npm - @seekrit/mcp - Versions diffs - 0.6.1 → 0.7.0 - Mend

@seekrit/mcp 0.6.1 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/index.js +1298 -44
package/package.json +2 -2

package/dist/index.js CHANGED Viewed

@@ -8,6 +8,43 @@ import { homedir } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
+//#region ../../packages/core/src/agent-policy.ts
+/** A bare hostname: no scheme, no port, no path, no wildcard. */
+const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
+const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
+/**
+* A path pattern. Must be absolute, because it is matched against a request
+* path — a relative pattern is a mistake that would silently match nothing.
+*/
+const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
+const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
+z.object({
+	host: policyHostSchema,
+	methods: z.array(policyMethodSchema).max(16).default([]),
+	paths: z.array(policyPathSchema).max(64).default([]),
+	allow: z.array(policySecretNameSchema).max(64).default([]),
+	label: z.string().trim().max(120).optional()
+});
+z.object({
+/** `ap1.<body>.<signature>` — opaque to the server. */
+bundle: z.string().min(16).max(256 * 1024) });
+z.object({
+	name: z.string().trim().min(1).max(120),
+	slug: z.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "slug is lowercase letters, digits, and dashes"),
+	/** The environment whose secrets this agent's policy may name. Optional. */
+	environmentId: z.string().trim().min(1).max(64).optional()
+});
+z.object({
+	name: z.string().trim().min(1).max(120).optional(),
+	enabled: z.boolean().optional(),
+	environmentId: z.string().trim().min(1).max(64).nullish()
+});
+z.object({
+	host: policyHostSchema,
+	method: policyMethodSchema,
+	path: z.string().trim().min(1).max(2048),
+	secret: policySecretNameSchema.optional()
+});
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -16,12 +53,24 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Client-side managed keys for application-layer encryption and signing.",
 		default: true
 	},
+	"feature.honey_tokens": {
+		kind: "feature",
+		label: "Honey tokens",
+		description: "Decoy credentials that alert the moment anyone tries to use them.",
+		default: true
+	},
 	"feature.leases": {
 		kind: "feature",
 		label: "Temporary access",
 		description: "Vault-style short-lived database and cloud credentials.",
 		default: true
 	},
+	"feature.rotation": {
+		kind: "feature",
+		label: "Secret rotation",
+		description: "Managed, scheduled rotation of stored credentials.",
+		default: true
+	},
 	"feature.log_sink": {
 		kind: "feature",
 		label: "Audit log export (SIEM)",
@@ -100,6 +149,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Maximum registered third-party sync destinations.",
 		default: null
 	},
+	"rotation.policies.max": {
+		kind: "limit",
+		label: "Rotation policies",
+		description: "Maximum secrets with managed rotation configured.",
+		default: null
+	},
 	members: {
 		kind: "metered",
 		label: "Members",
@@ -122,7 +177,7 @@ const PLAN_FAMILIES = {
 		id: "free",
 		name: "Free",
 		description: "Get started with the essentials.",
-		current: 1,
+		current: 3,
 		hidden: false
 	},
 	team: {
@@ -512,7 +567,7 @@ const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a
 */
 const awsRoleArnSchema = z.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
 /** An AWS region id, e.g. `us-east-1`, `eu-west-2`, `us-gov-west-1`. */
-const awsRegionSchema = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
+const awsRegionSchema$1 = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
 /**
 * An STS external id — the shared string a role's trust policy can require so a
 * confused-deputy can't assume it. AWS allows a broad charset; we keep to the
@@ -592,7 +647,7 @@ const connectionSchema = z.object({
 	database: z.string().min(1)
 });
 /** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
-const statementSchema = z.string().min(1).max(4e3);
+const statementSchema$1 = z.string().min(1).max(4e3);
 /** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
 const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
 const postgresTargetConfigSchema = z.object({
@@ -602,20 +657,20 @@ const postgresTargetConfigSchema = z.object({
 	schema: identifierSchema.optional(),
 	connection: connectionSchema,
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 /** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
-const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const mysqlHostSchema$1 = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
 const mysqlTargetConfigSchema = z.object({
 	provider: z.literal("mysql"),
 	executor: executorModeSchema,
 	accessLevel: mysqlAccessLevelSchema.optional(),
 	connection: connectionSchema,
-	userHost: mysqlHostSchema.optional(),
+	userHost: mysqlHostSchema$1.optional(),
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 const redisConnectionSchema = z.object({
 	host: z.string().min(1),
@@ -629,8 +684,8 @@ const redisTargetConfigSchema = z.object({
 	accessLevel: redisAccessLevelSchema.optional(),
 	connection: redisConnectionSchema,
 	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema).max(16).optional(),
-	revokeStatements: z.array(statementSchema).max(16).optional()
+	createStatements: z.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z.array(statementSchema$1).max(16).optional()
 });
 const sshTargetConfigSchema = z.object({
 	provider: z.literal("ssh"),
@@ -649,7 +704,7 @@ const awsTargetConfigSchema = z.object({
 	provider: z.literal("aws"),
 	executor: z.literal("in_do"),
 	roleArn: awsRoleArnSchema,
-	region: awsRegionSchema,
+	region: awsRegionSchema$1,
 	externalId: awsExternalIdSchema.optional(),
 	sessionPolicy: z.string().min(1).max(4e3).optional(),
 	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
@@ -813,7 +868,9 @@ const NOTIFICATION_TYPES = [
 	"org_welcome",
 	"token_expiring",
 	"lease_expired",
-	"sync_failed"
+	"sync_failed",
+	"honey_token_tripped",
+	"secret_rotation_failed"
 ];
 //#endregion
 //#region ../../packages/core/src/schemas.ts
@@ -920,6 +977,14 @@ z.object({
 	environmentId: z.string().min(1).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+z.object({
+	name: nameSchema,
+	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full token string. */
+	tokenHash: z.string().min(1),
+	/** Where the decoy was planted, as a reminder for whoever reads the alert. */
+	placement: z.string().max(200).nullish()
+});
 const kmsKeyPurposeSchema = z.enum(["encrypt", "sign"]);
 const kmsKeySpecSchema = z.enum(["aes-256-gcm", "ecdsa-p256"]);
 /** A wrapped key grant supplied by the client (server never sees plaintext material). */
@@ -1032,6 +1097,25 @@ z.object({
 	note: z.string().max(500).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+z.object({
+	code: z.string().min(4).max(40),
+	family: planFamilySchema,
+	version: z.number().int().positive().optional(),
+	durationDays: z.number().int().positive().max(3650).nullish(),
+	maxRedemptions: z.number().int().positive().nullish(),
+	startsAt: z.iso.datetime().nullish(),
+	endsAt: z.iso.datetime().nullish(),
+	note: z.string().max(500).nullish()
+});
+z.object({
+	maxRedemptions: z.number().int().positive().nullish(),
+	startsAt: z.iso.datetime().nullish(),
+	endsAt: z.iso.datetime().nullish(),
+	note: z.string().max(500).nullish(),
+	/** Kill switch. Disabling stops new redemptions; live grants are untouched. */
+	disabled: z.boolean().optional()
+});
+z.object({ code: z.string().min(1).max(40) });
 z.object({ family: planFamilySchema });
 z.object({
 	sessionId: z.string().regex(/^skc_[0-9A-Za-z]+$/),
@@ -1049,7 +1133,117 @@ z.object({
 	action: z.string().optional(),
 	resourceType: z.string().optional()
 });
-z.enum(["vercel"]);
+z.enum([
+	"generated",
+	"postgres",
+	"mysql",
+	"redis"
+]);
+z.enum([
+	"active",
+	"paused",
+	"failed"
+]);
+/** Statuses an admin may set directly (`failed` is only reached by the sweep). */
+const settableRotationStatusSchema = z.enum(["active", "paused"]);
+const rotationAlphabetSchema = z.enum([
+	"alphanumeric",
+	"hex",
+	"base64url",
+	"printable"
+]);
+const rotationIntervalSchema = z.number().int().min(300).max(3600 * 24 * 365);
+/**
+* A database user name we are willing to *re-key*. Deliberately more permissive
+* than the lease providers' name schemas — those name accounts seekrit creates,
+* whereas this names an account the customer's DBA created years ago, which may
+* be mixed-case or contain dots or dashes.
+*
+* It stays injection-safe for every place it is interpolated: a double-quoted
+* Postgres identifier, a single-quoted MySQL literal, and a bare Redis command
+* token. The charset excludes both quote characters, backslash, whitespace, and
+* `;`, so there is no way out of the surrounding quoting, and no whitespace to
+* split one Redis argument into two.
+*/
+const rotationUsernameSchema = z.string().regex(/^[A-Za-z0-9_$.-]{1,63}$/, "must be 1–63 chars of letters, digits, underscore, dollar, dot or dash");
+/** A `{{name}}`/`{{host}}`/`{{verifier}}` templated statement or command line. */
+const statementSchema = z.string().min(1).max(4e3);
+const passwordLengthSchema = z.number().int().min(16).max(256);
+/** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
+const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const generatedRotationConfigSchema = z.object({
+	kind: z.literal("generated"),
+	length: passwordLengthSchema.optional(),
+	alphabet: rotationAlphabetSchema.optional()
+});
+const postgresRotationConfigSchema = z.object({
+	kind: z.literal("postgres"),
+	username: rotationUsernameSchema,
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const mysqlRotationConfigSchema = z.object({
+	kind: z.literal("mysql"),
+	username: rotationUsernameSchema,
+	userHost: mysqlHostSchema.optional(),
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const redisRotationConfigSchema = z.object({
+	kind: z.literal("redis"),
+	username: rotationUsernameSchema,
+	passwordLength: passwordLengthSchema.optional(),
+	statements: z.array(statementSchema).max(16).optional()
+});
+const rotationConfigSchema = z.discriminatedUnion("kind", [
+	generatedRotationConfigSchema,
+	postgresRotationConfigSchema,
+	mysqlRotationConfigSchema,
+	redisRotationConfigSchema
+]);
+z.object({
+	environmentId: z.string().min(1),
+	/** The secret whose value rotates. It must already exist. */
+	secretName: secretNameSchema,
+	config: rotationConfigSchema,
+	intervalSeconds: rotationIntervalSchema,
+	/**
+	* The registered lease target supplying the connection, executor mode, and
+	* wrapped admin credential. Required for every kind but `generated`.
+	*/
+	targetId: z.string().min(1).optional(),
+	/** Environment DEK wrapped to the rotator public key (`wd1.` blob). */
+	wrappedDek: z.string().min(1).optional(),
+	/** Rotate once immediately instead of waiting for the first interval. */
+	rotateNow: z.boolean().optional()
+});
+z.object({
+	intervalSeconds: rotationIntervalSchema.optional(),
+	config: rotationConfigSchema.optional(),
+	/**
+	* `paused` stops the sweep; `active` resumes it and clears the failure
+	* streak, which is also how a `failed` policy is recovered.
+	*/
+	status: settableRotationStatusSchema.optional()
+}).refine((v) => v.intervalSeconds !== void 0 || v.config !== void 0 || v.status !== void 0, "provide at least one of intervalSeconds, config, or status");
+z.enum([
+	"vercel",
+	"cloudflare-workers",
+	"cloudflare-pages",
+	"cloudflare-secrets-store",
+	"railway",
+	"aws-secrets-manager",
+	"aws-parameter-store",
+	"render",
+	"fly",
+	"northflank",
+	"digitalocean",
+	"heroku",
+	"netlify",
+	"bunnyshell",
+	"github-actions",
+	"gcp-secret-manager"
+]);
 /**
 * Vercel account scope. The API token itself is never here — it is wrapped to
 * the connection's public key and stored as ciphertext.
@@ -1063,7 +1257,274 @@ const vercelConnectionConfigSchema = z.object({
 	/** Vercel Team id (`team_…`). Omit for a personal account. */
 	teamId: z.string().trim().min(1).max(128).optional()
 });
-const syncConnectionConfigSchema = z.discriminatedUnion("provider", [vercelConnectionConfigSchema]);
+/**
+* A Cloudflare account id — 32 lowercase hex characters, found in the sidebar
+* of any account's dashboard. Every Cloudflare endpoint seekrit calls is
+* account-scoped, so this is the account half of "which account, which thing".
+*
+* Validated by shape because the alternative is a bare 400 from Cloudflare
+* hours later inside an alarm, with nobody watching. It does not catch pasting
+* a *zone* id, which has the same shape — only the API can tell those apart.
+*/
+const cloudflareAccountIdSchema = z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Cloudflare account ID (lowercase hex)");
+/**
+* Cloudflare account scope, shared by all three Cloudflare providers. The API
+* token is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's is.
+*
+* The three providers are deliberately separate kinds rather than one
+* `cloudflare` with a mode field: they target different APIs, take different
+* destinations, and fail in different ways. Splitting them keeps the
+* exhaustiveness guard in `connectorFor` meaningful.
+*/
+const cloudflareWorkersConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflarePagesConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflareSecretsStoreConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	accountId: cloudflareAccountIdSchema
+});
+/**
+* A Railway id — every project, environment, and service is a UUID. Validated
+* by shape for the same reason Cloudflare's account id is: the alternative is a
+* bare GraphQL "Problem processing request" hours later inside an alarm, with
+* nobody watching.
+*/
+const railwayIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a Railway UUID");
+/**
+* Railway account scope. The token is never here — it is wrapped to the
+* connection's public key and stored as ciphertext, exactly as Vercel's is.
+*
+* There is no workspace/team id to carry: Railway ids are globally unique and
+* a destination names its project outright, so the token plus the destination
+* is the whole address.
+*/
+const railwayConnectionConfigSchema = z.object({
+	provider: z.literal("railway"),
+	tokenKind: z.enum(["account", "project"]).default("account")
+});
+/**
+* An AWS region id (`us-east-1`, `eu-central-1`, `us-gov-west-1`).
+*
+* Validated by shape rather than against a list, because AWS adds regions
+* faster than we ship. The endpoint host is built from this string, so a typo
+* would otherwise surface as a DNS failure inside an alarm with nobody
+* watching — which is a much worse place to learn about it than this form.
+*/
+const awsRegionSchema = z.string().trim().regex(/^[a-z]{2}(-[a-z]+)+-\d$/, "must be an AWS region ID, e.g. us-east-1");
+/**
+* The IAM access key id seekrit signs with.
+*
+* This lives in `config` — the *non-secret* half — on purpose: an access key id
+* is an identifier, not a credential. It appears in CloudTrail, in the IAM
+* console, and in the `Authorization` header of every signed request; only the
+* **secret access key** is secret, and that is what gets wrapped to the
+* connection's public key. Keeping the id here also lets the dashboard say
+* which key a connection is using, which is the first thing you want to know
+* when a connection starts failing after a key rotation.
+*
+* Long-lived IAM user keys only. `ASIA…` session credentials from STS expire
+* within hours, and a sync connection has to keep working unattended.
+*/
+const awsAccessKeyIdSchema = z.string().trim().regex(/^[A-Z0-9]{16,128}$/, "must be an AWS access key ID, e.g. AKIAIOSFODNN7EXAMPLE");
+/**
+* AWS account scope, shared by both AWS providers: which region to call and
+* which key to sign with. There is no account id — every endpoint seekrit calls
+* is reached through the regional host and authorizes off the signature, so the
+* account is whichever one the key belongs to.
+*
+* Two providers rather than one `aws` with a mode field, for the same reason
+* the three Cloudflare kinds are separate: different APIs, different
+* destinations, different IAM actions.
+*/
+const awsSecretsManagerConnectionConfigSchema = z.object({
+	provider: z.literal("aws-secrets-manager"),
+	region: awsRegionSchema,
+	accessKeyId: awsAccessKeyIdSchema
+});
+const awsParameterStoreConnectionConfigSchema = z.object({
+	provider: z.literal("aws-parameter-store"),
+	region: awsRegionSchema,
+	accessKeyId: awsAccessKeyIdSchema
+});
+/**
+* Render account scope — deliberately empty.
+*
+* Like Railway's, and unlike Vercel (which 403s team-owned resources without
+* `teamId`) or Cloudflare (whose every endpoint is account-scoped): a Render
+* API key is issued to a user, and every endpoint seekrit calls addresses its
+* resource by id — `srv-…`, `crn-…`, `evg-…`. There is nothing to scope, so
+* nothing is stored. The connection's `name` is what tells an operator which Render
+* workspace it belongs to.
+*/
+const renderConnectionConfigSchema = z.object({ provider: z.literal("render") });
+/**
+* Fly.io account scope — empty, as Render's is.
+*
+* Neither half of "which account, which thing" needs stating: Fly app names are
+* globally unique, so the destination names its app and that is the whole
+* address. Nor is there a token kind to declare the way Railway's `tokenKind`
+* is — Fly's two token shapes do take different auth schemes, but
+* `flyAuthorization` in the connector reads which one from the token itself.
+*/
+const flyConnectionConfigSchema = z.object({ provider: z.literal("fly") });
+/**
+* A Northflank id — projects and secret groups are both slugs derived from the
+* name they were created with (`default-project`, `example-secret-group`), and
+* both appear in the resource's URL. Validated against Northflank's own pattern
+* so the common slip — pasting the *display name*, spaces and all — fails here
+* rather than as a bare 404 inside an alarm with nobody watching.
+*/
+const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/, "must be a Northflank ID — the slug in the resource's URL, not its display name");
+/**
+* Northflank account scope — deliberately empty.
+*
+* A Northflank API token is issued by exactly one team (or org-owned team) and
+* carries that scope itself; `GET /v1/auth` reports which. There is no team id
+* to disambiguate the way Vercel needs one, and no account id the way
+* Cloudflare does: the token plus the destination's project is the whole
+* address. The kind exists so the discriminated union stays uniform.
+*/
+const northflankConnectionConfigSchema = z.object({ provider: z.literal("northflank") });
+/**
+* DigitalOcean account scope — deliberately empty, as Render's and Fly's are.
+*
+* A DigitalOcean personal access token belongs to one account (or one team, if
+* it was issued inside one) and carries that scope itself, and every endpoint
+* this connector calls addresses its app by id. There is no team id to
+* disambiguate the way Vercel needs one: the token plus the destination's app
+* id is the whole address.
+*/
+const digitalOceanConnectionConfigSchema = z.object({ provider: z.literal("digitalocean") });
+/**
+* Heroku account scope — empty, as Fly's and Render's are.
+*
+* A Heroku API token carries its user's access to every app and team they can
+* reach, and app names are globally unique, so the destination's app is the
+* whole address. There is no team id to state: unlike Vercel, where a personal
+* token 403s a team-owned project without `teamId`, Heroku resolves
+* `/apps/{app_id_or_name}` against everything the token can see, team-owned or
+* not.
+*/
+const herokuConnectionConfigSchema = z.object({ provider: z.literal("heroku") });
+/**
+* Netlify team scope — the one thing a Netlify token cannot tell us itself.
+*
+* Every environment variable endpoint is account-scoped
+* (`/accounts/{account_id}/env`), and a personal access token belongs to a
+* *user*, who may sit in several teams. So unlike Fly's or Heroku's, this
+* config is not empty: the token says who you are, and this says which team's
+* variables to write.
+*
+* Netlify treats the team's id and its slug as interchangeable wherever
+* `{account_id}` appears, so both are accepted. The slug is the one an operator
+* can find without an API call — it is in the dashboard URL
+* (`app.netlify.com/teams/<slug>`) and under Team settings → General.
+*/
+const netlifyConnectionConfigSchema = z.object({
+	provider: z.literal("netlify"),
+	/** Netlify team slug (`acme`) or account id — `{account_id}` accepts either. */
+	accountId: z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Netlify team slug or account ID — no slashes or spaces")
+});
+/**
+* Bunnyshell account scope — empty, as Fly's, Heroku's, and Northflank's are.
+*
+* A Bunnyshell access token (from `environments.bunnyshell.com/access-token`)
+* belongs to a *user* and carries their access to every organization they are
+* in, exactly as a Heroku token does. Unlike Netlify's, that does not force an
+* organization onto the connection, because nothing here is addressed *through*
+* one: both variable collections name their parent by an opaque, globally
+* unique id (`environment` or `project`), so the token plus the destination's
+* id is the whole address. The API offers an `organization` filter, but it
+* narrows a listing — it is not part of an address.
+*/
+const bunnyshellConnectionConfigSchema = z.object({ provider: z.literal("bunnyshell") });
+/**
+* GitHub account scope — empty for github.com, which is the whole point.
+*
+* A GitHub token addresses everything by `{owner}/{repo}` or `{org}`, and those
+* are the destination's business, so there is no account half to state the way
+* Cloudflare and Netlify need one. `baseUrl` is the single exception, and it is
+* not an account scope at all: it names a **GitHub Enterprise Server** install,
+* whose API lives on the customer's own host rather than on `api.github.com`.
+*
+* Left unset for github.com and for Enterprise Cloud (which is `api.github.com`
+* with a different plan behind it). Set only for a self-hosted GHES appliance,
+* where the REST API is at `https://<host>/api/v3`.
+*/
+const githubActionsConnectionConfigSchema = z.object({
+	provider: z.literal("github-actions"),
+	/**
+	* GitHub Enterprise Server API root, e.g. `https://github.acme.com/api/v3`.
+	* Omit for github.com. Must be `https:` — this URL carries the token.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the GitHub Enterprise Server API root, e.g. https://github.acme.com/api/v3").optional()
+});
+/**
+* A Google Cloud project, as `projects/{project}` accepts one: either the
+* project **ID** (`acme-prod`, 6–30 characters, what the console shows) or the
+* project **number** (all digits). Both are accepted because both work, and
+* the id is the one an operator can read off their own dashboard.
+*
+* Validated by shape for the reason Cloudflare's account id is: every Secret
+* Manager URL is built from this string, and a typo would otherwise surface as
+* a 403 from Google hours later inside an alarm, with nobody watching.
+*/
+const gcpProjectSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(value) || /^\d{1,20}$/.test(value), "must be a Google Cloud project ID (e.g. acme-prod) or project number");
+/**
+* Google Cloud project scope — which project's Secret Manager to write.
+*
+* The service account is *not* here, unlike AWS's access key id: a GCP
+* credential is a key JSON that names its own `client_email`, so the identity
+* arrives with the credential the way a Vercel token's does. What the
+* credential cannot say is which project to write, because a service account
+* can be granted access to secrets in projects other than its own — so that is
+* this field, exactly as Cloudflare's account id is.
+*
+* One project per connection. Syncing an environment into two projects means
+* two connections, which also keeps their key grants separate.
+*
+* Global secrets only: v1 addresses `secretmanager.googleapis.com`, not the
+* per-location `secretmanager.<location>.rep.googleapis.com` endpoints that
+* regional secrets live behind. Data residency is expressed instead through the
+* destination's user-managed replication.
+*/
+const gcpSecretManagerConnectionConfigSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	/** Project ID (`acme-prod`) or project number. */
+	projectId: gcpProjectSchema
+});
+const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
+	vercelConnectionConfigSchema,
+	cloudflareWorkersConnectionConfigSchema,
+	cloudflarePagesConnectionConfigSchema,
+	cloudflareSecretsStoreConnectionConfigSchema,
+	railwayConnectionConfigSchema,
+	awsSecretsManagerConnectionConfigSchema,
+	awsParameterStoreConnectionConfigSchema,
+	renderConnectionConfigSchema,
+	flyConnectionConfigSchema,
+	northflankConnectionConfigSchema,
+	digitalOceanConnectionConfigSchema,
+	herokuConnectionConfigSchema,
+	netlifyConnectionConfigSchema,
+	bunnyshellConnectionConfigSchema,
+	githubActionsConnectionConfigSchema,
+	gcpSecretManagerConnectionConfigSchema
+]);
 const vercelDestinationSchema = z.object({
 	provider: z.literal("vercel"),
 	/** Vercel project id (`prj_…`) or project name. */
@@ -1080,7 +1541,693 @@ const vercelDestinationSchema = z.object({
 	*/
 	gitBranch: z.string().trim().min(1).max(255).optional()
 });
-const syncDestinationSchema = z.discriminatedUnion("provider", [vercelDestinationSchema]);
+/**
+* The Worker whose secrets a binding owns. Wrangler *environments* are not a
+* separate field because they are not a separate concept at the API: deploying
+* `my-api` with `--env staging` creates a Worker literally named
+* `my-api-staging`, so pointing at an environment means naming that script.
+*/
+const cloudflareWorkersDestinationSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	/** Worker script name, as shown in the dashboard (`my-api`). */
+	scriptName: z.string().trim().min(1).max(63).regex(/^[A-Za-z0-9_][A-Za-z0-9_-]*$/, "must be a Worker script name")
+});
+const cloudflarePagesDestinationSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	/** Pages project name (`my-site`) — Pages has no separate project id. */
+	projectName: z.string().trim().min(1).max(58).regex(/^[A-Za-z0-9][A-Za-z0-9-]*$/, "must be a Pages project name"),
+	/** Which deployment configs receive these values. At least one. */
+	environments: z.array(z.enum(["production", "preview"])).min(1)
+});
+const cloudflareSecretsStoreDestinationSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	/** Store id (32 hex). An account has exactly one store today. */
+	storeId: z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Secrets Store ID (lowercase hex)"),
+	/** Scopes applied to secrets this binding creates. At least one. */
+	scopes: z.array(z.enum([
+		"workers",
+		"ai_gateway",
+		"dex",
+		"access",
+		"containers",
+		"websearch"
+	])).min(1)
+});
+/**
+* Where inside Railway a binding writes.
+*
+* Railway variables are addressed by (project, environment, service) — the
+* environment here is *Railway's* (`production`, `pr-42`), not the seekrit
+* environment the binding reads from; a binding is precisely the mapping
+* between the two.
+*
+* Omitting `serviceId` targets the project's **shared** variables for that
+* environment, which services opt into with `${{shared.NAME}}`. That is a
+* genuinely different destination from any one service's variables, so it is an
+* absent field rather than a sentinel.
+*/
+const railwayDestinationSchema = z.object({
+	provider: z.literal("railway"),
+	/** Railway project id (a UUID, from the project's Settings page or URL). */
+	projectId: railwayIdSchema,
+	/** Railway environment id (a UUID) — the deployment environment to write. */
+	environmentId: railwayIdSchema,
+	/** Service to write. Omit to write the environment's shared variables. */
+	serviceId: railwayIdSchema.optional(),
+	/**
+	* Suppress the redeploy Railway triggers when a variable changes.
+	*
+	* Left off (the default), a sync that changes a value redeploys the service,
+	* which is what makes the new value actually reach the running process —
+	* Railway applies variables at deploy time. Turn it on when deploys are
+	* gated behind a release process and a secrets push must not start one; the
+	* values then sit staged until the next deploy.
+	*/
+	skipDeploys: z.boolean().optional()
+});
+/**
+* A customer-managed KMS key to encrypt with, as a key id, ARN, or alias
+* (`alias/seekrit`). Omitted means the AWS-managed default for that service
+* (`aws/secretsmanager`, `aws/ssm`), which is what most accounts want.
+*
+* Deliberately loose: a KMS key can be named five different ways, half of them
+* cross-account ARNs, and rejecting a valid one here would be worse than
+* letting KMS give its own (very clear) error.
+*/
+const awsKmsKeyIdSchema = z.string().trim().min(1).max(2048);
+/**
+* Where in Secrets Manager a binding writes.
+*
+* `pathPrefix` exists rather than reusing {@link NameTransform}'s `prefix`
+* because the two answer different questions: a name transform produces a
+* *variable name* (`[A-Za-z0-9_]`, no slashes), while this produces a
+* *namespace* — `prod/storefront/` — and slashes are the whole point of it.
+*/
+const awsSecretsManagerDestinationSchema = z.object({
+	provider: z.literal("aws-secrets-manager"),
+	layout: z.enum(["secret-per-name", "json-bundle"]).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret's name, e.g.
+	* `prod/storefront/`. Optional, but strongly advised in an account that
+	* holds anything else — without it a binding writes at the root of a
+	* namespace it does not own.
+	*/
+	pathPrefix: z.string().trim().max(400).regex(/^[A-Za-z0-9/_+=.@-]*$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod/storefront/env`. */
+	secretName: z.string().trim().min(1).max(512).regex(/^[A-Za-z0-9/_+=.@-]+$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	kmsKeyId: awsKmsKeyIdSchema.optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretName !== void 0, {
+	message: "a json-bundle destination needs the name of the secret to write",
+	path: ["secretName"]
+});
+/**
+* The Parameter Store hierarchy a binding owns, e.g. `/prod/storefront/`.
+*
+* A path rather than a free-form prefix because that is what the API is built
+* around: `GetParametersByPath` is how an application reads a whole
+* environment in one call, and it only works on `/`-delimited names. Leading
+* and trailing slashes are required so the binding's names concatenate
+* unambiguously — `/prod/storefront/` + `DB_URL`.
+*/
+const awsParameterStoreDestinationSchema = z.object({
+	provider: z.literal("aws-parameter-store"),
+	/** Must start and end with `/`. `aws`/`ssm` are reserved by AWS as the first segment. */
+	path: z.string().trim().max(1011).regex(/^\/([A-Za-z0-9_.-]+\/)*$/, "must be a parameter path like /prod/storefront/"),
+	type: z.enum(["SecureString", "String"]).default("SecureString"),
+	/**
+	* Standard caps a value at 4KB and costs nothing; Advanced raises that to 8KB
+	* and is billed per parameter per month. `Intelligent-Tiering` lets AWS pick,
+	* upgrading only the parameters that need it.
+	*/
+	tier: z.enum([
+		"Standard",
+		"Advanced",
+		"Intelligent-Tiering"
+	]).default("Standard"),
+	kmsKeyId: awsKmsKeyIdSchema.optional()
+});
+/**
+* Render resource ids are `<prefix>-<slug>`, and the two prefixes below are the
+* documented ones: `srv-` for every service type, `crn-` for cron jobs, `evg-`
+* for an environment group.
+*
+* The patterns reject the *other* kind's prefix rather than requiring their own.
+* The mistake worth catching is pasting an env-group id into the service field
+* (or the reverse) — which is otherwise a 404 hours later inside an alarm, with
+* nobody watching. Requiring the positive prefix would also reject a valid id
+* the day Render introduces a new resource prefix, which is not our call to
+* make.
+*/
+const renderServiceIdSchema = z.string().trim().regex(/^(?!evg-)[A-Za-z0-9_-]{1,64}$/, "must be a Render service ID (`srv-…` or `crn-…`), not an environment group");
+const renderEnvGroupIdSchema = z.string().trim().regex(/^(?!srv-|crn-)[A-Za-z0-9_-]{1,64}$/, "must be a Render environment group ID (`evg-…`), not a service");
+/** Environment variables set directly on one service. */
+const renderServiceDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("service"),
+	/** Service id (`srv-…`, or `crn-…` for a cron job), from its dashboard URL. */
+	serviceId: renderServiceIdSchema
+});
+/**
+* Environment variables in a shared environment group. Every service linked to
+* the group sees them, which is the point — and the reason a group binding is
+* worth thinking about twice: its blast radius is the link list, not one
+* service.
+*/
+const renderEnvGroupDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("env-group"),
+	/** Environment group id (`evg-…`), from its dashboard URL. */
+	envGroupId: renderEnvGroupIdSchema
+});
+const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
+/**
+* The Fly app whose secret set a binding owns.
+*
+* A Fly app has **one** secret set, shared by every Machine in every region —
+* there is no per-target split to state, the way Vercel and Pages have one.
+* Fly's convention is that staging and production are separate *apps*
+* (`storefront`, `storefront-staging`), so pointing at an environment means
+* naming that app, exactly as a Wrangler environment means naming its own
+* Worker.
+*
+* Values land **staged**: Fly injects secrets when a Machine boots, so already
+* running Machines keep what they started with until the app is deployed or its
+* Machines are updated (`fly secrets deploy -a <app>`), while Machines created
+* after the push get them straight away. The connector deliberately restarts
+* nothing — see the note in `apps/api/src/lib/sync/connectors/fly.ts`.
+*/
+const flyDestinationSchema = z.object({
+	provider: z.literal("fly"),
+	/** Fly app name, as `fly apps list` prints it. */
+	appName: z.string().trim().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*$/, "must be a Fly app name (lowercase letters, numbers, and dashes)")
+});
+/**
+* Where inside Northflank a binding writes: one **secret group** in one
+* project.
+*
+* A secret group is Northflank's unit of injection — services and jobs in the
+* project inherit its variables, subject to the group's own restrictions and
+* priority. Those settings belong to the operator, not to seekrit: a binding
+* names an existing group and only ever writes its `variables` map, so
+* restrictions, priority, secret type, and any secret *files* stay as they were
+* configured.
+*
+* There is no environment field. Northflank has no per-group environment axis —
+* separate environments are separate projects (or separate groups restricted to
+* a stage), so the binding's seekrit environment maps to a group, one to one.
+*/
+const northflankDestinationSchema = z.object({
+	provider: z.literal("northflank"),
+	/** Project id — the slug in the project URL (`default-project`). */
+	projectId: northflankIdSchema,
+	/** Secret group id — the slug in the group's URL (`example-secret-group`). */
+	secretGroupId: northflankIdSchema
+});
+/**
+* When App Platform makes a variable visible. DigitalOcean's enum also has
+* `UNSET`, which is not offered: it means "no scope stated", and a secrets
+* manager that writes a value should say when that value applies.
+*
+* The default here is `RUN_TIME` rather than DigitalOcean's own
+* `RUN_AND_BUILD_TIME`, and the difference is deliberate. A build-time variable
+* is visible to every build command, every buildpack, and anything they print;
+* a secret only the running process needs has no business being there. Binding
+* a value a build genuinely needs — a private registry token, a sourcemap
+* upload key — is a decision worth making explicitly.
+*/
+const DIGITALOCEAN_ENV_SCOPES = [
+	"RUN_TIME",
+	"BUILD_TIME",
+	"RUN_AND_BUILD_TIME"
+];
+/**
+* A DigitalOcean app id — the UUID in the app's dashboard URL
+* (`cloud.digitalocean.com/apps/<id>`), and what `doctl apps list` prints.
+*
+* DigitalOcean's own spec types this as a bare string, but every app id it
+* issues is a UUID, and the slip worth catching is the one the API cannot tell
+* from a typo: pasting the app's *name* (`storefront`), which `GET /v2/apps/{id}`
+* answers with a flat 404 hours later inside an alarm, with nobody watching.
+*/
+const digitalOceanAppIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a DigitalOcean app ID (the UUID in the app's URL), not its name");
+/**
+* A component name, matching App Platform's own pattern for one. Names are
+* unique within an app, which is what makes a name — rather than an index into
+* `services` — the stable way to address a component's variables.
+*/
+const digitalOceanComponentNameSchema = z.string().trim().regex(/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/, "must be an App Platform component name (lowercase letters, numbers, and dashes)");
+/**
+* Where inside a DigitalOcean app a binding writes.
+*
+* ## A push is a deployment
+*
+* App Platform has no per-variable endpoint. Environment variables live in the
+* app spec, and the only way to change one is to submit a new spec — which
+* starts a **new deployment** of the app. That is not a side effect this
+* connector chose and there is no flag to suppress it; it is what "set an
+* environment variable" means on this platform, in the control panel and in
+* `doctl` alike.
+*
+* The deployment reuses each component's current source (seekrit never sends
+* `update_all_source_versions`), so it redeploys the code already running
+* rather than pulling a newer commit or image. It is still a real deployment:
+* a build, a health check, and a rollout. Bind an environment here knowing that
+* changing a secret in it will roll the app.
+*
+* ## Values are written encrypted
+*
+* Everything seekrit writes goes in as `type: SECRET`, so App Platform encrypts
+* it at rest and hands it back as an opaque `EV[1:…]` blob rather than as
+* plaintext. That is also why this connector cannot tell whether a value it is
+* about to write is already there — see
+* `apps/api/src/lib/sync/connectors/digitalocean.ts`.
+*/
+const digitalOceanAppDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("app"),
+	/** App id — the UUID in `cloud.digitalocean.com/apps/<id>`. */
+	appId: digitalOceanAppIdSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+/**
+* One component's own environment variables. Narrower than the app-level list:
+* only this service, worker, job, static site, or function sees them, and a key
+* here wins over the same key at app level.
+*/
+const digitalOceanComponentDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("component"),
+	appId: digitalOceanAppIdSchema,
+	/** Component name, as it appears in the app spec — not its type. */
+	componentName: digitalOceanComponentNameSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+const digitalOceanDestinationSchema = z.discriminatedUnion("kind", [digitalOceanAppDestinationSchema, digitalOceanComponentDestinationSchema]);
+/**
+* A Heroku app, named the way `/apps/{app_id_or_name}` names one: either the
+* app name or its UUID id. Both are accepted because both work, and the id is
+* the durable one — renaming an app in the dashboard breaks a binding that
+* holds its name, and does not break one that holds its id.
+*
+* The name pattern is Heroku's own (`^[a-z][a-z0-9-]{1,28}[a-z0-9]$`): 3–30
+* characters, starting with a letter and ending alphanumeric. Checking it here
+* turns the habitual slip — pasting `example.herokuapp.com`, or a name with
+* capitals — into a message at the form rather than a bare 404 from an alarm
+* with nobody watching.
+*/
+const herokuAppSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(value) || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value), "must be a Heroku app name (lowercase letters, numbers, and dashes) or its UUID");
+/**
+* The Heroku app whose config vars a binding owns.
+*
+* A Heroku app has **one** set of config vars, shared by every dyno and every
+* process type — there is no per-target split to state the way Vercel and Pages
+* have one. Heroku's convention is that staging and production are separate
+* *apps* (`storefront`, `storefront-staging`), so pointing at an environment
+* means naming that app, exactly as it does on Fly.
+*
+* Unlike Fly, values take effect **immediately**: setting config vars cuts a new
+* release and restarts the app's dynos, which is why a run sends exactly one
+* request — see the note in `apps/api/src/lib/sync/connectors/heroku.ts`.
+*/
+const herokuDestinationSchema = z.object({
+	provider: z.literal("heroku"),
+	/** App name as `heroku apps` prints it, or the app's UUID. */
+	app: herokuAppSchema
+});
+/**
+* The deploy contexts a Netlify value can be set for.
+*
+* These are Netlify's own, minus two. `all` is missing deliberately: Netlify
+* requires a **secret** value to be set against explicit contexts, and its
+* `setEnvVarValue` endpoint is reported to fail outright on `context: "all"` —
+* so the union offers only contexts that work under both. Naming the contexts
+* you mean is what you want here anyway; a binding already exists to map one
+* seekrit environment onto one deploy context. `dev-server` (Preview Server) is
+* left out for want of anyone asking.
+*
+* `branch` is the odd one: it needs a branch name alongside it, which the
+* destination carries as {@link netlifyDestinationSchema}'s `branch`.
+*/
+const NETLIFY_CONTEXTS = [
+	"production",
+	"deploy-preview",
+	"branch-deploy",
+	"branch",
+	"dev"
+];
+/**
+* A Netlify site, by its **API ID** — the UUID under Project configuration →
+* General → Project information.
+*
+* Netlify accepts a site's domain in place of its id where a site appears in a
+* *path* (`/sites/{site_id}`), but the environment variable endpoints take the
+* site as a `?site_id=` **query parameter** instead, and Netlify documents no
+* name resolution there. That asymmetry is why this is strict where the Heroku
+* and Fly destinations are permissive: a `site_id` Netlify does not resolve
+* does not 404 — the write lands on the *team*, as a shared variable inherited
+* by every site in it. Refusing anything but the UUID keeps a slip from turning
+* into a much wider blast radius than the operator asked for.
+*/
+const netlifySiteIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be the site's API ID (a UUID), not its name or URL");
+/**
+* The Netlify site, and which of its deploy contexts a binding owns.
+*
+* Netlify keys a value by (site, context), so the destination is that pair.
+* Contexts are a list rather than a single value for the same reason Vercel's
+* `targets` is one: a binding is unique per (connection, environment), so an
+* environment that feeds both production and deploy previews has to say so in
+* one destination or not at all.
+*
+* A push writes **only** the contexts listed here. Other contexts of the same
+* variable — and every variable this binding does not manage — are left as they
+* are, which is what makes it safe to point at a site that already has
+* variables set by hand.
+*
+* `secret` marks what seekrit creates as a Netlify **secret**: write-only, and
+* unreadable afterwards through the UI, CLI, and API. On by default, since that
+* is the whole point of pushing from a secrets manager. It applies only to
+* variables seekrit *creates* — Netlify will not let a flag be added to an
+* existing variable, or removed from one ever — and it needs a plan that
+* includes Secrets Controller.
+*/
+const netlifyDestinationSchema = z.object({
+	provider: z.literal("netlify"),
+	/** Site API ID (a UUID), from Project configuration → General. */
+	siteId: netlifySiteIdSchema,
+	/** Which deploy contexts receive these values. At least one. */
+	contexts: z.array(z.enum(NETLIFY_CONTEXTS)).min(1),
+	/** Branch name, required when `contexts` includes `branch`; ignored otherwise. */
+	branch: z.string().trim().min(1).max(255).optional(),
+	/** Create variables as Netlify secrets (default true). */
+	secret: z.boolean().optional()
+}).refine((d) => !d.contexts.includes("branch") || d.branch !== void 0, {
+	message: "a branch context needs the branch name it applies to",
+	path: ["branch"]
+});
+/**
+* A Bunnyshell resource id, as the platform hands it out.
+*
+* Deliberately loose. Bunnyshell documents no format for these — they are
+* opaque strings from `bns environments list` or the dashboard URL — so
+* asserting a shape here would be inventing a rule the platform never stated,
+* and the failure mode would be seekrit refusing an id that works.
+*
+* Being loose is affordable here in a way it is not on Netlify, where an
+* unresolved `site_id` silently widens a write to the whole team. Both
+* Bunnyshell variable collections name their parent in the **request body** of
+* a create, as a required relation: an id the platform cannot resolve is a 422
+* naming the field, not a write that lands somewhere broader. The listing side
+* is fenced separately — the connector re-checks every variable's own parent
+* before it touches it, so a filter that failed to bite cannot turn into an
+* edit of a neighbouring environment's variables.
+*/
+const bunnyshellIdSchema = z.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Bunnyshell ID — no slashes or spaces");
+/**
+* Variables on one Bunnyshell **environment** — the set every component in it
+* inherits, and the closest match to a seekrit environment.
+*
+* This is the destination for an environment that already exists and stays
+* around: a primary environment, or a long-lived ephemeral one.
+*/
+const bunnyshellEnvironmentDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("environment"),
+	/** Environment ID, as `bns environments list` prints it. */
+	environmentId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Variables on a Bunnyshell **project** — inherited by every environment
+* created in it from then on.
+*
+* Worth thinking about twice, for the reason a Render environment group is:
+* the blast radius is the project, not one environment. It earns its place
+* anyway, because it is the only destination that reaches an environment which
+* *does not exist yet*. Bunnyshell's whole shape is ephemeral environments spun
+* up per branch or per pull request; pushing to the environment cannot seed one
+* that a webhook will create tomorrow, and pushing to the project can.
+*
+* An environment inherits the project's value at creation and may then be
+* overridden at its own scope — so a project binding does not fight an
+* environment binding pointed at the same name, it loses to it.
+*/
+const bunnyshellProjectDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("project"),
+	/** Project ID, as `bns projects list` prints it. */
+	projectId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Where in Bunnyshell a binding writes.
+*
+* Split on `kind` rather than into two providers — the way Render's service and
+* environment group are, and unlike Cloudflare's three — because the two are the
+* same API twice over: `/v1/environment_variables` and `/v1/project_variables`
+* take the same fields, fail the same ways, and differ only in which parent they
+* name. One connector serves both, so one provider does too.
+*
+* `secret` is Bunnyshell's `isSecret`, and means less than Netlify's flag of the
+* same name: Bunnyshell encrypts every variable with an organization key whether
+* or not the flag is set, so this only decides whether the value is obscured in
+* the dashboard and stored encrypted in an exported definition. It is on by
+* default all the same — a value pushed from a secrets manager should not be
+* sitting in plain view of everyone with project access. It applies only to
+* variables seekrit **creates**: an update never sends the flag, so a variable
+* an operator deliberately un-secreted stays that way.
+*/
+const bunnyshellDestinationSchema = z.discriminatedUnion("kind", [bunnyshellEnvironmentDestinationSchema, bunnyshellProjectDestinationSchema]);
+/**
+* Which repositories in an organization can read an org-level secret.
+*
+* GitHub's own enum, unchanged. There is deliberately **no default**: `all` hands
+* the value to every repository in the organization — including ones added
+* tomorrow, and including forks' workflows to the extent the org allows them —
+* and that is not a blast radius a secrets manager should pick on an operator's
+* behalf. Naming it is the point.
+*/
+const GITHUB_ACTIONS_VISIBILITIES = [
+	"all",
+	"private",
+	"selected"
+];
+/**
+* A GitHub account or organization login, matching GitHub's own rule:
+* alphanumeric with single internal hyphens, 39 characters at most.
+*
+* Checked here so the habitual slip — pasting a URL, or `owner/repo` into the
+* owner field — fails at the form rather than as a 404 from an alarm with nobody
+* watching.
+*/
+const githubOwnerSchema = z.string().trim().min(1).max(39).regex(/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/, "must be a GitHub user or organization login — not a URL or an owner/repo pair");
+/**
+* A repository name. GitHub's rules are looser than an owner's: letters,
+* numbers, hyphens, underscores, and periods, up to 100 characters. `.` and `..`
+* are refused outright — they would traverse the API path rather than name a
+* repository.
+*/
+const githubRepoSchema = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "must be a repository name alone (`api`), not `owner/repo` or a URL").refine((value) => value !== "." && value !== "..", "is not a repository name");
+/**
+* A deployment environment name.
+*
+* Deliberately permissive: GitHub allows spaces and most punctuation here, and
+* the dashboard shows names like `prod (eu-west)`. Only the two things that would
+* break the request are refused — an empty name, and the path separators that
+* would let a name escape its URL segment. Everything else is GitHub's to reject.
+*/
+const githubEnvironmentSchema = z.string().trim().min(1).max(255).refine((value) => !value.includes("/") && !value.includes("\\"), "cannot contain a slash — that is a path separator, not part of an environment name");
+/**
+* One repository's Actions secrets.
+*
+* Every workflow in the repository can read these, including one added by a pull
+* request from a collaborator with write access. That is GitHub's model, not a
+* choice this connector makes — but it is the reason `environment` exists below,
+* and the reason to prefer it for anything that touches production.
+*/
+const githubActionsRepoDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("repo"),
+	/** Repository owner — a user or organization login. */
+	owner: githubOwnerSchema,
+	/** Repository name, without the owner. */
+	repo: githubRepoSchema
+});
+/**
+* One deployment environment's Actions secrets — the narrowest scope GitHub has.
+*
+* A job reads these only by declaring `environment: <name>`, which also subjects
+* it to that environment's protection rules: required reviewers, wait timers, and
+* the branch policy. That combination is the closest GitHub gets to "this secret
+* is for production, and reaching it requires approval", and it is the scope to
+* reach for by default.
+*
+* The environment must already exist. This connector will not create one: an
+* environment is a deployment gate, and silently creating an unprotected one
+* because a name was misspelled would quietly remove the protection the operator
+* was relying on.
+*/
+const githubActionsEnvironmentDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("environment"),
+	owner: githubOwnerSchema,
+	repo: githubRepoSchema,
+	/** Environment name, exactly as the repository's Settings → Environments shows it. */
+	environment: githubEnvironmentSchema
+});
+/**
+* An organization's Actions secrets.
+*
+* The widest scope in the product, and the only destination on any provider that
+* can hand a value to repositories nobody named. Read {@link
+* GITHUB_ACTIONS_VISIBILITIES} before using it.
+*
+* `selectedRepositoryIds` takes numeric repository **ids**, not names, because
+* that is what GitHub's API takes. An id is visible at
+* `GET /repos/{owner}/{repo}` as `id`, and in the dashboard nowhere at all —
+* which is friction worth accepting rather than resolving names to ids here: name
+* resolution would mean this connector picking which repository an ambiguous
+* name meant, and getting that wrong widens a secret's reach silently.
+*/
+const githubActionsOrgDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("org"),
+	/** Organization login. */
+	org: githubOwnerSchema,
+	/** Which repositories may read these secrets. Stated, never defaulted. */
+	visibility: z.enum(GITHUB_ACTIONS_VISIBILITIES),
+	/** Numeric repository ids, required when `visibility` is `selected`. */
+	selectedRepositoryIds: z.array(z.number().int().positive()).max(500).optional()
+}).refine((dest) => dest.visibility !== "selected" || dest.selectedRepositoryIds !== void 0 && dest.selectedRepositoryIds.length > 0, {
+	message: "selected visibility needs at least one repository id",
+	path: ["selectedRepositoryIds"]
+}).refine((dest) => dest.visibility === "selected" || dest.selectedRepositoryIds === void 0, {
+	message: "repository ids only apply to selected visibility — remove them, or select it",
+	path: ["selectedRepositoryIds"]
+});
+const githubActionsDestinationSchema = z.discriminatedUnion("kind", [
+	githubActionsRepoDestinationSchema,
+	githubActionsEnvironmentDestinationSchema,
+	githubActionsOrgDestinationSchema
+]);
+/**
+* How a binding lays its secrets out in Secret Manager. The same two shapes the
+* AWS Secrets Manager destination offers, and for the same reasons:
+*
+* - `secret-per-name` — one GCP secret per seekrit secret. The direct
+*   translation, and what Cloud Run's `--set-secrets` and GKE's Secret Manager
+*   CSI driver mount one at a time.
+* - `json-bundle` — every value as one JSON object in a single secret. Costs one
+*   active version instead of fifty, which is the whole billing unit here.
+*/
+const GCP_SECRET_MANAGER_LAYOUTS = ["secret-per-name", "json-bundle"];
+/**
+* Where Google keeps the copies of a secret. Chosen at creation and
+* **immutable** afterwards — changing it means deleting the secret and letting
+* the next run recreate it.
+*
+* - `automatic` — Google picks the locations. One billable replica, and what
+*   you want unless a policy says otherwise.
+* - `user-managed` — the binding names the regions. This is how data residency
+*   is expressed for global secrets, and each region is billed as its own
+*   active version.
+*/
+const GCP_REPLICATION_POLICIES = ["automatic", "user-managed"];
+/**
+* A Secret Manager secret ID. Google's own rule, quoted from the API reference:
+* "a string with a maximum length of 255 characters and can contain uppercase
+* and lowercase letters, numerals, and the hyphen (`-`) and underscore (`_`)
+* characters."
+*
+* Notably **no slashes and no dots**, which is what makes this a different
+* field from AWS's `pathPrefix` rather than the same idea renamed: a Secret
+* Manager namespace is spelled `prod-storefront-DB_URL`, not
+* `prod/storefront/DB_URL`.
+*/
+const gcpSecretIdSchema = z.string().trim().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/, "may contain letters, digits, hyphens, and underscores");
+/**
+* A GCP region for a user-managed replica (`us-east1`, `europe-west4`,
+* `northamerica-northeast1`). Validated by shape rather than against a list,
+* because Google adds regions faster than we ship — a name Secret Manager does
+* not know is refused by Google with a clear message at creation.
+*/
+const gcpLocationSchema = z.string().trim().regex(/^[a-z]+-[a-z]+\d+$/, "must be a GCP region ID, e.g. us-east1");
+/**
+* A Cloud KMS key, as its full resource name — the only form the API accepts:
+* `projects/p/locations/l/keyRings/r/cryptoKeys/k`.
+*
+* Stricter than AWS's `kmsKeyId` (which tolerates five spellings) because
+* Google tolerates exactly one, and because a key in the wrong *location* is
+* rejected at creation: an automatic-replication secret needs a `global` key,
+* and a user-managed replica needs one in its own region.
+*/
+const gcpKmsKeyNameSchema = z.string().trim().max(1024).regex(/^projects\/[^/]+\/locations\/[^/]+\/keyRings\/[^/]+\/cryptoKeys\/[^/]+$/, "must be a full Cloud KMS key name (projects/…/locations/…/keyRings/…/cryptoKeys/…)");
+/**
+* Where inside a project's Secret Manager a binding writes.
+*
+* ## Every push would otherwise cost a version
+*
+* Secret Manager has no "set the value" call — only `addVersion`, which appends.
+* A run pushes the whole environment (never a diff), so changing one secret in
+* an environment of fifty would leave fifty new versions behind, forty-nine of
+* them identical to their predecessors, each one billed for as long as it stays
+* active.
+*
+* So this connector writes a version only when the value actually changed,
+* decided from a keyed digest it keeps in the secret's own **annotations** — see
+* `apps/api/src/lib/sync/connectors/gcp-secret-manager.ts` for why it is keyed
+* and what that costs. `pruneVersions` is the other half of the bill: with it
+* on, the version a push supersedes is destroyed as soon as the new one lands,
+* so a secret keeps exactly one active version.
+*/
+const gcpSecretManagerDestinationSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	layout: z.enum(GCP_SECRET_MANAGER_LAYOUTS).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret ID, e.g.
+	* `prod-storefront-`. Optional, but strongly advised in a project that holds
+	* anything else — without it a binding writes at the root of a namespace it
+	* does not own, and Secret Manager has no folders to hide behind.
+	*/
+	idPrefix: z.string().trim().max(200).regex(/^[A-Za-z0-9_-]*$/, "may contain letters, digits, hyphens, and underscores").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod-storefront-env`. */
+	secretId: gcpSecretIdSchema.optional(),
+	replication: z.enum(GCP_REPLICATION_POLICIES).default("automatic"),
+	/** `user-managed` only: the regions to replicate to. At least one. */
+	locations: z.array(gcpLocationSchema).min(1).max(16).optional(),
+	/** Customer-managed encryption key. Omitted means Google-managed keys. */
+	kmsKeyName: gcpKmsKeyNameSchema.optional(),
+	/** Destroy the version each push supersedes, keeping one active version. */
+	pruneVersions: z.boolean().optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretId !== void 0, {
+	message: "a json-bundle destination needs the ID of the secret to write",
+	path: ["secretId"]
+}).refine((d) => d.replication !== "user-managed" || (d.locations?.length ?? 0) > 0, {
+	message: "user-managed replication needs at least one location",
+	path: ["locations"]
+}).refine((d) => d.kmsKeyName === void 0 || d.replication === "automatic" || (d.locations?.length ?? 0) === 1, {
+	message: "a customer-managed key covers one location — use automatic replication, or a single location",
+	path: ["kmsKeyName"]
+});
+const syncDestinationSchema = z.discriminatedUnion("provider", [
+	vercelDestinationSchema,
+	cloudflareWorkersDestinationSchema,
+	cloudflarePagesDestinationSchema,
+	cloudflareSecretsStoreDestinationSchema,
+	railwayDestinationSchema,
+	awsSecretsManagerDestinationSchema,
+	awsParameterStoreDestinationSchema,
+	renderDestinationSchema,
+	flyDestinationSchema,
+	northflankDestinationSchema,
+	digitalOceanDestinationSchema,
+	herokuDestinationSchema,
+	netlifyDestinationSchema,
+	bunnyshellDestinationSchema,
+	githubActionsDestinationSchema,
+	gcpSecretManagerDestinationSchema
+]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
 * explicit `rename` (wins outright), then `prefix`/`suffix`, then `case`.
@@ -1458,6 +2605,43 @@ async function generateDataKey(material, ref) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/random.ts
+const ALPHABETS = {
+	alphanumeric: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+	hex: "0123456789abcdef",
+	base64url: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_",
+	/**
+	* Alphanumerics plus punctuation chosen to survive being pasted anywhere a
+	* secret goes: no quote of either kind, no backslash, backtick, `$`, or
+	* whitespace, so the value can't break out of a shell word, a SQL literal, a
+	* URL component, or a `.env` line.
+	*/
+	printable: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-._~!*+="
+};
+/**
+* A cryptographically random string of `length` characters drawn uniformly from
+* `alphabet` (default `alphanumeric`, ≈5.95 bits/char — 32 chars ≈ 190 bits).
+*
+* Uses rejection sampling: bytes at or above the largest multiple of the
+* alphabet size are discarded rather than folded, so `% n` introduces no modulo
+* bias toward the low end of the alphabet.
+*/
+function generateSecretValue(length, alphabet = "alphanumeric") {
+	if (!Number.isInteger(length) || length < 1) throw new RangeError("length must be a positive integer");
+	const chars = ALPHABETS[alphabet];
+	const n = chars.length;
+	const limit = 256 - 256 % n;
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < limit) out += chars[byte % n];
+			if (out.length === length) break;
+		}
+	}
+	return out;
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -1487,7 +2671,6 @@ async function generateDataKey(material, ref) {
 * SCRAM helper does, with no hand-rolled hash primitive.
 */
 const DEFAULT_PASSWORD_LENGTH$1 = 32;
-const PASSWORD_ALPHABET$1 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function sha1(data) {
 	return new Uint8Array(await crypto.subtle.digest("SHA-1", data));
 }
@@ -1496,17 +2679,6 @@ function toUpperHex(bytes) {
 	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
 	return hex.toUpperCase();
 }
-function randomPassword$1(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET$1[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the `mysql_native_password` auth string `*<UPPER(HEX(SHA1(SHA1(pw))))>`
 * for a known password. Pass the result straight to
@@ -1520,7 +2692,7 @@ async function mysqlNativePasswordVerifier(password) {
 * — the client-side half of a Vault-style dynamic MySQL credential.
 */
 async function generateMysqlCredential(options = {}) {
-	const password = randomPassword$1(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH$1);
 	return {
 		password,
 		verifier: await mysqlNativePasswordVerifier(password)
@@ -1618,7 +2790,6 @@ const LOG = /* @__PURE__ */ new Uint8Array(256);
 }
 const SALT_LENGTH = 16;
 const DEFAULT_PASSWORD_LENGTH = 32;
-const PASSWORD_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 async function hmacSha256(key, message) {
 	const k = await crypto.subtle.importKey("raw", key, {
 		name: "HMAC",
@@ -1639,17 +2810,6 @@ async function saltPassword(password, salt, iterations) {
 	}, material, 256);
 	return new Uint8Array(bits);
 }
-function randomPassword(length) {
-	let out = "";
-	while (out.length < length) {
-		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
-		for (const byte of bytes) {
-			if (byte < 248) out += PASSWORD_ALPHABET[byte % 62];
-			if (out.length === length) break;
-		}
-	}
-	return out;
-}
 /**
 * Compute the `SCRAM-SHA-256$<i>:<salt>$<StoredKey>:<ServerKey>` verifier for a
 * known password. Pass the result straight to `CREATE ROLE … PASSWORD`.
@@ -1667,7 +2827,7 @@ async function scramSha256Verifier(password, options = {}) {
 * client-side half of a Vault-style dynamic Postgres credential.
 */
 async function generatePostgresCredential(options = {}) {
-	const password = randomPassword(options.length ?? DEFAULT_PASSWORD_LENGTH);
+	const password = generateSecretValue(options.length ?? DEFAULT_PASSWORD_LENGTH);
 	const iterations = options.iterations ?? 4096;
 	return {
 		password,
@@ -1796,7 +2956,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region ../cli/package.json
-var version$1 = "0.32.0";
+var version$1 = "0.42.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -2157,6 +3317,54 @@ var SeekritClient = class {
 	deleteToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}/permanent`);
 	}
+	listHoneyTokens(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/honey-tokens`);
+	}
+	createHoneyToken(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/honey-tokens`, input);
+	}
+	/** Delete a decoy outright — there is no access to revoke first. */
+	deleteHoneyToken(orgId, honeyTokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/honey-tokens/${honeyTokenId}`);
+	}
+	listAgents(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents`);
+	}
+	createAgent(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents`, input);
+	}
+	getAgent(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}`);
+	}
+	updateAgent(orgId, agentId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/agents/${agentId}`, input);
+	}
+	deleteAgent(orgId, agentId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/agents/${agentId}`);
+	}
+	/** Published versions, newest first. Append-only; nothing here is rewritten. */
+	listAgentPolicies(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/policies`);
+	}
+	/**
+	* Publish a bundle signed in the browser.
+	*
+	* The signing happens client-side (`signAgentPolicy` in `@seekrit/core`) with
+	* the publishing admin's own key, so the API receives an opaque envelope it
+	* cannot forge. A version mismatch answers `409`: the version is inside the
+	* signature, so a concurrent publish has to be re-signed, not patched.
+	*/
+	publishAgentPolicy(orgId, agentId, bundle) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents/${agentId}/policies`, { bundle });
+	}
+	/** Republish an earlier version's bundle as the newest version. */
+	rollbackAgentPolicy(orgId, agentId, version) {
+		return this.request("POST", `/v1/orgs/${orgId}/agents/${agentId}/policies/${version}/rollback`);
+	}
+	/** The caller's own signing thumbprint, for the trust-anchor snippet. */
+	getMyPolicySigner(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/signers/me`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -2267,6 +3475,39 @@ var SeekritClient = class {
 	revokeLease(orgId, leaseId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/leases/${leaseId}`);
 	}
+	/**
+	* The rotator public key (the broker DO's), plus the environments that have
+	* already granted it. Wrap an environment's DEK to this key client-side before
+	* configuring rotation — that wrap IS the grant, and the server can't make it.
+	*/
+	getRotatorKey(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation/rotator-key`);
+	}
+	listRotations(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation`);
+	}
+	getRotation(orgId, rotationId) {
+		return this.request("GET", `/v1/orgs/${orgId}/rotation/${rotationId}`);
+	}
+	/**
+	* Configure (or replace) a secret's rotation policy. `version` comes back only
+	* when `rotateNow` was set — a rotated secret's new version number, never its
+	* value.
+	*/
+	configureRotation(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/rotation`, input);
+	}
+	updateRotation(orgId, rotationId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/rotation/${rotationId}`, input);
+	}
+	/** Rotate now. Returns the new version — the value stays where it belongs. */
+	rotateSecretNow(orgId, rotationId) {
+		return this.request("POST", `/v1/orgs/${orgId}/rotation/${rotationId}/rotate`);
+	}
+	/** Disable rotation. `rotatorRevoked` reports whether the broker's key grant went too. */
+	disableRotation(orgId, rotationId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/rotation/${rotationId}`);
+	}
 	listAudit(orgId, query = {}) {
 		const params = new URLSearchParams();
 		if (query.cursor) params.set("cursor", query.cursor);
@@ -2323,6 +3564,19 @@ var SeekritClient = class {
 	cancelSubscription(orgId) {
 		return this.request("POST", `/v1/orgs/${orgId}/billing/cancel`);
 	}
+	/**
+	* Redeem a promo code, comping the org onto the plan the code grants.
+	* Admin-only. Casing, spaces, and dashes are normalized server-side, so pass
+	* the code as the user typed it. Returns the refreshed billing view.
+	*
+	* Every invalid code fails the same way regardless of why (unknown, expired,
+	* fully redeemed, already used by this org) — the API deliberately won't
+	* confirm that a code exists. Show the returned message as-is rather than
+	* guessing at a more specific one.
+	*/
+	redeemPromoCode(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/billing/promo`, input);
+	}
 };
 //#endregion
 //#region ../cli/src/io.ts
@@ -3891,7 +5145,7 @@ async function runMcpServer(options = {}) {
 * `seekrit mcp`. tsdown bundles the shared server source in at build time, so the
 * published package is self-contained and needs no `@seekrit/cli` install.
 */
-runMcpServer({ version: "0.6.1" }).catch((err) => {
+runMcpServer({ version: "0.7.0" }).catch((err) => {
 	const message = err instanceof Error ? err.message : String(err);
 	process.stderr.write(`seekrit-mcp: fatal: ${message}\n`);
 	process.exit(1);