@seekrit/mcp 0.7.0 → 0.8.0

package/dist/index.js

@@ -45,6 +45,192 @@ z.object({
 	path: z.string().trim().min(1).max(2048),
 	secret: policySecretNameSchema.optional()
 });
+/** One aggregated cell: a dimension tuple and how many times it happened. */
+const activityEntrySchema = z.object({
+	host: policyHostSchema,
+	method: policyMethodSchema,
+	decision: z.enum([
+		"allow",
+		"no_rule",
+		"method_not_allowed",
+		"path_not_allowed",
+		"secret_not_allowed",
+		"unknown_secret",
+		"ratchet_withdrawn",
+		"policy_unavailable"
+	]),
+	/**
+	* Which published rule decided, when one did. Null for refusals that never
+	* reached a rule (`no_rule`, `policy_unavailable`) — the distinction matters to
+	* a review, because "rule 3 refused this" and "nothing covered this" call for
+	* opposite changes.
+	*/
+	ruleIndex: z.number().int().min(0).max(255).nullable(),
+	count: z.number().int().min(1).max(1e6),
+	/**
+	* Secret names actually injected, name → count. Only meaningful on `allow`.
+	* This is what lets a review say "rule 2 permits three secrets and the agent
+	* has only ever used one" — the most useful narrowing there is, and impossible
+	* to see from policy alone.
+	*/
+	secrets: z.record(policySecretNameSchema, z.number().int().min(1)).optional()
+});
+z.object({
+	/** Start of the window these counts cover (ISO 8601). */
+	windowStart: z.string().trim().min(20).max(40),
+	/** Policy version in force while they were collected, for the ledger. */
+	policyVersion: z.number().int().min(0).optional(),
+	/**
+	* Capped so one report cannot be unbounded work. A proxy with more distinct
+	* cells than this in a window has a policy far broader than a review can help
+	* with, and truncating loudly beats accepting anything.
+	*/
+	entries: z.array(activityEntrySchema).min(1).max(500)
+});
+/**
+* Twelve hours, matching `[control] max_ttl` in a proxy config. A task is meant
+* to bound one run; something that needs longer wants a policy change, not a
+* longer ticket.
+*/
+const TASK_MAX_TTL_SECONDS = 720 * 60;
+/** An EC P-256 public JWK, for a sender-constraint proof key. */
+const taskProofJwkSchema = z.object({
+	kty: z.literal("EC"),
+	crv: z.literal("P-256"),
+	x: z.string().min(1).max(128),
+	y: z.string().min(1).max(128)
+});
+z.object({
+	/**
+	* The public `skd_…` segment of the minted token. Sent because the API never
+	* sees the token at dispatch and still needs a readable handle for the audit
+	* row and for a revoke to name — the id half of a credential, without the
+	* secret half.
+	*/
+	taskRef: z.string().trim().regex(/^skd_[0-9A-Za-z]+$/, "taskRef must be the skd_… segment of the minted token"),
+	/**
+	* SHA-256 (base64url) of the token the dispatcher minted. The token itself
+	* never reaches this API on the dispatch path — only on introspection, where
+	* it is hashed and discarded.
+	*/
+	tokenHash: z.string().trim().min(16).max(128),
+	/**
+	* Secret names this run may use. Omit for "whatever the agent's policy
+	* allows" — mirroring `Session.scopes: Option<BTreeSet<String>>` in the proxy,
+	* so absent means unnarrowed in both places.
+	*/
+	scopes: z.array(policySecretNameSchema).max(64).optional(),
+	ttlSeconds: z.number().int().min(60).max(TASK_MAX_TTL_SECONDS).optional(),
+	/**
+	* What this run is for, for the audit row and the operator's task list. Free
+	* text, and **not** a security input: never put a secret value in it.
+	*/
+	label: z.string().trim().max(200).optional(),
+	/**
+	* Public half of a proof key the presenter holds, recorded as an RFC 7638
+	* thumbprint. See `AgentTaskSession.proofThumbprint` for what this does and —
+	* importantly — does not yet do.
+	*/
+	proofJwk: taskProofJwkSchema.optional()
+});
+z.object({ 
+/** The presented token. In the body, never a URL — it is a credential. */
+token: z.string().trim().min(8).max(512) });
+//#endregion
+//#region ../../packages/core/src/archive.ts
+/**
+* The **break-glass archive** format: one signed JSON file holding everything
+* seekrit stores for an org, in the form seekrit stores it — ciphertext stays
+* ciphertext. Its whole purpose is to be openable on a machine that has never
+* heard of seekrit, so the format is plain JSON, self-describing, and versioned
+* by name (`seekrit-archive/v1`); a breaking change ships a new format string
+* rather than mutating this one, exactly like the `sc1.`/`wd1.` blob prefixes.
+*
+* Three parts:
+*  - `manifest` — what this archive is, and a SHA-256 digest per section.
+*  - `signature` — Ed25519 over the canonical manifest, or null when the
+*    producing deployment has no signing key configured.
+*  - `data` — the sections themselves.
+*
+* Integrity fields (`digest`, `signature.value`, `publicKey`, `keyId`) are
+* lowercase hex. Every blob *inside* `data` keeps its native base64url form, so
+* the one encoding rule to remember is "the archive's own bookkeeping is hex,
+* seekrit's blobs are unchanged".
+*
+* See docs/break-glass-export.md for what is deliberately excluded and why.
+*/
+const ARCHIVE_FORMAT = "seekrit-archive/v1";
+const sectionHeaderSchema = z.object({
+	name: z.enum([
+		"organization",
+		"users",
+		"memberships",
+		"invites",
+		"applications",
+		"groups",
+		"environments",
+		"environmentGroups",
+		"environmentKeys",
+		"secrets",
+		"secretVersions",
+		"serviceTokens",
+		"m2mClients",
+		"kmsKeys",
+		"kmsKeyVersions",
+		"kmsKeyGrants",
+		"recoveryConfig",
+		"recoveryShares",
+		"rotations",
+		"syncConnections",
+		"syncBindings",
+		"leaseTargets",
+		"agentIdentities",
+		"agentPolicies",
+		"auditLog",
+		"keyMaterial"
+	]),
+	count: z.number().int().min(0),
+	truncated: z.boolean(),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const manifestSchema = z.object({
+	archiveId: z.string().min(1),
+	createdAt: z.string().min(1),
+	org: z.object({
+		id: z.string(),
+		slug: z.string(),
+		name: z.string()
+	}),
+	producer: z.object({
+		service: z.string(),
+		environment: z.string(),
+		formatVersion: z.string()
+	}),
+	requestedBy: z.object({
+		actorType: z.string(),
+		actorId: z.string(),
+		label: z.string().nullable()
+	}),
+	options: z.object({
+		includeVersions: z.boolean(),
+		includeAudit: z.boolean(),
+		auditLimit: z.number().int().min(0)
+	}),
+	sections: z.array(sectionHeaderSchema),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const signatureSchema = z.object({
+	algorithm: z.literal("ed25519"),
+	publicKey: z.string().regex(/^[0-9a-f]{64}$/),
+	keyId: z.string().regex(/^[0-9a-f]{16}$/),
+	value: z.string().regex(/^[0-9a-f]{128}$/)
+});
+z.object({
+	format: z.literal(ARCHIVE_FORMAT),
+	manifest: manifestSchema,
+	signature: signatureSchema.nullable(),
+	data: z.record(z.string(), z.unknown())
+});
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -891,6 +1077,13 @@ const inviteRoleSchema = z.enum(["admin", "member"]);
 const principalTypeSchema = z.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
 const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	/** Include the full append-only ciphertext history of every secret. */
+	includeVersions: z.boolean().optional(),
+	includeAudit: z.boolean().optional(),
+	/** Newest audit rows to keep. Exceeding the server cap is a 400, not a silent trim. */
+	auditLimit: z.number().int().min(0).optional()
+});
 z.object({
 	name: nameSchema,
 	slug: slugSchema
@@ -902,6 +1095,8 @@ z.object({
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
 z.object({ required: z.boolean() });
 z.object({
 	email: emailSchema,
@@ -1242,7 +1437,8 @@ z.enum([
 	"netlify",
 	"bunnyshell",
 	"github-actions",
-	"gcp-secret-manager"
+	"gcp-secret-manager",
+	"langgraph-platform"
 ]);
 /**
 * Vercel account scope. The API token itself is never here — it is wrapped to
@@ -1507,6 +1703,56 @@ const gcpSecretManagerConnectionConfigSchema = z.object({
 	/** Project ID (`acme-prod`) or project number. */
 	projectId: gcpProjectSchema
 });
+/**
+* LangSmith workspace/tenant scope for LangGraph Platform.
+*
+* The API key is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's token is.
+*
+* Two optional fields, for two different situations, and setting both is
+* rejected rather than silently resolved:
+*
+*  - `region` picks one of {@link LANGGRAPH_PLATFORM_HOSTS}. Omitted means
+*    `us`, which is where an account created at `smith.langchain.com` lives.
+*  - `baseUrl` points the connection at a **self-hosted** LangSmith install,
+*    whose control plane is served from the customer's own host under
+*    `/api-host` rather than from `*.api.host.langchain.com`.
+*
+* `tenantId` is the workspace a key was minted in. A workspace-scoped key names
+* its own tenant and does not need it; an organization-scoped key reaches
+* several workspaces and gets a bare 403 without it, which is the same trap
+* Vercel's `teamId` sets — so it is passed through as `X-Tenant-Id` whenever
+* it is present.
+*/
+const langgraphPlatformConnectionConfigSchema = z.object({
+	provider: z.literal("langgraph-platform"),
+	/** Control-plane region. Omit for `us`. Mutually exclusive with `baseUrl`. */
+	region: z.enum([
+		"us",
+		"eu",
+		"apac",
+		"aws-us"
+	]).optional(),
+	/**
+	* Self-hosted LangSmith control-plane root, e.g.
+	* `https://langsmith.acme.com/api-host`. Omit for LangChain's own hosts.
+	* Must be `https:` — this URL carries the API key.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the self-hosted control-plane root, e.g. https://langsmith.acme.com/api-host").optional(),
+	/** LangSmith workspace (tenant) UUID, sent as `X-Tenant-Id`. */
+	tenantId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangSmith workspace UUID").optional()
+}).refine((c) => !(c.baseUrl !== void 0 && c.region !== void 0), {
+	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
+	path: ["baseUrl"]
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1523,7 +1769,8 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	netlifyConnectionConfigSchema,
 	bunnyshellConnectionConfigSchema,
 	githubActionsConnectionConfigSchema,
-	gcpSecretManagerConnectionConfigSchema
+	gcpSecretManagerConnectionConfigSchema,
+	langgraphPlatformConnectionConfigSchema
 ]);
 const vercelDestinationSchema = z.object({
 	provider: z.literal("vercel"),
@@ -2210,6 +2457,27 @@ const gcpSecretManagerDestinationSchema = z.object({
 	message: "a customer-managed key covers one location — use automatic replication, or a single location",
 	path: ["kmsKeyName"]
 });
+/**
+* One LangGraph Platform (Agent Server) **deployment**, addressed by its id.
+*
+* A deployment is the whole unit here: its secrets are a property of the
+* deployment, delivered to the agent container as environment variables, and
+* there is nothing finer to point at — no per-revision or per-graph scope, and
+* no equivalent of Vercel's `production`/`preview` split. A deployment that
+* needs different values is a different deployment, so it is a different
+* binding.
+*
+* Validated as a UUID because `PATCH /v2/deployments/{deployment_id}` declares
+* the path parameter as one: a name or a URL slug in the slot fails validation
+* at the control plane hours later inside an alarm, with nobody watching. It is
+* the `id` from `GET /v2/deployments`, and the UUID in the deployment's
+* dashboard URL.
+*/
+const langgraphPlatformDestinationSchema = z.object({
+	provider: z.literal("langgraph-platform"),
+	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
+	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -2226,7 +2494,8 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	netlifyDestinationSchema,
 	bunnyshellDestinationSchema,
 	githubActionsDestinationSchema,
-	gcpSecretManagerDestinationSchema
+	gcpSecretManagerDestinationSchema,
+	langgraphPlatformDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -2956,7 +3225,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region ../cli/package.json
-var version$1 = "0.42.0";
+var version$1 = "0.46.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -3157,6 +3426,10 @@ var SeekritClient = class {
 	getEnv(orgId, envId) {
 		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
+	/** Rename an environment (display name only — the slug is immutable). */
+	updateEnv(orgId, envId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/envs/${envId}`, input);
+	}
 	deleteEnv(orgId, envId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
@@ -3310,6 +3583,10 @@ var SeekritClient = class {
 	createToken(orgId, input) {
 		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
 	}
+	/** Rename a token. Role, environment binding, and expiry are immutable. */
+	updateToken(orgId, tokenId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/tokens/${tokenId}`, input);
+	}
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
@@ -3365,6 +3642,77 @@ var SeekritClient = class {
 	getMyPolicySigner(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/agents/signers/me`);
 	}
+	/**
+	* The bundle a proxy would see — `GET /v1/agents/:ref/policy`, the same route
+	* `seekrit-proxy` polls, resolved by agent id or slug.
+	*
+	* Not org-scoped, because the caller is not: a proxy holds a service token that
+	* knows an agent slug and nothing about org ids. Reachable with any service
+	* token bound to the agent's org (or a user session), which is what lets
+	* `seekrit proxy init` generate a config on the machine that holds the proxy's
+	* own token rather than requiring an admin credential there.
+	*
+	* The `bundle` is signed and opaque to the API. Anything that *acts* on it must
+	* verify the signature against locally pinned signers; decoding it for display
+	* or to name a route is not acting on it.
+	*/
+	getAgentPolicyBundle(agentRef) {
+		return this.request("GET", `/v1/agents/${encodeURIComponent(agentRef)}/policy`);
+	}
+	/**
+	* Dispatch a task for one agent run.
+	*
+	* The caller mints the token (`createAgentTaskToken` in `@seekrit/crypto`) and
+	* sends only its hash plus the public `skd_…` segment, so no presentable
+	* credential ever reaches this API — the same shape as service-token and CLI
+	* session creation. `scopes` may only narrow what the agent's published policy
+	* already permits; a name outside it is refused rather than dropped.
+	*
+	* Not org-scoped, because an orchestrator is not: it knows an agent slug.
+	*/
+	dispatchAgentTask(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/dispatch`, input);
+	}
+	/**
+	* Exchange a presented token for the session it authorizes — what an
+	* enforcement point calls once per task and caches until expiry.
+	*
+	* A POST because the token is a credential and must not land in a URL or an
+	* access log. Fails closed and says which way: revoked, expired, or a disabled
+	* identity are three different answers.
+	*/
+	introspectAgentTask(token) {
+		return this.request("POST", "/v1/tasks/introspect", { token });
+	}
+	/** End a run's authority now. Idempotent. */
+	revokeAgentTask(taskId) {
+		return this.request("POST", `/v1/tasks/${taskId}/revoke`);
+	}
+	getAgentTask(taskId) {
+		return this.request("GET", `/v1/tasks/${taskId}`);
+	}
+	/** Runs dispatched for one identity, newest first (admin). */
+	listAgentTasks(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/tasks`);
+	}
+	/**
+	* Report aggregate decisions. Called by an enforcement point, not a person.
+	*
+	* Counts only — hosts, methods, secret *names*, decisions, and rule indices.
+	* Never a request path: see the module comment in `agent-activity.ts` for why
+	* that line is drawn where it is.
+	*/
+	reportAgentActivity(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/activity`, input);
+	}
+	/**
+	* What an agent actually did, collapsed onto its dimensions — the evidence a
+	* grant review reasons over. The proposals themselves are computed client-side
+	* (`reviewPolicy` in `@seekrit/core`), so the API never opines on policy.
+	*/
+	getAgentActivity(orgId, agentId, days = 14) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/activity?days=${encodeURIComponent(String(days))}`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -3517,6 +3865,17 @@ var SeekritClient = class {
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
 	}
+	/**
+	* Export the org as one signed archive: every row seekrit holds for it, with
+	* ciphertext still ciphertext (docs/break-glass-export.md).
+	*
+	* The archive comes back inline rather than as a job handle, and it can be
+	* megabytes — buffer it to a file rather than holding several copies. Requires
+	* admin; deliberately not entitlement-gated.
+	*/
+	exportArchive(orgId, input = {}) {
+		return this.request("POST", `/v1/orgs/${orgId}/export`, input);
+	}
 	getLogSink(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
 	}
@@ -5145,7 +5504,7 @@ async function runMcpServer(options = {}) {
 * `seekrit mcp`. tsdown bundles the shared server source in at build time, so the
 * published package is self-contained and needs no `@seekrit/cli` install.
 */
-runMcpServer({ version: "0.7.0" }).catch((err) => {
+runMcpServer({ version: "0.8.0" }).catch((err) => {
 	const message = err instanceof Error ? err.message : String(err);
 	process.stderr.write(`seekrit-mcp: fatal: ${message}\n`);
 	process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/mcp",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "npx-able MCP server for seekrit — let Claude Code and other MCP clients provision, manage, and inject end-to-end encrypted secrets.",
   "mcpName": "dev.seekrit/mcp",
   "type": "module",
@@ -24,7 +24,7 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
-    "@seekrit/cli": "0.42.0"
+    "@seekrit/cli": "0.46.0"
   },
   "scripts": {
     "build": "tsdown",