts
+/** A credential shown to the administrator for the provisioner deployment.
+* Routing metadata is bundled with its signing key; upstream secrets stay local. */
+function createProvisionerConnection(input) {
+	const body = JSON.stringify({
+		version: 1,
+		...input
+	});
+	return `sp1.${btoa(String.fromCharCode(...new TextEncoder().encode(body))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")}`;
+}
 // ../../packages/core/src/dotenv.ts
 /**
 * `.env` parsing and serialization — the canonical definition of what a `.env`
@@ -1752,10 +1762,6 @@ function prettyJsonOrRaw(value) {
 	const inspection = inspectJsonValue(value);
 	return inspection.kind === "json" ? inspection.pretty : value;
 }
-// ../../packages/core/src/managed-providers/aws-cache.ts
-const cacheRegionSchema = z$1.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/);
-const cacheGroupSchema = z$1.string().min(1).max(128).regex(/^[a-zA-Z][a-zA-Z0-9-]*$/);
-const cacheAccessSchema = z$1.string().min(1).max(4096).refine((value) => /^on(?:\s|$)/.test(value) && !/(?:^|\s)(?:nopass|resetpass|[>#<])/.test(value), "ACL must enable the user and must not contain password directives");
 // ../../packages/core/src/managed-providers/common.ts
 const managedEndpointSchema = z$1.string().url().max(2048).refine((value) => {
 	try {
@@ -1768,6 +1774,10 @@ const managedEndpointSchema = z$1.string().url().max(2048).refine((value) => {
 }, "use a public HTTPS endpoint without embedded credentials, query, or fragment");
 const managedTtlSchema = z$1.number().int().min(60).max(604800).optional();
 const nameSchema$1 = z$1.string().min(1).max(128).regex(/^[a-zA-Z_][a-zA-Z0-9_-]*$/);
+// ../../packages/core/src/managed-providers/aws-cache.ts
+const cacheRegionSchema = z$1.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/);
+const cacheGroupSchema = z$1.string().min(1).max(128).regex(/^[a-zA-Z][a-zA-Z0-9-]*$/);
+const cacheAccessSchema = z$1.string().min(1).max(4096).refine((value) => /^on(?:\s|$)/.test(value) && !/(?:^|\s)(?:nopass|resetpass|[>#<])/.test(value), "ACL must enable the user and must not contain password directives");
 // ../../packages/core/src/managed-providers/memorydb.ts
 const memorydbTargetConfigSchema = z$1.object({
 	provider: z$1.literal("memorydb"),
@@ -1956,7 +1966,7 @@ const tailscaleTargetConfigSchema = z$1.object({
 		message: "federation requires HTTPS issuer, audience, and subject"
 	});
 });
-const managedTargetConfigSchema = z$1.discriminatedUnion("provider", [
+const hostedManagedTargetConfigSchema = z$1.discriminatedUnion("provider", [
 	clickhouseTargetConfigSchema,
 	rabbitmqTargetConfigSchema,
 	milvusTargetConfigSchema,
@@ -1969,12 +1979,230 @@ const managedTargetConfigSchema = z$1.discriminatedUnion("provider", [
 	tailscaleTargetConfigSchema,
 	elasticsearchTargetConfigSchema
 ]);
+function hasLocalServiceEndpoint(provider) {
+	return [
+		"milvus",
+		"rabbitmq",
+		"clickhouse",
+		"elasticsearch"
+	].includes(provider);
+}
+/** Reuse the provider's existing permission validation without accepting a
+* remotely supplied destination for a locally held administrator credential. */
+function customerSettingsAsHosted(provider, settings) {
+	const endpoint = typeof settings.endpoint === "string" ? settings.endpoint : void 0;
+	if (hasLocalServiceEndpoint(provider) && endpoint !== void 0) {
+		const url = new URL(z$1.string().parse(endpoint));
+		if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) throw new Error("Use an HTTPS service endpoint without credentials.");
+	}
+	const normalized = hostedManagedTargetConfigSchema.parse({
+		...settings,
+		provider,
+		executor: "in_do",
+		...hasLocalServiceEndpoint(provider) ? { endpoint: "https://customer-service.example.com" } : {}
+	});
+	return endpoint === void 0 ? normalized : {
+		...normalized,
+		endpoint
+	};
+}
+/** Permissions remain configured in Seekrit; destination and admin secret stay local. */
+const remoteManagedTargetConfigSchema = z$1.object({
+	provider: z$1.enum(MANAGED_LEASE_KINDS),
+	executor: z$1.literal("remote"),
+	provisionerId: z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/).optional(),
+	transport: z$1.enum(["push", "pull"]).default("push"),
+	provisionerUrl: managedEndpointSchema.optional(),
+	settings: z$1.record(z$1.string(), z$1.unknown()),
+	maxTtlSeconds: managedTtlSchema
+}).strict().superRefine((config, ctx) => {
+	if (!config.provisionerId && config.transport === "push" && !config.provisionerUrl) ctx.addIssue({
+		code: "custom",
+		path: ["provisionerUrl"],
+		message: "HTTPS mode requires a provisioner URL"
+	});
+	if (config.transport === "pull" && config.provisionerUrl) ctx.addIssue({
+		code: "custom",
+		path: ["provisionerUrl"],
+		message: "outbound mode does not use a provisioner URL"
+	});
+	if ([
+		"provider",
+		"executor",
+		"maxTtlSeconds"
+	].some((key) => key in config.settings)) {
+		ctx.addIssue({
+			code: "custom",
+			path: ["settings"],
+			message: "settings contain a reserved field"
+		});
+		return;
+	}
+	try {
+		if (!config.provisionerId && config.settings.endpoint !== void 0) throw new Error("Register a provisioner to configure its endpoint in Seekrit.");
+		if (config.provisionerId && hasLocalServiceEndpoint(config.provider) && !config.settings.endpoint) throw new Error("Configure the service endpoint in Seekrit.");
+		customerSettingsAsHosted(config.provider, config.settings);
+	} catch (error) {
+		if (error instanceof z$1.ZodError) for (const issue of error.issues) ctx.addIssue({
+			code: "custom",
+			path: ["settings", ...issue.path],
+			message: issue.message
+		});
+		else ctx.addIssue({
+			code: "custom",
+			path: ["settings"],
+			message: "invalid service settings"
+		});
+	}
+}).transform((config) => {
+	const normalized = customerSettingsAsHosted(config.provider, config.settings);
+	return {
+		...config,
+		settings: Object.fromEntries(Object.entries(normalized).filter(([key]) => ![
+			"provider",
+			"executor",
+			"maxTtlSeconds"
+		].includes(key) && (key !== "endpoint" || config.settings.endpoint !== void 0)))
+	};
+});
+const managedTargetConfigSchema = z$1.union([hostedManagedTargetConfigSchema, remoteManagedTargetConfigSchema]);
 function isManagedLeaseKind(value) {
 	return MANAGED_LEASE_KINDS.includes(value);
 }
 function isManagedTarget(value) {
 	return isManagedLeaseKind(value.provider);
 }
+const id = z$1.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/);
+const timestamp = z$1.number().int().nonnegative().safe();
+const provisionerPrincipalSchema = z$1.object({
+	type: z$1.enum(["user", "service_token"]),
+	id,
+	publicKeyJwk: z$1.string().min(1).max(1024)
+}).strict();
+const provisionerBootstrapSchema = z$1.object({
+	version: z$1.literal(1),
+	orgId: id,
+	provisionerId: id,
+	authority: provisionerPrincipalSchema,
+	createdAt: timestamp
+}).strict();
+const provisionerGrantSchema = z$1.object({
+	version: z$1.literal(1),
+	id,
+	orgId: id,
+	provisionerId: id,
+	principal: provisionerPrincipalSchema,
+	targets: z$1.array(id.or(z$1.literal("*"))).min(1).max(100),
+	manage: z$1.boolean(),
+	issuedAt: timestamp,
+	expiresAt: timestamp
+}).strict();
+const provisionerChainSchema = z$1.object({
+	bootstrap: z$1.string().max(4096).startsWith("pb1."),
+	grants: z$1.array(z$1.string().max(4096).startsWith("pg1.")).max(3)
+}).strict();
+z$1.object({
+	version: z$1.literal(1),
+	orgId: id,
+	provisionerId: id,
+	targetId: id,
+	provider: id,
+	leaseId: id,
+	instanceId: id,
+	nonce: id,
+	targetDigest: z$1.string().regex(/^[A-Za-z0-9_-]{43}$/),
+	action: z$1.unknown(),
+	recipientPublicKey: z$1.string().max(1024).optional(),
+	issuedAt: timestamp,
+	expiresAt: timestamp
+}).strict();
+const provisionerAuthorizationSchema = provisionerChainSchema.extend({ proof: z$1.string().max(16384).startsWith("pr1.") });
+const utf8 = new TextEncoder();
+function b64(bytes) {
+	return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function unb64(value) {
+	if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("Invalid authorization encoding");
+	return Uint8Array.from(atob(value.replaceAll("-", "+").replaceAll("_", "/")), (c) => c.charCodeAt(0));
+}
+function readProvisionerEnvelope(envelope, prefix) {
+	const parts = envelope.split(".");
+	if (envelope.length > 16384 || parts.length !== 3 || parts[0] !== prefix) throw new Error("Invalid customer authorization envelope");
+	return JSON.parse(new TextDecoder("utf-8", {
+		fatal: true,
+		ignoreBOM: false
+	}).decode(unb64(parts[1] ?? "")));
+}
+function provisionerPublicKey(value) {
+	const jwk = JSON.parse(value);
+	if (jwk.kty !== "EC" || jwk.crv !== "P-256" || !jwk.x || !jwk.y || jwk.d) throw new Error("Customer authorization requires a public P-256 key");
+	return {
+		kty: "EC",
+		crv: "P-256",
+		x: jwk.x,
+		y: jwk.y
+	};
+}
+async function signProvisionerEnvelope(prefix, key, payload) {
+	const encoded = b64(utf8.encode(JSON.stringify(payload)));
+	const signature = await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, key, utf8.encode(`${prefix}\n${encoded}`));
+	return `${prefix}.${encoded}.${b64(new Uint8Array(signature))}`;
+}
+async function verifyProvisionerEnvelope(envelope, prefix, publicKeyJwk) {
+	const payload = readProvisionerEnvelope(envelope, prefix);
+	const [, encoded, signature] = envelope.split(".");
+	const key = await crypto.subtle.importKey("jwk", provisionerPublicKey(publicKeyJwk), {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	if (!await crypto.subtle.verify({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, key, unb64(signature ?? ""), utf8.encode(`${prefix}\n${encoded}`))) throw new Error("Invalid customer authorization signature");
+	return payload;
+}
+/** The API compares bootstrap to its registration; the Rust service additionally
+* verifies its MAC with a root-derived key unavailable to the API. */
+async function verifyProvisionerChain(chain, orgId, provisionerId, now = Date.now()) {
+	provisionerChainSchema.parse(chain);
+	const root = provisionerBootstrapSchema.parse(readProvisionerEnvelope(chain.bootstrap, "pb1"));
+	if (root.orgId !== orgId || root.provisionerId !== provisionerId || root.authority.type !== "user") throw new Error("Customer authorization belongs to another provisioner");
+	provisionerPublicKey(root.authority.publicKeyJwk);
+	let access = {
+		principal: root.authority,
+		targets: ["*"],
+		manage: true,
+		expiresAt: Number.MAX_SAFE_INTEGER,
+		chain
+	};
+	for (const envelope of chain.grants) {
+		if (!access.manage) throw new Error("This permission cannot delegate access");
+		const grant = provisionerGrantSchema.parse(await verifyProvisionerEnvelope(envelope, "pg1", access.principal.publicKeyJwk));
+		if (grant.orgId !== orgId || grant.provisionerId !== provisionerId || grant.issuedAt > now + 3e5 || grant.expiresAt <= now || grant.expiresAt <= grant.issuedAt || grant.expiresAt - grant.issuedAt > 7776e6 || grant.expiresAt > access.expiresAt || !grant.targets.every((t) => access.targets.includes("*") || access.targets.includes(t)) || grant.manage && grant.principal.type !== "user") throw new Error("Expired or invalid customer access grant");
+		provisionerPublicKey(grant.principal.publicKeyJwk);
+		access = {
+			principal: grant.principal,
+			targets: grant.targets,
+			manage: grant.manage,
+			expiresAt: grant.expiresAt,
+			chain
+		};
+	}
+	return access;
+}
+/** Targets carry their templates inside encrypted configuration. */
+function provisionerTransportAction(action) {
+	if (action.kind === "sql") return {
+		kind: "sql",
+		statements: [],
+		parameters: action.parameters
+	};
+	if (action.kind === "ssh-sign") return action;
+	return { kind: "noop" };
+}
 z$1.enum([
 	"postgres",
 	"mysql",
@@ -2052,7 +2280,12 @@ const awsRegionSchema$1 = z$1.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must
 * documented safe set and bound the length.
 */
 const awsExternalIdSchema = z$1.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
-z$1.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
+/**
+* An STS session name stamped onto the assumed-role credential (and surfaced in
+* CloudTrail). We derive it from the lease id, so this is a sanity gate matching
+* the AWS-documented pattern.
+*/
+const awsRoleSessionNameSchema = z$1.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
 /**
 * A GCP service-account email the broker is allowed to impersonate (or that
 * appears in a delegation chain). Structurally validated and bounded: it is
@@ -2083,7 +2316,14 @@ const p256PublicKeyJwkSchema = z$1.string().max(2048).refine((s) => {
 		return false;
 	}
 }, "must be a JWK-serialized P-256 public key");
-z$1.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1–64 chars of [A-Za-z0-9_-]");
+/**
+* A MongoDB user name. Derived from the lease id (so it's server-chosen, not
+* user input), but validated as a strict token anyway: MongoDB user documents
+* are structured BSON — there is no string interpolation to inject into — yet a
+* bounded `[A-Za-z0-9_.-]` name keeps the created principal readable in
+* `db.getUsers()` and free of the `.`/`$` characters Mongo reserves.
+*/
+const mongoUserNameSchema = z$1.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1–64 chars of [A-Za-z0-9_-]");
 /**
 * A MongoDB database name — the db a preset role is granted on, or the
 * authentication database a leased user is created in. MongoDB forbids
@@ -2124,6 +2364,11 @@ const mongoAccessLevelSchema = z$1.enum([
 	"readwrite",
 	"custom"
 ]);
+/** The built-in MongoDB role each preset grants on the target database. */
+const MONGO_PRESET_ROLES = {
+	readonly: "read",
+	readwrite: "readWrite"
+};
 const connectionSchema = z$1.object({
 	host: z$1.string().min(1),
 	port: z$1.number().int().min(1).max(65535),
@@ -2134,6 +2379,8 @@ const statementSchema$1 = z$1.string().min(1).max(4e3);
 /** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
 const identifierSchema = z$1.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
 const postgresTargetConfigSchema = z$1.object({
+	tls: z$1.boolean().optional(),
+	provisionerId: z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/).optional(),
 	provider: z$1.literal("postgres"),
 	executor: executorModeSchema,
 	accessLevel: postgresAccessLevelSchema.optional(),
@@ -2146,6 +2393,8 @@ const postgresTargetConfigSchema = z$1.object({
 /** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
 const mysqlHostSchema$1 = z$1.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
 const mysqlTargetConfigSchema = z$1.object({
+	tls: z$1.boolean().optional(),
+	provisionerId: z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/).optional(),
 	provider: z$1.literal("mysql"),
 	executor: executorModeSchema,
 	accessLevel: mysqlAccessLevelSchema.optional(),
@@ -2162,6 +2411,7 @@ const redisConnectionSchema = z$1.object({
 	db: z$1.number().int().min(0).max(15).optional()
 });
 const redisTargetConfigSchema = z$1.object({
+	provisionerId: z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/).optional(),
 	provider: z$1.literal("redis"),
 	executor: executorModeSchema,
 	accessLevel: redisAccessLevelSchema.optional(),
@@ -2171,8 +2421,9 @@ const redisTargetConfigSchema = z$1.object({
 	revokeStatements: z$1.array(statementSchema$1).max(16).optional()
 });
 const sshTargetConfigSchema = z$1.object({
+	provisionerId: z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/).optional(),
 	provider: z$1.literal("ssh"),
-	executor: z$1.literal("in_do"),
+	executor: executorModeSchema,
 	caPublicKey: sshPublicKeySchema,
 	allowedPrincipals: z$1.array(sshPrincipalSchema).max(64).optional(),
 	extensions: z$1.array(sshExtensionSchema).max(16).optional(),
@@ -2184,8 +2435,9 @@ const sshTargetConfigSchema = z$1.object({
 });
 const AWS_MAX_TTL_SECONDS = 43200;
 const awsTargetConfigSchema = z$1.object({
+	provisionerId: z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/).optional(),
 	provider: z$1.literal("aws"),
-	executor: z$1.literal("in_do"),
+	executor: executorModeSchema,
 	roleArn: awsRoleArnSchema,
 	region: awsRegionSchema$1,
 	externalId: awsExternalIdSchema.optional(),
@@ -2194,16 +2446,18 @@ const awsTargetConfigSchema = z$1.object({
 });
 const GCP_MAX_TTL_SECONDS = 43200;
 const gcpTargetConfigSchema = z$1.object({
+	provisionerId: z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/).optional(),
 	provider: z$1.literal("gcp"),
-	executor: z$1.literal("in_do"),
+	executor: executorModeSchema,
 	serviceAccount: gcpServiceAccountEmailSchema,
 	scopes: z$1.array(gcpOauthScopeSchema).min(1).max(32).optional(),
 	delegates: z$1.array(gcpServiceAccountEmailSchema).max(8).optional(),
 	maxTtlSeconds: z$1.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
 });
 const mongoTargetConfigSchema = z$1.object({
+	provisionerId: z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/).optional(),
 	provider: z$1.literal("mongodb"),
-	executor: z$1.literal("in_do"),
+	executor: executorModeSchema,
 	accessLevel: mongoAccessLevelSchema.optional(),
 	connection: connectionSchema,
 	authSource: mongoDatabaseNameSchema.optional(),
@@ -2211,7 +2465,7 @@ const mongoTargetConfigSchema = z$1.object({
 	tls: z$1.boolean().optional(),
 	maxTtlSeconds: z$1.number().int().min(60).max(604800).optional()
 });
-const leaseTargetConfigSchema = z$1.discriminatedUnion("provider", [
+const leaseTargetConfigSchema = z$1.union([
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
 	redisTargetConfigSchema,
@@ -2219,9 +2473,26 @@ const leaseTargetConfigSchema = z$1.discriminatedUnion("provider", [
 	awsTargetConfigSchema,
 	gcpTargetConfigSchema,
 	mongoTargetConfigSchema,
-	...managedTargetConfigSchema.options
-]);
+	managedTargetConfigSchema
+]).superRefine((config, ctx) => {
+	if (config.executor === "remote" && [
+		"ssh",
+		"aws",
+		"gcp",
+		"mongodb"
+	].includes(config.provider) && !("provisionerId" in config && config.provisionerId)) ctx.addIssue({
+		code: "custom",
+		path: ["provisionerId"],
+		message: "Select a registered customer provisioner."
+	});
+	if ("provisionerId" in config && config.provisionerId && config.executor !== "remote") ctx.addIssue({
+		code: "custom",
+		path: ["executor"],
+		message: "A provisioner target must run in your network."
+	});
+});
 z$1.object({
+	id: z$1.string().regex(/^lt_[A-Za-z0-9_-]{24}$/).optional(),
 	name: z$1.string().trim().min(1).max(128),
 	config: leaseTargetConfigSchema,
 	/**
@@ -2230,7 +2501,7 @@ z$1.object({
 	* control plane stores only this ciphertext — it never sees the plaintext.
 	*/
 	wrappedAdminSecret: z$1.string().min(1)
-});
+}).refine((v) => !("provisionerId" in v.config && v.config.provisionerId) || v.wrappedAdminSecret.startsWith("wd1.") && v.wrappedAdminSecret.length <= 49152, "Encrypted provisioner configuration must be a wd1 blob no larger than 48 KiB");
 /** Requested lease lifetime, shared by all providers. */
 const ttlSecondsSchema = z$1.number().int().min(60).max(604800);
 /**
@@ -2241,6 +2512,7 @@ const ttlSecondsSchema = z$1.number().int().min(60).max(604800);
 const mintPostgresLeaseSchema = z$1.object({
 	provider: z$1.literal("postgres"),
 	targetId: z$1.string().min(1),
+	authorization: provisionerAuthorizationSchema.optional(),
 	roleName: postgresRoleNameSchema,
 	verifier: scramVerifierSchema,
 	ttlSeconds: ttlSecondsSchema
@@ -2253,6 +2525,7 @@ const mintPostgresLeaseSchema = z$1.object({
 const mintMysqlLeaseSchema = z$1.object({
 	provider: z$1.literal("mysql"),
 	targetId: z$1.string().min(1),
+	authorization: provisionerAuthorizationSchema.optional(),
 	roleName: mysqlUserNameSchema,
 	verifier: mysqlNativeVerifierSchema,
 	ttlSeconds: ttlSecondsSchema
@@ -2265,6 +2538,7 @@ const mintMysqlLeaseSchema = z$1.object({
 const mintRedisLeaseSchema = z$1.object({
 	provider: z$1.literal("redis"),
 	targetId: z$1.string().min(1),
+	authorization: provisionerAuthorizationSchema.optional(),
 	roleName: redisUserNameSchema,
 	verifier: redisSha256VerifierSchema,
 	ttlSeconds: ttlSecondsSchema
@@ -2277,6 +2551,7 @@ const mintRedisLeaseSchema = z$1.object({
 const mintSshLeaseSchema = z$1.object({
 	provider: z$1.literal("ssh"),
 	targetId: z$1.string().min(1),
+	authorization: provisionerAuthorizationSchema.optional(),
 	publicKey: sshPublicKeySchema,
 	principals: z$1.array(sshPrincipalSchema).min(1).max(32),
 	ttlSeconds: ttlSecondsSchema
@@ -2293,6 +2568,7 @@ const mintSshLeaseSchema = z$1.object({
 const mintAwsLeaseSchema = z$1.object({
 	provider: z$1.literal("aws"),
 	targetId: z$1.string().min(1),
+	authorization: provisionerAuthorizationSchema.optional(),
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: z$1.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
 });
@@ -2309,6 +2585,7 @@ const mintAwsLeaseSchema = z$1.object({
 const mintGcpLeaseSchema = z$1.object({
 	provider: z$1.literal("gcp"),
 	targetId: z$1.string().min(1),
+	authorization: provisionerAuthorizationSchema.optional(),
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: z$1.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
 });
@@ -2322,12 +2599,14 @@ const mintGcpLeaseSchema = z$1.object({
 const mintMongoLeaseSchema = z$1.object({
 	provider: z$1.literal("mongodb"),
 	targetId: z$1.string().min(1),
+	authorization: provisionerAuthorizationSchema.optional(),
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: ttlSecondsSchema
 });
 const mintManagedLeaseSchema = z$1.object({
 	provider: z$1.enum(MANAGED_LEASE_KINDS),
 	targetId: z$1.string().min(1),
+	authorization: provisionerAuthorizationSchema.optional(),
 	recipientPublicKey: p256PublicKeyJwkSchema.refine((value) => {
 		try {
 			return !("d" in JSON.parse(value));
@@ -2347,6 +2626,57 @@ z$1.discriminatedUnion("provider", [
 	mintMongoLeaseSchema,
 	mintManagedLeaseSchema
 ]);
+// ../../packages/core/src/providers/aws.ts
+/**
+* Tier-2 AWS provider. Unlike the verifier-injection providers, the target
+* (AWS/STS) mints the credential itself, so `render` cannot produce a
+* zero-knowledge verifier — instead it produces an {@link AwsStsSpec} the broker
+* executor runs: assume `roleArn` via STS, then wrap the returned credential to
+* the consumer's ephemeral public key before returning it. `render` stays pure
+* and secret-free (it never touches the admin credential or the network); the
+* consumer's private key never leaves their machine, so the plaintext
+* credential is only ever decryptable there.
+*
+* Revocation is a no-op: STS session credentials can't be revoked individually,
+* so v1 relies on the short `DurationSeconds` STS itself enforces — exactly like
+* the SSH provider's short-TTL certificates.
+*/
+/** Clamp a requested TTL into STS's `DurationSeconds` window and the target's cap. */
+function clampDuration(requested, maxTtlSeconds) {
+	return Math.max(900, Math.min(requested, Math.min(maxTtlSeconds ?? 43200, AWS_MAX_TTL_SECONDS)));
+}
+const awsProvider = {
+	kind: "aws",
+	zkTier: 2,
+	render(config, req, ctx) {
+		if (req.provider !== "aws") throw new Error("aws provider received a non-aws request");
+		const cfg = config;
+		awsRoleArnSchema.parse(cfg.roleArn);
+		p256PublicKeyJwkSchema.parse(req.recipientPublicKey);
+		const roleSessionName = awsRoleSessionNameSchema.parse(ctx.leaseId);
+		const durationSeconds = clampDuration(req.ttlSeconds, cfg.maxTtlSeconds);
+		return {
+			resourceRef: roleSessionName,
+			expiresAt: new Date(ctx.nowMs + durationSeconds * 1e3).toISOString(),
+			provision: {
+				kind: "aws-sts",
+				spec: {
+					roleArn: cfg.roleArn,
+					roleSessionName,
+					durationSeconds,
+					region: cfg.region,
+					externalId: cfg.externalId,
+					policy: cfg.sessionPolicy,
+					recipientPublicKey: req.recipientPublicKey
+				}
+			},
+			revoke: { kind: "noop" }
+		};
+	},
+	renderRevoke() {
+		return { kind: "noop" };
+	}
+};
 /**
 * The one-time IAM setup an admin performs so seekrit can assume the target
 * role. Analogue of `sshHostSetupInstructions` / `postgresGroupBootstrapSql` —
@@ -2373,6 +2703,59 @@ function awsTrustPolicyInstructions(config) {
 		`# on ${config.roleArn}. seekrit only ever calls AssumeRole on this role.`
 	].join("\n");
 }
+// ../../packages/core/src/providers/gcp.ts
+/**
+* Tier-2 GCP provider. Like {@link awsProvider}, the target (GCP's IAM
+* Credentials API) mints the credential itself, so `render` cannot produce a
+* zero-knowledge verifier — instead it produces a {@link GcpImpersonateSpec} the
+* broker executor runs: impersonate `serviceAccount` via `generateAccessToken`,
+* then wrap the returned OAuth token to the consumer's ephemeral public key
+* before returning it. `render` stays pure and secret-free (it never touches the
+* admin key or the network); the consumer's private key never leaves their
+* machine, so the plaintext token is only ever decryptable there.
+*
+* Revocation is a no-op: short-lived access tokens can't be revoked
+* individually, so v1 relies on the short `lifetime` GCP itself enforces —
+* exactly like the AWS and SSH providers.
+*/
+/** The default scope when a target sets none — full API access, IAM-scoped. */
+const GCP_DEFAULT_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+/** Clamp a requested TTL into GCP's `lifetime` window and the target's cap. */
+function clampLifetime(requested, maxTtlSeconds) {
+	return Math.max(60, Math.min(requested, Math.min(maxTtlSeconds ?? 43200, GCP_MAX_TTL_SECONDS)));
+}
+const gcpProvider = {
+	kind: "gcp",
+	zkTier: 2,
+	render(config, req, ctx) {
+		if (req.provider !== "gcp") throw new Error("gcp provider received a non-gcp request");
+		const cfg = config;
+		gcpServiceAccountEmailSchema.parse(cfg.serviceAccount);
+		p256PublicKeyJwkSchema.parse(req.recipientPublicKey);
+		const scopes = cfg.scopes?.length ? cfg.scopes : [GCP_DEFAULT_SCOPE];
+		for (const scope of scopes) gcpOauthScopeSchema.parse(scope);
+		const lifetimeSeconds = clampLifetime(req.ttlSeconds, cfg.maxTtlSeconds);
+		const expiresAt = new Date(ctx.nowMs + lifetimeSeconds * 1e3).toISOString();
+		return {
+			resourceRef: cfg.serviceAccount,
+			expiresAt,
+			provision: {
+				kind: "gcp-iam",
+				spec: {
+					serviceAccount: cfg.serviceAccount,
+					scopes,
+					lifetimeSeconds,
+					delegates: cfg.delegates,
+					recipientPublicKey: req.recipientPublicKey
+				}
+			},
+			revoke: { kind: "noop" }
+		};
+	},
+	renderRevoke() {
+		return { kind: "noop" };
+	}
+};
 /**
 * The one-time IAM setup an admin performs so seekrit can impersonate the target
 * service account. Analogue of `awsTrustPolicyInstructions` — printed for the
@@ -2394,6 +2777,145 @@ function gcpSetupInstructions(config) {
 		"gcloud services enable iamcredentials.googleapis.com"
 	].join("\n");
 }
+// ../../packages/core/src/providers/managed.ts
+function managedLeaseProvider(kind) {
+	return {
+		kind,
+		zkTier: 2,
+		render(target, request, context) {
+			const config = managedTargetConfigSchema.parse(target);
+			if (config.provider !== kind || request.provider !== kind || !("recipientPublicKey" in request)) throw new Error("managed credential provider mismatch");
+			p256PublicKeyJwkSchema.parse(request.recipientPublicKey);
+			const name = `sk_${context.leaseId}`;
+			if (!/^sk_[a-zA-Z0-9_-]{1,64}$/.test(name)) throw new Error("invalid lease id");
+			const ttl = Math.min(request.ttlSeconds, config.maxTtlSeconds ?? 604800);
+			const expiresAt = new Date(context.nowMs + ttl * 1e3).toISOString();
+			const spec = {
+				config,
+				name,
+				expiresAt,
+				recipientPublicKey: request.recipientPublicKey
+			};
+			return {
+				resourceRef: name,
+				expiresAt,
+				provision: {
+					kind: "managed-credential",
+					spec
+				},
+				revoke: {
+					kind: "managed-credential",
+					spec: {
+						...spec,
+						recipientPublicKey: ""
+					}
+				}
+			};
+		},
+		renderRevoke(target, resourceRef) {
+			const config = managedTargetConfigSchema.parse(target);
+			if (config.provider !== kind || !/^sk_[a-zA-Z0-9_-]{1,64}$/.test(resourceRef)) throw new Error("invalid managed credential revoke");
+			return {
+				kind: "managed-credential",
+				spec: {
+					config,
+					name: resourceRef,
+					recipientPublicKey: "",
+					expiresAt: ""
+				}
+			};
+		}
+	};
+}
+// ../../packages/core/src/providers/mongodb.ts
+/**
+* Tier-2 MongoDB provider. Unlike the verifier-injection providers, MongoDB's
+* `createUser` hashes the password *server-side* (there is no supported path to
+* inject a precomputed SCRAM credential), so `render` cannot produce a
+* zero-knowledge verifier. Instead it produces a {@link MongoUserSpec} the
+* broker executor runs: generate a password, `createUser` with the preset
+* roles, then wrap the credential to the consumer's ephemeral public key before
+* returning it. `render` stays pure and secret-free — it never generates the
+* password, touches the admin credential, or hits the network; the consumer's
+* private key never leaves their machine, so the plaintext credential is only
+* ever decryptable there.
+*
+* Revocation is real (unlike AWS/SSH): the broker's alarm-driven `dropUser` ends
+* the lease. Access levels map to MongoDB's built-in roles — `read` /
+* `readWrite` on the target database — or an explicit `roles` array for custom.
+*/
+/** Clamp a requested TTL to the target's optional cap. */
+function clampTtl(requested, maxTtlSeconds) {
+	return maxTtlSeconds ? Math.min(requested, maxTtlSeconds) : requested;
+}
+/** The role grants a target's access level maps to. Defaults to read-only. */
+function rolesFor(config) {
+	const db = config.connection.database;
+	if (config.accessLevel === "custom") {
+		if (!config.roles || config.roles.length === 0) throw new Error("mongodb custom target requires a non-empty roles array");
+		return config.roles;
+	}
+	const preset = config.accessLevel === "readwrite" ? "readwrite" : "readonly";
+	return [{
+		role: MONGO_PRESET_ROLES[preset],
+		db
+	}];
+}
+const mongoProvider = {
+	kind: "mongodb",
+	zkTier: 2,
+	render(config, req, ctx) {
+		if (config.provider !== "mongodb") throw new Error("mongoProvider given a non-mongodb config");
+		if (req.provider !== "mongodb") throw new Error("mongo provider received a non-mongodb request");
+		p256PublicKeyJwkSchema.parse(req.recipientPublicKey);
+		const username = mongoUserNameSchema.parse(ctx.leaseId);
+		const authSource = mongoDatabaseNameSchema.parse(config.authSource ?? "admin");
+		const database = mongoDatabaseNameSchema.parse(config.connection.database);
+		const roles = rolesFor(config);
+		const ttlSeconds = clampTtl(req.ttlSeconds, config.maxTtlSeconds);
+		const expiresAt = new Date(ctx.nowMs + ttlSeconds * 1e3).toISOString();
+		return {
+			resourceRef: username,
+			expiresAt,
+			provision: {
+				kind: "mongo-user",
+				spec: {
+					username,
+					authSource,
+					database,
+					roles,
+					recipientPublicKey: req.recipientPublicKey,
+					expiresAt
+				}
+			},
+			revoke: {
+				kind: "mongo-user",
+				spec: {
+					username,
+					authSource,
+					database: "",
+					roles: [],
+					recipientPublicKey: "",
+					expiresAt: ""
+				}
+			}
+		};
+	},
+	renderRevoke(config, resourceRef) {
+		if (config.provider !== "mongodb") throw new Error("mongoProvider given a non-mongodb config");
+		return {
+			kind: "mongo-user",
+			spec: {
+				username: mongoUserNameSchema.parse(resourceRef),
+				authSource: mongoDatabaseNameSchema.parse(config.authSource ?? "admin"),
+				database: "",
+				roles: [],
+				recipientPublicKey: "",
+				expiresAt: ""
+			}
+		};
+	}
+};
 /**
 * The one-time setup an admin performs so seekrit can provision users: create a
 * dedicated provisioning user with `userAdmin` on the target database (or
@@ -2418,6 +2940,187 @@ function mongoAdminSetupInstructions(config) {
 		`//   --uri "mongodb://seekrit_provisioner:<pwd>@${config.connection.host}:${config.connection.port}/?authSource=${authSource}"`
 	].join("\n");
 }
+// ../../packages/core/src/providers/mysql.ts
+/**
+* Tier-1 MySQL/MariaDB provider. The consumer generated the password and its
+* `mysql_native_password` verifier locally (see @seekrit/crypto
+* `mysqlNativePasswordVerifier`); we only ever see the verifier, which
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<hash>'` stores
+* verbatim and which cannot be used to authenticate (login is a
+* challenge-response needing a `SHA1(password)` preimage). So the handed-out
+* credential is zero-knowledge end to end — the provider merely renders SQL.
+*
+* Unlike Postgres there is no account-level `VALID UNTIL`: the broker's
+* alarm-driven `DROP USER` is the sole expiry mechanism. Preset access levels
+* apply inline `GRANT`s (MySQL roles need activation, an awkward fit for a
+* plain connection URL), so there is no shared group role / setup SQL.
+*/
+const DEFAULT_HOST = "%";
+/** Mirror of the registration-time host schema (render must not trust inputs). */
+const HOST_RE = /^[A-Za-z0-9_.%:-]{1,255}$/;
+/** Escape a backtick-quoted identifier by doubling backticks. */
+function ident(name) {
+	return name.replace(/`/g, "``");
+}
+function render$2(template, vars) {
+	return template.replace(/\{\{(name|verifier)\}\}/g, (_, key) => key === "name" ? vars.name : vars.verifier);
+}
+/**
+* Concrete create/revoke templates for a target. Presets synthesize a
+* `CREATE USER` plus an inline `GRANT` scoped to the target database; custom
+* (or a legacy target with no access level) uses the admin's statements,
+* falling back to a bare CREATE USER / DROP USER. Host and database come from
+* the (trusted, registration-validated) config and are baked in directly;
+* only `{{name}}`/`{{verifier}}` remain as per-lease placeholders.
+*/
+function statementsFor$2(config) {
+	const account = `'{{name}}'@'${config.userHost && HOST_RE.test(config.userHost) ? config.userHost : DEFAULT_HOST}'`;
+	const create = `CREATE USER ${account} IDENTIFIED WITH mysql_native_password AS '{{verifier}}';`;
+	const revoke = `DROP USER IF EXISTS ${account};`;
+	if (config.accessLevel === "readonly" || config.accessLevel === "readwrite") {
+		const db = ident(config.connection.database);
+		return {
+			create: [create, `GRANT ${config.accessLevel === "readonly" ? "SELECT" : "SELECT, INSERT, UPDATE, DELETE"} ON \`${db}\`.* TO ${account};`],
+			revoke: [revoke]
+		};
+	}
+	return {
+		create: config.createStatements ?? [create],
+		revoke: config.revokeStatements ?? [revoke]
+	};
+}
+const mysqlProvider = {
+	kind: "mysql",
+	zkTier: 1,
+	render(config, req, ctx) {
+		if (config.provider !== "mysql") throw new Error("mysqlProvider given a non-mysql config");
+		if (req.provider !== "mysql") throw new Error("mysql provider received a non-mysql request");
+		mysqlUserNameSchema.parse(req.roleName);
+		mysqlNativeVerifierSchema.parse(req.verifier);
+		const expiresAt = new Date(ctx.nowMs + req.ttlSeconds * 1e3).toISOString();
+		const vars = {
+			name: req.roleName,
+			verifier: req.verifier
+		};
+		const { create, revoke } = statementsFor$2(config);
+		const parameters = config.executor === "remote" && config.provisionerId ? { parameters: {
+			name: req.roleName,
+			verifier: req.verifier,
+			validUntil: expiresAt
+		} } : {};
+		return {
+			resourceRef: req.roleName,
+			expiresAt,
+			provision: {
+				kind: "sql",
+				...parameters,
+				statements: create.map((s) => render$2(s, vars))
+			},
+			revoke: {
+				kind: "sql",
+				...parameters,
+				statements: revoke.map((s) => render$2(s, {
+					name: req.roleName,
+					verifier: ""
+				}))
+			}
+		};
+	},
+	renderRevoke(config, resourceRef) {
+		if (config.provider !== "mysql") throw new Error("mysqlProvider given a non-mysql config");
+		mysqlUserNameSchema.parse(resourceRef);
+		return {
+			kind: "sql",
+			statements: statementsFor$2(config).revoke.map((s) => render$2(s, {
+				name: resourceRef,
+				verifier: ""
+			}))
+		};
+	}
+};
+// ../../packages/core/src/providers/postgres.ts
+/**
+* Tier-1 Postgres provider. The consumer generated the password and its SCRAM
+* verifier locally (see @seekrit/crypto `scramSha256Verifier`); we only ever
+* see the verifier, which `CREATE ROLE … PASSWORD` stores verbatim and which
+* cannot be used to authenticate. So the handed-out credential is
+* zero-knowledge end to end — the provider merely renders SQL.
+*
+* Per-lease inputs are strict tokens (validated role name + verifier) and the
+* SQL is either an admin-configured template (custom) or derived from a preset
+* access level backed by a shared group role, so substitution cannot inject SQL.
+*/
+const DEFAULT_CREATE$1 = [`CREATE ROLE "{{name}}" LOGIN PASSWORD '{{verifier}}' VALID UNTIL '{{valid_until}}';`];
+const DEFAULT_REVOKE$1 = [`DROP ROLE IF EXISTS "{{name}}";`];
+function render$1(template, vars) {
+	return template.replace(/\{\{(name|verifier|valid_until)\}\}/g, (_, key) => vars[key] ?? "");
+}
+/**
+* The concrete create/revoke templates for a target. Read-only and read-write
+* create the temp role `IN ROLE <group>` so it inherits the group's grants;
+* custom (or a legacy target with no access level) uses the admin's statements,
+* falling back to a bare CREATE ROLE.
+*/
+function statementsFor$1(config) {
+	if (config.accessLevel === "readonly" || config.accessLevel === "readwrite") return {
+		create: [`CREATE ROLE "{{name}}" LOGIN PASSWORD '{{verifier}}' VALID UNTIL '{{valid_until}}' IN ROLE ${POSTGRES_GROUP_ROLES[config.accessLevel]};`],
+		revoke: DEFAULT_REVOKE$1
+	};
+	return {
+		create: config.createStatements ?? DEFAULT_CREATE$1,
+		revoke: config.revokeStatements ?? DEFAULT_REVOKE$1
+	};
+}
+const postgresProvider = {
+	kind: "postgres",
+	zkTier: 1,
+	render(config, req, ctx) {
+		if (req.provider !== "postgres") throw new Error("postgres provider received a non-postgres request");
+		postgresRoleNameSchema.parse(req.roleName);
+		scramVerifierSchema.parse(req.verifier);
+		const expiresAt = new Date(ctx.nowMs + req.ttlSeconds * 1e3).toISOString();
+		const vars = {
+			name: req.roleName,
+			verifier: req.verifier,
+			valid_until: expiresAt
+		};
+		const { create, revoke } = statementsFor$1(config);
+		const parameters = config.executor === "remote" && config.provisionerId ? { parameters: {
+			name: req.roleName,
+			verifier: req.verifier,
+			validUntil: expiresAt
+		} } : {};
+		return {
+			resourceRef: req.roleName,
+			expiresAt,
+			provision: {
+				kind: "sql",
+				...parameters,
+				statements: create.map((s) => render$1(s, vars))
+			},
+			revoke: {
+				kind: "sql",
+				...parameters,
+				statements: revoke.map((s) => render$1(s, {
+					name: req.roleName,
+					verifier: "",
+					valid_until: ""
+				}))
+			}
+		};
+	},
+	renderRevoke(config, resourceRef) {
+		postgresRoleNameSchema.parse(resourceRef);
+		return {
+			kind: "sql",
+			statements: statementsFor$1(config).revoke.map((s) => render$1(s, {
+				name: resourceRef,
+				verifier: "",
+				valid_until: ""
+			}))
+		};
+	}
+};
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
 * read-only / read-write target's leased credentials inherit. Idempotent (safe
@@ -2448,6 +3151,156 @@ function postgresGroupBootstrapSql(config) {
 	if (config.accessLevel === "readwrite") lines.push(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO ${group};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE, SELECT ON SEQUENCES TO ${group};`);
 	return lines.join("\n");
 }
+// ../../packages/core/src/providers/redis.ts
+/**
+* Tier-1 Redis (6+) provider. The consumer generated the password and its
+* SHA-256 hex digest locally (see @seekrit/crypto `redisSha256Verifier`); we
+* only ever see the digest, which `ACL SETUSER … on #<hex>` stores verbatim and
+* which cannot be used to authenticate (Redis `AUTH` hashes the plaintext it
+* receives and compares, so the stored digest is a preimage). So the handed-out
+* credential is zero-knowledge end to end — the provider merely renders
+* commands.
+*
+* Unlike Postgres there is no account-level expiry: the broker's alarm-driven
+* `ACL DELUSER` is the sole expiry mechanism (as with MySQL). Preset access
+* levels apply inline ACL rules (Redis ACL has no role inheritance), so there is
+* no shared group role / setup step.
+*
+* Each rendered statement is a single Redis command line; the executor
+* whitespace-tokenizes it into RESP arguments. The per-lease inputs are strict
+* tokens (validated user name + hex digest) with no whitespace or ACL-rule
+* characters, so substitution cannot inject an extra argument or permission.
+*/
+const DEFAULT_CREATE = ["ACL SETUSER {{name}} on #{{verifier}}"];
+const DEFAULT_REVOKE = ["ACL DELUSER {{name}}"];
+/**
+* Inline ACL rules each preset grants: all keys (`~*`), the read (or read+write)
+* command category, and `+@connection` so client-handshake commands (HELLO,
+* PING, AUTH) work. No pub/sub channels (`&*`) — the categories don't enable
+* pub/sub anyway, and `&*` needs Redis 6.2+.
+*/
+const PRESET_RULES = {
+	readonly: "~* +@read +@connection",
+	readwrite: "~* +@read +@write +@connection"
+};
+function render(template, vars) {
+	return template.replace(/\{\{(name|verifier)\}\}/g, (_, key) => key === "name" ? vars.name : vars.verifier);
+}
+/**
+* Concrete create/revoke command lines for a target. Presets synthesize an
+* `ACL SETUSER` that enables the user (`on`), sets its password digest, and
+* grants the preset's inline rules; custom (or a legacy target with no access
+* level) uses the admin's statements, falling back to a no-privilege user.
+*/
+function statementsFor(config) {
+	if (config.accessLevel === "readonly" || config.accessLevel === "readwrite") return {
+		create: [`ACL SETUSER {{name}} on #{{verifier}} ${PRESET_RULES[config.accessLevel]}`],
+		revoke: DEFAULT_REVOKE
+	};
+	return {
+		create: config.createStatements ?? DEFAULT_CREATE,
+		revoke: config.revokeStatements ?? DEFAULT_REVOKE
+	};
+}
+const redisProvider = {
+	kind: "redis",
+	zkTier: 1,
+	render(config, req, ctx) {
+		if (config.provider !== "redis") throw new Error("redisProvider given a non-redis config");
+		if (req.provider !== "redis") throw new Error("redis provider received a non-redis request");
+		redisUserNameSchema.parse(req.roleName);
+		redisSha256VerifierSchema.parse(req.verifier);
+		const expiresAt = new Date(ctx.nowMs + req.ttlSeconds * 1e3).toISOString();
+		const vars = {
+			name: req.roleName,
+			verifier: req.verifier
+		};
+		const { create, revoke } = statementsFor(config);
+		const parameters = config.executor === "remote" && config.provisionerId ? { parameters: {
+			name: req.roleName,
+			verifier: req.verifier,
+			validUntil: expiresAt
+		} } : {};
+		return {
+			resourceRef: req.roleName,
+			expiresAt,
+			provision: {
+				kind: "sql",
+				...parameters,
+				statements: create.map((s) => render(s, vars))
+			},
+			revoke: {
+				kind: "sql",
+				...parameters,
+				statements: revoke.map((s) => render(s, {
+					name: req.roleName,
+					verifier: ""
+				}))
+			}
+		};
+	},
+	renderRevoke(config, resourceRef) {
+		if (config.provider !== "redis") throw new Error("redisProvider given a non-redis config");
+		redisUserNameSchema.parse(resourceRef);
+		return {
+			kind: "sql",
+			statements: statementsFor(config).revoke.map((s) => render(s, {
+				name: resourceRef,
+				verifier: ""
+			}))
+		};
+	}
+};
+// ../../packages/core/src/providers/ssh.ts
+/**
+* Tier-1 SSH certificate-authority provider. The consumer generated an
+* ephemeral keypair locally and sent only its public key; `render` produces a
+* validated {@link SshCertSpec} that the broker's `SshCaExecutor` signs with the
+* CA key. So render itself is pure and secret-free — it never sees the CA key,
+* and the consumer's private key never leaves their machine.
+*
+* A clock-skew grace is applied to `validAfter` so freshly minted certs work on
+* hosts whose clocks lag slightly. Revocation is a no-op: certificates are
+* self-contained, so v1 relies on short TTLs (a KRL is a follow-up).
+*/
+/** Backdate the validity window so minor host clock skew doesn't reject certs. */
+const CLOCK_SKEW_GRACE_SECONDS = 60;
+const sshProvider = {
+	kind: "ssh",
+	zkTier: 1,
+	render(config, req, ctx) {
+		if (req.provider !== "ssh") throw new Error("ssh provider received a non-ssh request");
+		const cfg = config;
+		sshPublicKeySchema.parse(req.publicKey);
+		const principals = req.principals.map((p) => sshPrincipalSchema.parse(p));
+		if (cfg.allowedPrincipals?.length) {
+			for (const p of principals) if (!cfg.allowedPrincipals.includes(p)) throw new Error(`principal "${p}" is not allowed by this target`);
+		}
+		const ttl = cfg.maxTtlSeconds ? Math.min(req.ttlSeconds, cfg.maxTtlSeconds) : req.ttlSeconds;
+		const nowSec = Math.floor(ctx.nowMs / 1e3);
+		const validAfter = nowSec - CLOCK_SKEW_GRACE_SECONDS;
+		const validBefore = nowSec + ttl;
+		return {
+			resourceRef: ctx.leaseId,
+			expiresAt: (/* @__PURE__ */ new Date(validBefore * 1e3)).toISOString(),
+			provision: {
+				kind: "ssh-sign",
+				spec: {
+					userPublicKey: req.publicKey,
+					keyId: ctx.leaseId,
+					principals,
+					validAfter,
+					validBefore,
+					extensions: cfg.extensions
+				}
+			},
+			revoke: { kind: "noop" }
+		};
+	},
+	renderRevoke() {
+		return { kind: "noop" };
+	}
+};
 /**
 * The one-time host setup an admin runs so a target's certificates are accepted.
 * Analogue of `postgresGroupBootstrapSql` — displayed for the admin to run, not
@@ -2467,6 +3320,57 @@ function sshHostSetupInstructions(config) {
 		"sudo systemctl reload sshd"
 	].join("\n");
 }
+// ../../packages/core/src/providers/index.ts
+/** Registry — new providers register here so callers resolve by kind. */
+const leaseProviders = {
+	postgres: postgresProvider,
+	mysql: mysqlProvider,
+	redis: redisProvider,
+	ssh: sshProvider,
+	aws: awsProvider,
+	gcp: gcpProvider,
+	mongodb: mongoProvider,
+	elasticsearch: managedLeaseProvider("elasticsearch"),
+	clickhouse: managedLeaseProvider("clickhouse"),
+	rabbitmq: managedLeaseProvider("rabbitmq"),
+	milvus: managedLeaseProvider("milvus"),
+	"mongodb-atlas": managedLeaseProvider("mongodb-atlas"),
+	couchbase: managedLeaseProvider("couchbase"),
+	snowflake: managedLeaseProvider("snowflake"),
+	elasticache: managedLeaseProvider("elasticache"),
+	memorydb: managedLeaseProvider("memorydb"),
+	openrouter: managedLeaseProvider("openrouter"),
+	tailscale: managedLeaseProvider("tailscale")
+};
+function leaseProviderFor(kind) {
+	return leaseProviders[kind];
+}
+// ../../packages/core/src/provisioners.ts
+const provisionerIdSchema = z$1.string().regex(/^prv_[A-Za-z0-9_-]{32}$/);
+z$1.object({
+	id: provisionerIdSchema,
+	name: z$1.string().trim().min(1).max(128),
+	transport: z$1.enum(["pull", "push"]).default("pull"),
+	provisionerUrl: managedEndpointSchema.optional(),
+	publicKeyJwk: p256PublicKeyJwkSchema.refine((value) => !("d" in JSON.parse(value)), "Supply only the public key"),
+	wrappedSigningKey: z$1.string().max(16384).startsWith("wd1."),
+	bootstrap: z$1.string().max(4096).startsWith("pb1.")
+}).strict().superRefine((v, ctx) => {
+	if (v.transport === "push" && !v.provisionerUrl) ctx.addIssue({
+		code: "custom",
+		path: ["provisionerUrl"],
+		message: "Inbound mode requires an HTTPS endpoint."
+	});
+	if (v.transport === "pull" && v.provisionerUrl) ctx.addIssue({
+		code: "custom",
+		path: ["provisionerUrl"],
+		message: "Outbound mode does not use an endpoint."
+	});
+});
+function provisionerIdFor(config) {
+	if (!config || typeof config !== "object" || !("executor" in config) || config.executor !== "remote" || !("provisionerId" in config)) return void 0;
+	return typeof config.provisionerId === "string" ? config.provisionerId : void 0;
+}
 // ../../packages/core/src/slug.ts
 /**
 * The slug rule, with no dependencies — so a caller that cannot afford zod (the
@@ -2547,6 +3451,12 @@ const AUDIT_ACTIONS = [
 	"lease.created",
 	"lease.revoked",
 	"lease.expired",
+	"lease.provisioner_job_claimed",
+	"lease.provisioner_registered",
+	"lease.provisioner_access_granted",
+	"lease.provisioner_access_revoked",
+	"lease.provisioner_deleted",
+	"lease.provisioner_job_completed",
 	"log_sink.configured",
 	"log_sink.deleted",
 	"log_sink.test",
@@ -5552,6 +6462,15 @@ function policySignerJwk(publicKeyJwk) {
 		y: jwk.y
 	};
 }
+// ../../packages/crypto/src/provisioner.ts
+async function sealProvisionerTarget(publicKeyJwk, input) {
+	const wrapped = await wrapDek(utf8Encode(JSON.stringify({
+		version: 2,
+		...input
+	})), publicKeyJwk);
+	if (wrapped.length > 49152) throw new Error("Target configuration is too large (48 KiB encrypted limit).");
+	return wrapped;
+}
 // ../../packages/crypto/src/shamir.ts
 /**
 * Shamir's Secret Sharing over GF(2^8) — the same field AES uses, with the
@@ -6140,7 +7059,7 @@ async function createAgentTaskToken() {
 	};
 }
 // package.json
-var version = "2.7.0";
+var version = "2.8.0";
 // ../../packages/api-client/src/index.ts
 /**
 * The proposer's note travels as a header, not a body field: an unprotected
@@ -6161,17 +7080,78 @@ var SeekritApiError = class extends Error {
 		this.code = code;
 	}
 };
-var SeekritClient = class {
+var SeekritClient = class SeekritClient {
 	baseUrl;
+	getLeaseSigner;
 	auth;
 	fetchImpl;
 	client;
 	constructor(options) {
 		this.baseUrl = options.baseUrl.replace(/\/$/, "");
 		this.auth = options.auth;
+		this.getLeaseSigner = options.getLeaseSigner;
 		this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
 		this.client = options.client;
 	}
+	/** Reuse this session while signing leases with its unlocked customer key. */
+	withLeaseSigner(getLeaseSigner) {
+		return new SeekritClient({
+			baseUrl: this.baseUrl,
+			auth: this.auth,
+			fetch: this.fetchImpl,
+			client: this.client,
+			getLeaseSigner
+		});
+	}
+	getProvisionerAccess(orgId, id) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases/provisioners/${id}/access`);
+	}
+	grantProvisionerAccess(orgId, id, chain) {
+		return this.request("POST", `/v1/orgs/${orgId}/leases/provisioners/${id}/access`, chain);
+	}
+	revokeProvisionerAccess(orgId, id, type, principalId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/leases/provisioners/${id}/access/${type}/${principalId}`);
+	}
+	async authorizeLease(orgId, input) {
+		if (input.authorization) return input;
+		const prep = await this.request("GET", `/v1/orgs/${orgId}/leases/targets/${input.targetId}/authorization`);
+		if (!prep.required) return input;
+		const token = this.auth.type === "bearer" ? this.auth.token : this.auth.type === "dynamic" ? await this.auth.getToken() : null;
+		const signingKey = token && isServiceToken(token) ? await importPolicySigningKey(JSON.stringify(await crypto.subtle.exportKey("jwk", (await parseServiceToken(token)).privateKey))) : await this.getLeaseSigner?.();
+		if (!signingKey) throw new Error("Unlock your Seekrit key to request a customer-provisioned lease.");
+		const access = await verifyProvisionerChain(prep.chain, orgId, prep.provisionerId);
+		if (!access.targets.includes("*") && !access.targets.includes(input.targetId)) throw new Error("Target is outside your provisioner access grant.");
+		const leaseId = randomId("lea");
+		const issuedAt = Date.now();
+		const rendered = leaseProviderFor(input.provider).render(prep.config, input, {
+			leaseId,
+			nowMs: issuedAt
+		});
+		const expiresAt = Date.parse(rendered.expiresAt);
+		if (expiresAt > access.expiresAt) throw new Error("Your access grant expires before this lease. Use a shorter duration or ask an administrator to renew it.");
+		const proof = {
+			version: 1,
+			orgId,
+			provisionerId: prep.provisionerId,
+			targetId: input.targetId,
+			provider: input.provider,
+			leaseId,
+			instanceId: prep.instanceId,
+			nonce: crypto.randomUUID(),
+			targetDigest: prep.targetDigest,
+			action: provisionerTransportAction(rendered.provision),
+			..."recipientPublicKey" in input ? { recipientPublicKey: input.recipientPublicKey } : {},
+			issuedAt,
+			expiresAt
+		};
+		return {
+			...input,
+			authorization: {
+				...prep.chain,
+				proof: await signProvisionerEnvelope("pr1", signingKey, proof)
+			}
+		};
+	}
 	async request(method, path, body, extraHeaders) {
 		const headers = {
 			accept: "application/json",
@@ -6844,6 +7824,15 @@ var SeekritClient = class {
 	getLeaseBrokerKey(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
 	}
+	listProvisioners(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases/provisioners`);
+	}
+	registerProvisioner(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/leases/provisioners`, input);
+	}
+	deleteProvisioner(orgId, id) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/leases/provisioners/${id}`);
+	}
 	listLeaseTargets(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases/targets`);
 	}
@@ -6905,7 +7894,7 @@ var SeekritClient = class {
 		return this.request("GET", `/v1/orgs/${orgId}/leases`);
 	}
 	mintLease(orgId, input) {
-		return this.request("POST", `/v1/orgs/${orgId}/leases`, input);
+		return this.authorizeLease(orgId, input).then((body) => this.request("POST", `/v1/orgs/${orgId}/leases`, body));
 	}
 	revokeLease(orgId, leaseId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
@@ -7325,15 +8314,17 @@ function tryBuildContext(dotenvVars = {}) {
 		email: devUser
 	};
 	else return null;
-	return {
+	const ctx = {
 		client: new SeekritClient({
 			baseUrl: apiUrl,
 			auth,
-			client: CLI_CLIENT
+			client: CLI_CLIENT,
+			getLeaseSigner: async () => importPolicySigningKey(JSON.stringify(await crypto.subtle.exportKey("jwk", await getPrivateKey(ctx))))
 		}),
 		auth,
 		apiUrl
 	};
+	return ctx;
 }
 function buildContext() {
 	const ctx = tryBuildContext();
@@ -12881,21 +13872,56 @@ function dynamicTtl(value) {
 function registerDynamicCommands(program) {
 	const dynamic = program.command("dynamic").description("manage provider-issued temporary credentials");
 	const targets = dynamic.command("target").description("manage dynamic credential targets");
-	targets.command("add").requiredOption("--name <name>", "target name").requiredOption("--config <file>", "non-secret provider configuration JSON").option("--org <slug>", "organization").description("register a target; read its admin credential from stdin and encrypt it locally").action(async (options) => {
+	targets.command("add").requiredOption("--name <name>", "target name").requiredOption("--config <file>", "non-secret provider configuration JSON").option("--org <slug>", "organization").description("register a target; read its admin credential (or legacy provisioner signing key) from stdin").action(async (options) => {
 		const config = managedTargetConfigSchema.parse(JSON.parse(readFileSync(options.config, "utf8")));
-		if (process.stdin.isTTY) fail("pipe the admin credential on stdin");
+		const provisionerId = provisionerIdFor(config);
+		const credentialLabel = config.executor === "remote" && !provisionerId ? "provisioner signing key" : "admin credential";
+		if (process.stdin.isTTY) fail(`pipe the ${credentialLabel} on stdin`);
 		const secret = (await readStdin()).trim();
-		if (!secret) fail("admin credential is empty");
+		if (!secret) fail(`${credentialLabel} is empty`);
+		if (config.executor === "remote" && !provisionerId) {
+			let length = 0;
+			try {
+				length = atob(secret).length;
+			} catch {}
+			if (length < 32) fail("use a base64 signing key containing at least 32 random bytes (seekrit provisioner keygen)");
+		}
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(secret), publicKeyJwk);
+		const id = randomId("lt");
+		let wrappedAdminSecret;
+		if (provisionerId) {
+			const { provisioners } = await ctx.client.listProvisioners(org.id);
+			const provisioner = provisioners.find((p) => p.id === provisionerId);
+			if (!provisioner) fail("provisioner not found");
+			wrappedAdminSecret = await sealProvisionerTarget(provisioner.publicKeyJwk, {
+				orgId: org.id,
+				provisionerId,
+				targetId: id,
+				config,
+				adminCredential: secret
+			});
+		} else {
+			const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+			wrappedAdminSecret = await wrapDek(new TextEncoder().encode(secret), publicKeyJwk);
+		}
 		const { target } = await ctx.client.registerLeaseTarget(org.id, {
+			id,
 			name: options.name,
 			config,
 			wrappedAdminSecret
 		});
-		console.log(JSON.stringify(target));
+		console.log(JSON.stringify(config.executor === "remote" && !provisionerId ? {
+			...target,
+			connectionToken: createProvisionerConnection({
+				orgId: org.id,
+				targetId: target.id,
+				provider: config.provider,
+				apiUrl: ctx.apiUrl,
+				signingKey: secret,
+				mode: config.transport
+			})
+		} : target));
 	});
 	targets.command("list").option("--org <slug>", "organization").action(async (options) => {
 		const ctx = buildContext();
@@ -14744,7 +15770,7 @@ function collect$5(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.16.0";
+const PROXY_VERSION = "0.16.1";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -14780,7 +15806,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.16.0";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.16.1";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -16763,10 +17789,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.16.0")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.16.1")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.16.0";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.16.1";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -16825,7 +17851,7 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.16.0`,
+			image: options.image ?? `seekritdev/proxy:0.16.1`,
 			publish: Boolean(options.publish)
 		}));
 	});