@seekrit/mcp 0.7.0 → 0.8.1

package/dist/index.js

@@ -45,6 +45,192 @@ z.object({
 	path: z.string().trim().min(1).max(2048),
 	secret: policySecretNameSchema.optional()
 });
+/** One aggregated cell: a dimension tuple and how many times it happened. */
+const activityEntrySchema = z.object({
+	host: policyHostSchema,
+	method: policyMethodSchema,
+	decision: z.enum([
+		"allow",
+		"no_rule",
+		"method_not_allowed",
+		"path_not_allowed",
+		"secret_not_allowed",
+		"unknown_secret",
+		"ratchet_withdrawn",
+		"policy_unavailable"
+	]),
+	/**
+	* Which published rule decided, when one did. Null for refusals that never
+	* reached a rule (`no_rule`, `policy_unavailable`) — the distinction matters to
+	* a review, because "rule 3 refused this" and "nothing covered this" call for
+	* opposite changes.
+	*/
+	ruleIndex: z.number().int().min(0).max(255).nullable(),
+	count: z.number().int().min(1).max(1e6),
+	/**
+	* Secret names actually injected, name → count. Only meaningful on `allow`.
+	* This is what lets a review say "rule 2 permits three secrets and the agent
+	* has only ever used one" — the most useful narrowing there is, and impossible
+	* to see from policy alone.
+	*/
+	secrets: z.record(policySecretNameSchema, z.number().int().min(1)).optional()
+});
+z.object({
+	/** Start of the window these counts cover (ISO 8601). */
+	windowStart: z.string().trim().min(20).max(40),
+	/** Policy version in force while they were collected, for the ledger. */
+	policyVersion: z.number().int().min(0).optional(),
+	/**
+	* Capped so one report cannot be unbounded work. A proxy with more distinct
+	* cells than this in a window has a policy far broader than a review can help
+	* with, and truncating loudly beats accepting anything.
+	*/
+	entries: z.array(activityEntrySchema).min(1).max(500)
+});
+/**
+* Twelve hours, matching `[control] max_ttl` in a proxy config. A task is meant
+* to bound one run; something that needs longer wants a policy change, not a
+* longer ticket.
+*/
+const TASK_MAX_TTL_SECONDS = 720 * 60;
+/** An EC P-256 public JWK, for a sender-constraint proof key. */
+const taskProofJwkSchema = z.object({
+	kty: z.literal("EC"),
+	crv: z.literal("P-256"),
+	x: z.string().min(1).max(128),
+	y: z.string().min(1).max(128)
+});
+z.object({
+	/**
+	* The public `skd_…` segment of the minted token. Sent because the API never
+	* sees the token at dispatch and still needs a readable handle for the audit
+	* row and for a revoke to name — the id half of a credential, without the
+	* secret half.
+	*/
+	taskRef: z.string().trim().regex(/^skd_[0-9A-Za-z]+$/, "taskRef must be the skd_… segment of the minted token"),
+	/**
+	* SHA-256 (base64url) of the token the dispatcher minted. The token itself
+	* never reaches this API on the dispatch path — only on introspection, where
+	* it is hashed and discarded.
+	*/
+	tokenHash: z.string().trim().min(16).max(128),
+	/**
+	* Secret names this run may use. Omit for "whatever the agent's policy
+	* allows" — mirroring `Session.scopes: Option<BTreeSet<String>>` in the proxy,
+	* so absent means unnarrowed in both places.
+	*/
+	scopes: z.array(policySecretNameSchema).max(64).optional(),
+	ttlSeconds: z.number().int().min(60).max(TASK_MAX_TTL_SECONDS).optional(),
+	/**
+	* What this run is for, for the audit row and the operator's task list. Free
+	* text, and **not** a security input: never put a secret value in it.
+	*/
+	label: z.string().trim().max(200).optional(),
+	/**
+	* Public half of a proof key the presenter holds, recorded as an RFC 7638
+	* thumbprint. See `AgentTaskSession.proofThumbprint` for what this does and —
+	* importantly — does not yet do.
+	*/
+	proofJwk: taskProofJwkSchema.optional()
+});
+z.object({ 
+/** The presented token. In the body, never a URL — it is a credential. */
+token: z.string().trim().min(8).max(512) });
+//#endregion
+//#region ../../packages/core/src/archive.ts
+/**
+* The **break-glass archive** format: one signed JSON file holding everything
+* seekrit stores for an org, in the form seekrit stores it — ciphertext stays
+* ciphertext. Its whole purpose is to be openable on a machine that has never
+* heard of seekrit, so the format is plain JSON, self-describing, and versioned
+* by name (`seekrit-archive/v1`); a breaking change ships a new format string
+* rather than mutating this one, exactly like the `sc1.`/`wd1.` blob prefixes.
+*
+* Three parts:
+*  - `manifest` — what this archive is, and a SHA-256 digest per section.
+*  - `signature` — Ed25519 over the canonical manifest, or null when the
+*    producing deployment has no signing key configured.
+*  - `data` — the sections themselves.
+*
+* Integrity fields (`digest`, `signature.value`, `publicKey`, `keyId`) are
+* lowercase hex. Every blob *inside* `data` keeps its native base64url form, so
+* the one encoding rule to remember is "the archive's own bookkeeping is hex,
+* seekrit's blobs are unchanged".
+*
+* See docs/break-glass-export.md for what is deliberately excluded and why.
+*/
+const ARCHIVE_FORMAT = "seekrit-archive/v1";
+const sectionHeaderSchema = z.object({
+	name: z.enum([
+		"organization",
+		"users",
+		"memberships",
+		"invites",
+		"applications",
+		"groups",
+		"environments",
+		"environmentGroups",
+		"environmentKeys",
+		"secrets",
+		"secretVersions",
+		"serviceTokens",
+		"m2mClients",
+		"kmsKeys",
+		"kmsKeyVersions",
+		"kmsKeyGrants",
+		"recoveryConfig",
+		"recoveryShares",
+		"rotations",
+		"syncConnections",
+		"syncBindings",
+		"leaseTargets",
+		"agentIdentities",
+		"agentPolicies",
+		"auditLog",
+		"keyMaterial"
+	]),
+	count: z.number().int().min(0),
+	truncated: z.boolean(),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const manifestSchema = z.object({
+	archiveId: z.string().min(1),
+	createdAt: z.string().min(1),
+	org: z.object({
+		id: z.string(),
+		slug: z.string(),
+		name: z.string()
+	}),
+	producer: z.object({
+		service: z.string(),
+		environment: z.string(),
+		formatVersion: z.string()
+	}),
+	requestedBy: z.object({
+		actorType: z.string(),
+		actorId: z.string(),
+		label: z.string().nullable()
+	}),
+	options: z.object({
+		includeVersions: z.boolean(),
+		includeAudit: z.boolean(),
+		auditLimit: z.number().int().min(0)
+	}),
+	sections: z.array(sectionHeaderSchema),
+	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+});
+const signatureSchema = z.object({
+	algorithm: z.literal("ed25519"),
+	publicKey: z.string().regex(/^[0-9a-f]{64}$/),
+	keyId: z.string().regex(/^[0-9a-f]{16}$/),
+	value: z.string().regex(/^[0-9a-f]{128}$/)
+});
+z.object({
+	format: z.literal(ARCHIVE_FORMAT),
+	manifest: manifestSchema,
+	signature: signatureSchema.nullable(),
+	data: z.record(z.string(), z.unknown())
+});
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -891,6 +1077,13 @@ const inviteRoleSchema = z.enum(["admin", "member"]);
 const principalTypeSchema = z.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
 const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	/** Include the full append-only ciphertext history of every secret. */
+	includeVersions: z.boolean().optional(),
+	includeAudit: z.boolean().optional(),
+	/** Newest audit rows to keep. Exceeding the server cap is a 400, not a silent trim. */
+	auditLimit: z.number().int().min(0).optional()
+});
 z.object({
 	name: nameSchema,
 	slug: slugSchema
@@ -902,6 +1095,8 @@ z.object({
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
 z.object({ required: z.boolean() });
 z.object({
 	email: emailSchema,
@@ -941,6 +1136,16 @@ z.object({
 	*/
 	encryptedPrivateKey: z.string().min(1)
 });
+z.object({
+	/** Base64url WebAuthn credential id — what `allowCredentials` is built from. */
+	credentialId: z.string().min(1).max(512),
+	/** Human label for the device, e.g. "MacBook Touch ID". Display only. */
+	label: z.string().min(1).max(64),
+	/** Base64url PRF evaluation input for this credential; not a secret. */
+	prfInput: z.string().min(1).max(256),
+	/** The private key wrapped to this passkey's PRF output. */
+	encryptedPrivateKey: z.string().min(1).max(8192).refine((v) => v.startsWith("pk2."), { message: "expected a pk2. passkey wrap" })
+});
 const grantEnvironmentKeySchema = z.object({
 	principalType: principalTypeSchema,
 	principalId: z.string().min(1),
@@ -1242,7 +1447,10 @@ z.enum([
 	"netlify",
 	"bunnyshell",
 	"github-actions",
-	"gcp-secret-manager"
+	"gcp-secret-manager",
+	"langgraph-platform",
+	"azure-key-vault",
+	"huggingface-spaces"
 ]);
 /**
 * Vercel account scope. The API token itself is never here — it is wrapped to
@@ -1507,6 +1715,119 @@ const gcpSecretManagerConnectionConfigSchema = z.object({
 	/** Project ID (`acme-prod`) or project number. */
 	projectId: gcpProjectSchema
 });
+/**
+* LangSmith workspace/tenant scope for LangGraph Platform.
+*
+* The API key is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's token is.
+*
+* Two optional fields, for two different situations, and setting both is
+* rejected rather than silently resolved:
+*
+*  - `region` picks one of {@link LANGGRAPH_PLATFORM_HOSTS}. Omitted means
+*    `us`, which is where an account created at `smith.langchain.com` lives.
+*  - `baseUrl` points the connection at a **self-hosted** LangSmith install,
+*    whose control plane is served from the customer's own host under
+*    `/api-host` rather than from `*.api.host.langchain.com`.
+*
+* `tenantId` is the workspace a key was minted in. A workspace-scoped key names
+* its own tenant and does not need it; an organization-scoped key reaches
+* several workspaces and gets a bare 403 without it, which is the same trap
+* Vercel's `teamId` sets — so it is passed through as `X-Tenant-Id` whenever
+* it is present.
+*/
+const langgraphPlatformConnectionConfigSchema = z.object({
+	provider: z.literal("langgraph-platform"),
+	/** Control-plane region. Omit for `us`. Mutually exclusive with `baseUrl`. */
+	region: z.enum([
+		"us",
+		"eu",
+		"apac",
+		"aws-us"
+	]).optional(),
+	/**
+	* Self-hosted LangSmith control-plane root, e.g.
+	* `https://langsmith.acme.com/api-host`. Omit for LangChain's own hosts.
+	* Must be `https:` — this URL carries the API key.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the self-hosted control-plane root, e.g. https://langsmith.acme.com/api-host").optional(),
+	/** LangSmith workspace (tenant) UUID, sent as `X-Tenant-Id`. */
+	tenantId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangSmith workspace UUID").optional()
+}).refine((c) => !(c.baseUrl !== void 0 && c.region !== void 0), {
+	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
+	path: ["baseUrl"]
+});
+/**
+* The Azure clouds a vault can live in.
+*
+* Unlike AWS, where the China partition can be read off the region string
+* (`cn-…`), nothing about a tenant id or a vault name says which cloud it
+* belongs to — and two hosts have to agree with the answer: the Entra authority
+* that issues the token and the DNS suffix the vault answers on. Getting either
+* wrong is a failure inside an alarm with nobody watching, so it is stated.
+*/
+const AZURE_CLOUDS = [
+	"public",
+	"usgov",
+	"china"
+];
+/**
+* A Microsoft Entra directory (tenant) or application (client) id.
+*
+* Both are GUIDs. Entra accepts a verified domain name in place of a tenant id
+* in the token URL, but not a client id, and taking only the GUID for both
+* keeps one rule — a tenant's GUID is on the same admin-center page as the
+* client id it pairs with, so nothing is harder to find.
+*/
+const azureGuidSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a GUID, as the Entra admin center shows it");
+/**
+* Azure account scope: which directory to authenticate against, as which app.
+*
+* The split follows AWS's, and for the same reason. A service principal's
+* **client secret** is the credential and is wrapped to the connection's key;
+* the tenant and client ids are *identifiers* — they appear in the token
+* request URL, in sign-in logs, and on the app registration blade. Keeping them
+* here lets the dashboard say which principal a connection authenticates as,
+* which is the first thing worth knowing when a connection starts failing after
+* a secret expires.
+*
+* Client secrets are the only credential kind here: a certificate or federated
+* credential would need a private key or a trust relationship the sync engine
+* has nowhere to keep, and Entra caps a client secret at 24 months, which is a
+* rotation the connection's `lastError` will make loud.
+*/
+const azureKeyVaultConnectionConfigSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Entra directory (tenant) ID. */
+	tenantId: azureGuidSchema,
+	/** Application (client) ID of the service principal seekrit signs in as. */
+	clientId: azureGuidSchema,
+	/** Which Azure cloud the tenant and its vaults live in. */
+	cloud: z.enum(AZURE_CLOUDS).default("public")
+});
+/**
+* Hugging Face account scope — empty, as Render's and Fly's are.
+*
+* Neither half of "which account, which thing" needs stating. A Hub user access
+* token belongs to one user and carries their write access to every Space they
+* or their organizations own; a Space is addressed by `owner/name`, which is
+* globally unique. So the token plus the destination is the whole address.
+*
+* There is deliberately no `baseUrl` twin of the GitHub Enterprise Server
+* field. `HF_ENDPOINT` exists in the Python client for Hub *mirrors*, which
+* serve repository content — not the settings API this connector writes, and
+* not something a mirror is expected to accept a write on. Adding the field
+* would invite pointing a connection at a host that silently swallows secrets.
+*/
+const huggingfaceSpacesConnectionConfigSchema = z.object({ provider: z.literal("huggingface-spaces") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1523,7 +1844,10 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	netlifyConnectionConfigSchema,
 	bunnyshellConnectionConfigSchema,
 	githubActionsConnectionConfigSchema,
-	gcpSecretManagerConnectionConfigSchema
+	gcpSecretManagerConnectionConfigSchema,
+	langgraphPlatformConnectionConfigSchema,
+	azureKeyVaultConnectionConfigSchema,
+	huggingfaceSpacesConnectionConfigSchema
 ]);
 const vercelDestinationSchema = z.object({
 	provider: z.literal("vercel"),
@@ -2210,6 +2534,98 @@ const gcpSecretManagerDestinationSchema = z.object({
 	message: "a customer-managed key covers one location — use automatic replication, or a single location",
 	path: ["kmsKeyName"]
 });
+/**
+* One LangGraph Platform (Agent Server) **deployment**, addressed by its id.
+*
+* A deployment is the whole unit here: its secrets are a property of the
+* deployment, delivered to the agent container as environment variables, and
+* there is nothing finer to point at — no per-revision or per-graph scope, and
+* no equivalent of Vercel's `production`/`preview` split. A deployment that
+* needs different values is a different deployment, so it is a different
+* binding.
+*
+* Validated as a UUID because `PATCH /v2/deployments/{deployment_id}` declares
+* the path parameter as one: a name or a URL slug in the slot fails validation
+* at the control plane hours later inside an alarm, with nobody watching. It is
+* the `id` from `GET /v2/deployments`, and the UUID in the deployment's
+* dashboard URL.
+*/
+const langgraphPlatformDestinationSchema = z.object({
+	provider: z.literal("langgraph-platform"),
+	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
+	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
+});
+/**
+* A Key Vault's name — the leftmost label of its DNS name, so the vault
+* `acme-prod` answers at `acme-prod.vault.azure.net`.
+*
+* Azure's own rule, stated here because the failure it prevents is confusing:
+* 3–24 characters, alphanumerics and hyphens, starting with a letter, ending
+* with a letter or digit, and no run of two hyphens. A name that breaks it
+* cannot exist, so a typo is a DNS failure rather than a 404 — an error that
+* says nothing about what was wrong.
+*
+* The *base URL* is not taken instead. It would let a connection be pointed at
+* any host, and the whole address seekrit needs is this label plus the cloud
+* already named on the connection.
+*/
+const azureVaultNameSchema = z.string().trim().regex(/^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/, "must be a Key Vault name: 3–24 letters, digits, and single hyphens, starting with a letter");
+/**
+* Which vault a binding writes to, and under what names.
+*
+* There is no layout choice as Secrets Manager has: the reason a `json-bundle`
+* exists there is billing — AWS charges per secret per month — and Key Vault
+* charges per *operation*, so fifty names cost the same stored fifty ways. One
+* secret per name is simply correct here.
+*/
+const azureKeyVaultDestinationSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Vault name, e.g. `acme-prod` for `acme-prod.vault.azure.net`. */
+	vault: azureVaultNameSchema,
+	/**
+	* Prepended to every secret name, e.g. `storefront-`. Key Vault has no
+	* hierarchy — its names are flat, and `/` is not among the characters it
+	* accepts — so unlike Parameter Store's `path` this is a naming convention
+	* and nothing more. Worth setting in a vault that holds anything else.
+	*/
+	prefix: z.string().trim().max(64).regex(/^[A-Za-z0-9-]*$/, "may contain letters, digits, and hyphens").optional(),
+	/** What to do with a name Key Vault cannot store — see {@link AZURE_KEY_VAULT_NAME_MODES}. */
+	nameMode: z.enum(["dash", "reject"]).default("dash")
+});
+/**
+* The Space whose secrets a binding owns, addressed the way the Hub addresses
+* every repository: `owner/name`, where `owner` is a user or an organization.
+*
+* A Space has **one** secret set, shared by every replica — there is no
+* per-target split to state, the way Vercel and Pages have one. The Hub's
+* convention is that staging and production are separate Spaces
+* (`acme/demo`, `acme/demo-staging`), so pointing at an environment means
+* naming that Space, exactly as a Fly environment means naming its own app.
+*
+* Validated by shape because the two habitual slips both fail *late*: pasting
+* the browser URL (`https://huggingface.co/spaces/acme/demo`) or the bare name
+* without its owner. Either one is a 404 from the Hub inside an alarm with
+* nobody watching, and a 404 says nothing about which half was wrong. The
+* leading character is held to alphanumeric, which is also what rejects the
+* `.` and `..` that no repository may be called.
+*/
+const huggingfaceRepoIdSchema = z.string().trim().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/, "must be a Space ID as owner/name, e.g. acme/support-demo — not a URL");
+/**
+* One Hugging Face **Space**, whose secrets arrive in the app's container as
+* environment variables.
+*
+* Only secrets. A Space also has *variables*, and they are not a second lane
+* seekrit could use: the Hub calls them "non-sensitive configuration values",
+* they are "publicly accessible and viewable", and they are copied into every
+* Space duplicated from this one. Writing a seekrit secret there would publish
+* it, so this connector has no variables mode — a binding that wants one is
+* asking for the wrong thing.
+*/
+const huggingfaceSpacesDestinationSchema = z.object({
+	provider: z.literal("huggingface-spaces"),
+	/** Space ID as `owner/name`, e.g. `acme/support-demo`. */
+	repoId: huggingfaceRepoIdSchema
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -2226,7 +2642,10 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	netlifyDestinationSchema,
 	bunnyshellDestinationSchema,
 	githubActionsDestinationSchema,
-	gcpSecretManagerDestinationSchema
+	gcpSecretManagerDestinationSchema,
+	langgraphPlatformDestinationSchema,
+	azureKeyVaultDestinationSchema,
+	huggingfaceSpacesDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -2956,7 +3375,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region ../cli/package.json
-var version$1 = "0.42.0";
+var version$1 = "1.2.2";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -3078,6 +3497,22 @@ var SeekritClient = class {
 	revokeCliSession(sessionId) {
 		return this.request("DELETE", `/v1/me/cli-sessions/${sessionId}`);
 	}
+	/**
+	* The passkeys enrolled to unlock this user's keyring, each with the `pk2.`
+	* blob its PRF output decrypts. One call is everything the unlock ceremony
+	* needs; the blobs are opaque without the authenticator.
+	*/
+	listMyPasskeys() {
+		return this.request("GET", "/v1/me/passkeys");
+	}
+	/** File a private key already wrapped, client-side, to a passkey's PRF output. */
+	enrollMyPasskey(input) {
+		return this.request("POST", "/v1/me/passkeys", input);
+	}
+	/** Stop a passkey unlocking the keyring. The key itself is untouched. */
+	deleteMyPasskey(passkeyId) {
+		return this.request("DELETE", `/v1/me/passkeys/${passkeyId}`);
+	}
 	/** What a pending login request is asking for — for the approval screen. */
 	getCliLoginRequest(code) {
 		return this.request("GET", `/v1/cli-login/${encodeURIComponent(code)}`);
@@ -3157,6 +3592,10 @@ var SeekritClient = class {
 	getEnv(orgId, envId) {
 		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
+	/** Rename an environment (display name only — the slug is immutable). */
+	updateEnv(orgId, envId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/envs/${envId}`, input);
+	}
 	deleteEnv(orgId, envId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
@@ -3310,6 +3749,10 @@ var SeekritClient = class {
 	createToken(orgId, input) {
 		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
 	}
+	/** Rename a token. Role, environment binding, and expiry are immutable. */
+	updateToken(orgId, tokenId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/tokens/${tokenId}`, input);
+	}
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
@@ -3365,6 +3808,77 @@ var SeekritClient = class {
 	getMyPolicySigner(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/agents/signers/me`);
 	}
+	/**
+	* The bundle a proxy would see — `GET /v1/agents/:ref/policy`, the same route
+	* `seekrit-proxy` polls, resolved by agent id or slug.
+	*
+	* Not org-scoped, because the caller is not: a proxy holds a service token that
+	* knows an agent slug and nothing about org ids. Reachable with any service
+	* token bound to the agent's org (or a user session), which is what lets
+	* `seekrit proxy init` generate a config on the machine that holds the proxy's
+	* own token rather than requiring an admin credential there.
+	*
+	* The `bundle` is signed and opaque to the API. Anything that *acts* on it must
+	* verify the signature against locally pinned signers; decoding it for display
+	* or to name a route is not acting on it.
+	*/
+	getAgentPolicyBundle(agentRef) {
+		return this.request("GET", `/v1/agents/${encodeURIComponent(agentRef)}/policy`);
+	}
+	/**
+	* Dispatch a task for one agent run.
+	*
+	* The caller mints the token (`createAgentTaskToken` in `@seekrit/crypto`) and
+	* sends only its hash plus the public `skd_…` segment, so no presentable
+	* credential ever reaches this API — the same shape as service-token and CLI
+	* session creation. `scopes` may only narrow what the agent's published policy
+	* already permits; a name outside it is refused rather than dropped.
+	*
+	* Not org-scoped, because an orchestrator is not: it knows an agent slug.
+	*/
+	dispatchAgentTask(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/dispatch`, input);
+	}
+	/**
+	* Exchange a presented token for the session it authorizes — what an
+	* enforcement point calls once per task and caches until expiry.
+	*
+	* A POST because the token is a credential and must not land in a URL or an
+	* access log. Fails closed and says which way: revoked, expired, or a disabled
+	* identity are three different answers.
+	*/
+	introspectAgentTask(token) {
+		return this.request("POST", "/v1/tasks/introspect", { token });
+	}
+	/** End a run's authority now. Idempotent. */
+	revokeAgentTask(taskId) {
+		return this.request("POST", `/v1/tasks/${taskId}/revoke`);
+	}
+	getAgentTask(taskId) {
+		return this.request("GET", `/v1/tasks/${taskId}`);
+	}
+	/** Runs dispatched for one identity, newest first (admin). */
+	listAgentTasks(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/tasks`);
+	}
+	/**
+	* Report aggregate decisions. Called by an enforcement point, not a person.
+	*
+	* Counts only — hosts, methods, secret *names*, decisions, and rule indices.
+	* Never a request path: see the module comment in `agent-activity.ts` for why
+	* that line is drawn where it is.
+	*/
+	reportAgentActivity(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/activity`, input);
+	}
+	/**
+	* What an agent actually did, collapsed onto its dimensions — the evidence a
+	* grant review reasons over. The proposals themselves are computed client-side
+	* (`reviewPolicy` in `@seekrit/core`), so the API never opines on policy.
+	*/
+	getAgentActivity(orgId, agentId, days = 14) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/activity?days=${encodeURIComponent(String(days))}`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -3517,6 +4031,17 @@ var SeekritClient = class {
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
 	}
+	/**
+	* Export the org as one signed archive: every row seekrit holds for it, with
+	* ciphertext still ciphertext (docs/break-glass-export.md).
+	*
+	* The archive comes back inline rather than as a job handle, and it can be
+	* megabytes — buffer it to a file rather than holding several copies. Requires
+	* admin; deliberately not entitlement-gated.
+	*/
+	exportArchive(orgId, input = {}) {
+		return this.request("POST", `/v1/orgs/${orgId}/export`, input);
+	}
 	getLogSink(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/log-sink`);
 	}
@@ -3594,7 +4119,18 @@ function fail(message) {
 	console.error(`error: ${message}`);
 	process.exit(1);
 }
-/** Prompt without echoing input (for passphrases). */
+/**
+* Prompt without echoing input (for passphrases).
+*
+* Piping the answer in (`echo … | seekrit secrets get …`) is supported and
+* common in CI, so this reads stdin rather than insisting on a TTY. But stdin
+* can also close with nothing on it — `< /dev/null`, a closed pipe, an agent
+* spawning us with no stdin — and readline signals that by emitting `close`
+* without ever calling the `question` callback. Left unhandled the promise
+* never settles, the event loop drains, and Node exits **0** having printed
+* nothing: `V=$(seekrit secrets get X)` silently yields an empty value and a
+* success status. So treat EOF-without-an-answer as the error it is.
+*/
 function promptHidden(question) {
 	const muted = new Writable({ write(_chunk, _encoding, callback) {
 		callback();
@@ -3605,8 +4141,15 @@ function promptHidden(question) {
 		output: muted,
 		terminal: true
 	});
-	return new Promise((resolve) => {
+	return new Promise((resolve, reject) => {
+		let answered = false;
+		rl.on("close", () => {
+			if (answered) return;
+			process.stderr.write("\n");
+			reject(/* @__PURE__ */ new Error("no passphrase on stdin — set SEEKRIT_PASSPHRASE, pipe it in, or run this in a terminal"));
+		});
 		rl.question("", (answer) => {
+			answered = true;
 			rl.close();
 			process.stderr.write("\n");
 			resolve(answer);
@@ -3628,9 +4171,23 @@ const CLI_CLIENT = `cli/${version$1}`;
 * `flag > env > .env` credential resolution. Empty for every command but
 * `seekrit run`, which loads `.env` before authenticating.
 */
+/**
+* A `SEEKRIT_*` value, or undefined if it is absent *or blank*.
+*
+* Blank has to mean absent. An unset CI secret, a `${VAR}` that expanded to
+* nothing, a bare `export SEEKRIT_TOKEN=` — all arrive as `""`, and `??` only
+* falls back on null/undefined. Left alone, an empty `SEEKRIT_API_URL` makes
+* every request relative and an empty `SEEKRIT_TOKEN` authenticates as a
+* bearer of nothing: a 401 where the honest answer is "you have no
+* credentials", pointing at the API instead of at the missing variable.
+*/
+function present(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
 function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
-	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const fromEnv = (key) => present(process.env[key]) ?? present(dotenvVars[key]);
 	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
 	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token ?? config.sessionToken;
 	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
@@ -3697,11 +4254,46 @@ async function resolveOrg(ctx, orgSlug) {
 	fail("specify --org (or run `seekrit init`)");
 }
 /**
+* The environment a service token is bound to.
+*
+* The binding lives on the token row, not in the token string — `GET
+* /v1/resolve` is where the API publishes it, and `seekrit whoami` reads it the
+* same way. One round trip, and it also resolves `--branch` against the bound
+* environment, which is the only environment a token may name a branch of.
+*/
+async function boundEnvTarget(ctx, opts) {
+	let scope;
+	try {
+		({scope} = await ctx.client.resolve(opts.branch ? { branch: opts.branch } : {}));
+	} catch (err) {
+		fail(`specify --env — this token has no environment of its own to fall back to (${err instanceof Error ? err.message : String(err)})`);
+	}
+	const env = scope.branchOf ?? {
+		envId: scope.envId,
+		envSlug: scope.envSlug
+	};
+	const label = scope.branchOf ? `${scope.appSlug}/${scope.branchOf.envSlug}#${scope.envSlug}` : `${scope.appSlug}/${scope.envSlug}`;
+	if (opts.org && opts.org !== scope.orgSlug && opts.org !== scope.orgId) fail(`this token belongs to ${scope.orgSlug}, not "${opts.org}"`);
+	if (opts.env && opts.env !== env.envSlug && opts.env !== env.envId) fail(`this token is bound to ${scope.appSlug}/${env.envSlug}, not "${opts.env}" — add --app (or --group) to target another environment you hold a key for`);
+	return {
+		orgId: scope.orgId,
+		envId: scope.envId,
+		label
+	};
+}
+/**
 * Resolve an environment to operate on — an application env (`--app --env`,
 * or the config's app + `--env`), a branch of one (`--branch`), or a group env
 * (`--group --env`).
+*
+* `--env` is optional for a service token that names no `--app`/`--group`: it is
+* already bound to exactly one environment, so requiring the flag made every
+* documented one-liner (`seekrit secrets list`) fail for the CI job and the
+* agent that are the point of a token. The local MCP server has always inferred
+* it this way; this is the same rule, in one place, for both.
 */
 async function resolveEnvTarget(ctx, opts) {
+	if (!opts.app && !opts.group && isTokenAuth(ctx)) return boundEnvTarget(ctx, opts);
 	const org = await resolveOrg(ctx, opts.org);
 	if (!opts.env) fail("specify --env");
 	if (opts.group) {
@@ -4277,22 +4869,6 @@ const targetShape = {
 	group: z.string().optional().describe("target a group environment instead of an app"),
 	env: z.string().optional().describe("environment slug or id (a service token infers its own)")
 };
-/**
-* Resolve which environment a secret tool addresses. A service token with no
-* explicit app/group targets its own bound environment (no flags needed);
-* everyone else names app|group + env.
-*/
-async function resolveTargetEnv(ctx, o) {
-	if (isTokenAuth(ctx) && !o.app && !o.group) {
-		const { scope } = await ctx.client.resolve();
-		return {
-			orgId: scope.orgId,
-			envId: scope.envId,
-			label: `${scope.appSlug}/${scope.envSlug}`
-		};
-	}
-	return resolveEnvTarget(ctx, o);
-}
 async function runMcpServer(options = {}) {
 	setFailThrows(true);
 	await ensureM2mAdminToken();
@@ -4573,7 +5149,7 @@ async function runMcpServer(options = {}) {
 	});
 	tool("list_secrets", "List secret names + versions in an environment (never values).", ro, targetShape, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { secrets } = await ctx.client.listSecrets(orgId, envId);
 		return secrets.map((s) => ({
 			name: s.name,
@@ -4762,7 +5338,7 @@ async function runMcpServer(options = {}) {
 	}, async (o) => {
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		await encryptAndSetSecret(ctx, orgId, envId, o.name, o.value);
 		return {
 			ok: true,
@@ -4777,7 +5353,7 @@ async function runMcpServer(options = {}) {
 		version: z.number().int().positive().optional().describe("an earlier version from list_secret_versions (default: current)")
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		if (!o.reveal) {
 			const { secrets } = await ctx.client.listSecrets(orgId, envId);
 			const row = secrets.find((s) => s.name === o.name);
@@ -4812,7 +5388,7 @@ async function runMcpServer(options = {}) {
 		limit: z.number().int().min(1).max(200).optional().describe("default 20")
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { versions, currentVersion } = await ctx.client.listSecretVersions(orgId, envId, o.name, { limit: o.limit ?? 20 });
 		return {
 			currentVersion,
@@ -4830,7 +5406,7 @@ async function runMcpServer(options = {}) {
 		version: z.number().int().positive()
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { secret, restoredFrom } = await ctx.client.restoreSecret(orgId, envId, o.name, o.version);
 		return {
 			ok: true,
@@ -4844,7 +5420,7 @@ async function runMcpServer(options = {}) {
 		name: z.string()
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		await ctx.client.deleteSecret(orgId, envId, o.name);
 		return {
 			ok: true,
@@ -4967,7 +5543,7 @@ async function runMcpServer(options = {}) {
 		if (Boolean(o.user) === Boolean(o.token)) throw new Error("pass exactly one of user or token");
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
-		const { orgId, envId, label } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId, label } = await resolveEnvTarget(ctx, o);
 		const dek = await getDek(ctx, orgId, envId);
 		let principalType;
 		let principalId;
@@ -5145,7 +5721,7 @@ async function runMcpServer(options = {}) {
 * `seekrit mcp`. tsdown bundles the shared server source in at build time, so the
 * published package is self-contained and needs no `@seekrit/cli` install.
 */
-runMcpServer({ version: "0.7.0" }).catch((err) => {
+runMcpServer({ version: "0.8.1" }).catch((err) => {
 	const message = err instanceof Error ? err.message : String(err);
 	process.stderr.write(`seekrit-mcp: fatal: ${message}\n`);
 	process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/mcp",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "npx-able MCP server for seekrit — let Claude Code and other MCP clients provision, manage, and inject end-to-end encrypted secrets.",
   "mcpName": "dev.seekrit/mcp",
   "type": "module",
@@ -17,14 +17,14 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "zod": "^4.4.3"
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
-    "vitest": "^4.1.9",
-    "@seekrit/cli": "0.42.0"
+    "vitest": "^4.1.11",
+    "@seekrit/cli": "1.2.2"
   },
   "scripts": {
     "build": "tsdown",