@seekrit/mcp 0.1.0

package/dist/index.js

@@ -0,0 +1,2230 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, parse } from "node:path";
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+//#region ../../packages/crypto/src/encoding.ts
+const CHUNK = 32768;
+/** Base64url (no padding) — portable across browsers, Workers, and Node. */
+function toBase64Url(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
+	const binary = atob(base64);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+/**
+* Standard base64 (with `+`, `/`, and `=` padding). Most seekrit blobs use
+* base64url, but some external wire formats mandate standard base64 — notably
+* PostgreSQL SCRAM-SHA-256 verifier strings (see scram.ts).
+*/
+function toBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+	return btoa(binary);
+}
+function utf8Encode(text) {
+	return new TextEncoder().encode(text);
+}
+function utf8Decode(bytes) {
+	return new TextDecoder().decode(bytes);
+}
+//#endregion
+//#region ../../packages/crypto/src/errors.ts
+var SeekritCryptoError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SeekritCryptoError";
+		this.code = code;
+	}
+};
+/**
+* Split a versioned blob like `sc1.<b64>.<b64>` and verify the prefix.
+* AES-GCM auth failure downstream surfaces as DECRYPT_FAILED — that is also
+* the "wrong passphrase" signal for passphrase-encrypted blobs.
+*/
+function splitBlob(blob, prefix, segments) {
+	const parts = blob.split(".");
+	if (parts[0] !== prefix) throw new SeekritCryptoError("UNSUPPORTED_VERSION", `expected a "${prefix}" blob, got "${parts[0] ?? ""}"`);
+	if (parts.length !== segments + 1 || parts.some((p) => p.length === 0)) throw new SeekritCryptoError("MALFORMED_BLOB", `malformed "${prefix}" blob`);
+	return parts.slice(1);
+}
+//#endregion
+//#region ../../packages/crypto/src/aes.ts
+const SECRET_PREFIX = "sc1";
+const IV_LENGTH$1 = 12;
+/** Generate a fresh 256-bit data encryption key for an environment. */
+function generateDek() {
+	return crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+}
+async function importDek(dek, usage) {
+	return crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, [usage]);
+}
+/**
+* Encrypt a secret value with the environment DEK.
+*
+* @param aad Authenticated context binding the ciphertext to its location
+*   (e.g. `environmentId/SECRET_NAME`) so blobs cannot be swapped between
+*   secrets or environments without detection.
+*/
+async function encryptSecret(dek, plaintext, aad) {
+	const key = await importDek(dek, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH$1));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(aad)
+	}, key, utf8Encode(plaintext));
+	return `${SECRET_PREFIX}.${toBase64Url(iv)}.${toBase64Url(new Uint8Array(ciphertext))}`;
+}
+async function decryptSecret(dek, blob, aad) {
+	const [ivB64, ctB64] = splitBlob(blob, SECRET_PREFIX, 2);
+	const key = await importDek(dek, "decrypt");
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64),
+			additionalData: utf8Encode(aad)
+		}, key, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "secret decryption failed: wrong key, tampered data, or mismatched context");
+	}
+}
+/** AAD binding a secret ciphertext to its environment + name. */
+function secretAad(environmentId, secretName) {
+	return `${environmentId}/${secretName}`;
+}
+//#endregion
+//#region ../../packages/crypto/src/keys.ts
+async function generateKeyPair() {
+	const pair = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const [publicJwk, privateJwk] = await Promise.all([crypto.subtle.exportKey("jwk", pair.publicKey), crypto.subtle.exportKey("jwk", pair.privateKey)]);
+	return {
+		publicKeyJwk: JSON.stringify(publicJwk),
+		privateKeyJwk: JSON.stringify(privateJwk)
+	};
+}
+async function importPublicKey(publicKeyJwk) {
+	return crypto.subtle.importKey("jwk", JSON.parse(publicKeyJwk), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, []);
+}
+async function importPrivateKey(privateKeyJwk) {
+	return crypto.subtle.importKey("jwk", JSON.parse(privateKeyJwk), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+}
+async function exportPrivateKeyPkcs8(key) {
+	return new Uint8Array(await crypto.subtle.exportKey("pkcs8", key));
+}
+async function importPrivateKeyPkcs8(pkcs8) {
+	return crypto.subtle.importKey("pkcs8", pkcs8, {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+}
+//#endregion
+//#region ../../packages/crypto/src/wrap.ts
+/**
+* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
+* the recipient's public key; the shared secret is run through HKDF-SHA256 to
+* derive a one-time AES-256-GCM wrapping key. Only the holder of the
+* recipient private key can unwrap.
+*
+* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
+*/
+const WRAP_PREFIX = "wd1";
+const HKDF_INFO = "seekrit/wrap-dek/v1";
+async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
+	const ecdh = {
+		name: "ECDH",
+		public: peerPublicKey
+	};
+	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
+	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt,
+		info: utf8Encode(HKDF_INFO)
+	}, hkdfKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
+}
+/** Wrap an environment DEK to a principal's public key. */
+async function wrapDek(dek, recipientPublicKeyJwk) {
+	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
+	const ephemeral = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, wrappingKey, dek);
+	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	return [
+		WRAP_PREFIX,
+		toBase64Url(ephemeralRaw),
+		toBase64Url(salt),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
+}
+/** Unwrap an environment DEK with the principal's private ECDH key. */
+async function unwrapDek(wrapped, privateKey) {
+	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
+	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, false, []), fromBase64Url(saltB64), "decrypt");
+	try {
+		const dek = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64)
+		}, wrappingKey, fromBase64Url(ctB64));
+		return new Uint8Array(dek);
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
+	}
+}
+//#endregion
+//#region ../../packages/crypto/src/kms.ts
+/**
+* Client-side KMS envelope encryption. A managed `encrypt` key is a 256-bit
+* AES-GCM key whose material reaches the client only as a `wd1.` grant (wrapped
+* to the principal's public key). These helpers operate on that material
+* directly — the server never sees plaintext or key material, exactly as for
+* environment DEKs.
+*
+* Blob formats:
+*   `ce1.<keyId>.<version>.<iv>.<ciphertext>`  — Encrypt output
+*   `dk1.<keyId>.<version>.<iv>.<ciphertext>`  — GenerateDataKey wrapped key
+*
+* The keyId + version travel in the blob (so Decrypt can select the right key
+* version) and are folded into the AAD (so a blob can't be replayed under a
+* different key/version). For `ce1` the caller's optional encryption *context*
+* is also bound — Decrypt must supply the same context, mirroring AWS KMS.
+*/
+const ENCRYPT_PREFIX = "ce1";
+const DATAKEY_PREFIX = "dk1";
+const IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+/** Generate fresh 256-bit material for an `encrypt` KMS key. */
+function generateEncryptKeyMaterial() {
+	return crypto.getRandomValues(new Uint8Array(KEY_LENGTH));
+}
+async function importAesKey(material, usage) {
+	return crypto.subtle.importKey("raw", material, { name: "AES-GCM" }, false, [usage]);
+}
+function encryptAad(ref, context) {
+	return `${ref.keyId}/${ref.version}/${context}`;
+}
+function dataKeyAad(keyId, version) {
+	return `${keyId}/${version}`;
+}
+function parseVersion(versionStr) {
+	const version = Number(versionStr);
+	if (!Number.isInteger(version) || version < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid key version in KMS blob");
+	return version;
+}
+/** Read the key id + version a `ce1`/`dk1` blob was produced under. */
+function kmsBlobKeyRef(blob) {
+	const prefix = blob.split(".")[0];
+	if (prefix !== ENCRYPT_PREFIX && prefix !== DATAKEY_PREFIX) throw new SeekritCryptoError("UNSUPPORTED_VERSION", `not a KMS blob: "${prefix ?? ""}"`);
+	const [keyId, versionStr] = splitBlob(blob, prefix, 4);
+	return {
+		keyId,
+		version: parseVersion(versionStr)
+	};
+}
+/** Encrypt a value under a managed key. `context` (bound as AAD) defaults to empty. */
+async function kmsEncrypt(material, ref, plaintext, context = "") {
+	const key = await importAesKey(material, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(encryptAad(ref, context))
+	}, key, utf8Encode(plaintext));
+	return [
+		ENCRYPT_PREFIX,
+		ref.keyId,
+		String(ref.version),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
+}
+/**
+* Decrypt a `ce1` blob. The caller supplies the material for the key version
+* named in the blob (see `kmsBlobKeyRef`) and the same `context` used to
+* encrypt.
+*/
+async function kmsDecrypt(material, blob, context = "") {
+	const [keyId, versionStr, ivB64, ctB64] = splitBlob(blob, ENCRYPT_PREFIX, 4);
+	const ref = {
+		keyId,
+		version: parseVersion(versionStr)
+	};
+	const key = await importAesKey(material, "decrypt");
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64),
+			additionalData: utf8Encode(encryptAad(ref, context))
+		}, key, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "KMS decryption failed: wrong key/version, tampered data, or mismatched context");
+	}
+}
+/**
+* Generate a fresh data key wrapped under a managed key — the envelope pattern
+* for large payloads (AWS KMS GenerateDataKey). Encrypt bulk data with
+* `plaintext`, store `wrapped` alongside it, and recover the key later with
+* `decryptDataKey`.
+*/
+async function generateDataKey(material, ref) {
+	const plaintext = crypto.getRandomValues(new Uint8Array(KEY_LENGTH));
+	const key = await importAesKey(material, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(dataKeyAad(ref.keyId, String(ref.version)))
+	}, key, plaintext);
+	return {
+		plaintext,
+		wrapped: [
+			DATAKEY_PREFIX,
+			ref.keyId,
+			String(ref.version),
+			toBase64Url(iv),
+			toBase64Url(new Uint8Array(ciphertext))
+		].join(".")
+	};
+}
+//#endregion
+//#region ../../packages/crypto/src/mysql.ts
+/**
+* Client-side construction of a MySQL/MariaDB `mysql_native_password`
+* authentication string, for minting *temporary MySQL login credentials*
+* without the password plaintext ever reaching seekrit's control plane OR
+* MySQL itself.
+*
+* The trick mirrors the Postgres SCRAM one (scram.ts): the stored auth string
+* is `*<UPPER(HEX(SHA1(SHA1(password))))>`, and
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'` stores that
+* string verbatim — MySQL does NOT re-hash it. So the flow is:
+*
+*   1. the machine that will connect generates a random password locally,
+*   2. computes this hash locally,
+*   3. sends only the hash to the broker → `CREATE USER … AS '<hash>'`,
+*   4. connects directly to MySQL with the plaintext it never shared.
+*
+* Zero-knowledge at both layers: the control plane relays only the hash, and
+* the hash is NOT sufficient to authenticate. `mysql_native_password` login is
+* a challenge-response — the server proves knowledge of `SHA1(SHA1(password))`
+* against a fresh scramble, and verifying a client requires `SHA1(password)`
+* (the preimage of the first inner hash), which the stored double-SHA1 does not
+* reveal. A dump of `mysql.user` / the query log therefore cannot log in.
+*
+* SHA-1 is available via WebCrypto (`crypto.subtle.digest("SHA-1", …)`) in the
+* browser, the CLI, the MCP server, and Workers — so this runs everywhere the
+* SCRAM helper does, with no hand-rolled hash primitive.
+*/
+const DEFAULT_PASSWORD_LENGTH$1 = 32;
+const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function sha1(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
+}
+function toUpperHex(bytes) {
+	let hex = "";
+	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+	return hex.toUpperCase();
+}
+function randomPassword$1(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+/**
+* Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
+* for a known password. Pass the result straight to
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`.
+*/
+async function mysqlNativePasswordVerifier(password) {
+	return `*${toUpperHex(await sha1(await sha1(utf8Encode(password))))}`;
+}
+/**
+* Mint a fresh random password and its `mysql_native_password` hash in one step
+* — the client-side half of a Vault-style dynamic MySQL credential.
+*/
+async function generateMysqlCredential(options = {}) {
+	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	return {
+		password,
+		verifier: await mysqlNativePasswordVerifier(password)
+	};
+}
+//#endregion
+//#region ../../packages/crypto/src/passphrase.ts
+/**
+* User private keys are stored server-side encrypted under a key derived from
+* the user's passphrase, so any browser or CLI session can fetch and unlock
+* them without the server ever seeing the passphrase or plaintext key.
+*
+* KDF is PBKDF2-HMAC-SHA256 (WebCrypto-native everywhere). The blob embeds
+* its own salt + iteration count for future agility; bumping ITERATIONS only
+* affects newly written blobs. TODO: revisit Argon2id via WASM later.
+*
+* Blob format: `pk1.<iterations>.<salt>.<iv>.<ciphertext>`
+*/
+const PK_PREFIX = "pk1";
+async function deriveKek(passphrase, salt, iterations, usage) {
+	const material = await crypto.subtle.importKey("raw", utf8Encode(passphrase), "PBKDF2", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "PBKDF2",
+		hash: "SHA-256",
+		salt,
+		iterations
+	}, material, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
+}
+/** Wrong passphrase surfaces as SeekritCryptoError with code DECRYPT_FAILED. */
+async function decryptPrivateKey(passphrase, blob) {
+	const [iterStr, saltB64, ivB64, ctB64] = splitBlob(blob, PK_PREFIX, 4);
+	const iterations = Number.parseInt(iterStr, 10);
+	if (!Number.isFinite(iterations) || iterations < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid PBKDF2 iteration count");
+	const kek = await deriveKek(passphrase, fromBase64Url(saltB64), iterations, "decrypt");
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64)
+		}, kek, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
+	}
+}
+//#endregion
+//#region ../../packages/crypto/src/shamir.ts
+/**
+* Shamir's Secret Sharing over GF(2^8) — the same field AES uses, with the
+* reduction polynomial x^8 + x^4 + x^3 + x + 1 (0x11b). Splits a byte string
+* into `shares` shares such that any `threshold` of them reconstruct the secret
+* exactly and any fewer reveal nothing about it.
+*
+* This is the one hand-rolled primitive behind org recovery (P0-1): the org
+* recovery private key is split into shares, each wrapped to a designated
+* custodian's public key, so a quorum — never seekrit, never any single
+* custodian below the threshold — can reconstruct it. See recovery.ts for the
+* composition with key wrapping.
+*
+* Each secret byte gets its own degree-(threshold-1) polynomial whose constant
+* term is that byte; a share is that polynomial family evaluated at one distinct
+* nonzero x-coordinate. Reconstruction is Lagrange interpolation back to x = 0.
+*
+* Share wire format: a Uint8Array whose first byte is the share's distinct
+* nonzero x-coordinate and whose remaining bytes are the evaluations p_j(x) for
+* each secret byte j. Self-describing, so combineSecret() needs no external
+* index — the x-coordinate survives being wrapped/unwrapped/re-wrapped intact.
+*/
+/** Russian-peasant multiply in GF(2^8) (mod 0x11b) — used only to seed tables. */
+function peasantMul(a, b) {
+	let product = 0;
+	let x = a;
+	let y = b;
+	for (let i = 0; i < 8; i++) {
+		if (y & 1) product ^= x;
+		const carry = x & 128;
+		x = x << 1 & 255;
+		if (carry) x ^= 27;
+		y >>= 1;
+	}
+	return product;
+}
+const EXP = /* @__PURE__ */ new Uint8Array(512);
+const LOG = /* @__PURE__ */ new Uint8Array(256);
+{
+	let a = 1;
+	for (let i = 0; i < 255; i++) {
+		EXP[i] = a;
+		LOG[a] = i;
+		a = peasantMul(a, 3);
+	}
+	for (let i = 255; i < 512; i++) EXP[i] = EXP[i - 255];
+}
+const SALT_LENGTH = 16;
+const DEFAULT_PASSWORD_LENGTH = 32;
+const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+async function hmacSha256(key, message) {
+	const k = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return new Uint8Array(await crypto.subtle.sign("HMAC", k, message));
+}
+async function sha256(data) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+}
+async function saltPassword(password, salt, iterations) {
+	const material = await crypto.subtle.importKey("raw", utf8Encode(password), "PBKDF2", false, ["deriveBits"]);
+	const bits = await crypto.subtle.deriveBits({
+		name: "PBKDF2",
+		hash: "SHA-256",
+		salt,
+		iterations
+	}, material, 256);
+	return new Uint8Array(bits);
+}
+function randomPassword(length) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += PASSWORD_ALPHABET[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+/**
+* Compute the `SCRAM-SHA-256$<i>:<salt>$<StoredKey>:<ServerKey>` verifier for a
+* known password. Pass the result straight to `CREATE ROLE … PASSWORD`.
+*/
+async function scramSha256Verifier(password, options = {}) {
+	const salt = options.salt ?? crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+	const iterations = options.iterations ?? 4096;
+	const saltedPassword = await saltPassword(password, salt, iterations);
+	const storedKey = await sha256(await hmacSha256(saltedPassword, utf8Encode("Client Key")));
+	const serverKey = await hmacSha256(saltedPassword, utf8Encode("Server Key"));
+	return `SCRAM-SHA-256$${iterations}:${toBase64(salt)}$${toBase64(storedKey)}:${toBase64(serverKey)}`;
+}
+/**
+* Mint a fresh random password and its SCRAM verifier in one step — the
+* client-side half of a Vault-style dynamic Postgres credential.
+*/
+async function generatePostgresCredential(options = {}) {
+	const password = randomPassword(options.length ?? DEFAULT_PASSWORD_LENGTH);
+	const iterations = options.iterations ?? 4096;
+	return {
+		password,
+		verifier: await scramSha256Verifier(password, { iterations }),
+		iterations
+	};
+}
+//#endregion
+//#region ../../packages/crypto/src/sign.ts
+/**
+* Managed signing keys for the client-side KMS — ECDSA over P-256 (the curve
+* already used for principal keypairs; universal in WebCrypto). A `sign` key's
+* private half reaches the client only as a `wd1.` grant wrapping its PKCS8
+* bytes; the public half is published per version so verification needs no
+* grant. Signatures are `sg1.<keyId>.<version>.<signature>` — the keyId +
+* version let a verifier fetch the matching version's public key.
+*/
+const ECDSA_PARAMS = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+const ECDSA_SIGN = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+const SIGN_PREFIX = "sg1";
+/** Generate a fresh signing keypair for a `sign` KMS key (or a new version). */
+async function generateSigningKeyMaterial() {
+	const pair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+	const [publicJwk, pkcs8] = await Promise.all([crypto.subtle.exportKey("jwk", pair.publicKey), crypto.subtle.exportKey("pkcs8", pair.privateKey)]);
+	return {
+		publicKeyJwk: JSON.stringify(publicJwk),
+		privateKeyPkcs8: new Uint8Array(pkcs8)
+	};
+}
+/** Import the wrapped-then-unwrapped PKCS8 private key for signing. */
+async function importSigningKey(pkcs8) {
+	return crypto.subtle.importKey("pkcs8", pkcs8, ECDSA_PARAMS, false, ["sign"]);
+}
+/** Import a published public key (JWK) for verification. */
+async function importVerifyingKey(publicKeyJwk) {
+	return crypto.subtle.importKey("jwk", JSON.parse(publicKeyJwk), ECDSA_PARAMS, false, ["verify"]);
+}
+/** Sign a message with a managed signing key; returns an `sg1.` blob. */
+async function signMessage(privateKey, ref, message) {
+	const data = typeof message === "string" ? utf8Encode(message) : message;
+	const sig = new Uint8Array(await crypto.subtle.sign(ECDSA_SIGN, privateKey, data));
+	return [
+		SIGN_PREFIX,
+		ref.keyId,
+		String(ref.version),
+		toBase64Url(sig)
+	].join(".");
+}
+/** Verify an `sg1.` signature over a message with the version's public key. */
+async function verifyMessage(publicKey, signature, message) {
+	const [, , sigB64] = splitBlob(signature, SIGN_PREFIX, 3);
+	const data = typeof message === "string" ? utf8Encode(message) : message;
+	return crypto.subtle.verify(ECDSA_SIGN, publicKey, fromBase64Url(sigB64), data);
+}
+/** Read the key id + version an `sg1.` signature was produced under. */
+function signatureKeyRef(signature) {
+	const [keyId, versionStr] = splitBlob(signature, SIGN_PREFIX, 3);
+	const version = Number(versionStr);
+	if (!Number.isInteger(version) || version < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid key version in signature");
+	return {
+		keyId,
+		version
+	};
+}
+//#endregion
+//#region ../../packages/crypto/src/token.ts
+/**
+* Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
+* principals: the token string itself carries the private key, so the server
+* never holds it. The server stores only the SHA-256 hash of the full token
+* (for authentication) and the public key (for wrapping DEK grants).
+*
+* Format: `skt_<token id>_<private key pkcs8, base64url>`
+*/
+const TOKEN_PREFIX = "skt";
+const TOKEN_ID_LENGTH = 22;
+const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+function randomTokenId() {
+	let out = "";
+	while (out.length < TOKEN_ID_LENGTH) {
+		const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += ID_ALPHABET[byte % 62];
+			if (out.length === TOKEN_ID_LENGTH) break;
+		}
+	}
+	return `${TOKEN_PREFIX}_${out}`;
+}
+async function hashToken(token) {
+	const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token));
+	return toBase64Url(new Uint8Array(digest));
+}
+async function createServiceToken() {
+	const { publicKeyJwk, privateKeyJwk } = await generateKeyPair();
+	const pkcs8 = await exportPrivateKeyPkcs8(await importPrivateKey(privateKeyJwk));
+	const tokenId = randomTokenId();
+	const token = `${tokenId}_${toBase64Url(pkcs8)}`;
+	return {
+		token,
+		tokenId,
+		tokenHash: await hashToken(token),
+		publicKeyJwk
+	};
+}
+async function parseServiceToken(token) {
+	const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
+	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
+	const [, tokenId, keyB64] = match;
+	try {
+		return {
+			tokenId,
+			privateKey: await importPrivateKeyPkcs8(fromBase64Url(keyB64))
+		};
+	} catch {
+		throw new SeekritCryptoError("MALFORMED_TOKEN", "service token private key is corrupted");
+	}
+}
+function isServiceToken(value) {
+	return value.startsWith(`${TOKEN_PREFIX}_`);
+}
+//#endregion
+//#region ../cli/package.json
+var version$1 = "0.18.0";
+const PROJECT_FILE = "seekrit.json";
+function globalConfigPath() {
+	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
+}
+function readGlobalConfig() {
+	const path = globalConfigPath();
+	if (!existsSync(path)) return {};
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+/** Walk up from cwd looking for seekrit.json. */
+function findProjectConfig(startDir = process.cwd()) {
+	let dir = startDir;
+	const { root } = parse(dir);
+	while (true) {
+		const candidate = join(dir, PROJECT_FILE);
+		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
+		if (dir === root) return null;
+		dir = dirname(dir);
+	}
+}
+function writeProjectConfig(config, dir = process.cwd()) {
+	const path = join(dir, PROJECT_FILE);
+	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
+	return path;
+}
+//#endregion
+//#region ../../packages/api-client/src/index.ts
+var SeekritApiError = class extends Error {
+	status;
+	code;
+	constructor(status, code, message) {
+		super(message);
+		this.name = "SeekritApiError";
+		this.status = status;
+		this.code = code;
+	}
+};
+var SeekritClient = class {
+	baseUrl;
+	auth;
+	fetchImpl;
+	constructor(options) {
+		this.baseUrl = options.baseUrl.replace(/\/$/, "");
+		this.auth = options.auth;
+		this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+	}
+	async request(method, path, body) {
+		const headers = { accept: "application/json" };
+		if (this.auth.type === "bearer") headers.authorization = `Bearer ${this.auth.token}`;
+		else if (this.auth.type === "dynamic") {
+			const token = await this.auth.getToken();
+			if (!token) throw new SeekritApiError(401, "unauthorized", "session expired");
+			headers.authorization = `Bearer ${token}`;
+		} else headers["x-seekrit-dev-user"] = this.auth.email;
+		if (body !== void 0) headers["content-type"] = "application/json";
+		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+			method,
+			headers,
+			body: body === void 0 ? void 0 : JSON.stringify(body)
+		});
+		if (!res.ok) {
+			const fallback = { error: {
+				code: "internal",
+				message: `HTTP ${res.status}`
+			} };
+			const payload = await res.json().catch(() => fallback);
+			throw new SeekritApiError(res.status, payload.error?.code ?? "internal", payload.error?.message ?? `HTTP ${res.status}`);
+		}
+		return await res.json();
+	}
+	me() {
+		return this.request("GET", "/v1/me");
+	}
+	getMyKeys() {
+		return this.request("GET", "/v1/me/keys");
+	}
+	setMyKeys(input) {
+		return this.request("PUT", "/v1/me/keys", input);
+	}
+	getMyNotificationPrefs() {
+		return this.request("GET", "/v1/me/notifications");
+	}
+	setMyNotificationPrefs(input) {
+		return this.request("PUT", "/v1/me/notifications", input);
+	}
+	listOrgs() {
+		return this.request("GET", "/v1/orgs");
+	}
+	createOrg(input) {
+		return this.request("POST", "/v1/orgs", input);
+	}
+	getOrg(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}`);
+	}
+	/** Rename an organization (display name only — the slug is immutable). */
+	updateOrg(orgId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}`, input);
+	}
+	listMembers(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/members`);
+	}
+	/**
+	* The org-wide "require a second factor for all members" policy. `configured`
+	* is false when the identity provider isn't wired up (local dev), in which
+	* case the toggle is inert.
+	*/
+	getMfaPolicy(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/mfa-policy`);
+	}
+	setMfaPolicy(orgId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/mfa-policy`, input);
+	}
+	listInvites(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/invites`);
+	}
+	createInvite(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/invites`, input);
+	}
+	revokeInvite(orgId, inviteId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/invites/${inviteId}`);
+	}
+	listApps(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps`);
+	}
+	createApp(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/apps`, input);
+	}
+	getApp(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}`);
+	}
+	/** Rename an application (display name only — the slug is immutable). */
+	updateApp(orgId, appId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/apps/${appId}`, input);
+	}
+	deleteApp(orgId, appId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/apps/${appId}`);
+	}
+	listEnvs(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/envs`);
+	}
+	createEnv(orgId, appId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/apps/${appId}/envs`, input);
+	}
+	getEnv(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
+	}
+	deleteEnv(orgId, envId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
+	}
+	listGroups(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups`);
+	}
+	createGroup(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/groups`, input);
+	}
+	getGroup(orgId, groupId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}`);
+	}
+	/** Rename a group (display name only — the slug is immutable). */
+	updateGroup(orgId, groupId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/groups/${groupId}`, input);
+	}
+	deleteGroup(orgId, groupId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/groups/${groupId}`);
+	}
+	listGroupEnvs(orgId, groupId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}/envs`);
+	}
+	createGroupEnv(orgId, groupId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/groups/${groupId}/envs`, input);
+	}
+	listEnvGroups(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/groups`);
+	}
+	linkEnvGroup(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/groups`, input);
+	}
+	unlinkEnvGroup(orgId, envId, groupId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/groups/${groupId}`);
+	}
+	/** Ordered ciphertext layers + wrapped DEKs for the calling principal. */
+	resolve(query = {}) {
+		const params = new URLSearchParams();
+		if (query.env) params.set("env", query.env);
+		for (const [group, slug] of Object.entries(query.with ?? {})) params.append("with", `${group}:${slug}`);
+		const qs = params.size > 0 ? `?${params}` : "";
+		return this.request("GET", `/v1/resolve${qs}`);
+	}
+	listSecrets(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/secrets`);
+	}
+	setSecret(orgId, envId, name, ciphertext) {
+		return this.request("PUT", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`, { ciphertext });
+	}
+	deleteSecret(orgId, envId, name) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`);
+	}
+	/** The calling principal's wrapped DEK for this environment. */
+	getMyEnvKey(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
+	}
+	listEnvKeys(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/keys`);
+	}
+	grantEnvKey(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/keys`, input);
+	}
+	revokeEnvKey(orgId, envId, grantId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/keys/${grantId}`);
+	}
+	/** Org recovery status: threshold, custodians, and environment coverage. */
+	getRecovery(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/recovery`);
+	}
+	/** Enable recovery with the recovery public key, custodian shares, and grants. */
+	configureRecovery(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/recovery`, input);
+	}
+	/** Rotate the recovery key: new keypair, custodian set, and env re-wraps. */
+	rotateRecovery(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/recovery/rotate`, input);
+	}
+	disableRecovery(orgId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/recovery`);
+	}
+	/** The calling principal's own wrapped recovery share (custodian only). */
+	getMyRecoveryShare(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/recovery/share`);
+	}
+	/** Every environment DEK wrapped to the org recovery key (admin only). */
+	getRecoveryEnvKeys(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/recovery/env-keys`);
+	}
+	/** Backfill recovery grants for environments the caller can decrypt. */
+	uploadRecoveryGrants(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/recovery/grants`, input);
+	}
+	listRecoveryRequests(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/recovery/requests`);
+	}
+	createRecoveryRequest(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/recovery/requests`, input);
+	}
+	getRecoveryRequest(orgId, requestId) {
+		return this.request("GET", `/v1/orgs/${orgId}/recovery/requests/${requestId}`);
+	}
+	/** A custodian contributes their share, re-wrapped to the request target. */
+	contributeRecoveryShare(orgId, requestId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/recovery/requests/${requestId}/shares`, input);
+	}
+	/** The target finalizes recovery, re-granting itself the recovered DEKs. */
+	completeRecoveryRequest(orgId, requestId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/recovery/requests/${requestId}/complete`, input);
+	}
+	cancelRecoveryRequest(orgId, requestId) {
+		return this.request("POST", `/v1/orgs/${orgId}/recovery/requests/${requestId}/cancel`);
+	}
+	listTokens(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/tokens`);
+	}
+	createToken(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
+	}
+	revokeToken(orgId, tokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
+	}
+	/** Permanently delete a token. Only allowed once it has been revoked. */
+	deleteToken(orgId, tokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}/permanent`);
+	}
+	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
+	listKmsKeys(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
+	}
+	createKmsKey(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys`, input);
+	}
+	/** Key metadata + every version (admin). */
+	getKmsKey(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}`);
+	}
+	/** The caller's wrapped key material for a key, across granted versions. */
+	getMyKmsKey(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/key`);
+	}
+	/** Published public keys of a `sign` key (grant-free within the org). */
+	getKmsPublicKeys(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/public`);
+	}
+	listKmsGrants(orgId, keyId) {
+		return this.request("GET", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants`);
+	}
+	grantKmsKey(orgId, keyId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants`, input);
+	}
+	/** Revoke a principal entirely (all versions). */
+	revokeKmsKey(orgId, keyId, principal) {
+		const qs = new URLSearchParams(principal).toString();
+		return this.request("DELETE", `/v1/orgs/${orgId}/kms/keys/${keyId}/grants?${qs}`);
+	}
+	rotateKmsKey(orgId, keyId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/rotate`, input);
+	}
+	disableKmsKey(orgId, keyId) {
+		return this.request("POST", `/v1/orgs/${orgId}/kms/keys/${keyId}/disable`);
+	}
+	/** The broker's public key — wrap the admin credential to it before registering a target. */
+	getLeaseBrokerKey(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases/broker-key`);
+	}
+	listLeaseTargets(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases/targets`);
+	}
+	registerLeaseTarget(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/leases/targets`, input);
+	}
+	deleteLeaseTarget(orgId, targetId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/leases/targets/${targetId}`);
+	}
+	listLeases(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/leases`);
+	}
+	mintLease(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/leases`, input);
+	}
+	revokeLease(orgId, leaseId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
+	}
+	listAudit(orgId, query = {}) {
+		const params = new URLSearchParams();
+		if (query.cursor) params.set("cursor", query.cursor);
+		if (query.limit) params.set("limit", String(query.limit));
+		if (query.action) params.set("action", query.action);
+		if (query.resourceType) params.set("resourceType", query.resourceType);
+		const qs = params.size > 0 ? `?${params}` : "";
+		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
+	}
+	getLogSink(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
+	}
+	setLogSink(orgId, input) {
+		return this.request("PUT", `/v1/orgs/${orgId}/log-sink`, input);
+	}
+	deleteLogSink(orgId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/log-sink`);
+	}
+	/** Send a synthetic record to the configured endpoint to verify connectivity. */
+	testLogSink(orgId) {
+		return this.request("POST", `/v1/orgs/${orgId}/log-sink/test`);
+	}
+	/**
+	* The org's plan, effective entitlements, current metered usage ("X of Y"),
+	* overrides, and which self-serve actions are available (`manage`). Readable
+	* by any member; `enforced` reports whether limits are currently active
+	* (false until plans are turned on, when every org has full access).
+	*/
+	getBilling(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/billing`);
+	}
+	/**
+	* Start self-serve checkout to upgrade the org to a plan family. Returns a
+	* biller-hosted URL to redirect the browser to. Admin-only; the biller must
+	* be configured (see `getBilling().manage`). The resulting subscription links
+	* back to the org via the checkout webhook.
+	*/
+	startCheckout(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/checkout`, input);
+	}
+	/**
+	* Open the biller's Billing Portal to manage the existing subscription
+	* (update card, change plan, cancel). Returns a URL to redirect to. Admin-only
+	* and only once a biller customer is linked (see `getBilling().manage.portal`).
+	*/
+	openBillingPortal(orgId) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/portal`);
+	}
+	/**
+	* Downgrade the org to the Free (default) plan: cancels any active paid
+	* subscription in the biller and reverts the org to Free immediately.
+	* Admin-only. Refetch `getBilling` for the new state.
+	*/
+	cancelSubscription(orgId) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/cancel`);
+	}
+};
+//#endregion
+//#region ../cli/src/io.ts
+let failThrows = false;
+/**
+* In `seekrit mcp` the process is a long-lived stdio server, so a `fail()`
+* must surface as a catchable error (→ a tool error result) rather than
+* exiting and killing every other tool. Toggled on once at MCP startup.
+*/
+function setFailThrows(value) {
+	failThrows = value;
+}
+function fail(message) {
+	if (failThrows) throw new Error(message);
+	console.error(`error: ${message}`);
+	process.exit(1);
+}
+/** Prompt without echoing input (for passphrases). */
+function promptHidden(question) {
+	const muted = new Writable({ write(_chunk, _encoding, callback) {
+		callback();
+	} });
+	process.stderr.write(question);
+	const rl = createInterface({
+		input: process.stdin,
+		output: muted,
+		terminal: true
+	});
+	return new Promise((resolve) => {
+		rl.question("", (answer) => {
+			rl.close();
+			process.stderr.write("\n");
+			resolve(answer);
+		});
+	});
+}
+//#endregion
+//#region ../cli/src/context.ts
+/**
+* Build the client context from configured credentials, or return null when
+* none are set. `seekrit run` uses this to degrade to a plain launcher instead
+* of exiting; every other command goes through `buildContext`, which fails.
+*
+* `dotenvVars` supplies `SEEKRIT_*` values read from a `.env` file. They sit
+* below the live `process.env` but above the saved config, so a project-local
+* `.env` can carry the token / API URL — matching `seekrit-run`'s
+* `flag > env > .env` credential resolution. Empty for every command but
+* `seekrit run`, which loads `.env` before authenticating.
+*/
+function tryBuildContext(dotenvVars = {}) {
+	const config = readGlobalConfig();
+	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token;
+	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
+	let auth;
+	if (token) auth = {
+		type: "bearer",
+		token
+	};
+	else if (devUser) auth = {
+		type: "dev",
+		email: devUser
+	};
+	else return null;
+	return {
+		client: new SeekritClient({
+			baseUrl: apiUrl,
+			auth
+		}),
+		auth
+	};
+}
+function isTokenAuth(ctx) {
+	return ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token);
+}
+/**
+* Recover the calling principal's private key:
+*  - service tokens carry their private key in the token string;
+*  - users fetch their passphrase-encrypted key from the API and unlock it.
+*/
+async function getPrivateKey(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { privateKey } = await parseServiceToken(ctx.auth.token);
+		return privateKey;
+	}
+	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
+	return importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey));
+}
+/** Recover one environment's DEK for the current principal. */
+async function getDek(ctx, orgId, envId) {
+	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
+	return unwrapDek(wrappedDek, privateKey);
+}
+//#endregion
+//#region ../cli/src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
+/**
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
+*/
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
+//#endregion
+//#region ../cli/src/kms.ts
+/** The calling principal's identity + public key (for a self-grant). */
+async function kmsCallerIdentity(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return {
+			principalType: "service_token",
+			principalId: tokenId,
+			publicKeyJwk: JSON.stringify(pub)
+		};
+	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+	return {
+		principalType: "user",
+		principalId: user.id,
+		publicKeyJwk: user.publicKeyJwk
+	};
+}
+/** Look up an org member (by email) or service token (by id) as a grant recipient. */
+async function kmsResolveRecipient(ctx, orgId, who) {
+	if (who.user) {
+		const { members } = await ctx.client.listMembers(orgId);
+		const m = members.find((x) => x.email === who.user);
+		if (!m) fail(`no member ${who.user}`);
+		if (!m.publicKeyJwk) fail(`${who.user} has not completed key setup`);
+		return {
+			principalType: "user",
+			principalId: m.userId,
+			publicKeyJwk: m.publicKeyJwk
+		};
+	}
+	if (who.token) {
+		const { tokens } = await ctx.client.listTokens(orgId);
+		const t = tokens.find((x) => x.id === who.token);
+		if (!t) fail(`no service token ${who.token}`);
+		return {
+			principalType: "service_token",
+			principalId: t.id,
+			publicKeyJwk: t.publicKeyJwk
+		};
+	}
+	fail("specify --user <email> or --token <id>");
+}
+async function kmsResolveKey(ctx, orgId, ref) {
+	const { keys } = await ctx.client.listKmsKeys(orgId);
+	const key = keys.find((k) => k.id === ref || k.name === ref);
+	if (!key) fail(`no KMS key "${ref}"`);
+	return key;
+}
+/** Recover a key's material for one version (default: current), for the caller. */
+async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
+	const mat = await ctx.client.getMyKmsKey(orgId, keyId);
+	const v = version ?? mat.currentVersion;
+	const grant = mat.grants.find((g) => g.version === v);
+	if (!grant) fail(`no grant for version ${v} of this key`);
+	return {
+		material: await unwrapDek(grant.wrappedKey, await getPrivateKey(ctx)),
+		version: v,
+		currentVersion: mat.currentVersion
+	};
+}
+//#endregion
+//#region ../cli/src/dotenv.ts
+/**
+* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
+* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
+* escapes; unquoted values drop trailing ` # comments`). Multiline values are
+* not supported — keep those in seekrit itself.
+*/
+function parseDotenv(content) {
+	const out = {};
+	for (const raw of content.split(/\r?\n/)) {
+		let line = raw.trim();
+		if (!line || line.startsWith("#")) continue;
+		if (line.startsWith("export ")) line = line.slice(7).trimStart();
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		const key = line.slice(0, eq).trim();
+		if (!key) continue;
+		let value = line.slice(eq + 1).trim();
+		const quote = value[0];
+		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
+			value = value.slice(1, -1);
+			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+		} else {
+			const comment = value.indexOf(" #");
+			if (comment !== -1) value = value.slice(0, comment).trim();
+		}
+		out[key] = value;
+	}
+	return out;
+}
+//#endregion
+//#region ../cli/src/secrets.ts
+/** Fetch + decrypt every secret in a single environment. */
+async function fetchDecryptedSecrets(ctx, orgId, envId) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
+	return Object.fromEntries(entries);
+}
+async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
+	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
+	await ctx.client.setSecret(orgId, envId, name, ciphertext);
+}
+/**
+* Resolve the full, layered environment for a running app: composed group
+* secrets (lowest precedence) → the app env's own secrets → `.env` files.
+* Each layer's DEK is unwrapped once with the principal's private key and its
+* ciphertext decrypted locally. `process.env` is NOT applied here — callers
+* that spawn a process layer it on top so the live shell always wins.
+*/
+async function materializeEnv(ctx, opts) {
+	const query = {};
+	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (!isTokenAuth(ctx)) {
+		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
+		query.env = opts.envId;
+	}
+	const { scope, layers } = await ctx.client.resolve(query);
+	const privateKey = await getPrivateKey(ctx);
+	const values = {};
+	const provenance = {};
+	for (const layer of layers) {
+		const dek = await unwrapDek(layer.wrappedDek, privateKey);
+		const label = layer.source === "group" ? `group:${layer.groupSlug}@${layer.slug}` : `app:${scope.appSlug}/${layer.slug}`;
+		for (const secret of layer.secrets) {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
+			provenance[secret.name] = label;
+		}
+	}
+	return {
+		values,
+		provenance,
+		scope,
+		loadedEnvFiles: overlayEnvFiles(values, provenance, opts.envFiles)
+	};
+}
+/**
+* Overlay `.env` files onto an existing value/provenance set (later files win).
+* Missing files are skipped. Returns the files that were actually loaded. Used
+* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
+* managed secrets are unavailable but `.env` should still apply.
+*/
+function overlayEnvFiles(values, provenance, envFiles) {
+	const loaded = [];
+	for (const file of envFiles) {
+		if (!existsSync(file)) continue;
+		loaded.push(file);
+		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
+			values[name] = value;
+			provenance[name] = `dotenv:${file}`;
+		}
+	}
+	return loaded;
+}
+//#endregion
+//#region ../cli/src/mcp.ts
+/** Lowercase-alphanumeric string for a fresh Postgres role name. */
+function randomLower(length) {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	for (const b of crypto.getRandomValues(new Uint8Array(length))) out += alphabet[b % 36];
+	return out;
+}
+function jsonText(data) {
+	return { content: [{
+		type: "text",
+		text: typeof data === "string" ? data : JSON.stringify(data, null, 2)
+	}] };
+}
+function errText(err) {
+	return {
+		content: [{
+			type: "text",
+			text: `error: ${err instanceof Error ? err.message : String(err)}`
+		}],
+		isError: true
+	};
+}
+/** Build the client context or throw a friendly, agent-readable error. */
+function getCtx() {
+	const ctx = tryBuildContext();
+	if (!ctx) throw new Error("no credentials — set SEEKRIT_TOKEN (a skt_… token) or SEEKRIT_DEV_USER in the MCP server env, or run `seekrit login` first");
+	return ctx;
+}
+/**
+* Guard tools that decrypt: under user auth we cannot prompt for a passphrase
+* (stdin is the transport), so it must be supplied out-of-band.
+*/
+function ensureDecryptable(ctx) {
+	if (!isTokenAuth(ctx) && !process.env.SEEKRIT_PASSPHRASE) throw new Error("this operation decrypts data; set SEEKRIT_PASSPHRASE in the MCP server env, or use a service token (SEEKRIT_TOKEN)");
+}
+/**
+* The calling principal's public key JWK — needed to wrap a freshly generated
+* DEK when creating an environment. Service tokens carry their private key, so
+* we derive the public half from it; users publish theirs at key setup.
+*/
+async function principalPublicKeyJwk(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return JSON.stringify(pub);
+	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) throw new Error("this user has no keypair yet — run `seekrit keys setup` first");
+	return user.publicKeyJwk;
+}
+/** Run a child command with `env` and capture its output (values never returned). */
+function runChild(cmd, args, env, cwd) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(cmd, args, {
+			env,
+			cwd,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let stdout = "";
+		let stderr = "";
+		const cap = 64e3;
+		child.stdout.on("data", (d) => {
+			if (stdout.length < cap) stdout += d.toString("utf8");
+		});
+		child.stderr.on("data", (d) => {
+			if (stderr.length < cap) stderr += d.toString("utf8");
+		});
+		child.on("error", reject);
+		child.on("close", (code) => resolve({
+			exitCode: code ?? 1,
+			stdout,
+			stderr
+		}));
+	});
+}
+/** Resolve the layered environment for run/export (token path infers the env). */
+async function materializeFor(ctx, o) {
+	let envId;
+	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, o)).envId;
+	return materializeEnv(ctx, {
+		envId,
+		with: o.with,
+		envFiles: o.envFile ?? [".env"]
+	});
+}
+const targetShape = {
+	org: z.string().optional().describe("organization slug or id (defaults to a lone org)"),
+	app: z.string().optional().describe("application slug or id (or set via configure_project)"),
+	group: z.string().optional().describe("target a group environment instead of an app"),
+	env: z.string().optional().describe("environment slug or id (a service token infers its own)")
+};
+/**
+* Resolve which environment a secret tool addresses. A service token with no
+* explicit app/group targets its own bound environment (no flags needed);
+* everyone else names app|group + env.
+*/
+async function resolveTargetEnv(ctx, o) {
+	if (isTokenAuth(ctx) && !o.app && !o.group) {
+		const { scope } = await ctx.client.resolve();
+		return {
+			orgId: scope.orgId,
+			envId: scope.envId,
+			label: `${scope.appSlug}/${scope.envSlug}`
+		};
+	}
+	return resolveEnvTarget(ctx, o);
+}
+async function runMcpServer(options = {}) {
+	setFailThrows(true);
+	const server = new McpServer({
+		name: "seekrit",
+		version: options.version ?? version$1
+	});
+	/** Register a tool whose handler returns data (serialized) or throws (→ isError). */
+	const tool = (name, description, shape, handler) => {
+		server.registerTool(name, {
+			description,
+			inputSchema: shape
+		}, (async (args) => {
+			try {
+				return jsonText(await handler(args));
+			} catch (err) {
+				return errText(err);
+			}
+		}));
+	};
+	tool("whoami", "Show the authenticated identity, its role, and accessible orgs.", {}, async () => {
+		const ctx = getCtx();
+		if (isTokenAuth(ctx) && ctx.auth.type === "bearer") {
+			const { tokenId } = await parseServiceToken(ctx.auth.token);
+			const { orgs } = await ctx.client.listOrgs();
+			let scope = null;
+			try {
+				scope = (await ctx.client.resolve()).scope;
+			} catch {}
+			return {
+				kind: "service_token",
+				tokenId,
+				org: orgs[0]?.slug ?? null,
+				boundScope: scope
+			};
+		}
+		return {
+			kind: "user",
+			...await ctx.client.me()
+		};
+	});
+	tool("list_orgs", "List organizations the caller can access.", {}, async () => (await getCtx().client.listOrgs()).orgs);
+	tool("list_apps", "List applications in an organization.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listApps(orgRef.id)).apps;
+	});
+	tool("list_envs", "List environments of an application.", {
+		org: z.string().optional(),
+		app: z.string()
+	}, async ({ org, app }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { apps } = await ctx.client.listApps(orgRef.id);
+		const appRow = apps.find((a) => a.slug === app || a.id === app);
+		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
+		return (await ctx.client.listEnvs(orgRef.id, appRow.id)).environments;
+	});
+	tool("list_groups", "List shared groups (reusable secret bags) in an organization.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listGroups(orgRef.id)).groups;
+	});
+	tool("list_group_envs", "List a group's environments (per-slug value sets).", {
+		org: z.string().optional(),
+		group: z.string()
+	}, async ({ org, group }) => {
+		const ctx = getCtx();
+		const g = await resolveGroup(ctx, {
+			org,
+			group
+		});
+		return (await ctx.client.listGroupEnvs(g.orgId, g.id)).environments;
+	});
+	tool("list_env_groups", "List the groups composed into an application environment (precedence order).", {
+		org: z.string().optional(),
+		app: z.string(),
+		env: z.string()
+	}, async ({ org, app, env }) => {
+		const ctx = getCtx();
+		const target = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		});
+		return (await ctx.client.listEnvGroups(target.orgId, target.envId)).groups;
+	});
+	tool("list_members", "List organization members and their public keys (for granting access).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listMembers(orgRef.id)).members;
+	});
+	tool("kms_list_keys", "List managed KMS keys the caller can see (metadata only).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listKmsKeys(orgRef.id)).keys;
+	});
+	tool("kms_create_key", "Create an org-scoped managed key. Material is generated locally and wrapped to each grantee (self plus any listed users/tokens); the server never sees it. Use the CLI for app/group-scoped keys.", {
+		org: z.string().optional(),
+		name: z.string(),
+		purpose: z.enum(["encrypt", "sign"]),
+		grantUsers: z.array(z.string()).optional(),
+		grantTokens: z.array(z.string()).optional()
+	}, async ({ org, name, purpose, grantUsers, grantTokens }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		let toWrap;
+		let publicKeyJwk;
+		if (purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		const recipients = [await kmsCallerIdentity(ctx)];
+		for (const u of grantUsers ?? []) recipients.push(await kmsResolveRecipient(ctx, orgRef.id, { user: u }));
+		for (const t of grantTokens ?? []) recipients.push(await kmsResolveRecipient(ctx, orgRef.id, { token: t }));
+		const seen = /* @__PURE__ */ new Set();
+		const grants = [];
+		for (const r of recipients) {
+			const dedupeKey = `${r.principalType}:${r.principalId}`;
+			if (seen.has(dedupeKey)) continue;
+			seen.add(dedupeKey);
+			grants.push({
+				principalType: r.principalType,
+				principalId: r.principalId,
+				wrappedKey: await wrapDek(toWrap, r.publicKeyJwk)
+			});
+		}
+		const { key } = await ctx.client.createKmsKey(orgRef.id, {
+			name,
+			purpose,
+			spec: purpose === "sign" ? "ecdsa-p256" : "aes-256-gcm",
+			...publicKeyJwk ? { publicKeyJwk } : {},
+			grants
+		});
+		return key;
+	});
+	tool("kms_grant", "Grant a principal (user email or token id) use of a key's current version.", {
+		org: z.string().optional(),
+		key: z.string(),
+		user: z.string().optional(),
+		token: z.string().optional()
+	}, async ({ org, key, user, token }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const recipient = await kmsResolveRecipient(ctx, orgRef.id, {
+			user,
+			token
+		});
+		const { material } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		await ctx.client.grantKmsKey(orgRef.id, k.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId,
+			wrappedKey: await wrapDek(material, recipient.publicKeyJwk)
+		});
+		return {
+			granted: recipient.principalId,
+			key: k.name
+		};
+	});
+	tool("kms_encrypt", "Encrypt a value under a managed encrypt key; returns a ce1 ciphertext blob. `context` (if given) is bound as AAD and must be supplied identically to decrypt.", {
+		org: z.string().optional(),
+		key: z.string(),
+		plaintext: z.string(),
+		context: z.string().optional()
+	}, async ({ org, key, plaintext, context }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "encrypt") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		return { ciphertext: await kmsEncrypt(material, {
+			keyId: k.id,
+			version: currentVersion
+		}, plaintext, context ?? "") };
+	});
+	tool("kms_decrypt", "Decrypt a ce1 blob. Supply the same `context` used to encrypt.", {
+		org: z.string().optional(),
+		key: z.string(),
+		ciphertext: z.string(),
+		context: z.string().optional()
+	}, async ({ org, key, ciphertext, context }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const ref = kmsBlobKeyRef(ciphertext);
+		const { material } = await kmsRecoverMaterial(ctx, orgRef.id, k.id, ref.version);
+		return { plaintext: await kmsDecrypt(material, ciphertext, context ?? "") };
+	});
+	tool("kms_generate_data_key", "Generate a data key under a managed encrypt key (envelope encryption). Returns the plaintext key (base64) and its wrapped form to store.", {
+		org: z.string().optional(),
+		key: z.string()
+	}, async ({ org, key }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "encrypt") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		const dk = await generateDataKey(material, {
+			keyId: k.id,
+			version: currentVersion
+		});
+		return {
+			plaintextBase64: toBase64(dk.plaintext),
+			wrapped: dk.wrapped
+		};
+	});
+	tool("kms_sign", "Sign a message with a managed signing key; returns an sg1 signature blob.", {
+		org: z.string().optional(),
+		key: z.string(),
+		message: z.string()
+	}, async ({ org, key, message }) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		if (k.purpose !== "sign") throw new Error(`${k.name} is a ${k.purpose} key`);
+		const { material, currentVersion } = await kmsRecoverMaterial(ctx, orgRef.id, k.id);
+		return { signature: await signMessage(await importSigningKey(material), {
+			keyId: k.id,
+			version: currentVersion
+		}, message) };
+	});
+	tool("kms_verify", "Verify an sg1 signature over a message using a signing key's published public key (no grant needed).", {
+		org: z.string().optional(),
+		key: z.string(),
+		signature: z.string(),
+		message: z.string()
+	}, async ({ org, key, signature, message }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const k = await kmsResolveKey(ctx, orgRef.id, key);
+		const ref = signatureKeyRef(signature);
+		const { versions } = await ctx.client.getKmsPublicKeys(orgRef.id, k.id);
+		const pub = versions.find((v) => v.version === ref.version)?.publicKeyJwk;
+		if (!pub) throw new Error(`no published public key for version ${ref.version}`);
+		return { valid: await verifyMessage(await importVerifyingKey(pub), signature, message) };
+	});
+	tool("list_secrets", "List secret names + versions in an environment (never values).", targetShape, async (o) => {
+		const ctx = getCtx();
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { secrets } = await ctx.client.listSecrets(orgId, envId);
+		return secrets.map((s) => ({
+			name: s.name,
+			version: s.version,
+			updatedAt: s.updatedAt
+		}));
+	});
+	tool("list_tokens", "List an organization's service tokens (never the secret token strings).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listTokens(orgRef.id)).tokens;
+	});
+	tool("audit", "Read the organization's audit trail (most recent first).", {
+		org: z.string().optional(),
+		limit: z.number().int().min(1).max(200).optional(),
+		action: z.string().optional().describe("filter by action, e.g. secret.updated")
+	}, async ({ org, limit, action }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listAudit(orgRef.id, {
+			limit: limit ?? 50,
+			action
+		})).entries;
+	});
+	tool("create_org", "Create an organization. Requires a user session — service tokens cannot own a Stytch org.", {
+		name: z.string(),
+		slug: z.string()
+	}, async ({ name, slug }) => (await getCtx().client.createOrg({
+		name,
+		slug
+	})).org);
+	tool("create_app", "Create an application in an organization.", {
+		org: z.string().optional(),
+		name: z.string(),
+		slug: z.string()
+	}, async ({ org, name, slug }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.createApp(orgRef.id, {
+			name,
+			slug
+		})).app;
+	});
+	tool("create_group", "Create a shared group (reusable secret bag) in an organization.", {
+		org: z.string().optional(),
+		name: z.string(),
+		slug: z.string()
+	}, async ({ org, name, slug }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.createGroup(orgRef.id, {
+			name,
+			slug
+		})).group;
+	});
+	tool("create_env", "Create an application environment. Generates the data key locally and grants it to the caller.", {
+		org: z.string().optional(),
+		app: z.string(),
+		name: z.string(),
+		slug: z.string()
+	}, async ({ org, app, name, slug }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { apps } = await ctx.client.listApps(orgRef.id);
+		const appRow = apps.find((a) => a.slug === app || a.id === app);
+		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
+		const wrappedDek = await wrapDek(generateDek(), await principalPublicKeyJwk(ctx));
+		return (await ctx.client.createEnv(orgRef.id, appRow.id, {
+			name,
+			slug,
+			wrappedDek
+		})).environment;
+	});
+	tool("create_group_env", "Create a group environment. Generates the data key locally and grants it to the caller.", {
+		org: z.string().optional(),
+		group: z.string(),
+		name: z.string(),
+		slug: z.string()
+	}, async ({ org, group, name, slug }) => {
+		const ctx = getCtx();
+		const g = await resolveGroup(ctx, {
+			org,
+			group
+		});
+		const wrappedDek = await wrapDek(generateDek(), await principalPublicKeyJwk(ctx));
+		return (await ctx.client.createGroupEnv(g.orgId, g.id, {
+			name,
+			slug,
+			wrappedDek
+		})).environment;
+	});
+	tool("compose_group", "Compose a group into an application environment (higher position wins on name clashes).", {
+		org: z.string().optional(),
+		app: z.string(),
+		env: z.string(),
+		group: z.string(),
+		position: z.number().int().min(0).optional()
+	}, async ({ org, app, env, group, position }) => {
+		const ctx = getCtx();
+		const target = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		});
+		const g = await resolveGroup(ctx, {
+			org,
+			group
+		});
+		return (await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+			groupId: g.id,
+			position
+		})).group;
+	});
+	tool("uncompose_group", "Remove a composed group from an application environment.", {
+		org: z.string().optional(),
+		app: z.string(),
+		env: z.string(),
+		group: z.string()
+	}, async ({ org, app, env, group }) => {
+		const ctx = getCtx();
+		const target = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		});
+		const g = await resolveGroup(ctx, {
+			org,
+			group
+		});
+		await ctx.client.unlinkEnvGroup(target.orgId, target.envId, g.id);
+		return { ok: true };
+	});
+	tool("set_secret", "Encrypt a value locally and store it in an environment.", {
+		...targetShape,
+		name: z.string(),
+		value: z.string()
+	}, async (o) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		await encryptAndSetSecret(ctx, orgId, envId, o.name, o.value);
+		return {
+			ok: true,
+			name: o.name
+		};
+	});
+	tool("get_secret", "Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command).", {
+		...targetShape,
+		name: z.string(),
+		reveal: z.boolean().optional()
+	}, async (o) => {
+		const ctx = getCtx();
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		if (!o.reveal) {
+			const { secrets } = await ctx.client.listSecrets(orgId, envId);
+			const row = secrets.find((s) => s.name === o.name);
+			if (!row) throw new Error(`no secret named ${o.name}`);
+			return {
+				name: row.name,
+				version: row.version,
+				revealed: false
+			};
+		}
+		ensureDecryptable(ctx);
+		const values = await fetchDecryptedSecrets(ctx, orgId, envId);
+		if (!(o.name in values)) throw new Error(`no secret named ${o.name}`);
+		return {
+			name: o.name,
+			value: values[o.name],
+			revealed: true
+		};
+	});
+	tool("delete_secret", "Delete a secret from an environment.", {
+		...targetShape,
+		name: z.string()
+	}, async (o) => {
+		const ctx = getCtx();
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		await ctx.client.deleteSecret(orgId, envId, o.name);
+		return {
+			ok: true,
+			name: o.name
+		};
+	});
+	tool("run_command", "Run a command with the resolved secrets injected as environment variables, and return its exit code + captured output. Secret VALUES are never returned — this is the preferred way to use secrets. process env > .env > app env > groups.", {
+		command: z.string().describe("executable to run"),
+		args: z.array(z.string()).optional(),
+		org: z.string().optional(),
+		app: z.string().optional(),
+		env: z.string().optional().describe("environment slug (token auth infers this)"),
+		with: z.record(z.string(), z.string()).optional().describe("group=env slice overrides"),
+		envFile: z.array(z.string()).optional().describe(".env files to overlay (default [.env])"),
+		cwd: z.string().optional()
+	}, async (o) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const { values } = await materializeFor(ctx, o);
+		const childEnv = {
+			...values,
+			...process.env
+		};
+		return {
+			...await runChild(o.command, o.args ?? [], childEnv, o.cwd),
+			injectedVarCount: Object.keys(values).length
+		};
+	});
+	tool("export_env", "Write the resolved secrets to a dotenv file on disk and return the variable names written (never the values). Use to materialize a .env for local tooling.", {
+		file: z.string().describe("path to write, e.g. .env"),
+		org: z.string().optional(),
+		app: z.string().optional(),
+		env: z.string().optional(),
+		with: z.record(z.string(), z.string()).optional()
+	}, async (o) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const { values } = await materializeFor(ctx, o);
+		const { writeFileSync } = await import("node:fs");
+		const body = Object.entries(values).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join("\n");
+		writeFileSync(o.file, `${body}\n`, { mode: 384 });
+		return {
+			file: o.file,
+			names: Object.keys(values).sort()
+		};
+	});
+	tool("create_token", "Mint a service token, printed once. Runtime tokens bind to one app environment (auto-granted its keys, so a command/agent can decrypt it). Pass admin:true for an org-scoped provisioning token (create apps/groups/envs, grant, mint tokens) — admin tokens need no env binding.", {
+		name: z.string().describe("display name, e.g. ci-deploy or agent-session"),
+		org: z.string().optional(),
+		app: z.string().optional().describe("bind to this app (runtime tokens)"),
+		env: z.string().optional().describe("bind to this env (runtime tokens)"),
+		admin: z.boolean().optional().describe("mint an org-scoped admin token")
+	}, async ({ name, org, app, env, admin }) => {
+		const ctx = getCtx();
+		const role = admin ? "admin" : "member";
+		const boundToEnv = Boolean(app || env);
+		if (!admin && !boundToEnv) throw new Error("runtime tokens need app + env, or pass admin:true for an org-scoped token");
+		if (boundToEnv && !(app && env)) throw new Error("pass both app and env to bind a token");
+		const target = boundToEnv ? await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		}) : { orgId: (await resolveOrg(ctx, org)).id };
+		const created = await createServiceToken();
+		await ctx.client.createToken(target.orgId, {
+			name,
+			tokenId: created.tokenId,
+			tokenHash: created.tokenHash,
+			publicKeyJwk: created.publicKeyJwk,
+			role,
+			environmentId: "envId" in target ? target.envId : null
+		});
+		if (boundToEnv && "envId" in target) {
+			ensureDecryptable(ctx);
+			const grantEnv = async (envId) => {
+				const dek = await getDek(ctx, target.orgId, envId);
+				await ctx.client.grantEnvKey(target.orgId, envId, {
+					principalType: "service_token",
+					principalId: created.tokenId,
+					wrappedDek: await wrapDek(dek, created.publicKeyJwk)
+				});
+			};
+			await grantEnv(target.envId);
+			const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
+			for (const g of groups) {
+				const { environments } = await ctx.client.listGroupEnvs(target.orgId, g.groupId);
+				const slice = environments.find((e) => e.slug === target.envSlug);
+				if (slice) await grantEnv(slice.id);
+			}
+		}
+		return {
+			token: created.token,
+			tokenId: created.tokenId,
+			role,
+			note: "save this now — the secret token string is not stored and cannot be retrieved"
+		};
+	});
+	tool("revoke_token", "Revoke a service token by id.", {
+		org: z.string().optional(),
+		tokenId: z.string()
+	}, async ({ org, tokenId }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		await ctx.client.revokeToken(orgRef.id, tokenId);
+		return {
+			ok: true,
+			tokenId
+		};
+	});
+	tool("grant_env", "Grant a member (by email) or service token (by id) access to an environment's data key. Re-wraps the DEK to the grantee — the caller must already hold the key.", {
+		...targetShape,
+		user: z.string().optional().describe("org member email"),
+		token: z.string().optional().describe("service token id (skt_…)")
+	}, async (o) => {
+		if (Boolean(o.user) === Boolean(o.token)) throw new Error("pass exactly one of user or token");
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const { orgId, envId, label } = await resolveTargetEnv(ctx, o);
+		const dek = await getDek(ctx, orgId, envId);
+		let principalType;
+		let principalId;
+		let publicKeyJwk;
+		if (o.user) {
+			const { members } = await ctx.client.listMembers(orgId);
+			const member = members.find((m) => m.email === o.user);
+			if (!member) throw new Error(`no member ${o.user}`);
+			if (!member.publicKeyJwk) throw new Error(`${o.user} has not completed key setup`);
+			[principalType, principalId, publicKeyJwk] = [
+				"user",
+				member.userId,
+				member.publicKeyJwk
+			];
+		} else {
+			const { tokens } = await ctx.client.listTokens(orgId);
+			const t = tokens.find((x) => x.id === o.token);
+			if (!t) throw new Error(`no service token ${o.token}`);
+			[principalType, principalId, publicKeyJwk] = [
+				"service_token",
+				t.id,
+				t.publicKeyJwk
+			];
+		}
+		await ctx.client.grantEnvKey(orgId, envId, {
+			principalType,
+			principalId,
+			wrappedDek: await wrapDek(dek, publicKeyJwk)
+		});
+		return {
+			ok: true,
+			env: label,
+			principalType,
+			principalId
+		};
+	});
+	tool("list_pg_targets", "List registered Postgres provisioning targets for temporary credentials.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeaseTargets(orgRef.id)).targets;
+	});
+	tool("create_pg_lease", "Mint a short-lived Postgres credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its SCRAM verifier is sent to the API — the plaintext never reaches seekrit or Postgres at rest. The role auto-expires; revoke early with revoke_pg_lease.", {
+		org: z.string().optional(),
+		target: z.string().describe("target id or name"),
+		role: z.string().optional().describe("role name to create (default: random tmp_ name)"),
+		ttlSeconds: z.number().int().min(60).max(604800).optional().describe("lifetime (default 3600)")
+	}, async ({ org, target, role, ttlSeconds }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { targets } = await ctx.client.listLeaseTargets(orgRef.id);
+		const t = targets.find((x) => x.id === target || x.name === target);
+		if (!t) throw new Error(`no target "${target}" in ${orgRef.slug}`);
+		const roleName = role ?? `tmp_${randomLower(12)}`;
+		const { password, verifier } = await generatePostgresCredential();
+		const { lease, connection } = await ctx.client.mintLease(orgRef.id, {
+			provider: "postgres",
+			targetId: t.id,
+			roleName,
+			verifier,
+			ttlSeconds: ttlSeconds ?? 3600
+		});
+		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		return {
+			leaseId: lease.id,
+			url,
+			username: roleName,
+			expiresAt: connection.expiresAt,
+			note: "short-lived credential; it auto-expires and the plaintext is not stored anywhere"
+		};
+	});
+	tool("list_pg_leases", "List Postgres leases (the ledger — never secret material).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeases(orgRef.id)).leases;
+	});
+	tool("revoke_pg_lease", "Revoke a Postgres lease now (drops the role immediately).", {
+		org: z.string().optional(),
+		leaseId: z.string()
+	}, async ({ org, leaseId }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		await ctx.client.revokeLease(orgRef.id, leaseId);
+		return {
+			ok: true,
+			leaseId
+		};
+	});
+	tool("list_mysql_targets", "List registered MySQL/MariaDB provisioning targets for temporary credentials.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeaseTargets(orgRef.id)).targets.filter((t) => t.provider === "mysql");
+	});
+	tool("create_mysql_lease", "Mint a short-lived MySQL/MariaDB credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its mysql_native_password hash is sent to the API — the plaintext never reaches seekrit or MySQL at rest. The user auto-expires; revoke early with revoke_mysql_lease.", {
+		org: z.string().optional(),
+		target: z.string().describe("target id or name"),
+		user: z.string().optional().describe("user name to create (default: random tmp_ name)"),
+		ttlSeconds: z.number().int().min(60).max(604800).optional().describe("lifetime (default 3600)")
+	}, async ({ org, target, user, ttlSeconds }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { targets } = await ctx.client.listLeaseTargets(orgRef.id);
+		const t = targets.find((x) => x.id === target || x.name === target);
+		if (!t) throw new Error(`no target "${target}" in ${orgRef.slug}`);
+		if (t.provider !== "mysql") throw new Error(`target "${target}" is not a MySQL target`);
+		const userName = user ?? `tmp_${randomLower(12)}`;
+		const { password, verifier } = await generateMysqlCredential();
+		const { lease, connection } = await ctx.client.mintLease(orgRef.id, {
+			provider: "mysql",
+			targetId: t.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds: ttlSeconds ?? 3600
+		});
+		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		return {
+			leaseId: lease.id,
+			url,
+			username: userName,
+			expiresAt: connection.expiresAt,
+			note: "short-lived credential; it auto-expires and the plaintext is not stored anywhere"
+		};
+	});
+	tool("list_mysql_leases", "List MySQL/MariaDB leases (the ledger — never secret material).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listLeases(orgRef.id)).leases.filter((l) => l.provider === "mysql");
+	});
+	tool("revoke_mysql_lease", "Revoke a MySQL/MariaDB lease now (drops the user immediately).", {
+		org: z.string().optional(),
+		leaseId: z.string()
+	}, async ({ org, leaseId }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		await ctx.client.revokeLease(orgRef.id, leaseId);
+		return {
+			ok: true,
+			leaseId
+		};
+	});
+	tool("configure_project", "Link a directory to an org/app by writing seekrit.json (like `seekrit init`). The environment is chosen by the service token at runtime.", {
+		org: z.string(),
+		app: z.string(),
+		dir: z.string().optional()
+	}, async ({ org, app, dir }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { apps } = await ctx.client.listApps(orgRef.id);
+		const appRow = apps.find((a) => a.slug === app || a.id === app);
+		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
+		return {
+			path: writeProjectConfig({
+				org: orgRef.slug,
+				app: appRow.slug
+			}, dir),
+			guidance: "Run commands with `seekrit run -- <cmd>` (or the seekrit-run binary) and a SEEKRIT_TOKEN bound to the desired environment; the token selects org+app+env."
+		};
+	});
+	await server.connect(new StdioServerTransport());
+}
+//#endregion
+//#region src/index.ts
+/**
+* `@seekrit/mcp` — a standalone, `npx`-able entrypoint for seekrit's MCP server.
+*
+* This is a thin wrapper: the server itself (all 27 tools, the crypto plane of
+* the two-server design) lives in `@seekrit/cli` and is shared with the
+* `seekrit mcp` subcommand — this package just publishes it as its own binary so
+* an agent can run it with zero prior install:
+*
+*   npx -y @seekrit/mcp
+*
+* Everything else — auth resolution (`SEEKRIT_TOKEN` / `SEEKRIT_API_URL` /
+* `SEEKRIT_DEV_USER` or `~/.config/seekrit/config.json`), the zero-knowledge
+* invariant (decryption only ever happens here, on the client) — is identical to
+* `seekrit mcp`. tsdown bundles the shared server source in at build time, so the
+* published package is self-contained and needs no `@seekrit/cli` install.
+*/
+runMcpServer({ version: "0.1.0" }).catch((err) => {
+	const message = err instanceof Error ? err.message : String(err);
+	process.stderr.write(`seekrit-mcp: fatal: ${message}\n`);
+	process.exit(1);
+});
+//#endregion
+export {};