npm - @seekrit/mcp - Versions diffs - 0.6.0 → 0.7.0 - Mend

@seekrit/mcp 0.6.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/index.js +2802 -126
package/package.json +4 -2

package/dist/index.js CHANGED Viewed

@@ -8,6 +8,2285 @@ import { homedir } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
+//#region ../../packages/core/src/agent-policy.ts
+/** A bare hostname: no scheme, no port, no path, no wildcard. */
+const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
+const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
+/**
+* A path pattern. Must be absolute, because it is matched against a request
+* path — a relative pattern is a mistake that would silently match nothing.
+*/
+const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
+const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
+z.object({
+	host: policyHostSchema,
+	methods: z.array(policyMethodSchema).max(16).default([]),
+	paths: z.array(policyPathSchema).max(64).default([]),
+	allow: z.array(policySecretNameSchema).max(64).default([]),
+	label: z.string().trim().max(120).optional()
+});
+z.object({
+/** `ap1.<body>.<signature>` — opaque to the server. */
+bundle: z.string().min(16).max(256 * 1024) });
+z.object({
+	name: z.string().trim().min(1).max(120),
+	slug: z.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "slug is lowercase letters, digits, and dashes"),
+	/** The environment whose secrets this agent's policy may name. Optional. */
+	environmentId: z.string().trim().min(1).max(64).optional()
+});
+z.object({
+	name: z.string().trim().min(1).max(120).optional(),
+	enabled: z.boolean().optional(),
+	environmentId: z.string().trim().min(1).max(64).nullish()
+});
+z.object({
+	host: policyHostSchema,
+	method: policyMethodSchema,
+	path: z.string().trim().min(1).max(2048),
+	secret: policySecretNameSchema.optional()
+});
+/** All catalog keys as a runtime array (for iteration / zod enums). */
+const ENTITLEMENT_KEYS = Object.keys({
+	"feature.kms": {
+		kind: "feature",
+		label: "Managed keys (KMS)",
+		description: "Client-side managed keys for application-layer encryption and signing.",
+		default: true
+	},
+	"feature.honey_tokens": {
+		kind: "feature",
+		label: "Honey tokens",
+		description: "Decoy credentials that alert the moment anyone tries to use them.",
+		default: true
+	},
+	"feature.leases": {
+		kind: "feature",
+		label: "Temporary access",
+		description: "Vault-style short-lived database and cloud credentials.",
+		default: true
+	},
+	"feature.rotation": {
+		kind: "feature",
+		label: "Secret rotation",
+		description: "Managed, scheduled rotation of stored credentials.",
+		default: true
+	},
+	"feature.log_sink": {
+		kind: "feature",
+		label: "Audit log export (SIEM)",
+		description: "Stream the audit log to an external OTLP collector.",
+		default: true
+	},
+	"feature.proxy": {
+		kind: "feature",
+		label: "Agent egress proxy",
+		description: "Substitute secrets into outbound requests for untrusted workloads.",
+		default: true
+	},
+	"feature.sso": {
+		kind: "feature",
+		label: "SSO / SAML",
+		description: "Single sign-on beyond the built-in providers.",
+		default: true
+	},
+	"feature.sync": {
+		kind: "feature",
+		label: "Third-party sync",
+		description: "Push environment secrets to external platforms like Vercel.",
+		default: true
+	},
+	"apps.max": {
+		kind: "limit",
+		label: "Applications",
+		description: "Maximum applications in the organization.",
+		default: null
+	},
+	"envs.per_app.max": {
+		kind: "limit",
+		label: "Environments per application",
+		description: "Maximum environments under a single application.",
+		default: null
+	},
+	"branches.per_app.max": {
+		kind: "limit",
+		label: "Branch configs per application",
+		description: "Maximum ephemeral branch environments under a single application.",
+		default: null
+	},
+	"secrets.per_env.max": {
+		kind: "limit",
+		label: "Secrets per environment",
+		description: "Maximum secrets in a single environment.",
+		default: null
+	},
+	"groups.max": {
+		kind: "limit",
+		label: "Groups",
+		description: "Maximum reusable secret groups in the organization.",
+		default: null
+	},
+	"tokens.max": {
+		kind: "limit",
+		label: "Service tokens",
+		description: "Maximum active service tokens in the organization.",
+		default: null
+	},
+	"kms.keys.max": {
+		kind: "limit",
+		label: "Managed keys",
+		description: "Maximum managed KMS keys in the organization.",
+		default: null
+	},
+	"lease.targets.max": {
+		kind: "limit",
+		label: "Lease targets",
+		description: "Maximum registered temporary-access targets.",
+		default: null
+	},
+	"sync.connections.max": {
+		kind: "limit",
+		label: "Sync connections",
+		description: "Maximum registered third-party sync destinations.",
+		default: null
+	},
+	"rotation.policies.max": {
+		kind: "limit",
+		label: "Rotation policies",
+		description: "Maximum secrets with managed rotation configured.",
+		default: null
+	},
+	members: {
+		kind: "metered",
+		label: "Members",
+		description: "Users in the organization. Included in the plan, then billed per seat.",
+		default: null,
+		metric: "member_count"
+	},
+	"resolves.monthly": {
+		kind: "metered",
+		label: "Monthly resolves",
+		description: "Secret resolutions per month. Included in the plan, then billed per unit.",
+		default: null,
+		metric: "monthly_resolves"
+	}
+});
+//#endregion
+//#region ../../packages/core/src/plans.ts
+const PLAN_FAMILIES = {
+	free: {
+		id: "free",
+		name: "Free",
+		description: "Get started with the essentials.",
+		current: 3,
+		hidden: false
+	},
+	team: {
+		id: "team",
+		name: "Team",
+		description: "For small teams collaborating on secrets.",
+		current: 1,
+		hidden: false
+	},
+	pro: {
+		id: "pro",
+		name: "Pro",
+		description: "For teams running secrets in production.",
+		current: 1,
+		hidden: true
+	},
+	enterprise: {
+		id: "enterprise",
+		name: "Enterprise",
+		description: "Unlimited scale with advanced governance.",
+		current: 1,
+		hidden: false
+	}
+};
+const PLAN_FAMILY_IDS = Object.keys(PLAN_FAMILIES);
+PLAN_FAMILY_IDS.filter((family) => !PLAN_FAMILIES[family].hidden);
+//#endregion
+//#region ../../packages/core/src/billing.ts
+/**
+* Lifecycle states a subscription can be in. Mirrors the biller's own states
+* (Stripe) but is provider-neutral so a different biller could map onto it.
+*/
+const SUBSCRIPTION_STATUSES = [
+	"trialing",
+	"active",
+	"past_due",
+	"canceled",
+	"paused"
+];
+//#endregion
+//#region ../../packages/core/src/branches.ts
+/**
+* Branch (ephemeral) environments — a per-PR/preview overlay on an existing
+* application environment.
+*
+* A branch is an ordinary environment row with a parent and a TTL. It is an
+* **overlay, not a copy**: resolve returns the parent's layers and then the
+* branch's own on top, so a branch holds only the values that differ and
+* tracks the parent live. Nothing is re-encrypted at creation — a secret's
+* ciphertext is bound to `(environmentId, name)` as AAD, so copying blobs into
+* a new environment could not decrypt anyway, and a snapshot would immediately
+* drift from its base.
+*
+* Two rules keep the read path cheap and predictable, enforced here:
+*
+* - **Depth one.** A branch's parent must not itself be a branch, so resolve
+*   never recurses on the hot path.
+* - **Application environments only.** Group environments are pulled in by
+*   composition (matched by slug) and have no single parent to overlay.
+*/
+/** Longest life a branch may be given. Bounds sprawl even if nobody cleans up. */
+const MAX_BRANCH_TTL_SECONDS = 720 * 60 * 60;
+/**
+* Parse a human TTL — `30m`, `12h`, `7d`, `2w`, or bare seconds — into seconds.
+* Returns null for anything unparseable, so callers can report the input back.
+* `never` / `none` mean "no expiry" and yield `Infinity`, which
+* {@link planBranchCreate} rejects unless passed as an explicit `null`.
+*/
+function parseBranchTtl(input) {
+	const raw = input.trim().toLowerCase();
+	if (raw === "never" || raw === "none") return Number.POSITIVE_INFINITY;
+	const match = /^(\d+)\s*(s|m|h|d|w)?$/.exec(raw);
+	if (!match) return null;
+	const value = Number(match[1]);
+	const multiplier = {
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400,
+		w: 604800
+	}[match[2] ?? "s"];
+	if (multiplier === void 0) return null;
+	return value * multiplier;
+}
+//#endregion
+//#region ../../packages/core/src/dotenv.ts
+/**
+* Apply double-quote escapes in a single left-to-right pass.
+*
+* A pass per escape (`\n` → newline, then `\\` → `\`, …) is wrong: in `\\n` the
+* first pass matches the trailing `\n` and yields a real newline, corrupting
+* every literal backslash-n a JSON credential is made of. Scanning once means a
+* backslash consumes the character after it and can never be re-read.
+*/
+function unescapeDoubleQuoted(text) {
+	let out = "";
+	for (let i = 0; i < text.length; i++) {
+		if (text[i] !== "\\" || i === text.length - 1) {
+			out += text[i];
+			continue;
+		}
+		const next = text[++i];
+		if (next === "n") out += "\n";
+		else if (next === "r") out += "\r";
+		else if (next === "t") out += "	";
+		else if (next === "\"" || next === "\\") out += next;
+		else out += `\\${next}`;
+	}
+	return out;
+}
+/**
+* Find the index of the quote that closes a value opened at `start`.
+*
+* Inside double quotes a `\"` is an escaped quote, not the terminator (and a
+* `\\` immediately before the quote *is* a terminator, since the backslash is
+* itself escaped) — so the scan tracks escapes rather than searching for the
+* next bare quote. Single quotes have no escapes: the next one closes. Returns
+* -1 when the value is never closed.
+*/
+function findClosingQuote(content, start, quote) {
+	for (let i = start; i < content.length; i++) {
+		if (quote === "\"" && content[i] === "\\") {
+			i++;
+			continue;
+		}
+		if (content[i] === quote) return i;
+	}
+	return -1;
+}
+/**
+* Parse `.env` text into variables. Later assignments win, matching the
+* object-assignment semantics every `.env` reader has.
+*/
+function parseDotenv(content) {
+	const out = {};
+	let cursor = 0;
+	while (cursor < content.length) {
+		const newline = content.indexOf("\n", cursor);
+		const lineEnd = newline === -1 ? content.length : newline;
+		const lineStart = cursor;
+		const trimmedEnd = lineEnd > lineStart && content[lineEnd - 1] === "\r" ? lineEnd - 1 : lineEnd;
+		cursor = lineEnd + 1;
+		let i = skipSpace(content, lineStart, trimmedEnd);
+		if (i === trimmedEnd || content[i] === "#") continue;
+		if (content.startsWith("export ", i)) i = skipSpace(content, i + 7, trimmedEnd);
+		const eq = content.indexOf("=", i);
+		if (eq === -1 || eq >= trimmedEnd) continue;
+		const key = content.slice(i, eq).trim();
+		if (!key) continue;
+		const valueStart = skipSpace(content, eq + 1, trimmedEnd);
+		const quote = content[valueStart];
+		if (valueStart === trimmedEnd || quote !== "\"" && quote !== "'") {
+			const rest = content.slice(valueStart, trimmedEnd).trimEnd();
+			const comment = rest.indexOf(" #");
+			out[key] = comment === -1 ? rest : rest.slice(0, comment).trimEnd();
+			continue;
+		}
+		const close = findClosingQuote(content, valueStart + 1, quote);
+		const valueEnd = close === -1 ? content.length : close;
+		const value = content.slice(valueStart + 1, valueEnd);
+		out[key] = quote === "\"" ? unescapeDoubleQuoted(value) : value;
+		if (valueEnd >= cursor) {
+			const after = content.indexOf("\n", valueEnd);
+			cursor = after === -1 ? content.length : after + 1;
+		}
+	}
+	return out;
+}
+/** First index at or after `from` (and before `end`) that isn't a space or tab. */
+function skipSpace(content, from, end) {
+	let i = from;
+	while (i < end && (content[i] === " " || content[i] === "	")) i++;
+	return i;
+}
+//#endregion
+//#region ../../packages/core/src/interpolate.ts
+/**
+* Secret references: `${OTHER_SECRET}` inside a secret value.
+*
+* This is the **canonical specification** of the expansion. It is pure string
+* work over an already-decrypted variable set, so it runs wherever plaintext
+* legitimately exists — the CLI, the browser, the language SDKs, and the Rust
+* clients (`crates/seekrit-core/src/interpolate.rs` mirrors it, pinned by the
+* shared golden fixture in `apps/run/testdata/vectors.json`).
+*
+* Expansion happens at **read time**, on the client, never on write and never
+* on the server: the API only ever holds the ciphertext of the literal
+* `${OTHER_SECRET}` text, so referencing costs nothing against the
+* zero-knowledge invariant. It also means a reference stays live — rotating
+* `DB_PASSWORD` updates every value that references it, with no re-encryption.
+*
+* The rules, in full:
+*
+* - `${NAME}` is replaced with the value of `NAME` in the *same fully-merged
+*   set* — after group → app-env → `.env` layering, so a reference always sees
+*   the value that layer precedence actually selected.
+* - `NAME` must be a valid secret name (`[A-Za-z_][A-Za-z0-9_]*`, matching
+*   `secretNameSchema`). Anything else — `${1}`, `${FOO:-bar}`, `${a.b}` — is
+*   left exactly as written, so shell and CI template syntax passes through
+*   untouched.
+* - A reference to a name that is not in the set is **left literal** and
+*   reported in {@link InterpolationResult.unresolved}. Erroring would mean a
+*   stored value that happens to contain `${GITHUB_SHA}` could break a whole
+*   environment's resolve; leaving it alone is the safe default, and the report
+*   is there to surface typos (`seekrit run --explain` prints it).
+* - Expansion is recursive: a referenced value may itself contain references.
+* - `$${NAME}` is an escape producing the literal text `${NAME}`. A `$$` not
+*   followed by `{` is ordinary text (passwords full of `$` are safe).
+* - A reference **cycle** throws {@link InterpolationError}. Unlike an unknown
+*   name, a cycle can only be a configuration mistake — every name in it
+*   exists — and there is no value that could be correct to emit.
+*
+* `process.env` is deliberately *not* a reference source: `seekrit run` layers
+* the live shell on top of the resolved set afterwards, and letting a stored
+* secret pull in arbitrary host environment variables would be a surprising
+* (and machine-dependent) way to change a secret's value.
+*/
+/** A reference name — the same grammar as `secretNameSchema`. */
+const REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* Cap on a single expanded value. Nested references can multiply length
+* (`A=${B}${B}`, `B=${C}${C}`, …), which memoization makes fast but does not
+* make small. A megabyte is far above any real secret and far below anything
+* that would exhaust a container.
+*/
+const MAX_EXPANDED_LENGTH = 1048576;
+/**
+* Split a value into literal runs and references — the single tokenizer every
+* rule above is expressed in terms of, so expansion and inspection can never
+* disagree about what counts as a reference.
+*/
+function* scan(text) {
+	let i = 0;
+	while (i < text.length) {
+		const dollar = text.indexOf("$", i);
+		if (dollar === -1) {
+			yield { literal: text.slice(i) };
+			return;
+		}
+		if (dollar > i) yield { literal: text.slice(i, dollar) };
+		if (text[dollar + 1] === "$" && text[dollar + 2] === "{") {
+			yield { literal: "${" };
+			i = dollar + 3;
+			continue;
+		}
+		const close = text[dollar + 1] === "{" ? text.indexOf("}", dollar + 2) : -1;
+		const reference = close === -1 ? null : text.slice(dollar + 2, close);
+		if (reference !== null && REFERENCE_NAME.test(reference)) {
+			yield {
+				reference,
+				raw: text.slice(dollar, close + 1)
+			};
+			i = close + 1;
+			continue;
+		}
+		yield { literal: "$" };
+		i = dollar + 1;
+	}
+}
+var InterpolationError = class extends Error {
+	code;
+	/**
+	* For `cycle`, the reference chain that closed on itself, starting and ending
+	* on the same name (`["A", "B", "A"]`). For `too_large`, the single name
+	* whose expansion blew the cap.
+	*/
+	chain;
+	constructor(code, message, chain) {
+		super(message);
+		this.name = "InterpolationError";
+		this.code = code;
+		this.chain = chain;
+	}
+};
+/**
+* Expand `${NAME}` references throughout a decrypted variable set.
+*
+* Pure: the input is never mutated. Throws {@link InterpolationError} on a
+* reference cycle (see the module comment for the complete rule set).
+*/
+function interpolateSecrets(values) {
+	const resolved = /* @__PURE__ */ new Map();
+	const unresolved = /* @__PURE__ */ new Set();
+	const expanded = [];
+	/** The chain currently being expanded — the cycle detector. */
+	const stack = [];
+	/** Expand one present name's value, memoized so each is expanded once. */
+	function resolve(name) {
+		const cached = resolved.get(name);
+		if (cached !== void 0) return cached;
+		const cycleAt = stack.indexOf(name);
+		if (cycleAt !== -1) {
+			const chain = [...stack.slice(cycleAt), name];
+			throw new InterpolationError("cycle", `secret reference cycle: ${chain.join(" → ")}`, chain);
+		}
+		stack.push(name);
+		let out = "";
+		for (const segment of scan(values[name])) if ("literal" in segment) out += segment.literal;
+		else if (Object.hasOwn(values, segment.reference)) out += resolve(segment.reference);
+		else {
+			unresolved.add(segment.reference);
+			out += segment.raw;
+		}
+		stack.pop();
+		if (out.length > MAX_EXPANDED_LENGTH) throw new InterpolationError("too_large", `${name} expands to more than ${MAX_EXPANDED_LENGTH} bytes — check its references`, [name]);
+		resolved.set(name, out);
+		return out;
+	}
+	const result = {};
+	for (const name of Object.keys(values)) {
+		const value = resolve(name);
+		result[name] = value;
+		if (value !== values[name]) expanded.push(name);
+	}
+	return {
+		values: result,
+		expanded,
+		unresolved: [...unresolved].sort()
+	};
+}
+z.enum([
+	"postgres",
+	"mysql",
+	"ssh",
+	"redis",
+	"aws",
+	"gcp",
+	"mongodb"
+]);
+const executorModeSchema = z.enum(["in_do", "remote"]);
+/**
+* A Postgres role name we are willing to create. Deliberately strict — this
+* value is interpolated into a SQL template, so it must be a bare identifier
+* with no way to break out of quoting (no quotes, whitespace, or semicolons).
+*/
+const postgresRoleNameSchema = z.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must be 3–63 chars, lowercase letters/digits/underscore, starting with a letter or underscore");
+/**
+* A SCRAM-SHA-256 verifier string as produced by @seekrit/crypto. Validated so
+* it, too, is safe to interpolate into a quoted SQL literal (the alphabet is
+* base64 + the fixed structural characters, none of which is a single quote).
+*/
+const scramVerifierSchema = z.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
+/**
+* An SSH login principal (a Unix-style username the certificate authorizes).
+* Bounded and restricted to a safe charset — principals are SSH-wire-encoded,
+* not shell-interpolated, so this is sanity/DoS hardening, not an injection gate.
+*/
+const sshPrincipalSchema = z.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "must be 1–64 chars of letters, digits, dot, dash, underscore");
+/** An `ssh-ed25519 <base64> [comment]` public key line (deep-validated on sign). */
+const sshPublicKeySchema = z.string().max(2048).regex(/^ssh-ed25519 [A-Za-z0-9+/=]+( .*)?$/, "must be an ssh-ed25519 public key");
+/** An SSH certificate extension name, e.g. `permit-pty`. */
+const sshExtensionSchema = z.string().regex(/^[a-z0-9-]{1,64}$/);
+/**
+* A MySQL/MariaDB user name we are willing to create. Interpolated into a
+* quoted SQL literal (`'{{name}}'@'%'`), so it is kept strict — plain
+* alphanumerics/underscore, no quotes/whitespace/semicolons to break out.
+*/
+const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+/**
+* A `mysql_native_password` authentication string — `*` followed by 40 upper
+* hex chars (`UPPER(HEX(SHA1(SHA1(password))))`), as produced by
+* @seekrit/crypto `mysqlNativePasswordVerifier`. Stored verbatim by
+* `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`, and its
+* alphabet contains no single quote, so it is safe in a quoted SQL literal.
+*/
+const mysqlNativeVerifierSchema = z.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
+/**
+* A Redis ACL user name we are willing to create. Interpolated into a Redis
+* command line as a bare token (`ACL SETUSER <name> …`), so it is kept strict —
+* plain alphanumerics/underscore, no whitespace to split the arg or ACL rule
+* characters (`~ + @ # & %`) that could be read as a permission.
+*/
+const redisUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+/**
+* A Redis password verifier — the lowercase-hex SHA-256 of the password, as
+* produced by @seekrit/crypto `redisSha256Verifier`. `ACL SETUSER … on #<hex>`
+* stores this digest verbatim, and it cannot authenticate: Redis `AUTH` hashes
+* the *plaintext* it receives with SHA-256 and compares, so the stored digest
+* is preimage-resistant (the password is high-entropy and machine-generated).
+* The alphabet is bare hex, so it is a safe bare command token.
+*/
+const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase-hex SHA-256 digest (64 chars)");
+/**
+* An IAM role ARN the broker is allowed to assume. Bounded and structurally
+* validated: `arn:<partition>:iam::<account>:role/<path-and-name>`. Partition
+* covers commercial (`aws`), GovCloud (`aws-us-gov`), and China (`aws-cn`).
+*/
+const awsRoleArnSchema = z.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
+/** An AWS region id, e.g. `us-east-1`, `eu-west-2`, `us-gov-west-1`. */
+const awsRegionSchema$1 = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
+/**
+* An STS external id — the shared string a role's trust policy can require so a
+* confused-deputy can't assume it. AWS allows a broad charset; we keep to the
+* documented safe set and bound the length.
+*/
+const awsExternalIdSchema = z.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
+z.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
+/**
+* A GCP service-account email the broker is allowed to impersonate (or that
+* appears in a delegation chain). Structurally validated and bounded: it is
+* interpolated into the IAM Credentials API URL path, so the charset excludes
+* anything that could break out of a path segment. Covers user-managed
+* (`name@<project>.iam.gserviceaccount.com`) and Google-managed
+* (`<project-number>-compute@developer.gserviceaccount.com`) forms.
+*/
+const gcpServiceAccountEmailSchema = z.string().max(256).regex(/^[a-z0-9-]+@[a-z0-9.-]+\.gserviceaccount\.com$/, "must be a service-account email (…@….gserviceaccount.com)");
+/**
+* An OAuth 2.0 scope granted to the minted access token, e.g.
+* `https://www.googleapis.com/auth/cloud-platform`. Bounded and whitespace-free
+* (scopes are space-delimited); passed to the IAM Credentials API in a JSON body
+* array, not a URL, so this is sanity/DoS hardening rather than an injection gate.
+*/
+const gcpOauthScopeSchema = z.string().min(1).max(256).regex(/^\S+$/, "must be a single OAuth scope with no whitespace");
+/**
+* The consumer's ephemeral P-256 public key (JWK-serialized) that a tier-2
+* credential is wrapped to before it is returned. Validated structurally here;
+* the executor imports it defensively before wrapping. Bounded so a giant blob
+* can't be pushed through the control plane.
+*/
+const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
+	try {
+		const jwk = JSON.parse(s);
+		return jwk.kty === "EC" && jwk.crv === "P-256" && !!jwk.x && !!jwk.y;
+	} catch {
+		return false;
+	}
+}, "must be a JWK-serialized P-256 public key");
+z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1–64 chars of [A-Za-z0-9_-]");
+/**
+* A MongoDB database name — the db a preset role is granted on, or the
+* authentication database a leased user is created in. MongoDB forbids
+* `/\. "$*<>:|?` and the empty string in db names; we keep to a safe subset.
+*/
+const mongoDatabaseNameSchema = z.string().regex(/^[A-Za-z0-9_-]{1,63}$/, "must be 1–63 chars of [A-Za-z0-9_-]");
+/**
+* A single MongoDB role grant `{ role, db }` for a `custom` target — e.g.
+* `{ role: "readWrite", db: "app" }` or a user-defined role. Admin-supplied
+* trusted input, set once at registration; still bounded structurally.
+*/
+const mongoRoleSchema = z.object({
+	role: z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be a role name"),
+	db: mongoDatabaseNameSchema
+});
+const postgresAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
+const mysqlAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
+const redisAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
+const mongoAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
+const connectionSchema = z.object({
+	host: z.string().min(1),
+	port: z.number().int().min(1).max(65535),
+	database: z.string().min(1)
+});
+/** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
+const statementSchema$1 = z.string().min(1).max(4e3);
+/** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
+const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
+const postgresTargetConfigSchema = z.object({
+	provider: z.literal("postgres"),
+	executor: executorModeSchema,
+	accessLevel: postgresAccessLevelSchema.optional(),
+	schema: identifierSchema.optional(),
+	connection: connectionSchema,
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
+});
+/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
+const mysqlHostSchema$1 = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const mysqlTargetConfigSchema = z.object({
+	provider: z.literal("mysql"),
+	executor: executorModeSchema,
+	accessLevel: mysqlAccessLevelSchema.optional(),
+	connection: connectionSchema,
+	userHost: mysqlHostSchema$1.optional(),
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
+});
+const redisConnectionSchema = z.object({
+	host: z.string().min(1),
+	port: z.number().int().min(1).max(65535),
+	/** Redis logical database index (the `/<n>` in a connection URL). */
+	db: z.number().int().min(0).max(15).optional()
+});
+const redisTargetConfigSchema = z.object({
+	provider: z.literal("redis"),
+	executor: executorModeSchema,
+	accessLevel: redisAccessLevelSchema.optional(),
+	connection: redisConnectionSchema,
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
+});
+const sshTargetConfigSchema = z.object({
+	provider: z.literal("ssh"),
+	executor: z.literal("in_do"),
+	caPublicKey: sshPublicKeySchema,
+	allowedPrincipals: z.array(sshPrincipalSchema).max(64).optional(),
+	extensions: z.array(sshExtensionSchema).max(16).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional(),
+	connection: z.object({
+		host: z.string().min(1).optional(),
+		user: sshPrincipalSchema.optional()
+	}).optional()
+});
+const AWS_MAX_TTL_SECONDS = 3600 * 12;
+const awsTargetConfigSchema = z.object({
+	provider: z.literal("aws"),
+	executor: z.literal("in_do"),
+	roleArn: awsRoleArnSchema,
+	region: awsRegionSchema$1,
+	externalId: awsExternalIdSchema.optional(),
+	sessionPolicy: z.string().min(1).max(4e3).optional(),
+	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
+});
+const GCP_MAX_TTL_SECONDS = 3600 * 12;
+const gcpTargetConfigSchema = z.object({
+	provider: z.literal("gcp"),
+	executor: z.literal("in_do"),
+	serviceAccount: gcpServiceAccountEmailSchema,
+	scopes: z.array(gcpOauthScopeSchema).min(1).max(32).optional(),
+	delegates: z.array(gcpServiceAccountEmailSchema).max(8).optional(),
+	maxTtlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
+});
+const mongoTargetConfigSchema = z.object({
+	provider: z.literal("mongodb"),
+	executor: z.literal("in_do"),
+	accessLevel: mongoAccessLevelSchema.optional(),
+	connection: connectionSchema,
+	authSource: mongoDatabaseNameSchema.optional(),
+	roles: z.array(mongoRoleSchema).min(1).max(32).optional(),
+	tls: z.boolean().optional(),
+	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional()
+});
+const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
+	postgresTargetConfigSchema,
+	mysqlTargetConfigSchema,
+	redisTargetConfigSchema,
+	sshTargetConfigSchema,
+	awsTargetConfigSchema,
+	gcpTargetConfigSchema,
+	mongoTargetConfigSchema
+]);
+z.object({
+	name: z.string().trim().min(1).max(128),
+	config: leaseTargetConfigSchema,
+	/**
+	* The admin/provisioning credential (e.g. a Postgres connection string),
+	* encrypted client-side to the broker's public key (a `wd1.` wrap). The
+	* control plane stores only this ciphertext — it never sees the plaintext.
+	*/
+	wrappedAdminSecret: z.string().min(1)
+});
+/** Requested lease lifetime, shared by all providers. */
+const ttlSecondsSchema = z.number().int().min(60).max(3600 * 24 * 7);
+/**
+* Client → API: mint a Postgres lease. The client generates the password and
+* its SCRAM verifier locally and sends only the verifier — the plaintext
+* password never leaves the requesting machine.
+*/
+const mintPostgresLeaseSchema = z.object({
+	provider: z.literal("postgres"),
+	targetId: z.string().min(1),
+	roleName: postgresRoleNameSchema,
+	verifier: scramVerifierSchema,
+	ttlSeconds: ttlSecondsSchema
+});
+/**
+* Client → API: mint a MySQL/MariaDB lease. The client generates the password
+* and its `mysql_native_password` hash locally and sends only the hash — the
+* plaintext password never leaves the requesting machine.
+*/
+const mintMysqlLeaseSchema = z.object({
+	provider: z.literal("mysql"),
+	targetId: z.string().min(1),
+	roleName: mysqlUserNameSchema,
+	verifier: mysqlNativeVerifierSchema,
+	ttlSeconds: ttlSecondsSchema
+});
+/**
+* Client → API: mint a Redis lease. The client generates the password and its
+* SHA-256 hex digest locally and sends only the digest — the plaintext password
+* never leaves the requesting machine.
+*/
+const mintRedisLeaseSchema = z.object({
+	provider: z.literal("redis"),
+	targetId: z.string().min(1),
+	roleName: redisUserNameSchema,
+	verifier: redisSha256VerifierSchema,
+	ttlSeconds: ttlSecondsSchema
+});
+/**
+* Client → API: mint an SSH lease. The client generates an ephemeral keypair
+* locally and sends only the public key; the signed certificate comes back in
+* the response. The private key never leaves the requesting machine.
+*/
+const mintSshLeaseSchema = z.object({
+	provider: z.literal("ssh"),
+	targetId: z.string().min(1),
+	publicKey: sshPublicKeySchema,
+	principals: z.array(sshPrincipalSchema).min(1).max(32),
+	ttlSeconds: ttlSecondsSchema
+});
+/**
+* Client → API: mint an AWS lease. The client generates an ephemeral P-256
+* keypair locally and sends only the public key; STS mints the credential and
+* the broker returns it wrapped to that key. The private key never leaves the
+* requesting machine, so the plaintext credential is only decryptable there.
+*
+* TTL bounds are STS's own `DurationSeconds` limits (15 min – 12 h), not the
+* generic lease bounds — STS rejects anything below 900 seconds.
+*/
+const mintAwsLeaseSchema = z.object({
+	provider: z.literal("aws"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
+});
+/**
+* Client → API: mint a GCP lease. Like AWS (tier 2): the client generates an
+* ephemeral P-256 keypair locally and sends only the public key; the IAM
+* Credentials API mints the access token and the broker returns it wrapped to
+* that key. The private key never leaves the requesting machine, so the plaintext
+* token is only decryptable there.
+*
+* TTL bounds are GCP's `generateAccessToken` limits (1 min – 12 h); tokens over
+* 1 h require the credential-lifetime-extension org policy.
+*/
+const mintGcpLeaseSchema = z.object({
+	provider: z.literal("gcp"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
+});
+/**
+* Client → API: mint a MongoDB lease. Like AWS (tier 2), the client generates
+* an ephemeral P-256 keypair locally and sends only the public key; the broker
+* generates the password, runs `createUser`, and returns the credential wrapped
+* to that key. The private key never leaves the requesting machine, so the
+* plaintext credential is only decryptable there.
+*/
+const mintMongoLeaseSchema = z.object({
+	provider: z.literal("mongodb"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: ttlSecondsSchema
+});
+z.discriminatedUnion("provider", [
+	mintPostgresLeaseSchema,
+	mintMysqlLeaseSchema,
+	mintRedisLeaseSchema,
+	mintSshLeaseSchema,
+	mintAwsLeaseSchema,
+	mintGcpLeaseSchema,
+	mintMongoLeaseSchema
+]);
+//#endregion
+//#region ../../packages/core/src/types.ts
+/**
+* Transactional notification emails seekrit can send. Each id is one
+* user-facing on/off toggle (see `NOTIFICATION_TYPE_META`). These carry only
+* audit-grade metadata — never secret material — and every one is opt-out
+* (defaults on). Kept as a const array so the API, api-client, and dashboard
+* share a single source of truth (mirrors `AUDIT_ACTIONS`).
+*/
+const NOTIFICATION_TYPES = [
+	"token_created",
+	"token_revoked",
+	"env_access_granted",
+	"env_access_revoked",
+	"resolve_denied",
+	"org_welcome",
+	"token_expiring",
+	"lease_expired",
+	"sync_failed",
+	"honey_token_tripped",
+	"secret_rotation_failed"
+];
+//#endregion
+//#region ../../packages/core/src/schemas.ts
+/** URL-safe identifier segment: `my-app`, `production`, … */
+const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
+const nameSchema = z.string().trim().min(1).max(128);
+/** An email address, normalized to trimmed lowercase before validation. */
+const emailSchema = z.string().trim().toLowerCase().pipe(z.email().max(320));
+/** Env-var style secret name: FOO, DATABASE_URL, apiKey2 … */
+const secretNameSchema = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
+z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+/** Role a person may be invited at — never `owner` (ownership isn't invitable). */
+const inviteRoleSchema = z.enum(["admin", "member"]);
+const principalTypeSchema = z.enum(["user", "service_token"]);
+/** Org-level capability a service token can hold (never `owner`). */
+const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
+z.object({ required: z.boolean() });
+z.object({
+	email: emailSchema,
+	role: inviteRoleSchema.default("member")
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	groupId: z.string().min(1),
+	/** Precedence among an env's groups (higher wins). Appended if omitted. */
+	position: z.number().int().min(0).optional()
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema,
+	/** Environment DEK wrapped to the creator's public key — created client-side. */
+	wrappedDek: z.string().min(1),
+	/**
+	* When the org has recovery enabled, the same DEK additionally wrapped to the
+	* org recovery public key, so the environment is recovery-protected from
+	* creation. Omitted when recovery is off (backfilled later by `recovery sync`).
+	*/
+	recoveryWrappedDek: z.string().min(1).nullish()
+});
+z.object({
+/** Opaque versioned ciphertext blob from @seekrit/crypto. */
+ciphertext: z.string().min(1).max(65536) });
+z.object({ version: z.number().int().positive() });
+z.object({ limit: z.coerce.number().int().min(1).max(200).default(50) });
+z.object({
+	publicKeyJwk: z.string().min(1),
+	/**
+	* Private key encrypted with a passphrase-derived KEK; opaque to the
+	* server. Self-contained blob (embeds KDF salt + iterations).
+	*/
+	encryptedPrivateKey: z.string().min(1)
+});
+const grantEnvironmentKeySchema = z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	wrappedDek: z.string().min(1)
+});
+z.object({
+	slug: slugSchema,
+	/** Display name; defaults to the slug. */
+	name: nameSchema.optional(),
+	ttlSeconds: z.number().int().min(60).max(MAX_BRANCH_TTL_SECONDS).nullish(),
+	/** The branch's own DEK, wrapped to the creator — generated client-side. */
+	wrappedDek: z.string().min(1),
+	recoveryWrappedDek: z.string().min(1).nullish(),
+	/** The same DEK wrapped to each of the parent's existing grant-holders. */
+	grants: z.array(grantEnvironmentKeySchema).max(500).default([])
+});
+z.object({
+	name: nameSchema,
+	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full token string. */
+	tokenHash: z.string().min(1),
+	publicKeyJwk: z.string().min(1),
+	/**
+	* Org-level capability. Defaults to `member` (a runtime credential); pass
+	* `admin` to mint a headless provisioning token. Only an admin caller may
+	* create an `admin` token, so capability cannot escalate itself.
+	*/
+	role: serviceTokenRoleSchema.default("member"),
+	/**
+	* The application environment this token is bound to (org + app + env).
+	* Optional so org-admin tokens can exist, but required for runtime tokens
+	* that resolve secrets via `GET /v1/resolve`.
+	*/
+	environmentId: z.string().min(1).nullish(),
+	expiresAt: z.iso.datetime().nullish()
+});
+z.object({
+	name: nameSchema,
+	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full token string. */
+	tokenHash: z.string().min(1),
+	/** Where the decoy was planted, as a reminder for whoever reads the alert. */
+	placement: z.string().max(200).nullish()
+});
+const kmsKeyPurposeSchema = z.enum(["encrypt", "sign"]);
+const kmsKeySpecSchema = z.enum(["aes-256-gcm", "ecdsa-p256"]);
+/** A wrapped key grant supplied by the client (server never sees plaintext material). */
+const kmsGrantInputSchema = z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	/** Key material wrapped to the principal's public key (`wd1.` blob). */
+	wrappedKey: z.string().min(1)
+});
+z.object({
+	name: nameSchema,
+	purpose: kmsKeyPurposeSchema,
+	spec: kmsKeySpecSchema,
+	applicationId: z.string().min(1).nullish(),
+	groupId: z.string().min(1).nullish(),
+	/** ECDSA P-256 public key (JWK) for `sign` keys; omit for `encrypt` keys. */
+	publicKeyJwk: z.string().min(1).nullish(),
+	grants: z.array(kmsGrantInputSchema).min(1)
+}).refine((v) => !(v.applicationId && v.groupId), {
+	message: "a key may be scoped to an application or a group, not both",
+	path: ["groupId"]
+}).refine((v) => v.purpose === "sign" === (v.spec === "ecdsa-p256"), {
+	message: "sign keys require spec ecdsa-p256; encrypt keys require aes-256-gcm",
+	path: ["spec"]
+}).refine((v) => v.purpose === "sign" === (v.publicKeyJwk != null), {
+	message: "sign keys require a publicKeyJwk; encrypt keys must omit it",
+	path: ["publicKeyJwk"]
+});
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	/** Current-version key material wrapped to the principal's public key. */
+	wrappedKey: z.string().min(1)
+});
+z.object({
+	publicKeyJwk: z.string().min(1).nullish(),
+	grants: z.array(kmsGrantInputSchema).min(1)
+});
+/**
+* One custodian's wrapped Shamir share of the org recovery private key. The
+* client generates the recovery keypair, splits the private half M-of-N, and
+* wraps each share to a custodian's public key — the server stores only the
+* opaque `wrappedShare` and can reconstruct nothing.
+*/
+const recoveryShareInputSchema = z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	/** Shamir x-coordinate carried by the share (1..255). */
+	shareIndex: z.number().int().min(1).max(255),
+	/** The recovery-key share wrapped to the custodian's public key (`wd1.`). */
+	wrappedShare: z.string().min(1)
+});
+/** An environment DEK additionally wrapped to the org recovery public key. */
+const recoveryEnvGrantSchema = z.object({
+	environmentId: z.string().min(1),
+	/** The environment's DEK wrapped to the recovery public key (`wd1.`). */
+	wrappedDek: z.string().min(1)
+});
+z.object({
+	recoveryPublicKeyJwk: z.string().min(1),
+	threshold: z.number().int().min(1).max(255),
+	shares: z.array(recoveryShareInputSchema).min(1).max(255),
+	grants: z.array(recoveryEnvGrantSchema).default([])
+}).refine((v) => v.threshold <= v.shares.length, {
+	message: "threshold cannot exceed the number of custodians",
+	path: ["threshold"]
+}).refine((v) => new Set(v.shares.map((s) => `${s.principalType}:${s.principalId}`)).size === v.shares.length, {
+	message: "custodians must be distinct",
+	path: ["shares"]
+});
+z.object({ grants: z.array(recoveryEnvGrantSchema).min(1).max(500) });
+z.object({
+	targetPublicKeyJwk: z.string().min(1),
+	targetType: principalTypeSchema.nullish(),
+	targetId: z.string().min(1).nullish(),
+	reason: z.string().max(500).nullish()
+});
+z.object({
+	shareIndex: z.number().int().min(1).max(255),
+	/** The custodian's share re-wrapped to the target public key (`wd1.`). */
+	contributedShare: z.string().min(1)
+});
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	grants: z.array(recoveryEnvGrantSchema).min(1).max(500)
+});
+z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
+z.object({
+	endpoint: z.url().max(2048),
+	headers: z.record(z.string().min(1).max(256), z.string().max(4096)).optional(),
+	enabled: z.boolean().default(true)
+});
+const planFamilySchema = z.enum(PLAN_FAMILY_IDS);
+const subscriptionStatusSchema = z.enum(SUBSCRIPTION_STATUSES);
+z.enum(ENTITLEMENT_KEYS);
+/** An entitlement value: boolean (features), number or null/unlimited (limits, metered). */
+const entitlementValueSchema = z.union([
+	z.boolean(),
+	z.number(),
+	z.null()
+]);
+z.object({
+	family: planFamilySchema,
+	version: z.number().int().positive().optional(),
+	status: subscriptionStatusSchema.default("active")
+});
+z.object({
+	value: entitlementValueSchema,
+	note: z.string().max(500).nullish(),
+	expiresAt: z.iso.datetime().nullish()
+});
+z.object({
+	code: z.string().min(4).max(40),
+	family: planFamilySchema,
+	version: z.number().int().positive().optional(),
+	durationDays: z.number().int().positive().max(3650).nullish(),
+	maxRedemptions: z.number().int().positive().nullish(),
+	startsAt: z.iso.datetime().nullish(),
+	endsAt: z.iso.datetime().nullish(),
+	note: z.string().max(500).nullish()
+});
+z.object({
+	maxRedemptions: z.number().int().positive().nullish(),
+	startsAt: z.iso.datetime().nullish(),
+	endsAt: z.iso.datetime().nullish(),
+	note: z.string().max(500).nullish(),
+	/** Kill switch. Disabling stops new redemptions; live grants are untouched. */
+	disabled: z.boolean().optional()
+});
+z.object({ code: z.string().min(1).max(40) });
+z.object({ family: planFamilySchema });
+z.object({
+	sessionId: z.string().regex(/^skc_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full session token string. */
+	tokenHash: z.string().min(1).max(128),
+	/** Display-only, e.g. `miles@studio.local`. */
+	deviceLabel: z.string().trim().min(1).max(120),
+	/** Display-only, e.g. `cli/0.4.2`. */
+	client: z.string().trim().max(60).optional()
+});
+z.object({ code: z.string().trim().min(1).max(32) });
+z.object({
+	cursor: z.string().optional(),
+	limit: z.coerce.number().int().min(1).max(200).default(50),
+	action: z.string().optional(),
+	resourceType: z.string().optional()
+});
+z.enum([
+	"generated",
+	"postgres",
+	"mysql",
+	"redis"
+]);
+z.enum([
+	"active",
+	"paused",
+	"failed"
+]);
+/** Statuses an admin may set directly (`failed` is only reached by the sweep). */
+const settableRotationStatusSchema = z.enum(["active", "paused"]);
+const rotationAlphabetSchema = z.enum([
+	"alphanumeric",
+	"hex",
+	"base64url",
+	"printable"
+]);
+const rotationIntervalSchema = z.number().int().min(300).max(3600 * 24 * 365);
+/**
+* A database user name we are willing to *re-key*. Deliberately more permissive
+* than the lease providers' name schemas — those name accounts seekrit creates,
+* whereas this names an account the customer's DBA created years ago, which may
+* be mixed-case or contain dots or dashes.
+*
+* It stays injection-safe for every place it is interpolated: a double-quoted
+* Postgres identifier, a single-quoted MySQL literal, and a bare Redis command
+* token. The charset excludes both quote characters, backslash, whitespace, and
+* `;`, so there is no way out of the surrounding quoting, and no whitespace to
+* split one Redis argument into two.
+*/
+const rotationUsernameSchema = z.string().regex(/^[A-Za-z0-9_$.-]{1,63}$/, "must be 1–63 chars of letters, digits, underscore, dollar, dot or dash");
+/** A `{{name}}`/`{{host}}`/`{{verifier}}` templated statement or command line. */
+const statementSchema = z.string().min(1).max(4e3);
+const passwordLengthSchema = z.number().int().min(16).max(256);
+/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
+const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const generatedRotationConfigSchema = z.object({
+	kind: z.literal("generated"),
+	length: passwordLengthSchema.optional(),
+	alphabet: rotationAlphabetSchema.optional()
+});
+const postgresRotationConfigSchema = z.object({
+	kind: z.literal("postgres"),
+	username: rotationUsernameSchema,
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const mysqlRotationConfigSchema = z.object({
+	kind: z.literal("mysql"),
+	username: rotationUsernameSchema,
+	userHost: mysqlHostSchema.optional(),
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const redisRotationConfigSchema = z.object({
+	kind: z.literal("redis"),
+	username: rotationUsernameSchema,
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const rotationConfigSchema = z.discriminatedUnion("kind", [
+	generatedRotationConfigSchema,
+	postgresRotationConfigSchema,
+	mysqlRotationConfigSchema,
+	redisRotationConfigSchema
+]);
+z.object({
+	environmentId: z.string().min(1),
+	/** The secret whose value rotates. It must already exist. */
+	secretName: secretNameSchema,
+	config: rotationConfigSchema,
+	intervalSeconds: rotationIntervalSchema,
+	/**
+	* The registered lease target supplying the connection, executor mode, and
+	* wrapped admin credential. Required for every kind but `generated`.
+	*/
+	targetId: z.string().min(1).optional(),
+	/** Environment DEK wrapped to the rotator public key (`wd1.` blob). */
+	wrappedDek: z.string().min(1).optional(),
+	/** Rotate once immediately instead of waiting for the first interval. */
+	rotateNow: z.boolean().optional()
+});
+z.object({
+	intervalSeconds: rotationIntervalSchema.optional(),
+	config: rotationConfigSchema.optional(),
+	/**
+	* `paused` stops the sweep; `active` resumes it and clears the failure
+	* streak, which is also how a `failed` policy is recovered.
+	*/
+	status: settableRotationStatusSchema.optional()
+}).refine((v) => v.intervalSeconds !== void 0 || v.config !== void 0 || v.status !== void 0, "provide at least one of intervalSeconds, config, or status");
+z.enum([
+	"vercel",
+	"cloudflare-workers",
+	"cloudflare-pages",
+	"cloudflare-secrets-store",
+	"railway",
+	"aws-secrets-manager",
+	"aws-parameter-store",
+	"render",
+	"fly",
+	"northflank",
+	"digitalocean",
+	"heroku",
+	"netlify",
+	"bunnyshell",
+	"github-actions",
+	"gcp-secret-manager"
+]);
+/**
+* Vercel account scope. The API token itself is never here — it is wrapped to
+* the connection's public key and stored as ciphertext.
+*
+* `teamId` is required for tokens scoped to a Vercel Team; personal-account
+* tokens omit it. Vercel rejects team-owned project calls that lack it with a
+* bare 403, so we pass it through as `?teamId=` on every request.
+*/
+const vercelConnectionConfigSchema = z.object({
+	provider: z.literal("vercel"),
+	/** Vercel Team id (`team_…`). Omit for a personal account. */
+	teamId: z.string().trim().min(1).max(128).optional()
+});
+/**
+* A Cloudflare account id — 32 lowercase hex characters, found in the sidebar
+* of any account's dashboard. Every Cloudflare endpoint seekrit calls is
+* account-scoped, so this is the account half of "which account, which thing".
+*
+* Validated by shape because the alternative is a bare 400 from Cloudflare
+* hours later inside an alarm, with nobody watching. It does not catch pasting
+* a *zone* id, which has the same shape — only the API can tell those apart.
+*/
+const cloudflareAccountIdSchema = z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Cloudflare account ID (lowercase hex)");
+/**
+* Cloudflare account scope, shared by all three Cloudflare providers. The API
+* token is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's is.
+*
+* The three providers are deliberately separate kinds rather than one
+* `cloudflare` with a mode field: they target different APIs, take different
+* destinations, and fail in different ways. Splitting them keeps the
+* exhaustiveness guard in `connectorFor` meaningful.
+*/
+const cloudflareWorkersConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflarePagesConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflareSecretsStoreConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	accountId: cloudflareAccountIdSchema
+});
+/**
+* A Railway id — every project, environment, and service is a UUID. Validated
+* by shape for the same reason Cloudflare's account id is: the alternative is a
+* bare GraphQL "Problem processing request" hours later inside an alarm, with
+* nobody watching.
+*/
+const railwayIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a Railway UUID");
+/**
+* Railway account scope. The token is never here — it is wrapped to the
+* connection's public key and stored as ciphertext, exactly as Vercel's is.
+*
+* There is no workspace/team id to carry: Railway ids are globally unique and
+* a destination names its project outright, so the token plus the destination
+* is the whole address.
+*/
+const railwayConnectionConfigSchema = z.object({
+	provider: z.literal("railway"),
+	tokenKind: z.enum(["account", "project"]).default("account")
+});
+/**
+* An AWS region id (`us-east-1`, `eu-central-1`, `us-gov-west-1`).
+*
+* Validated by shape rather than against a list, because AWS adds regions
+* faster than we ship. The endpoint host is built from this string, so a typo
+* would otherwise surface as a DNS failure inside an alarm with nobody
+* watching — which is a much worse place to learn about it than this form.
+*/
+const awsRegionSchema = z.string().trim().regex(/^[a-z]{2}(-[a-z]+)+-\d$/, "must be an AWS region ID, e.g. us-east-1");
+/**
+* The IAM access key id seekrit signs with.
+*
+* This lives in `config` — the *non-secret* half — on purpose: an access key id
+* is an identifier, not a credential. It appears in CloudTrail, in the IAM
+* console, and in the `Authorization` header of every signed request; only the
+* **secret access key** is secret, and that is what gets wrapped to the
+* connection's public key. Keeping the id here also lets the dashboard say
+* which key a connection is using, which is the first thing you want to know
+* when a connection starts failing after a key rotation.
+*
+* Long-lived IAM user keys only. `ASIA…` session credentials from STS expire
+* within hours, and a sync connection has to keep working unattended.
+*/
+const awsAccessKeyIdSchema = z.string().trim().regex(/^[A-Z0-9]{16,128}$/, "must be an AWS access key ID, e.g. AKIAIOSFODNN7EXAMPLE");
+/**
+* AWS account scope, shared by both AWS providers: which region to call and
+* which key to sign with. There is no account id — every endpoint seekrit calls
+* is reached through the regional host and authorizes off the signature, so the
+* account is whichever one the key belongs to.
+*
+* Two providers rather than one `aws` with a mode field, for the same reason
+* the three Cloudflare kinds are separate: different APIs, different
+* destinations, different IAM actions.
+*/
+const awsSecretsManagerConnectionConfigSchema = z.object({
+	provider: z.literal("aws-secrets-manager"),
+	region: awsRegionSchema,
+	accessKeyId: awsAccessKeyIdSchema
+});
+const awsParameterStoreConnectionConfigSchema = z.object({
+	provider: z.literal("aws-parameter-store"),
+	region: awsRegionSchema,
+	accessKeyId: awsAccessKeyIdSchema
+});
+/**
+* Render account scope — deliberately empty.
+*
+* Like Railway's, and unlike Vercel (which 403s team-owned resources without
+* `teamId`) or Cloudflare (whose every endpoint is account-scoped): a Render
+* API key is issued to a user, and every endpoint seekrit calls addresses its
+* resource by id — `srv-…`, `crn-…`, `evg-…`. There is nothing to scope, so
+* nothing is stored. The connection's `name` is what tells an operator which Render
+* workspace it belongs to.
+*/
+const renderConnectionConfigSchema = z.object({ provider: z.literal("render") });
+/**
+* Fly.io account scope — empty, as Render's is.
+*
+* Neither half of "which account, which thing" needs stating: Fly app names are
+* globally unique, so the destination names its app and that is the whole
+* address. Nor is there a token kind to declare the way Railway's `tokenKind`
+* is — Fly's two token shapes do take different auth schemes, but
+* `flyAuthorization` in the connector reads which one from the token itself.
+*/
+const flyConnectionConfigSchema = z.object({ provider: z.literal("fly") });
+/**
+* A Northflank id — projects and secret groups are both slugs derived from the
+* name they were created with (`default-project`, `example-secret-group`), and
+* both appear in the resource's URL. Validated against Northflank's own pattern
+* so the common slip — pasting the *display name*, spaces and all — fails here
+* rather than as a bare 404 inside an alarm with nobody watching.
+*/
+const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/, "must be a Northflank ID — the slug in the resource's URL, not its display name");
+/**
+* Northflank account scope — deliberately empty.
+*
+* A Northflank API token is issued by exactly one team (or org-owned team) and
+* carries that scope itself; `GET /v1/auth` reports which. There is no team id
+* to disambiguate the way Vercel needs one, and no account id the way
+* Cloudflare does: the token plus the destination's project is the whole
+* address. The kind exists so the discriminated union stays uniform.
+*/
+const northflankConnectionConfigSchema = z.object({ provider: z.literal("northflank") });
+/**
+* DigitalOcean account scope — deliberately empty, as Render's and Fly's are.
+*
+* A DigitalOcean personal access token belongs to one account (or one team, if
+* it was issued inside one) and carries that scope itself, and every endpoint
+* this connector calls addresses its app by id. There is no team id to
+* disambiguate the way Vercel needs one: the token plus the destination's app
+* id is the whole address.
+*/
+const digitalOceanConnectionConfigSchema = z.object({ provider: z.literal("digitalocean") });
+/**
+* Heroku account scope — empty, as Fly's and Render's are.
+*
+* A Heroku API token carries its user's access to every app and team they can
+* reach, and app names are globally unique, so the destination's app is the
+* whole address. There is no team id to state: unlike Vercel, where a personal
+* token 403s a team-owned project without `teamId`, Heroku resolves
+* `/apps/{app_id_or_name}` against everything the token can see, team-owned or
+* not.
+*/
+const herokuConnectionConfigSchema = z.object({ provider: z.literal("heroku") });
+/**
+* Netlify team scope — the one thing a Netlify token cannot tell us itself.
+*
+* Every environment variable endpoint is account-scoped
+* (`/accounts/{account_id}/env`), and a personal access token belongs to a
+* *user*, who may sit in several teams. So unlike Fly's or Heroku's, this
+* config is not empty: the token says who you are, and this says which team's
+* variables to write.
+*
+* Netlify treats the team's id and its slug as interchangeable wherever
+* `{account_id}` appears, so both are accepted. The slug is the one an operator
+* can find without an API call — it is in the dashboard URL
+* (`app.netlify.com/teams/<slug>`) and under Team settings → General.
+*/
+const netlifyConnectionConfigSchema = z.object({
+	provider: z.literal("netlify"),
+	/** Netlify team slug (`acme`) or account id — `{account_id}` accepts either. */
+	accountId: z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Netlify team slug or account ID — no slashes or spaces")
+});
+/**
+* Bunnyshell account scope — empty, as Fly's, Heroku's, and Northflank's are.
+*
+* A Bunnyshell access token (from `environments.bunnyshell.com/access-token`)
+* belongs to a *user* and carries their access to every organization they are
+* in, exactly as a Heroku token does. Unlike Netlify's, that does not force an
+* organization onto the connection, because nothing here is addressed *through*
+* one: both variable collections name their parent by an opaque, globally
+* unique id (`environment` or `project`), so the token plus the destination's
+* id is the whole address. The API offers an `organization` filter, but it
+* narrows a listing — it is not part of an address.
+*/
+const bunnyshellConnectionConfigSchema = z.object({ provider: z.literal("bunnyshell") });
+/**
+* GitHub account scope — empty for github.com, which is the whole point.
+*
+* A GitHub token addresses everything by `{owner}/{repo}` or `{org}`, and those
+* are the destination's business, so there is no account half to state the way
+* Cloudflare and Netlify need one. `baseUrl` is the single exception, and it is
+* not an account scope at all: it names a **GitHub Enterprise Server** install,
+* whose API lives on the customer's own host rather than on `api.github.com`.
+*
+* Left unset for github.com and for Enterprise Cloud (which is `api.github.com`
+* with a different plan behind it). Set only for a self-hosted GHES appliance,
+* where the REST API is at `https://<host>/api/v3`.
+*/
+const githubActionsConnectionConfigSchema = z.object({
+	provider: z.literal("github-actions"),
+	/**
+	* GitHub Enterprise Server API root, e.g. `https://github.acme.com/api/v3`.
+	* Omit for github.com. Must be `https:` — this URL carries the token.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the GitHub Enterprise Server API root, e.g. https://github.acme.com/api/v3").optional()
+});
+/**
+* A Google Cloud project, as `projects/{project}` accepts one: either the
+* project **ID** (`acme-prod`, 6–30 characters, what the console shows) or the
+* project **number** (all digits). Both are accepted because both work, and
+* the id is the one an operator can read off their own dashboard.
+*
+* Validated by shape for the reason Cloudflare's account id is: every Secret
+* Manager URL is built from this string, and a typo would otherwise surface as
+* a 403 from Google hours later inside an alarm, with nobody watching.
+*/
+const gcpProjectSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(value) || /^\d{1,20}$/.test(value), "must be a Google Cloud project ID (e.g. acme-prod) or project number");
+/**
+* Google Cloud project scope — which project's Secret Manager to write.
+*
+* The service account is *not* here, unlike AWS's access key id: a GCP
+* credential is a key JSON that names its own `client_email`, so the identity
+* arrives with the credential the way a Vercel token's does. What the
+* credential cannot say is which project to write, because a service account
+* can be granted access to secrets in projects other than its own — so that is
+* this field, exactly as Cloudflare's account id is.
+*
+* One project per connection. Syncing an environment into two projects means
+* two connections, which also keeps their key grants separate.
+*
+* Global secrets only: v1 addresses `secretmanager.googleapis.com`, not the
+* per-location `secretmanager.<location>.rep.googleapis.com` endpoints that
+* regional secrets live behind. Data residency is expressed instead through the
+* destination's user-managed replication.
+*/
+const gcpSecretManagerConnectionConfigSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	/** Project ID (`acme-prod`) or project number. */
+	projectId: gcpProjectSchema
+});
+const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
+	vercelConnectionConfigSchema,
+	cloudflareWorkersConnectionConfigSchema,
+	cloudflarePagesConnectionConfigSchema,
+	cloudflareSecretsStoreConnectionConfigSchema,
+	railwayConnectionConfigSchema,
+	awsSecretsManagerConnectionConfigSchema,
+	awsParameterStoreConnectionConfigSchema,
+	renderConnectionConfigSchema,
+	flyConnectionConfigSchema,
+	northflankConnectionConfigSchema,
+	digitalOceanConnectionConfigSchema,
+	herokuConnectionConfigSchema,
+	netlifyConnectionConfigSchema,
+	bunnyshellConnectionConfigSchema,
+	githubActionsConnectionConfigSchema,
+	gcpSecretManagerConnectionConfigSchema
+]);
+const vercelDestinationSchema = z.object({
+	provider: z.literal("vercel"),
+	/** Vercel project id (`prj_…`) or project name. */
+	projectId: z.string().trim().min(1).max(128),
+	/** Which deployment targets receive these values. At least one. */
+	targets: z.array(z.enum([
+		"production",
+		"preview",
+		"development"
+	])).min(1),
+	/**
+	* Restrict `preview` writes to one git branch. Vercel only honors this when
+	* `targets` includes `preview`; ignored otherwise.
+	*/
+	gitBranch: z.string().trim().min(1).max(255).optional()
+});
+/**
+* The Worker whose secrets a binding owns. Wrangler *environments* are not a
+* separate field because they are not a separate concept at the API: deploying
+* `my-api` with `--env staging` creates a Worker literally named
+* `my-api-staging`, so pointing at an environment means naming that script.
+*/
+const cloudflareWorkersDestinationSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	/** Worker script name, as shown in the dashboard (`my-api`). */
+	scriptName: z.string().trim().min(1).max(63).regex(/^[A-Za-z0-9_][A-Za-z0-9_-]*$/, "must be a Worker script name")
+});
+const cloudflarePagesDestinationSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	/** Pages project name (`my-site`) — Pages has no separate project id. */
+	projectName: z.string().trim().min(1).max(58).regex(/^[A-Za-z0-9][A-Za-z0-9-]*$/, "must be a Pages project name"),
+	/** Which deployment configs receive these values. At least one. */
+	environments: z.array(z.enum(["production", "preview"])).min(1)
+});
+const cloudflareSecretsStoreDestinationSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	/** Store id (32 hex). An account has exactly one store today. */
+	storeId: z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Secrets Store ID (lowercase hex)"),
+	/** Scopes applied to secrets this binding creates. At least one. */
+	scopes: z.array(z.enum([
+		"workers",
+		"ai_gateway",
+		"dex",
+		"access",
+		"containers",
+		"websearch"
+	])).min(1)
+});
+/**
+* Where inside Railway a binding writes.
+*
+* Railway variables are addressed by (project, environment, service) — the
+* environment here is *Railway's* (`production`, `pr-42`), not the seekrit
+* environment the binding reads from; a binding is precisely the mapping
+* between the two.
+*
+* Omitting `serviceId` targets the project's **shared** variables for that
+* environment, which services opt into with `${{shared.NAME}}`. That is a
+* genuinely different destination from any one service's variables, so it is an
+* absent field rather than a sentinel.
+*/
+const railwayDestinationSchema = z.object({
+	provider: z.literal("railway"),
+	/** Railway project id (a UUID, from the project's Settings page or URL). */
+	projectId: railwayIdSchema,
+	/** Railway environment id (a UUID) — the deployment environment to write. */
+	environmentId: railwayIdSchema,
+	/** Service to write. Omit to write the environment's shared variables. */
+	serviceId: railwayIdSchema.optional(),
+	/**
+	* Suppress the redeploy Railway triggers when a variable changes.
+	*
+	* Left off (the default), a sync that changes a value redeploys the service,
+	* which is what makes the new value actually reach the running process —
+	* Railway applies variables at deploy time. Turn it on when deploys are
+	* gated behind a release process and a secrets push must not start one; the
+	* values then sit staged until the next deploy.
+	*/
+	skipDeploys: z.boolean().optional()
+});
+/**
+* A customer-managed KMS key to encrypt with, as a key id, ARN, or alias
+* (`alias/seekrit`). Omitted means the AWS-managed default for that service
+* (`aws/secretsmanager`, `aws/ssm`), which is what most accounts want.
+*
+* Deliberately loose: a KMS key can be named five different ways, half of them
+* cross-account ARNs, and rejecting a valid one here would be worse than
+* letting KMS give its own (very clear) error.
+*/
+const awsKmsKeyIdSchema = z.string().trim().min(1).max(2048);
+/**
+* Where in Secrets Manager a binding writes.
+*
+* `pathPrefix` exists rather than reusing {@link NameTransform}'s `prefix`
+* because the two answer different questions: a name transform produces a
+* *variable name* (`[A-Za-z0-9_]`, no slashes), while this produces a
+* *namespace* — `prod/storefront/` — and slashes are the whole point of it.
+*/
+const awsSecretsManagerDestinationSchema = z.object({
+	provider: z.literal("aws-secrets-manager"),
+	layout: z.enum(["secret-per-name", "json-bundle"]).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret's name, e.g.
+	* `prod/storefront/`. Optional, but strongly advised in an account that
+	* holds anything else — without it a binding writes at the root of a
+	* namespace it does not own.
+	*/
+	pathPrefix: z.string().trim().max(400).regex(/^[A-Za-z0-9/_+=.@-]*$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod/storefront/env`. */
+	secretName: z.string().trim().min(1).max(512).regex(/^[A-Za-z0-9/_+=.@-]+$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	kmsKeyId: awsKmsKeyIdSchema.optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretName !== void 0, {
+	message: "a json-bundle destination needs the name of the secret to write",
+	path: ["secretName"]
+});
+/**
+* The Parameter Store hierarchy a binding owns, e.g. `/prod/storefront/`.
+*
+* A path rather than a free-form prefix because that is what the API is built
+* around: `GetParametersByPath` is how an application reads a whole
+* environment in one call, and it only works on `/`-delimited names. Leading
+* and trailing slashes are required so the binding's names concatenate
+* unambiguously — `/prod/storefront/` + `DB_URL`.
+*/
+const awsParameterStoreDestinationSchema = z.object({
+	provider: z.literal("aws-parameter-store"),
+	/** Must start and end with `/`. `aws`/`ssm` are reserved by AWS as the first segment. */
+	path: z.string().trim().max(1011).regex(/^\/([A-Za-z0-9_.-]+\/)*$/, "must be a parameter path like /prod/storefront/"),
+	type: z.enum(["SecureString", "String"]).default("SecureString"),
+	/**
+	* Standard caps a value at 4KB and costs nothing; Advanced raises that to 8KB
+	* and is billed per parameter per month. `Intelligent-Tiering` lets AWS pick,
+	* upgrading only the parameters that need it.
+	*/
+	tier: z.enum([
+		"Standard",
+		"Advanced",
+		"Intelligent-Tiering"
+	]).default("Standard"),
+	kmsKeyId: awsKmsKeyIdSchema.optional()
+});
+/**
+* Render resource ids are `<prefix>-<slug>`, and the two prefixes below are the
+* documented ones: `srv-` for every service type, `crn-` for cron jobs, `evg-`
+* for an environment group.
+*
+* The patterns reject the *other* kind's prefix rather than requiring their own.
+* The mistake worth catching is pasting an env-group id into the service field
+* (or the reverse) — which is otherwise a 404 hours later inside an alarm, with
+* nobody watching. Requiring the positive prefix would also reject a valid id
+* the day Render introduces a new resource prefix, which is not our call to
+* make.
+*/
+const renderServiceIdSchema = z.string().trim().regex(/^(?!evg-)[A-Za-z0-9_-]{1,64}$/, "must be a Render service ID (`srv-…` or `crn-…`), not an environment group");
+const renderEnvGroupIdSchema = z.string().trim().regex(/^(?!srv-|crn-)[A-Za-z0-9_-]{1,64}$/, "must be a Render environment group ID (`evg-…`), not a service");
+/** Environment variables set directly on one service. */
+const renderServiceDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("service"),
+	/** Service id (`srv-…`, or `crn-…` for a cron job), from its dashboard URL. */
+	serviceId: renderServiceIdSchema
+});
+/**
+* Environment variables in a shared environment group. Every service linked to
+* the group sees them, which is the point — and the reason a group binding is
+* worth thinking about twice: its blast radius is the link list, not one
+* service.
+*/
+const renderEnvGroupDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("env-group"),
+	/** Environment group id (`evg-…`), from its dashboard URL. */
+	envGroupId: renderEnvGroupIdSchema
+});
+const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
+/**
+* The Fly app whose secret set a binding owns.
+*
+* A Fly app has **one** secret set, shared by every Machine in every region —
+* there is no per-target split to state, the way Vercel and Pages have one.
+* Fly's convention is that staging and production are separate *apps*
+* (`storefront`, `storefront-staging`), so pointing at an environment means
+* naming that app, exactly as a Wrangler environment means naming its own
+* Worker.
+*
+* Values land **staged**: Fly injects secrets when a Machine boots, so already
+* running Machines keep what they started with until the app is deployed or its
+* Machines are updated (`fly secrets deploy -a <app>`), while Machines created
+* after the push get them straight away. The connector deliberately restarts
+* nothing — see the note in `apps/api/src/lib/sync/connectors/fly.ts`.
+*/
+const flyDestinationSchema = z.object({
+	provider: z.literal("fly"),
+	/** Fly app name, as `fly apps list` prints it. */
+	appName: z.string().trim().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*$/, "must be a Fly app name (lowercase letters, numbers, and dashes)")
+});
+/**
+* Where inside Northflank a binding writes: one **secret group** in one
+* project.
+*
+* A secret group is Northflank's unit of injection — services and jobs in the
+* project inherit its variables, subject to the group's own restrictions and
+* priority. Those settings belong to the operator, not to seekrit: a binding
+* names an existing group and only ever writes its `variables` map, so
+* restrictions, priority, secret type, and any secret *files* stay as they were
+* configured.
+*
+* There is no environment field. Northflank has no per-group environment axis —
+* separate environments are separate projects (or separate groups restricted to
+* a stage), so the binding's seekrit environment maps to a group, one to one.
+*/
+const northflankDestinationSchema = z.object({
+	provider: z.literal("northflank"),
+	/** Project id — the slug in the project URL (`default-project`). */
+	projectId: northflankIdSchema,
+	/** Secret group id — the slug in the group's URL (`example-secret-group`). */
+	secretGroupId: northflankIdSchema
+});
+/**
+* When App Platform makes a variable visible. DigitalOcean's enum also has
+* `UNSET`, which is not offered: it means "no scope stated", and a secrets
+* manager that writes a value should say when that value applies.
+*
+* The default here is `RUN_TIME` rather than DigitalOcean's own
+* `RUN_AND_BUILD_TIME`, and the difference is deliberate. A build-time variable
+* is visible to every build command, every buildpack, and anything they print;
+* a secret only the running process needs has no business being there. Binding
+* a value a build genuinely needs — a private registry token, a sourcemap
+* upload key — is a decision worth making explicitly.
+*/
+const DIGITALOCEAN_ENV_SCOPES = [
+	"RUN_TIME",
+	"BUILD_TIME",
+	"RUN_AND_BUILD_TIME"
+];
+/**
+* A DigitalOcean app id — the UUID in the app's dashboard URL
+* (`cloud.digitalocean.com/apps/<id>`), and what `doctl apps list` prints.
+*
+* DigitalOcean's own spec types this as a bare string, but every app id it
+* issues is a UUID, and the slip worth catching is the one the API cannot tell
+* from a typo: pasting the app's *name* (`storefront`), which `GET /v2/apps/{id}`
+* answers with a flat 404 hours later inside an alarm, with nobody watching.
+*/
+const digitalOceanAppIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a DigitalOcean app ID (the UUID in the app's URL), not its name");
+/**
+* A component name, matching App Platform's own pattern for one. Names are
+* unique within an app, which is what makes a name — rather than an index into
+* `services` — the stable way to address a component's variables.
+*/
+const digitalOceanComponentNameSchema = z.string().trim().regex(/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/, "must be an App Platform component name (lowercase letters, numbers, and dashes)");
+/**
+* Where inside a DigitalOcean app a binding writes.
+*
+* ## A push is a deployment
+*
+* App Platform has no per-variable endpoint. Environment variables live in the
+* app spec, and the only way to change one is to submit a new spec — which
+* starts a **new deployment** of the app. That is not a side effect this
+* connector chose and there is no flag to suppress it; it is what "set an
+* environment variable" means on this platform, in the control panel and in
+* `doctl` alike.
+*
+* The deployment reuses each component's current source (seekrit never sends
+* `update_all_source_versions`), so it redeploys the code already running
+* rather than pulling a newer commit or image. It is still a real deployment:
+* a build, a health check, and a rollout. Bind an environment here knowing that
+* changing a secret in it will roll the app.
+*
+* ## Values are written encrypted
+*
+* Everything seekrit writes goes in as `type: SECRET`, so App Platform encrypts
+* it at rest and hands it back as an opaque `EV[1:…]` blob rather than as
+* plaintext. That is also why this connector cannot tell whether a value it is
+* about to write is already there — see
+* `apps/api/src/lib/sync/connectors/digitalocean.ts`.
+*/
+const digitalOceanAppDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("app"),
+	/** App id — the UUID in `cloud.digitalocean.com/apps/<id>`. */
+	appId: digitalOceanAppIdSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+/**
+* One component's own environment variables. Narrower than the app-level list:
+* only this service, worker, job, static site, or function sees them, and a key
+* here wins over the same key at app level.
+*/
+const digitalOceanComponentDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("component"),
+	appId: digitalOceanAppIdSchema,
+	/** Component name, as it appears in the app spec — not its type. */
+	componentName: digitalOceanComponentNameSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+const digitalOceanDestinationSchema = z.discriminatedUnion("kind", [digitalOceanAppDestinationSchema, digitalOceanComponentDestinationSchema]);
+/**
+* A Heroku app, named the way `/apps/{app_id_or_name}` names one: either the
+* app name or its UUID id. Both are accepted because both work, and the id is
+* the durable one — renaming an app in the dashboard breaks a binding that
+* holds its name, and does not break one that holds its id.
+*
+* The name pattern is Heroku's own (`^[a-z][a-z0-9-]{1,28}[a-z0-9]$`): 3–30
+* characters, starting with a letter and ending alphanumeric. Checking it here
+* turns the habitual slip — pasting `example.herokuapp.com`, or a name with
+* capitals — into a message at the form rather than a bare 404 from an alarm
+* with nobody watching.
+*/
+const herokuAppSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(value) || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value), "must be a Heroku app name (lowercase letters, numbers, and dashes) or its UUID");
+/**
+* The Heroku app whose config vars a binding owns.
+*
+* A Heroku app has **one** set of config vars, shared by every dyno and every
+* process type — there is no per-target split to state the way Vercel and Pages
+* have one. Heroku's convention is that staging and production are separate
+* *apps* (`storefront`, `storefront-staging`), so pointing at an environment
+* means naming that app, exactly as it does on Fly.
+*
+* Unlike Fly, values take effect **immediately**: setting config vars cuts a new
+* release and restarts the app's dynos, which is why a run sends exactly one
+* request — see the note in `apps/api/src/lib/sync/connectors/heroku.ts`.
+*/
+const herokuDestinationSchema = z.object({
+	provider: z.literal("heroku"),
+	/** App name as `heroku apps` prints it, or the app's UUID. */
+	app: herokuAppSchema
+});
+/**
+* The deploy contexts a Netlify value can be set for.
+*
+* These are Netlify's own, minus two. `all` is missing deliberately: Netlify
+* requires a **secret** value to be set against explicit contexts, and its
+* `setEnvVarValue` endpoint is reported to fail outright on `context: "all"` —
+* so the union offers only contexts that work under both. Naming the contexts
+* you mean is what you want here anyway; a binding already exists to map one
+* seekrit environment onto one deploy context. `dev-server` (Preview Server) is
+* left out for want of anyone asking.
+*
+* `branch` is the odd one: it needs a branch name alongside it, which the
+* destination carries as {@link netlifyDestinationSchema}'s `branch`.
+*/
+const NETLIFY_CONTEXTS = [
+	"production",
+	"deploy-preview",
+	"branch-deploy",
+	"branch",
+	"dev"
+];
+/**
+* A Netlify site, by its **API ID** — the UUID under Project configuration →
+* General → Project information.
+*
+* Netlify accepts a site's domain in place of its id where a site appears in a
+* *path* (`/sites/{site_id}`), but the environment variable endpoints take the
+* site as a `?site_id=` **query parameter** instead, and Netlify documents no
+* name resolution there. That asymmetry is why this is strict where the Heroku
+* and Fly destinations are permissive: a `site_id` Netlify does not resolve
+* does not 404 — the write lands on the *team*, as a shared variable inherited
+* by every site in it. Refusing anything but the UUID keeps a slip from turning
+* into a much wider blast radius than the operator asked for.
+*/
+const netlifySiteIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be the site's API ID (a UUID), not its name or URL");
+/**
+* The Netlify site, and which of its deploy contexts a binding owns.
+*
+* Netlify keys a value by (site, context), so the destination is that pair.
+* Contexts are a list rather than a single value for the same reason Vercel's
+* `targets` is one: a binding is unique per (connection, environment), so an
+* environment that feeds both production and deploy previews has to say so in
+* one destination or not at all.
+*
+* A push writes **only** the contexts listed here. Other contexts of the same
+* variable — and every variable this binding does not manage — are left as they
+* are, which is what makes it safe to point at a site that already has
+* variables set by hand.
+*
+* `secret` marks what seekrit creates as a Netlify **secret**: write-only, and
+* unreadable afterwards through the UI, CLI, and API. On by default, since that
+* is the whole point of pushing from a secrets manager. It applies only to
+* variables seekrit *creates* — Netlify will not let a flag be added to an
+* existing variable, or removed from one ever — and it needs a plan that
+* includes Secrets Controller.
+*/
+const netlifyDestinationSchema = z.object({
+	provider: z.literal("netlify"),
+	/** Site API ID (a UUID), from Project configuration → General. */
+	siteId: netlifySiteIdSchema,
+	/** Which deploy contexts receive these values. At least one. */
+	contexts: z.array(z.enum(NETLIFY_CONTEXTS)).min(1),
+	/** Branch name, required when `contexts` includes `branch`; ignored otherwise. */
+	branch: z.string().trim().min(1).max(255).optional(),
+	/** Create variables as Netlify secrets (default true). */
+	secret: z.boolean().optional()
+}).refine((d) => !d.contexts.includes("branch") || d.branch !== void 0, {
+	message: "a branch context needs the branch name it applies to",
+	path: ["branch"]
+});
+/**
+* A Bunnyshell resource id, as the platform hands it out.
+*
+* Deliberately loose. Bunnyshell documents no format for these — they are
+* opaque strings from `bns environments list` or the dashboard URL — so
+* asserting a shape here would be inventing a rule the platform never stated,
+* and the failure mode would be seekrit refusing an id that works.
+*
+* Being loose is affordable here in a way it is not on Netlify, where an
+* unresolved `site_id` silently widens a write to the whole team. Both
+* Bunnyshell variable collections name their parent in the **request body** of
+* a create, as a required relation: an id the platform cannot resolve is a 422
+* naming the field, not a write that lands somewhere broader. The listing side
+* is fenced separately — the connector re-checks every variable's own parent
+* before it touches it, so a filter that failed to bite cannot turn into an
+* edit of a neighbouring environment's variables.
+*/
+const bunnyshellIdSchema = z.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Bunnyshell ID — no slashes or spaces");
+/**
+* Variables on one Bunnyshell **environment** — the set every component in it
+* inherits, and the closest match to a seekrit environment.
+*
+* This is the destination for an environment that already exists and stays
+* around: a primary environment, or a long-lived ephemeral one.
+*/
+const bunnyshellEnvironmentDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("environment"),
+	/** Environment ID, as `bns environments list` prints it. */
+	environmentId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Variables on a Bunnyshell **project** — inherited by every environment
+* created in it from then on.
+*
+* Worth thinking about twice, for the reason a Render environment group is:
+* the blast radius is the project, not one environment. It earns its place
+* anyway, because it is the only destination that reaches an environment which
+* *does not exist yet*. Bunnyshell's whole shape is ephemeral environments spun
+* up per branch or per pull request; pushing to the environment cannot seed one
+* that a webhook will create tomorrow, and pushing to the project can.
+*
+* An environment inherits the project's value at creation and may then be
+* overridden at its own scope — so a project binding does not fight an
+* environment binding pointed at the same name, it loses to it.
+*/
+const bunnyshellProjectDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("project"),
+	/** Project ID, as `bns projects list` prints it. */
+	projectId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Where in Bunnyshell a binding writes.
+*
+* Split on `kind` rather than into two providers — the way Render's service and
+* environment group are, and unlike Cloudflare's three — because the two are the
+* same API twice over: `/v1/environment_variables` and `/v1/project_variables`
+* take the same fields, fail the same ways, and differ only in which parent they
+* name. One connector serves both, so one provider does too.
+*
+* `secret` is Bunnyshell's `isSecret`, and means less than Netlify's flag of the
+* same name: Bunnyshell encrypts every variable with an organization key whether
+* or not the flag is set, so this only decides whether the value is obscured in
+* the dashboard and stored encrypted in an exported definition. It is on by
+* default all the same — a value pushed from a secrets manager should not be
+* sitting in plain view of everyone with project access. It applies only to
+* variables seekrit **creates**: an update never sends the flag, so a variable
+* an operator deliberately un-secreted stays that way.
+*/
+const bunnyshellDestinationSchema = z.discriminatedUnion("kind", [bunnyshellEnvironmentDestinationSchema, bunnyshellProjectDestinationSchema]);
+/**
+* Which repositories in an organization can read an org-level secret.
+*
+* GitHub's own enum, unchanged. There is deliberately **no default**: `all` hands
+* the value to every repository in the organization — including ones added
+* tomorrow, and including forks' workflows to the extent the org allows them —
+* and that is not a blast radius a secrets manager should pick on an operator's
+* behalf. Naming it is the point.
+*/
+const GITHUB_ACTIONS_VISIBILITIES = [
+	"all",
+	"private",
+	"selected"
+];
+/**
+* A GitHub account or organization login, matching GitHub's own rule:
+* alphanumeric with single internal hyphens, 39 characters at most.
+*
+* Checked here so the habitual slip — pasting a URL, or `owner/repo` into the
+* owner field — fails at the form rather than as a 404 from an alarm with nobody
+* watching.
+*/
+const githubOwnerSchema = z.string().trim().min(1).max(39).regex(/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/, "must be a GitHub user or organization login — not a URL or an owner/repo pair");
+/**
+* A repository name. GitHub's rules are looser than an owner's: letters,
+* numbers, hyphens, underscores, and periods, up to 100 characters. `.` and `..`
+* are refused outright — they would traverse the API path rather than name a
+* repository.
+*/
+const githubRepoSchema = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "must be a repository name alone (`api`), not `owner/repo` or a URL").refine((value) => value !== "." && value !== "..", "is not a repository name");
+/**
+* A deployment environment name.
+*
+* Deliberately permissive: GitHub allows spaces and most punctuation here, and
+* the dashboard shows names like `prod (eu-west)`. Only the two things that would
+* break the request are refused — an empty name, and the path separators that
+* would let a name escape its URL segment. Everything else is GitHub's to reject.
+*/
+const githubEnvironmentSchema = z.string().trim().min(1).max(255).refine((value) => !value.includes("/") && !value.includes("\\"), "cannot contain a slash — that is a path separator, not part of an environment name");
+/**
+* One repository's Actions secrets.
+*
+* Every workflow in the repository can read these, including one added by a pull
+* request from a collaborator with write access. That is GitHub's model, not a
+* choice this connector makes — but it is the reason `environment` exists below,
+* and the reason to prefer it for anything that touches production.
+*/
+const githubActionsRepoDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("repo"),
+	/** Repository owner — a user or organization login. */
+	owner: githubOwnerSchema,
+	/** Repository name, without the owner. */
+	repo: githubRepoSchema
+});
+/**
+* One deployment environment's Actions secrets — the narrowest scope GitHub has.
+*
+* A job reads these only by declaring `environment: <name>`, which also subjects
+* it to that environment's protection rules: required reviewers, wait timers, and
+* the branch policy. That combination is the closest GitHub gets to "this secret
+* is for production, and reaching it requires approval", and it is the scope to
+* reach for by default.
+*
+* The environment must already exist. This connector will not create one: an
+* environment is a deployment gate, and silently creating an unprotected one
+* because a name was misspelled would quietly remove the protection the operator
+* was relying on.
+*/
+const githubActionsEnvironmentDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("environment"),
+	owner: githubOwnerSchema,
+	repo: githubRepoSchema,
+	/** Environment name, exactly as the repository's Settings → Environments shows it. */
+	environment: githubEnvironmentSchema
+});
+/**
+* An organization's Actions secrets.
+*
+* The widest scope in the product, and the only destination on any provider that
+* can hand a value to repositories nobody named. Read {@link
+* GITHUB_ACTIONS_VISIBILITIES} before using it.
+*
+* `selectedRepositoryIds` takes numeric repository **ids**, not names, because
+* that is what GitHub's API takes. An id is visible at
+* `GET /repos/{owner}/{repo}` as `id`, and in the dashboard nowhere at all —
+* which is friction worth accepting rather than resolving names to ids here: name
+* resolution would mean this connector picking which repository an ambiguous
+* name meant, and getting that wrong widens a secret's reach silently.
+*/
+const githubActionsOrgDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("org"),
+	/** Organization login. */
+	org: githubOwnerSchema,
+	/** Which repositories may read these secrets. Stated, never defaulted. */
+	visibility: z.enum(GITHUB_ACTIONS_VISIBILITIES),
+	/** Numeric repository ids, required when `visibility` is `selected`. */
+	selectedRepositoryIds: z.array(z.number().int().positive()).max(500).optional()
+}).refine((dest) => dest.visibility !== "selected" || dest.selectedRepositoryIds !== void 0 && dest.selectedRepositoryIds.length > 0, {
+	message: "selected visibility needs at least one repository id",
+	path: ["selectedRepositoryIds"]
+}).refine((dest) => dest.visibility === "selected" || dest.selectedRepositoryIds === void 0, {
+	message: "repository ids only apply to selected visibility — remove them, or select it",
+	path: ["selectedRepositoryIds"]
+});
+const githubActionsDestinationSchema = z.discriminatedUnion("kind", [
+	githubActionsRepoDestinationSchema,
+	githubActionsEnvironmentDestinationSchema,
+	githubActionsOrgDestinationSchema
+]);
+/**
+* How a binding lays its secrets out in Secret Manager. The same two shapes the
+* AWS Secrets Manager destination offers, and for the same reasons:
+*
+* - `secret-per-name` — one GCP secret per seekrit secret. The direct
+*   translation, and what Cloud Run's `--set-secrets` and GKE's Secret Manager
+*   CSI driver mount one at a time.
+* - `json-bundle` — every value as one JSON object in a single secret. Costs one
+*   active version instead of fifty, which is the whole billing unit here.
+*/
+const GCP_SECRET_MANAGER_LAYOUTS = ["secret-per-name", "json-bundle"];
+/**
+* Where Google keeps the copies of a secret. Chosen at creation and
+* **immutable** afterwards — changing it means deleting the secret and letting
+* the next run recreate it.
+*
+* - `automatic` — Google picks the locations. One billable replica, and what
+*   you want unless a policy says otherwise.
+* - `user-managed` — the binding names the regions. This is how data residency
+*   is expressed for global secrets, and each region is billed as its own
+*   active version.
+*/
+const GCP_REPLICATION_POLICIES = ["automatic", "user-managed"];
+/**
+* A Secret Manager secret ID. Google's own rule, quoted from the API reference:
+* "a string with a maximum length of 255 characters and can contain uppercase
+* and lowercase letters, numerals, and the hyphen (`-`) and underscore (`_`)
+* characters."
+*
+* Notably **no slashes and no dots**, which is what makes this a different
+* field from AWS's `pathPrefix` rather than the same idea renamed: a Secret
+* Manager namespace is spelled `prod-storefront-DB_URL`, not
+* `prod/storefront/DB_URL`.
+*/
+const gcpSecretIdSchema = z.string().trim().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/, "may contain letters, digits, hyphens, and underscores");
+/**
+* A GCP region for a user-managed replica (`us-east1`, `europe-west4`,
+* `northamerica-northeast1`). Validated by shape rather than against a list,
+* because Google adds regions faster than we ship — a name Secret Manager does
+* not know is refused by Google with a clear message at creation.
+*/
+const gcpLocationSchema = z.string().trim().regex(/^[a-z]+-[a-z]+\d+$/, "must be a GCP region ID, e.g. us-east1");
+/**
+* A Cloud KMS key, as its full resource name — the only form the API accepts:
+* `projects/p/locations/l/keyRings/r/cryptoKeys/k`.
+*
+* Stricter than AWS's `kmsKeyId` (which tolerates five spellings) because
+* Google tolerates exactly one, and because a key in the wrong *location* is
+* rejected at creation: an automatic-replication secret needs a `global` key,
+* and a user-managed replica needs one in its own region.
+*/
+const gcpKmsKeyNameSchema = z.string().trim().max(1024).regex(/^projects\/[^/]+\/locations\/[^/]+\/keyRings\/[^/]+\/cryptoKeys\/[^/]+$/, "must be a full Cloud KMS key name (projects/…/locations/…/keyRings/…/cryptoKeys/…)");
+/**
+* Where inside a project's Secret Manager a binding writes.
+*
+* ## Every push would otherwise cost a version
+*
+* Secret Manager has no "set the value" call — only `addVersion`, which appends.
+* A run pushes the whole environment (never a diff), so changing one secret in
+* an environment of fifty would leave fifty new versions behind, forty-nine of
+* them identical to their predecessors, each one billed for as long as it stays
+* active.
+*
+* So this connector writes a version only when the value actually changed,
+* decided from a keyed digest it keeps in the secret's own **annotations** — see
+* `apps/api/src/lib/sync/connectors/gcp-secret-manager.ts` for why it is keyed
+* and what that costs. `pruneVersions` is the other half of the bill: with it
+* on, the version a push supersedes is destroyed as soon as the new one lands,
+* so a secret keeps exactly one active version.
+*/
+const gcpSecretManagerDestinationSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	layout: z.enum(GCP_SECRET_MANAGER_LAYOUTS).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret ID, e.g.
+	* `prod-storefront-`. Optional, but strongly advised in a project that holds
+	* anything else — without it a binding writes at the root of a namespace it
+	* does not own, and Secret Manager has no folders to hide behind.
+	*/
+	idPrefix: z.string().trim().max(200).regex(/^[A-Za-z0-9_-]*$/, "may contain letters, digits, hyphens, and underscores").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod-storefront-env`. */
+	secretId: gcpSecretIdSchema.optional(),
+	replication: z.enum(GCP_REPLICATION_POLICIES).default("automatic"),
+	/** `user-managed` only: the regions to replicate to. At least one. */
+	locations: z.array(gcpLocationSchema).min(1).max(16).optional(),
+	/** Customer-managed encryption key. Omitted means Google-managed keys. */
+	kmsKeyName: gcpKmsKeyNameSchema.optional(),
+	/** Destroy the version each push supersedes, keeping one active version. */
+	pruneVersions: z.boolean().optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretId !== void 0, {
+	message: "a json-bundle destination needs the ID of the secret to write",
+	path: ["secretId"]
+}).refine((d) => d.replication !== "user-managed" || (d.locations?.length ?? 0) > 0, {
+	message: "user-managed replication needs at least one location",
+	path: ["locations"]
+}).refine((d) => d.kmsKeyName === void 0 || d.replication === "automatic" || (d.locations?.length ?? 0) === 1, {
+	message: "a customer-managed key covers one location — use automatic replication, or a single location",
+	path: ["kmsKeyName"]
+});
+const syncDestinationSchema = z.discriminatedUnion("provider", [
+	vercelDestinationSchema,
+	cloudflareWorkersDestinationSchema,
+	cloudflarePagesDestinationSchema,
+	cloudflareSecretsStoreDestinationSchema,
+	railwayDestinationSchema,
+	awsSecretsManagerDestinationSchema,
+	awsParameterStoreDestinationSchema,
+	renderDestinationSchema,
+	flyDestinationSchema,
+	northflankDestinationSchema,
+	digitalOceanDestinationSchema,
+	herokuDestinationSchema,
+	netlifyDestinationSchema,
+	bunnyshellDestinationSchema,
+	githubActionsDestinationSchema,
+	gcpSecretManagerDestinationSchema
+]);
+/**
+* How seekrit secret names become destination key names. Applied in order:
+* explicit `rename` (wins outright), then `prefix`/`suffix`, then `case`.
+*/
+const nameTransformSchema = z.object({
+	prefix: z.string().max(64).regex(/^[A-Za-z0-9_]*$/, "must be alphanumeric or underscore").optional(),
+	suffix: z.string().max(64).regex(/^[A-Za-z0-9_]*$/, "must be alphanumeric or underscore").optional(),
+	case: z.enum([
+		"preserve",
+		"upper",
+		"lower"
+	]).optional(),
+	/** Exact per-secret overrides, seekrit name → destination name. */
+	rename: z.record(secretNameSchema, secretNameSchema).optional()
+});
+z.object({
+	/**
+	* The id the client already fetched a public key for. Connections are a
+	* two-step dance — mint the key, wrap the credential to it, then create the
+	* row — so the id has to be chosen before the row exists. Omit it and the
+	* server generates one (only useful when there is no credential to wrap yet).
+	*/
+	id: z.string().regex(/^syc_[A-Za-z0-9]{24}$/, "must be a connection id from the public-key call").optional(),
+	name: z.string().trim().min(1).max(128),
+	config: syncConnectionConfigSchema,
+	/**
+	* The destination's API credential (a Vercel token), encrypted client-side to
+	* the connection's public key (a `wd1.` wrap). The control plane stores only
+	* this ciphertext; it is unwrapped transiently inside the sync engine DO.
+	*/
+	wrappedCredential: z.string().min(1)
+});
+z.object({ destination: syncDestinationSchema });
+const globListSchema = z.array(z.string().trim().min(1).max(256)).max(100);
+z.object({
+	connectionId: z.string().min(1),
+	environmentId: z.string().min(1),
+	destination: syncDestinationSchema,
+	nameTransform: nameTransformSchema.optional(),
+	include: globListSchema.optional(),
+	exclude: globListSchema.optional(),
+	onDelete: z.enum(["delete", "retain"]).default("delete"),
+	mode: z.enum(["auto", "manual"]).default("auto"),
+	wrappedDeks: z.array(z.object({
+		environmentId: z.string().min(1),
+		wrappedDek: z.string().min(1)
+	})).min(1),
+	acknowledgedDecryption: z.literal(true)
+});
+z.object({
+	destination: syncDestinationSchema.optional(),
+	nameTransform: nameTransformSchema.nullable().optional(),
+	include: globListSchema.nullable().optional(),
+	exclude: globListSchema.nullable().optional(),
+	onDelete: z.enum(["delete", "retain"]).optional(),
+	mode: z.enum(["auto", "manual"]).optional(),
+	enabled: z.boolean().optional()
+});
+//#endregion
 //#region ../../packages/crypto/src/encoding.ts
 const CHUNK = 32768;
 /** Base64url (no padding) — portable across browsers, Workers, and Node. */
@@ -326,6 +2605,43 @@ async function generateDataKey(material, ref) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/random.ts
+const ALPHABETS = {
+	alphanumeric: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+	hex: "0123456789abcdef",
+	base64url: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_",
+	/**
+	* Alphanumerics plus punctuation chosen to survive being pasted anywhere a
+	* secret goes: no quote of either kind, no backslash, backtick, `$`, or
+	* whitespace, so the value can't break out of a shell word, a SQL literal, a
+	* URL component, or a `.env` line.
+	*/
+	printable: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-._~!*+="
+};
+/**
+* A cryptographically random string of `length` characters drawn uniformly from
+* `alphabet` (default `alphanumeric`, ≈5.95 bits/char — 32 chars ≈ 190 bits).
+*
+* Uses rejection sampling: bytes at or above the largest multiple of the
+* alphabet size are discarded rather than folded, so `% n` introduces no modulo
+* bias toward the low end of the alphabet.
+*/
+function generateSecretValue(length, alphabet = "alphanumeric") {
+	if (!Number.isInteger(length) || length < 1) throw new RangeError("length must be a positive integer");
+	const chars = ALPHABETS[alphabet];
+	const n = chars.length;
+	const limit = 256 - 256 % n;
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < limit) out += chars[byte % n];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -355,7 +2671,6 @@ async function generateDataKey(material, ref) {
 * SCRAM helper does, with no hand-rolled hash primitive.
 */
 const DEFAULT_PASSWORD_LENGTH$1 = 32;
-const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function sha1(data) {
 	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
 }
@@ -364,17 +2679,6 @@ function toUpperHex(bytes) {
 	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
 	return hex.toUpperCase();
 }
-function randomPassword$1(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
 * for a known password. Pass the result straight to
@@ -388,7 +2692,7 @@ async function mysqlNativePasswordVerifier(password) {
 * — the client-side half of a Vault-style dynamic MySQL credential.
 */
 async function generateMysqlCredential(options = {}) {
-	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
 	return {
 		password,
 		verifier: await mysqlNativePasswordVerifier(password)
@@ -486,7 +2790,6 @@ const LOG = /* @__PURE__ */ new Uint8Array(256);
 }
 const SALT_LENGTH = 16;
 const DEFAULT_PASSWORD_LENGTH = 32;
-const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function hmacSha256(key, message) {
 	const k = await crypto.subtle.importKey("raw", key, {
 		name: "HMAC",
@@ -507,17 +2810,6 @@ async function saltPassword(password, salt, iterations) {
 	}, material, 256);
 	return new Uint8Array(bits);
 }
-function randomPassword(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the `SCRAM-SHA-256$<i>:<salt>$<StoredKey>:<ServerKey>` verifier for a
 * known password. Pass the result straight to `CREATE ROLE … PASSWORD`.
@@ -535,7 +2827,7 @@ async function scramSha256Verifier(password, options = {}) {
 * client-side half of a Vault-style dynamic Postgres credential.
 */
 async function generatePostgresCredential(options = {}) {
-	const password = randomPassword(options.length ?? DEFAULT_PASSWORD_LENGTH);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH);
 	const iterations = options.iterations ?? 4096;
 	return {
 		password,
@@ -619,7 +2911,7 @@ function signatureKeyRef(signature) {
 const TOKEN_PREFIX = "skt";
 const TOKEN_ID_LENGTH = 22;
 const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-function randomTokenId() {
+function randomTokenId(prefix = TOKEN_PREFIX) {
 	let out = "";
 	while (out.length < TOKEN_ID_LENGTH) {
 		const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
@@ -628,7 +2920,7 @@ function randomTokenId() {
 			if (out.length === TOKEN_ID_LENGTH) break;
 		}
 	}
-	return `${TOKEN_PREFIX}_${out}`;
+	return `${prefix}_${out}`;
 }
 async function hashToken(token) {
 	const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token));
@@ -664,7 +2956,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region ../cli/package.json
-var version$1 = "0.24.0";
+var version$1 = "0.42.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -674,6 +2966,10 @@ function readGlobalConfig() {
 	if (!existsSync(path)) return {};
 	return JSON.parse(readFileSync(path, "utf8"));
 }
+/**
+* Merge into the saved config. A key set to `undefined` is *removed* (JSON
+* drops it), which is how the login paths clear a credential they replace.
+*/
 function writeGlobalConfig(update) {
 	const path = globalConfigPath();
 	const merged = {
@@ -771,6 +3067,32 @@ var SeekritClient = class {
 	getMyNotificationPrefs() {
 		return this.request("GET", "/v1/me/notifications");
 	}
+	/**
+	* Devices this user has authorized. `currentSessionId` is set when the caller
+	* *is* a CLI session, so it can label (or revoke) itself.
+	*/
+	listCliSessions() {
+		return this.request("GET", "/v1/me/cli-sessions");
+	}
+	/** Sign a device out. Its token stops authenticating immediately. */
+	revokeCliSession(sessionId) {
+		return this.request("DELETE", `/v1/me/cli-sessions/${sessionId}`);
+	}
+	/** What a pending login request is asking for — for the approval screen. */
+	getCliLoginRequest(code) {
+		return this.request("GET", `/v1/cli-login/${encodeURIComponent(code)}`);
+	}
+	/**
+	* Authorize a device. Requires a browser session; members with a second
+	* factor must have re-entered it just now, else this rejects with
+	* `mfa_required` (recoverable — prompt for a code and retry).
+	*/
+	approveCliLogin(code) {
+		return this.request("POST", `/v1/cli-login/${encodeURIComponent(code)}/approve`);
+	}
+	denyCliLogin(code) {
+		return this.request("POST", `/v1/cli-login/${encodeURIComponent(code)}/deny`);
+	}
 	setMyNotificationPrefs(input) {
 		return this.request("PUT", "/v1/me/notifications", input);
 	}
@@ -838,6 +3160,28 @@ var SeekritClient = class {
 	deleteEnv(orgId, envId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
+	/**
+	* The public keys of an environment's grant-holders, so a client can wrap a
+	* new DEK to each of them (see `createBranch`). No key material is returned.
+	*/
+	listGrantees(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/grantees`);
+	}
+	listBranches(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/branches`);
+	}
+	/** Every branch in an application, across all its environments. */
+	listAppBranches(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/branches`);
+	}
+	/** Fork `envId` into an ephemeral branch. `envId` is the parent, not the branch. */
+	createBranch(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/branches`, input);
+	}
+	/** Branches are environments, so tearing one down is `deleteEnv`. */
+	deleteBranch(orgId, branchId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${branchId}`);
+	}
 	listGroups(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/groups`);
 	}
@@ -873,6 +3217,7 @@ var SeekritClient = class {
 	resolve(query = {}) {
 		const params = new URLSearchParams();
 		if (query.env) params.set("env", query.env);
+		if (query.branch) params.set("branch", query.branch);
 		for (const [group, slug] of Object.entries(query.with ?? {})) params.append("with", `${group}:${slug}`);
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/resolve${qs}`);
@@ -972,6 +3317,54 @@ var SeekritClient = class {
 	deleteToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}/permanent`);
 	}
+	listHoneyTokens(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/honey-tokens`);
+	}
+	createHoneyToken(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/honey-tokens`, input);
+	}
+	/** Delete a decoy outright — there is no access to revoke first. */
+	deleteHoneyToken(orgId, honeyTokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/honey-tokens/${honeyTokenId}`);
+	}
+	listAgents(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents`);
+	}
+	createAgent(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents`, input);
+	}
+	getAgent(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}`);
+	}
+	updateAgent(orgId, agentId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/agents/${agentId}`, input);
+	}
+	deleteAgent(orgId, agentId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/agents/${agentId}`);
+	}
+	/** Published versions, newest first. Append-only; nothing here is rewritten. */
+	listAgentPolicies(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/policies`);
+	}
+	/**
+	* Publish a bundle signed in the browser.
+	*
+	* The signing happens client-side (`signAgentPolicy` in `@seekrit/core`) with
+	* the publishing admin's own key, so the API receives an opaque envelope it
+	* cannot forge. A version mismatch answers `409`: the version is inside the
+	* signature, so a concurrent publish has to be re-signed, not patched.
+	*/
+	publishAgentPolicy(orgId, agentId, bundle) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents/${agentId}/policies`, { bundle });
+	}
+	/** Republish an earlier version's bundle as the newest version. */
+	rollbackAgentPolicy(orgId, agentId, version) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents/${agentId}/policies/${version}/rollback`);
+	}
+	/** The caller's own signing thumbprint, for the trust-anchor snippet. */
+	getMyPolicySigner(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/signers/me`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -1025,6 +3418,54 @@ var SeekritClient = class {
 	deleteLeaseTarget(orgId, targetId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/leases/targets/${targetId}`);
 	}
+	listSyncConnections(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/sync/connections`);
+	}
+	/**
+	* Mint (or re-read) the keypair for a connection id, *before* the connection
+	* exists. Wrap the destination credential and every environment DEK to this
+	* key, then pass the same id to {@link createSyncConnection}.
+	*/
+	getSyncConnectionKey(orgId, connectionId) {
+		return this.request("GET", `/v1/orgs/${orgId}/sync/connections/${connectionId}/public-key`);
+	}
+	createSyncConnection(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/sync/connections`, input);
+	}
+	/** Test the stored credential against a destination. Never throws on a bad token. */
+	verifySyncConnection(orgId, connectionId, destination) {
+		return this.request("POST", `/v1/orgs/${orgId}/sync/connections/${connectionId}/verify`, { destination });
+	}
+	/** Deletes the connection, its bindings, its key grants, and its keypair. */
+	deleteSyncConnection(orgId, connectionId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/sync/connections/${connectionId}`);
+	}
+	listSyncBindings(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/sync/bindings`);
+	}
+	/**
+	* Enable sync for one environment. `wrappedDeks` must cover the target
+	* environment *and* every group environment it composes, each wrapped to the
+	* connection's public key — the API cannot compute these, which is what keeps
+	* enabling sync a key-holder operation.
+	*/
+	createSyncBinding(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/sync/bindings`, input);
+	}
+	updateSyncBinding(orgId, bindingId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/sync/bindings/${bindingId}`, input);
+	}
+	deleteSyncBinding(orgId, bindingId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/sync/bindings/${bindingId}`);
+	}
+	/** Push now, synchronously. */
+	runSyncBinding(orgId, bindingId) {
+		return this.request("POST", `/v1/orgs/${orgId}/sync/bindings/${bindingId}/run`);
+	}
+	listSyncRuns(orgId, bindingId) {
+		const qs = bindingId ? `?bindingId=${encodeURIComponent(bindingId)}` : "";
+		return this.request("GET", `/v1/orgs/${orgId}/sync/runs${qs}`);
+	}
 	listLeases(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases`);
 	}
@@ -1034,6 +3475,39 @@ var SeekritClient = class {
 	revokeLease(orgId, leaseId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
 	}
+	/**
+	* The rotator public key (the broker DO's), plus the environments that have
+	* already granted it. Wrap an environment's DEK to this key client-side before
+	* configuring rotation — that wrap IS the grant, and the server can't make it.
+	*/
+	getRotatorKey(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation/rotator-key`);
+	}
+	listRotations(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation`);
+	}
+	getRotation(orgId, rotationId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation/${rotationId}`);
+	}
+	/**
+	* Configure (or replace) a secret's rotation policy. `version` comes back only
+	* when `rotateNow` was set — a rotated secret's new version number, never its
+	* value.
+	*/
+	configureRotation(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/rotation`, input);
+	}
+	updateRotation(orgId, rotationId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/rotation/${rotationId}`, input);
+	}
+	/** Rotate now. Returns the new version — the value stays where it belongs. */
+	rotateSecretNow(orgId, rotationId) {
+		return this.request("POST", `/v1/orgs/${orgId}/rotation/${rotationId}/rotate`);
+	}
+	/** Disable rotation. `rotatorRevoked` reports whether the broker's key grant went too. */
+	disableRotation(orgId, rotationId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/rotation/${rotationId}`);
+	}
 	listAudit(orgId, query = {}) {
 		const params = new URLSearchParams();
 		if (query.cursor) params.set("cursor", query.cursor);
@@ -1090,6 +3564,19 @@ var SeekritClient = class {
 	cancelSubscription(orgId) {
 		return this.request("POST", `/v1/orgs/${orgId}/billing/cancel`);
 	}
+	/**
+	* Redeem a promo code, comping the org onto the plan the code grants.
+	* Admin-only. Casing, spaces, and dashes are normalized server-side, so pass
+	* the code as the user typed it. Returns the refreshed billing view.
+	*
+	* Every invalid code fails the same way regardless of why (unknown, expired,
+	* fully redeemed, already used by this org) — the API deliberately won't
+	* confirm that a code exists. Show the returned message as-is rather than
+	* guessing at a more specific one.
+	*/
+	redeemPromoCode(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/promo`, input);
+	}
 };
 //#endregion
 //#region ../cli/src/io.ts
@@ -1145,7 +3632,7 @@ function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
 	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
 	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
-	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token;
+	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token ?? config.sessionToken;
 	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
 	let auth;
 	if (token) auth = {
@@ -1163,7 +3650,8 @@ function tryBuildContext(dotenvVars = {}) {
 			auth,
 			client: CLI_CLIENT
 		}),
-		auth
+		auth,
+		apiUrl
 	};
 }
 function isTokenAuth(ctx) {
@@ -1210,12 +3698,14 @@ async function resolveOrg(ctx, orgSlug) {
 }
 /**
 * Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
+* or the config's app + `--env`), a branch of one (`--branch`), or a group env
+* (`--group --env`).
 */
 async function resolveEnvTarget(ctx, opts) {
 	const org = await resolveOrg(ctx, opts.org);
 	if (!opts.env) fail("specify --env");
 	if (opts.group) {
+		if (opts.branch) fail("--branch applies to application environments, not groups");
 		const { groups } = await ctx.client.listGroups(org.id);
 		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
 		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
@@ -1228,34 +3718,59 @@ async function resolveEnvTarget(ctx, opts) {
 			label: `${group.slug}@${env.slug}`
 		};
 	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const app = await resolveApp(ctx, opts);
 	const { environments } = await ctx.client.listEnvs(org.id, app.id);
 	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
 	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	if (opts.branch) {
+		const branch = await resolveBranch(ctx, app, opts.branch);
+		return {
+			orgId: org.id,
+			envId: branch.id,
+			label: `${app.slug}/${env.slug}#${branch.slug}`
+		};
+	}
 	return {
 		orgId: org.id,
 		envId: env.id,
 		label: `${app.slug}/${env.slug}`
 	};
 }
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
+/** Resolve the target application from a flag or the committed config. */
+async function resolveApp(ctx, opts) {
 	const org = await resolveOrg(ctx, opts.org);
 	const appSlug = opts.app ?? findProjectConfig()?.app;
 	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
 	const { apps } = await ctx.client.listApps(org.id);
 	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
 	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	return {
+		orgId: org.id,
+		orgSlug: org.slug,
+		id: app.id,
+		slug: app.slug
+	};
+}
+/**
+* Find a branch by slug (or id) anywhere in an application. Branch slugs share
+* the application's environment namespace, so one lookup is unambiguous — no
+* need to name the parent environment.
+*/
+async function resolveBranch(ctx, app, branchRef) {
+	const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+	const branch = branches.find((b) => b.slug === branchRef || b.id === branchRef);
+	if (!branch) fail(`no branch "${branchRef}" in ${app.slug}`);
+	return branch;
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	if (!opts.env) fail("specify --env");
+	const app = await resolveApp(ctx, opts);
+	const { environments } = await ctx.client.listEnvs(app.orgId, app.id);
 	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
 	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
 	return {
-		orgId: org.id,
+		orgId: app.orgId,
 		appId: app.id,
 		appSlug: app.slug,
 		envId: env.id,
@@ -1357,12 +3872,16 @@ function readM2mCreds(dotenvVars = {}) {
 		clientSecret
 	};
 }
-/** True when a service/dev credential is already configured explicitly. */
+/**
+* True when a service/session/dev credential is already configured explicitly.
+* A browser-authorized session counts: a human who ran `seekrit login` must not
+* be silently swapped onto a machine identity.
+*/
 function hasExplicitCredential(dotenvVars) {
 	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
 	if (fromEnv("SEEKRIT_TOKEN") || fromEnv("SEEKRIT_DEV_USER")) return true;
 	const config = readGlobalConfig();
-	return Boolean(config.token || config.devUser);
+	return Boolean(config.token || config.sessionToken || config.devUser);
 }
 /** Mint a fresh org-scoped admin token using M2M credentials (keyless). */
 async function mintAdminToken(apiUrl, creds) {
@@ -1412,41 +3931,59 @@ async function ensureM2mAdminToken(dotenvVars = {}) {
 	return token;
 }
 //#endregion
-//#region ../cli/src/dotenv.ts
+//#region ../cli/src/cache.ts
+/** Render an age for a log line, rounded to its largest whole unit. */
+function humanize(ms) {
+	const secs = Math.floor(ms / 1e3);
+	if (secs < 60) return `${secs}s`;
+	if (secs < 3600) return `${Math.floor(secs / 60)}m`;
+	if (secs < 86400) return `${Math.floor(secs / 3600)}h`;
+	return `${Math.floor(secs / 86400)}d`;
+}
 /**
-* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
-* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
-* escapes; unquoted values drop trailing ` # comments`). Multiline values are
-* not supported — keep those in seekrit itself.
+* Whether a failed resolve means the API was *unreachable* (the cache may stand
+* in) rather than *refusing us* (it must not). A refusal is an answer, and
+* revocation is supposed to take effect the moment it arrives.
 */
-function parseDotenv(content) {
-	const out = {};
-	for (const raw of content.split(/\r?\n/)) {
-		let line = raw.trim();
-		if (!line || line.startsWith("#")) continue;
-		if (line.startsWith("export ")) line = line.slice(7).trimStart();
-		const eq = line.indexOf("=");
-		if (eq === -1) continue;
-		const key = line.slice(0, eq).trim();
-		if (!key) continue;
-		let value = line.slice(eq + 1).trim();
-		const quote = value[0];
-		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
-			value = value.slice(1, -1);
-			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
-		} else {
-			const comment = value.indexOf(" #");
-			if (comment !== -1) value = value.slice(0, comment).trim();
-		}
-		out[key] = value;
-	}
-	return out;
+function mayFallBack(err) {
+	if (err instanceof SeekritApiError) return err.status >= 500 || err.status === 429;
+	return true;
 }
-/** Fetch + decrypt every secret in a single environment. */
-async function fetchDecryptedSecrets(ctx, orgId, envId) {
+/**
+* Fetch + decrypt every secret in a single environment.
+*
+* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
+* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
+* scope here — a reference to a secret inherited from a composed group is left
+* literal, because the group layers aren't fetched. `materializeEnv` is the
+* fully-layered view.
+*/
+async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
 	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
 	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
-	return Object.fromEntries(entries);
+	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
+}
+/**
+* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
+* the CLI's standard fatal exit — it is a config bug with no correct value to
+* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
+*/
+function interpolateValues(values, enabled = true) {
+	if (!enabled) return {
+		values,
+		interpolated: [],
+		unresolvedRefs: []
+	};
+	try {
+		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
+		return {
+			values: expandedValues,
+			interpolated: expanded,
+			unresolvedRefs: unresolved
+		};
+	} catch (err) {
+		return fail(err instanceof Error ? err.message : String(err));
+	}
 }
 /**
 * Decrypt one historical version of a secret. Ciphertext is bound to
@@ -1469,34 +4006,82 @@ async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
 * Each layer's DEK is unwrapped once with the principal's private key and its
 * ciphertext decrypted locally. `process.env` is NOT applied here — callers
 * that spawn a process layer it on top so the live shell always wins.
+*
+* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
+* reference always resolves to whichever layer won the name.
 */
 async function materializeEnv(ctx, opts) {
 	const query = {};
 	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (opts.branch) query.branch = opts.branch;
 	if (!isTokenAuth(ctx)) {
 		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
 		query.env = opts.envId;
 	}
-	const { scope, layers } = await ctx.client.resolve(query);
+	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
 	const privateKey = await getPrivateKey(ctx);
 	const values = {};
 	const provenance = {};
 	for (const layer of layers) {
 		const dek = await unwrapDek(layer.wrappedDek, privateKey);
-		const label = layer.source === "group" ? `group:${layer.groupSlug}@${layer.slug}` : `app:${scope.appSlug}/${layer.slug}`;
+		let label;
+		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
+		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
+		else label = `app:${scope.appSlug}/${layer.slug}`;
 		for (const secret of layer.secrets) {
 			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
 			provenance[secret.name] = label;
 		}
 	}
+	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
 	return {
-		values,
+		...interpolateValues(values, opts.interpolate !== false),
 		provenance,
 		scope,
-		loadedEnvFiles: overlayEnvFiles(values, provenance, opts.envFiles)
+		loadedEnvFiles
 	};
 }
 /**
+* Resolve, going through the last-known-good cache when one is configured.
+*
+* Always live first: the cache exists for when the call cannot land, not to
+* save a round trip, so a recovered network is picked up on the very next
+* invocation. A *refused* resolve (401/403/…) drops the entry rather than
+* falling back to it — otherwise revoking a token would keep working offline
+* until the entry aged out.
+*/
+async function resolveWithCache(ctx, query, cache) {
+	if (!cache) return ctx.client.resolve(query);
+	try {
+		const response = await ctx.client.resolve(query);
+		try {
+			cache.write(JSON.stringify(response));
+		} catch (err) {
+			warn(`could not update the cache: ${errorMessage(err)}`);
+		}
+		return response;
+	} catch (err) {
+		if (!mayFallBack(err)) {
+			cache.invalidate();
+			throw err;
+		}
+		const found = cache.read();
+		if (found.kind === "hit") {
+			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
+			return JSON.parse(found.body);
+		}
+		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
+		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
+		throw err;
+	}
+}
+function warn(text) {
+	process.stderr.write(`seekrit: ${text}\n`);
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
 * Overlay `.env` files onto an existing value/provenance set (later files win).
 * Missing files are skipped. Returns the files that were actually loaded. Used
 * both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
@@ -1538,6 +4123,16 @@ function errText(err) {
 		isError: true
 	};
 }
+/** Read-only and safe to repeat — every list/inspect tool. */
+const ro = {
+	readOnly: true,
+	idempotent: true
+};
+/** Removes or overwrites something; repeating it lands in the same state. */
+const destructive = {
+	destructive: true,
+	idempotent: true
+};
 /**
 * Short primer surfaced as the MCP server `instructions`. Most clients show
 * this to the model on connect, so it has to orient an agent that lands here
@@ -1671,6 +4266,7 @@ async function materializeFor(ctx, o) {
 	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, o)).envId;
 	return materializeEnv(ctx, {
 		envId,
+		branch: o.branch,
 		with: o.with,
 		envFiles: o.envFile ?? [".env"]
 	});
@@ -1705,10 +4301,17 @@ async function runMcpServer(options = {}) {
 		version: options.version ?? version$1
 	}, { instructions: serverInstructions() });
 	/** Register a tool whose handler returns data (serialized) or throws (→ isError). */
-	const tool = (name, description, shape, handler) => {
+	const tool = (name, description, hints, shape, handler) => {
 		server.registerTool(name, {
 			description,
-			inputSchema: shape
+			inputSchema: shape,
+			annotations: {
+				title: name,
+				readOnlyHint: hints.readOnly ?? false,
+				destructiveHint: hints.destructive ?? false,
+				idempotentHint: hints.idempotent ?? false,
+				openWorldHint: true
+			}
 		}, (async (args) => {
 			try {
 				return jsonText(await handler(args));
@@ -1726,7 +4329,7 @@ async function runMcpServer(options = {}) {
 			openWorldHint: false
 		}
 	}, async () => jsonText(getStartedText()));
-	tool("whoami", "Show the authenticated identity, its role, and accessible orgs.", {}, async () => {
+	tool("whoami", "Show the authenticated identity, its role, and accessible orgs.", ro, {}, async () => {
 		const ctx = getCtx();
 		if (isTokenAuth(ctx) && ctx.auth.type === "bearer") {
 			const { tokenId } = await parseServiceToken(ctx.auth.token);
@@ -1747,13 +4350,13 @@ async function runMcpServer(options = {}) {
 			...await ctx.client.me()
 		};
 	});
-	tool("list_orgs", "List organizations the caller can access.", {}, async () => (await getCtx().client.listOrgs()).orgs);
-	tool("list_apps", "List applications in an organization.", { org: z.string().optional() }, async ({ org }) => {
+	tool("list_orgs", "List organizations the caller can access.", ro, {}, async () => (await getCtx().client.listOrgs()).orgs);
+	tool("list_apps", "List applications in an organization.", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listApps(orgRef.id)).apps;
 	});
-	tool("list_envs", "List environments of an application.", {
+	tool("list_envs", "List environments of an application.", ro, {
 		org: z.string().optional(),
 		app: z.string()
 	}, async ({ org, app }) => {
@@ -1764,12 +4367,30 @@ async function runMcpServer(options = {}) {
 		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
 		return (await ctx.client.listEnvs(orgRef.id, appRow.id)).environments;
 	});
-	tool("list_groups", "List shared groups (reusable secret bags) in an organization.", { org: z.string().optional() }, async ({ org }) => {
+	tool("list_branches", "List ephemeral branch configs in an application (optionally just one environment's).", ro, {
+		org: z.string().optional(),
+		app: z.string(),
+		env: z.string().optional()
+	}, async ({ org, app, env }) => {
+		const ctx = getCtx();
+		const appRef = await resolveApp(ctx, {
+			org,
+			app
+		});
+		if (!env) return (await ctx.client.listAppBranches(appRef.orgId, appRef.id)).branches;
+		const parent = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		});
+		return (await ctx.client.listBranches(parent.orgId, parent.envId)).branches;
+	});
+	tool("list_groups", "List shared groups (reusable secret bags) in an organization.", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listGroups(orgRef.id)).groups;
 	});
-	tool("list_group_envs", "List a group's environments (per-slug value sets).", {
+	tool("list_group_envs", "List a group's environments (per-slug value sets).", ro, {
 		org: z.string().optional(),
 		group: z.string()
 	}, async ({ org, group }) => {
@@ -1780,7 +4401,7 @@ async function runMcpServer(options = {}) {
 		});
 		return (await ctx.client.listGroupEnvs(g.orgId, g.id)).environments;
 	});
-	tool("list_env_groups", "List the groups composed into an application environment (precedence order).", {
+	tool("list_env_groups", "List the groups composed into an application environment (precedence order).", ro, {
 		org: z.string().optional(),
 		app: z.string(),
 		env: z.string()
@@ -1793,17 +4414,17 @@ async function runMcpServer(options = {}) {
 		});
 		return (await ctx.client.listEnvGroups(target.orgId, target.envId)).groups;
 	});
-	tool("list_members", "List organization members and their public keys (for granting access).", { org: z.string().optional() }, async ({ org }) => {
+	tool("list_members", "List organization members and their public keys (for granting access).", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listMembers(orgRef.id)).members;
 	});
-	tool("kms_list_keys", "List managed KMS keys the caller can see (metadata only).", { org: z.string().optional() }, async ({ org }) => {
+	tool("kms_list_keys", "List managed KMS keys the caller can see (metadata only).", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listKmsKeys(orgRef.id)).keys;
 	});
-	tool("kms_create_key", "Create an org-scoped managed key. Material is generated locally and wrapped to each grantee (self plus any listed users/tokens); the server never sees it. Use the CLI for app/group-scoped keys.", {
+	tool("kms_create_key", "Create an org-scoped managed key. Material is generated locally and wrapped to each grantee (self plus any listed users/tokens); the server never sees it. Use the CLI for app/group-scoped keys.", { idempotent: false }, {
 		org: z.string().optional(),
 		name: z.string(),
 		purpose: z.enum(["encrypt", "sign"]),
@@ -1844,7 +4465,7 @@ async function runMcpServer(options = {}) {
 		});
 		return key;
 	});
-	tool("kms_grant", "Grant a principal (user email or token id) use of a key's current version.", {
+	tool("kms_grant", "Grant a principal (user email or token id) use of a key's current version.", { idempotent: true }, {
 		org: z.string().optional(),
 		key: z.string(),
 		user: z.string().optional(),
@@ -1869,7 +4490,7 @@ async function runMcpServer(options = {}) {
 			key: k.name
 		};
 	});
-	tool("kms_encrypt", "Encrypt a value under a managed encrypt key; returns a ce1 ciphertext blob. `context` (if given) is bound as AAD and must be supplied identically to decrypt.", {
+	tool("kms_encrypt", "Encrypt a value under a managed encrypt key; returns a ce1 ciphertext blob. `context` (if given) is bound as AAD and must be supplied identically to decrypt.", { readOnly: true }, {
 		org: z.string().optional(),
 		key: z.string(),
 		plaintext: z.string(),
@@ -1886,7 +4507,7 @@ async function runMcpServer(options = {}) {
 			version: currentVersion
 		}, plaintext, context ?? "") };
 	});
-	tool("kms_decrypt", "Decrypt a ce1 blob. Supply the same `context` used to encrypt.", {
+	tool("kms_decrypt", "Decrypt a ce1 blob. Supply the same `context` used to encrypt.", ro, {
 		org: z.string().optional(),
 		key: z.string(),
 		ciphertext: z.string(),
@@ -1900,7 +4521,7 @@ async function runMcpServer(options = {}) {
 		const { material } = await kmsRecoverMaterial(ctx, orgRef.id, k.id, ref.version);
 		return { plaintext: await kmsDecrypt(material, ciphertext, context ?? "") };
 	});
-	tool("kms_generate_data_key", "Generate a data key under a managed encrypt key (envelope encryption). Returns the plaintext key (base64) and its wrapped form to store.", {
+	tool("kms_generate_data_key", "Generate a data key under a managed encrypt key (envelope encryption). Returns the plaintext key (base64) and its wrapped form to store.", { readOnly: true }, {
 		org: z.string().optional(),
 		key: z.string()
 	}, async ({ org, key }) => {
@@ -1919,7 +4540,7 @@ async function runMcpServer(options = {}) {
 			wrapped: dk.wrapped
 		};
 	});
-	tool("kms_sign", "Sign a message with a managed signing key; returns an sg1 signature blob.", {
+	tool("kms_sign", "Sign a message with a managed signing key; returns an sg1 signature blob.", { readOnly: true }, {
 		org: z.string().optional(),
 		key: z.string(),
 		message: z.string()
@@ -1935,7 +4556,7 @@ async function runMcpServer(options = {}) {
 			version: currentVersion
 		}, message) };
 	});
-	tool("kms_verify", "Verify an sg1 signature over a message using a signing key's published public key (no grant needed).", {
+	tool("kms_verify", "Verify an sg1 signature over a message using a signing key's published public key (no grant needed).", ro, {
 		org: z.string().optional(),
 		key: z.string(),
 		signature: z.string(),
@@ -1950,7 +4571,7 @@ async function runMcpServer(options = {}) {
 		if (!pub) throw new Error(`no published public key for version ${ref.version}`);
 		return { valid: await verifyMessage(await importVerifyingKey(pub), signature, message) };
 	});
-	tool("list_secrets", "List secret names + versions in an environment (never values).", targetShape, async (o) => {
+	tool("list_secrets", "List secret names + versions in an environment (never values).", ro, targetShape, async (o) => {
 		const ctx = getCtx();
 		const { orgId, envId } = await resolveTargetEnv(ctx, o);
 		const { secrets } = await ctx.client.listSecrets(orgId, envId);
@@ -1960,12 +4581,12 @@ async function runMcpServer(options = {}) {
 			updatedAt: s.updatedAt
 		}));
 	});
-	tool("list_tokens", "List an organization's service tokens (never the secret token strings).", { org: z.string().optional() }, async ({ org }) => {
+	tool("list_tokens", "List an organization's service tokens (never the secret token strings).", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listTokens(orgRef.id)).tokens;
 	});
-	tool("audit", "Read the organization's audit trail (most recent first).", {
+	tool("audit", "Read the organization's audit trail (most recent first).", ro, {
 		org: z.string().optional(),
 		limit: z.number().int().min(1).max(200).optional(),
 		action: z.string().optional().describe("filter by action, e.g. secret.updated")
@@ -1977,14 +4598,14 @@ async function runMcpServer(options = {}) {
 			action
 		})).entries;
 	});
-	tool("create_org", "Create an organization. Requires a user session — service tokens cannot own a Stytch org.", {
+	tool("create_org", "Create an organization. Requires a user session — service tokens cannot own a Stytch org.", { idempotent: false }, {
 		name: z.string(),
 		slug: z.string()
 	}, async ({ name, slug }) => (await getCtx().client.createOrg({
 		name,
 		slug
 	})).org);
-	tool("create_app", "Create an application in an organization.", {
+	tool("create_app", "Create an application in an organization.", { idempotent: false }, {
 		org: z.string().optional(),
 		name: z.string(),
 		slug: z.string()
@@ -1996,7 +4617,7 @@ async function runMcpServer(options = {}) {
 			slug
 		})).app;
 	});
-	tool("create_group", "Create a shared group (reusable secret bag) in an organization.", {
+	tool("create_group", "Create a shared group (reusable secret bag) in an organization.", { idempotent: false }, {
 		org: z.string().optional(),
 		name: z.string(),
 		slug: z.string()
@@ -2008,7 +4629,7 @@ async function runMcpServer(options = {}) {
 			slug
 		})).group;
 	});
-	tool("create_env", "Create an application environment. Generates the data key locally and grants it to the caller.", {
+	tool("create_env", "Create an application environment. Generates the data key locally and grants it to the caller.", { idempotent: false }, {
 		org: z.string().optional(),
 		app: z.string(),
 		name: z.string(),
@@ -2026,7 +4647,56 @@ async function runMcpServer(options = {}) {
 			wrappedDek
 		})).environment;
 	});
-	tool("create_group_env", "Create a group environment. Generates the data key locally and grants it to the caller.", {
+	tool("create_branch", "Fork an environment into an ephemeral branch (a per-PR / preview config). The branch inherits the parent's secrets by layering at read time — nothing is copied or re-encrypted — and holds only the values you override on it. Generates the branch's data key locally, grants it to the caller, and shares it with the parent's other readers.", { idempotent: false }, {
+		org: z.string().optional(),
+		app: z.string(),
+		from: z.string().describe("the environment to branch"),
+		slug: z.string().describe("the branch name, e.g. pr-142"),
+		ttl: z.string().optional().describe("lifetime: 12h, 7d, 2w, … or `never` (default 7d)")
+	}, async ({ org, app, from, slug, ttl }) => {
+		const ctx = getCtx();
+		const parent = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env: from
+		});
+		const parsedTtl = parseBranchTtl(ttl ?? "7d");
+		if (parsedTtl === null) throw new Error(`invalid ttl "${ttl}" (try 12h, 7d, 2w, or never)`);
+		const me = await kmsCallerIdentity(ctx);
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, me.publicKeyJwk);
+		const grants = [];
+		const { grantees } = await ctx.client.listGrantees(parent.orgId, parent.envId);
+		for (const grantee of grantees) {
+			if (grantee.principalType === me.principalType && grantee.principalId === me.principalId) continue;
+			grants.push({
+				principalType: grantee.principalType,
+				principalId: grantee.principalId,
+				wrappedDek: await wrapDek(dek, grantee.publicKeyJwk)
+			});
+		}
+		return (await ctx.client.createBranch(parent.orgId, parent.envId, {
+			slug,
+			ttlSeconds: Number.isFinite(parsedTtl) ? parsedTtl : null,
+			wrappedDek,
+			grants
+		})).branch;
+	});
+	tool("delete_branch", "Tear down a branch config and every value it overrode. The parent environment is untouched.", destructive, {
+		org: z.string().optional(),
+		app: z.string(),
+		branch: z.string()
+	}, async ({ org, app, branch }) => {
+		const ctx = getCtx();
+		const appRef = await resolveApp(ctx, {
+			org,
+			app
+		});
+		const target = await resolveBranch(ctx, appRef, branch);
+		await ctx.client.deleteBranch(appRef.orgId, target.id);
+		return { deleted: target.slug };
+	});
+	tool("create_group_env", "Create a group environment. Generates the data key locally and grants it to the caller.", { idempotent: false }, {
 		org: z.string().optional(),
 		group: z.string(),
 		name: z.string(),
@@ -2044,7 +4714,7 @@ async function runMcpServer(options = {}) {
 			wrappedDek
 		})).environment;
 	});
-	tool("compose_group", "Compose a group into an application environment (higher position wins on name clashes).", {
+	tool("compose_group", "Compose a group into an application environment (higher position wins on name clashes).", { idempotent: true }, {
 		org: z.string().optional(),
 		app: z.string(),
 		env: z.string(),
@@ -2066,7 +4736,7 @@ async function runMcpServer(options = {}) {
 			position
 		})).group;
 	});
-	tool("uncompose_group", "Remove a composed group from an application environment.", {
+	tool("uncompose_group", "Remove a composed group from an application environment.", { idempotent: true }, {
 		org: z.string().optional(),
 		app: z.string(),
 		env: z.string(),
@@ -2085,7 +4755,7 @@ async function runMcpServer(options = {}) {
 		await ctx.client.unlinkEnvGroup(target.orgId, target.envId, g.id);
 		return { ok: true };
 	});
-	tool("set_secret", "Encrypt a value locally and store it in an environment.", {
+	tool("set_secret", "Encrypt a value locally and store it in an environment. A value may reference another secret as ${OTHER_SECRET}: the reference is stored literally and expanded whenever the secret is read, so it tracks the referenced value. Write $${OTHER_SECRET} for a literal.", { idempotent: false }, {
 		...targetShape,
 		name: z.string(),
 		value: z.string()
@@ -2099,10 +4769,11 @@ async function runMcpServer(options = {}) {
 			name: o.name
 		};
 	});
-	tool("get_secret", "Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command). Pass `version` to read an earlier version instead of the current one.", {
+	tool("get_secret", "Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command). A revealed current value has its ${OTHER_SECRET} references expanded against this environment's own secrets; pass raw:true for the stored text instead. Pass `version` to read an earlier version instead of the current one (always as stored, never expanded).", ro, {
 		...targetShape,
 		name: z.string(),
 		reveal: z.boolean().optional(),
+		raw: z.boolean().optional().describe("skip ${OTHER_SECRET} expansion (with reveal)"),
 		version: z.number().int().positive().optional().describe("an earlier version from list_secret_versions (default: current)")
 	}, async (o) => {
 		const ctx = getCtx();
@@ -2127,7 +4798,7 @@ async function runMcpServer(options = {}) {
 				revealed: true
 			};
 		}
-		const values = await fetchDecryptedSecrets(ctx, orgId, envId);
+		const values = await fetchDecryptedSecrets(ctx, orgId, envId, { raw: o.raw });
 		if (!(o.name in values)) throw new Error(`no secret named ${o.name}`);
 		return {
 			name: o.name,
@@ -2135,7 +4806,7 @@ async function runMcpServer(options = {}) {
 			revealed: true
 		};
 	});
-	tool("list_secret_versions", "List a secret's version history: who wrote each version, when, and which ones were restores. Never returns values — pair it with restore_secret to roll back, or get_secret(version, reveal:true) to inspect one.", {
+	tool("list_secret_versions", "List a secret's version history: who wrote each version, when, and which ones were restores. Never returns values — pair it with restore_secret to roll back, or get_secret(version, reveal:true) to inspect one.", ro, {
 		...targetShape,
 		name: z.string(),
 		limit: z.number().int().min(1).max(200).optional().describe("default 20")
@@ -2153,7 +4824,7 @@ async function runMcpServer(options = {}) {
 			}))
 		};
 	});
-	tool("restore_secret", "Roll a secret back to an earlier version. The stored ciphertext is replayed as a NEW version (history is append-only, nothing is overwritten). Keyless — no decryption happens, so this works even without a key.", {
+	tool("restore_secret", "Roll a secret back to an earlier version. The stored ciphertext is replayed as a NEW version (history is append-only, nothing is overwritten). Keyless — no decryption happens, so this works even without a key.", { idempotent: false }, {
 		...targetShape,
 		name: z.string(),
 		version: z.number().int().positive()
@@ -2168,7 +4839,7 @@ async function runMcpServer(options = {}) {
 			version: secret.version
 		};
 	});
-	tool("delete_secret", "Delete a secret from an environment.", {
+	tool("delete_secret", "Delete a secret from an environment.", destructive, {
 		...targetShape,
 		name: z.string()
 	}, async (o) => {
@@ -2181,11 +4852,15 @@ async function runMcpServer(options = {}) {
 		};
 	});
 	tool("run_command", "Run a command with the resolved secrets injected as environment variables, and return its exit code + captured output. Secret VALUES are never returned — this is the preferred way to use secrets. process env > .env > app env > groups.", {
+		destructive: true,
+		idempotent: false
+	}, {
 		command: z.string().describe("executable to run"),
 		args: z.array(z.string()).optional(),
 		org: z.string().optional(),
 		app: z.string().optional(),
 		env: z.string().optional().describe("environment slug (token auth infers this)"),
+		branch: z.string().optional().describe("read an ephemeral branch of that environment"),
 		with: z.record(z.string(), z.string()).optional().describe("group=env slice overrides"),
 		envFile: z.array(z.string()).optional().describe(".env files to overlay (default [.env])"),
 		cwd: z.string().optional()
@@ -2202,11 +4877,12 @@ async function runMcpServer(options = {}) {
 			injectedVarCount: Object.keys(values).length
 		};
 	});
-	tool("export_env", "Write the resolved secrets to a dotenv file on disk and return the variable names written (never the values). Use to materialize a .env for local tooling.", {
+	tool("export_env", "Write the resolved secrets to a dotenv file on disk and return the variable names written (never the values). Use to materialize a .env for local tooling.", destructive, {
 		file: z.string().describe("path to write, e.g. .env"),
 		org: z.string().optional(),
 		app: z.string().optional(),
 		env: z.string().optional(),
+		branch: z.string().optional().describe("read an ephemeral branch of that environment"),
 		with: z.record(z.string(), z.string()).optional()
 	}, async (o) => {
 		const ctx = getCtx();
@@ -2220,7 +4896,7 @@ async function runMcpServer(options = {}) {
 			names: Object.keys(values).sort()
 		};
 	});
-	tool("create_token", "Mint a service token, printed once. Runtime tokens bind to one app environment (auto-granted its keys, so a command/agent can decrypt it). Pass admin:true for an org-scoped provisioning token (create apps/groups/envs, grant, mint tokens) — admin tokens need no env binding.", {
+	tool("create_token", "Mint a service token, printed once. Runtime tokens bind to one app environment (auto-granted its keys, so a command/agent can decrypt it). Pass admin:true for an org-scoped provisioning token (create apps/groups/envs, grant, mint tokens) — admin tokens need no env binding.", { idempotent: false }, {
 		name: z.string().describe("display name, e.g. ci-deploy or agent-session"),
 		org: z.string().optional(),
 		app: z.string().optional().describe("bind to this app (runtime tokens)"),
@@ -2271,7 +4947,7 @@ async function runMcpServer(options = {}) {
 			note: "save this now — the secret token string is not stored and cannot be retrieved"
 		};
 	});
-	tool("revoke_token", "Revoke a service token by id.", {
+	tool("revoke_token", "Revoke a service token by id.", destructive, {
 		org: z.string().optional(),
 		tokenId: z.string()
 	}, async ({ org, tokenId }) => {
@@ -2283,7 +4959,7 @@ async function runMcpServer(options = {}) {
 			tokenId
 		};
 	});
-	tool("grant_env", "Grant a member (by email) or service token (by id) access to an environment's data key. Re-wraps the DEK to the grantee — the caller must already hold the key.", {
+	tool("grant_env", "Grant a member (by email) or service token (by id) access to an environment's data key. Re-wraps the DEK to the grantee — the caller must already hold the key.", { idempotent: true }, {
 		...targetShape,
 		user: z.string().optional().describe("org member email"),
 		token: z.string().optional().describe("service token id (skt_…)")
@@ -2328,12 +5004,12 @@ async function runMcpServer(options = {}) {
 			principalId
 		};
 	});
-	tool("list_pg_targets", "List registered Postgres provisioning targets for temporary credentials.", { org: z.string().optional() }, async ({ org }) => {
+	tool("list_pg_targets", "List registered Postgres provisioning targets for temporary credentials.", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listLeaseTargets(orgRef.id)).targets;
 	});
-	tool("create_pg_lease", "Mint a short-lived Postgres credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its SCRAM verifier is sent to the API — the plaintext never reaches seekrit or Postgres at rest. The role auto-expires; revoke early with revoke_pg_lease.", {
+	tool("create_pg_lease", "Mint a short-lived Postgres credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its SCRAM verifier is sent to the API — the plaintext never reaches seekrit or Postgres at rest. The role auto-expires; revoke early with revoke_pg_lease.", { idempotent: false }, {
 		org: z.string().optional(),
 		target: z.string().describe("target id or name"),
 		role: z.string().optional().describe("role name to create (default: random tmp_ name)"),
@@ -2362,12 +5038,12 @@ async function runMcpServer(options = {}) {
 			note: "short-lived credential; it auto-expires and the plaintext is not stored anywhere"
 		};
 	});
-	tool("list_pg_leases", "List Postgres leases (the ledger — never secret material).", { org: z.string().optional() }, async ({ org }) => {
+	tool("list_pg_leases", "List Postgres leases (the ledger — never secret material).", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listLeases(orgRef.id)).leases;
 	});
-	tool("revoke_pg_lease", "Revoke a Postgres lease now (drops the role immediately).", {
+	tool("revoke_pg_lease", "Revoke a Postgres lease now (drops the role immediately).", destructive, {
 		org: z.string().optional(),
 		leaseId: z.string()
 	}, async ({ org, leaseId }) => {
@@ -2379,12 +5055,12 @@ async function runMcpServer(options = {}) {
 			leaseId
 		};
 	});
-	tool("list_mysql_targets", "List registered MySQL/MariaDB provisioning targets for temporary credentials.", { org: z.string().optional() }, async ({ org }) => {
+	tool("list_mysql_targets", "List registered MySQL/MariaDB provisioning targets for temporary credentials.", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listLeaseTargets(orgRef.id)).targets.filter((t) => t.provider === "mysql");
 	});
-	tool("create_mysql_lease", "Mint a short-lived MySQL/MariaDB credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its mysql_native_password hash is sent to the API — the plaintext never reaches seekrit or MySQL at rest. The user auto-expires; revoke early with revoke_mysql_lease.", {
+	tool("create_mysql_lease", "Mint a short-lived MySQL/MariaDB credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its mysql_native_password hash is sent to the API — the plaintext never reaches seekrit or MySQL at rest. The user auto-expires; revoke early with revoke_mysql_lease.", { idempotent: false }, {
 		org: z.string().optional(),
 		target: z.string().describe("target id or name"),
 		user: z.string().optional().describe("user name to create (default: random tmp_ name)"),
@@ -2414,12 +5090,12 @@ async function runMcpServer(options = {}) {
 			note: "short-lived credential; it auto-expires and the plaintext is not stored anywhere"
 		};
 	});
-	tool("list_mysql_leases", "List MySQL/MariaDB leases (the ledger — never secret material).", { org: z.string().optional() }, async ({ org }) => {
+	tool("list_mysql_leases", "List MySQL/MariaDB leases (the ledger — never secret material).", ro, { org: z.string().optional() }, async ({ org }) => {
 		const ctx = getCtx();
 		const orgRef = await resolveOrg(ctx, org);
 		return (await ctx.client.listLeases(orgRef.id)).leases.filter((l) => l.provider === "mysql");
 	});
-	tool("revoke_mysql_lease", "Revoke a MySQL/MariaDB lease now (drops the user immediately).", {
+	tool("revoke_mysql_lease", "Revoke a MySQL/MariaDB lease now (drops the user immediately).", destructive, {
 		org: z.string().optional(),
 		leaseId: z.string()
 	}, async ({ org, leaseId }) => {
@@ -2431,7 +5107,7 @@ async function runMcpServer(options = {}) {
 			leaseId
 		};
 	});
-	tool("configure_project", "Link a directory to an org/app by writing seekrit.json (like `seekrit init`). The environment is chosen by the service token at runtime.", {
+	tool("configure_project", "Link a directory to an org/app by writing seekrit.json (like `seekrit init`). The environment is chosen by the service token at runtime.", destructive, {
 		org: z.string(),
 		app: z.string(),
 		dir: z.string().optional()
@@ -2469,7 +5145,7 @@ async function runMcpServer(options = {}) {
 * `seekrit mcp`. tsdown bundles the shared server source in at build time, so the
 * published package is self-contained and needs no `@seekrit/cli` install.
 */
-runMcpServer({ version: "0.6.0" }).catch((err) => {
+runMcpServer({ version: "0.7.0" }).catch((err) => {
 	const message = err instanceof Error ? err.message : String(err);
 	process.stderr.write(`seekrit-mcp: fatal: ${message}\n`);
 	process.exit(1);