@seekrit/mcp 0.8.0 → 0.8.1

package/dist/index.js

@@ -1136,6 +1136,16 @@ z.object({
 	*/
 	encryptedPrivateKey: z.string().min(1)
 });
+z.object({
+	/** Base64url WebAuthn credential id — what `allowCredentials` is built from. */
+	credentialId: z.string().min(1).max(512),
+	/** Human label for the device, e.g. "MacBook Touch ID". Display only. */
+	label: z.string().min(1).max(64),
+	/** Base64url PRF evaluation input for this credential; not a secret. */
+	prfInput: z.string().min(1).max(256),
+	/** The private key wrapped to this passkey's PRF output. */
+	encryptedPrivateKey: z.string().min(1).max(8192).refine((v) => v.startsWith("pk2."), { message: "expected a pk2. passkey wrap" })
+});
 const grantEnvironmentKeySchema = z.object({
 	principalType: principalTypeSchema,
 	principalId: z.string().min(1),
@@ -1438,7 +1448,9 @@ z.enum([
 	"bunnyshell",
 	"github-actions",
 	"gcp-secret-manager",
-	"langgraph-platform"
+	"langgraph-platform",
+	"azure-key-vault",
+	"huggingface-spaces"
 ]);
 /**
 * Vercel account scope. The API token itself is never here — it is wrapped to
@@ -1753,6 +1765,69 @@ const langgraphPlatformConnectionConfigSchema = z.object({
 	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
 	path: ["baseUrl"]
 });
+/**
+* The Azure clouds a vault can live in.
+*
+* Unlike AWS, where the China partition can be read off the region string
+* (`cn-…`), nothing about a tenant id or a vault name says which cloud it
+* belongs to — and two hosts have to agree with the answer: the Entra authority
+* that issues the token and the DNS suffix the vault answers on. Getting either
+* wrong is a failure inside an alarm with nobody watching, so it is stated.
+*/
+const AZURE_CLOUDS = [
+	"public",
+	"usgov",
+	"china"
+];
+/**
+* A Microsoft Entra directory (tenant) or application (client) id.
+*
+* Both are GUIDs. Entra accepts a verified domain name in place of a tenant id
+* in the token URL, but not a client id, and taking only the GUID for both
+* keeps one rule — a tenant's GUID is on the same admin-center page as the
+* client id it pairs with, so nothing is harder to find.
+*/
+const azureGuidSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a GUID, as the Entra admin center shows it");
+/**
+* Azure account scope: which directory to authenticate against, as which app.
+*
+* The split follows AWS's, and for the same reason. A service principal's
+* **client secret** is the credential and is wrapped to the connection's key;
+* the tenant and client ids are *identifiers* — they appear in the token
+* request URL, in sign-in logs, and on the app registration blade. Keeping them
+* here lets the dashboard say which principal a connection authenticates as,
+* which is the first thing worth knowing when a connection starts failing after
+* a secret expires.
+*
+* Client secrets are the only credential kind here: a certificate or federated
+* credential would need a private key or a trust relationship the sync engine
+* has nowhere to keep, and Entra caps a client secret at 24 months, which is a
+* rotation the connection's `lastError` will make loud.
+*/
+const azureKeyVaultConnectionConfigSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Entra directory (tenant) ID. */
+	tenantId: azureGuidSchema,
+	/** Application (client) ID of the service principal seekrit signs in as. */
+	clientId: azureGuidSchema,
+	/** Which Azure cloud the tenant and its vaults live in. */
+	cloud: z.enum(AZURE_CLOUDS).default("public")
+});
+/**
+* Hugging Face account scope — empty, as Render's and Fly's are.
+*
+* Neither half of "which account, which thing" needs stating. A Hub user access
+* token belongs to one user and carries their write access to every Space they
+* or their organizations own; a Space is addressed by `owner/name`, which is
+* globally unique. So the token plus the destination is the whole address.
+*
+* There is deliberately no `baseUrl` twin of the GitHub Enterprise Server
+* field. `HF_ENDPOINT` exists in the Python client for Hub *mirrors*, which
+* serve repository content — not the settings API this connector writes, and
+* not something a mirror is expected to accept a write on. Adding the field
+* would invite pointing a connection at a host that silently swallows secrets.
+*/
+const huggingfaceSpacesConnectionConfigSchema = z.object({ provider: z.literal("huggingface-spaces") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1770,7 +1845,9 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	bunnyshellConnectionConfigSchema,
 	githubActionsConnectionConfigSchema,
 	gcpSecretManagerConnectionConfigSchema,
-	langgraphPlatformConnectionConfigSchema
+	langgraphPlatformConnectionConfigSchema,
+	azureKeyVaultConnectionConfigSchema,
+	huggingfaceSpacesConnectionConfigSchema
 ]);
 const vercelDestinationSchema = z.object({
 	provider: z.literal("vercel"),
@@ -2478,6 +2555,77 @@ const langgraphPlatformDestinationSchema = z.object({
 	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
 	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
 });
+/**
+* A Key Vault's name — the leftmost label of its DNS name, so the vault
+* `acme-prod` answers at `acme-prod.vault.azure.net`.
+*
+* Azure's own rule, stated here because the failure it prevents is confusing:
+* 3–24 characters, alphanumerics and hyphens, starting with a letter, ending
+* with a letter or digit, and no run of two hyphens. A name that breaks it
+* cannot exist, so a typo is a DNS failure rather than a 404 — an error that
+* says nothing about what was wrong.
+*
+* The *base URL* is not taken instead. It would let a connection be pointed at
+* any host, and the whole address seekrit needs is this label plus the cloud
+* already named on the connection.
+*/
+const azureVaultNameSchema = z.string().trim().regex(/^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/, "must be a Key Vault name: 3–24 letters, digits, and single hyphens, starting with a letter");
+/**
+* Which vault a binding writes to, and under what names.
+*
+* There is no layout choice as Secrets Manager has: the reason a `json-bundle`
+* exists there is billing — AWS charges per secret per month — and Key Vault
+* charges per *operation*, so fifty names cost the same stored fifty ways. One
+* secret per name is simply correct here.
+*/
+const azureKeyVaultDestinationSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Vault name, e.g. `acme-prod` for `acme-prod.vault.azure.net`. */
+	vault: azureVaultNameSchema,
+	/**
+	* Prepended to every secret name, e.g. `storefront-`. Key Vault has no
+	* hierarchy — its names are flat, and `/` is not among the characters it
+	* accepts — so unlike Parameter Store's `path` this is a naming convention
+	* and nothing more. Worth setting in a vault that holds anything else.
+	*/
+	prefix: z.string().trim().max(64).regex(/^[A-Za-z0-9-]*$/, "may contain letters, digits, and hyphens").optional(),
+	/** What to do with a name Key Vault cannot store — see {@link AZURE_KEY_VAULT_NAME_MODES}. */
+	nameMode: z.enum(["dash", "reject"]).default("dash")
+});
+/**
+* The Space whose secrets a binding owns, addressed the way the Hub addresses
+* every repository: `owner/name`, where `owner` is a user or an organization.
+*
+* A Space has **one** secret set, shared by every replica — there is no
+* per-target split to state, the way Vercel and Pages have one. The Hub's
+* convention is that staging and production are separate Spaces
+* (`acme/demo`, `acme/demo-staging`), so pointing at an environment means
+* naming that Space, exactly as a Fly environment means naming its own app.
+*
+* Validated by shape because the two habitual slips both fail *late*: pasting
+* the browser URL (`https://huggingface.co/spaces/acme/demo`) or the bare name
+* without its owner. Either one is a 404 from the Hub inside an alarm with
+* nobody watching, and a 404 says nothing about which half was wrong. The
+* leading character is held to alphanumeric, which is also what rejects the
+* `.` and `..` that no repository may be called.
+*/
+const huggingfaceRepoIdSchema = z.string().trim().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/, "must be a Space ID as owner/name, e.g. acme/support-demo — not a URL");
+/**
+* One Hugging Face **Space**, whose secrets arrive in the app's container as
+* environment variables.
+*
+* Only secrets. A Space also has *variables*, and they are not a second lane
+* seekrit could use: the Hub calls them "non-sensitive configuration values",
+* they are "publicly accessible and viewable", and they are copied into every
+* Space duplicated from this one. Writing a seekrit secret there would publish
+* it, so this connector has no variables mode — a binding that wants one is
+* asking for the wrong thing.
+*/
+const huggingfaceSpacesDestinationSchema = z.object({
+	provider: z.literal("huggingface-spaces"),
+	/** Space ID as `owner/name`, e.g. `acme/support-demo`. */
+	repoId: huggingfaceRepoIdSchema
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -2495,7 +2643,9 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	bunnyshellDestinationSchema,
 	githubActionsDestinationSchema,
 	gcpSecretManagerDestinationSchema,
-	langgraphPlatformDestinationSchema
+	langgraphPlatformDestinationSchema,
+	azureKeyVaultDestinationSchema,
+	huggingfaceSpacesDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3225,7 +3375,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region ../cli/package.json
-var version$1 = "0.46.0";
+var version$1 = "1.2.2";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -3347,6 +3497,22 @@ var SeekritClient = class {
 	revokeCliSession(sessionId) {
 		return this.request("DELETE", `/v1/me/cli-sessions/${sessionId}`);
 	}
+	/**
+	* The passkeys enrolled to unlock this user's keyring, each with the `pk2.`
+	* blob its PRF output decrypts. One call is everything the unlock ceremony
+	* needs; the blobs are opaque without the authenticator.
+	*/
+	listMyPasskeys() {
+		return this.request("GET", "/v1/me/passkeys");
+	}
+	/** File a private key already wrapped, client-side, to a passkey's PRF output. */
+	enrollMyPasskey(input) {
+		return this.request("POST", "/v1/me/passkeys", input);
+	}
+	/** Stop a passkey unlocking the keyring. The key itself is untouched. */
+	deleteMyPasskey(passkeyId) {
+		return this.request("DELETE", `/v1/me/passkeys/${passkeyId}`);
+	}
 	/** What a pending login request is asking for — for the approval screen. */
 	getCliLoginRequest(code) {
 		return this.request("GET", `/v1/cli-login/${encodeURIComponent(code)}`);
@@ -3953,7 +4119,18 @@ function fail(message) {
 	console.error(`error: ${message}`);
 	process.exit(1);
 }
-/** Prompt without echoing input (for passphrases). */
+/**
+* Prompt without echoing input (for passphrases).
+*
+* Piping the answer in (`echo … | seekrit secrets get …`) is supported and
+* common in CI, so this reads stdin rather than insisting on a TTY. But stdin
+* can also close with nothing on it — `< /dev/null`, a closed pipe, an agent
+* spawning us with no stdin — and readline signals that by emitting `close`
+* without ever calling the `question` callback. Left unhandled the promise
+* never settles, the event loop drains, and Node exits **0** having printed
+* nothing: `V=$(seekrit secrets get X)` silently yields an empty value and a
+* success status. So treat EOF-without-an-answer as the error it is.
+*/
 function promptHidden(question) {
 	const muted = new Writable({ write(_chunk, _encoding, callback) {
 		callback();
@@ -3964,8 +4141,15 @@ function promptHidden(question) {
 		output: muted,
 		terminal: true
 	});
-	return new Promise((resolve) => {
+	return new Promise((resolve, reject) => {
+		let answered = false;
+		rl.on("close", () => {
+			if (answered) return;
+			process.stderr.write("\n");
+			reject(/* @__PURE__ */ new Error("no passphrase on stdin — set SEEKRIT_PASSPHRASE, pipe it in, or run this in a terminal"));
+		});
 		rl.question("", (answer) => {
+			answered = true;
 			rl.close();
 			process.stderr.write("\n");
 			resolve(answer);
@@ -3987,9 +4171,23 @@ const CLI_CLIENT = `cli/${version$1}`;
 * `flag > env > .env` credential resolution. Empty for every command but
 * `seekrit run`, which loads `.env` before authenticating.
 */
+/**
+* A `SEEKRIT_*` value, or undefined if it is absent *or blank*.
+*
+* Blank has to mean absent. An unset CI secret, a `${VAR}` that expanded to
+* nothing, a bare `export SEEKRIT_TOKEN=` — all arrive as `""`, and `??` only
+* falls back on null/undefined. Left alone, an empty `SEEKRIT_API_URL` makes
+* every request relative and an empty `SEEKRIT_TOKEN` authenticates as a
+* bearer of nothing: a 401 where the honest answer is "you have no
+* credentials", pointing at the API instead of at the missing variable.
+*/
+function present(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
 function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
-	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const fromEnv = (key) => present(process.env[key]) ?? present(dotenvVars[key]);
 	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
 	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token ?? config.sessionToken;
 	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
@@ -4056,11 +4254,46 @@ async function resolveOrg(ctx, orgSlug) {
 	fail("specify --org (or run `seekrit init`)");
 }
 /**
+* The environment a service token is bound to.
+*
+* The binding lives on the token row, not in the token string — `GET
+* /v1/resolve` is where the API publishes it, and `seekrit whoami` reads it the
+* same way. One round trip, and it also resolves `--branch` against the bound
+* environment, which is the only environment a token may name a branch of.
+*/
+async function boundEnvTarget(ctx, opts) {
+	let scope;
+	try {
+		({scope} = await ctx.client.resolve(opts.branch ? { branch: opts.branch } : {}));
+	} catch (err) {
+		fail(`specify --env — this token has no environment of its own to fall back to (${err instanceof Error ? err.message : String(err)})`);
+	}
+	const env = scope.branchOf ?? {
+		envId: scope.envId,
+		envSlug: scope.envSlug
+	};
+	const label = scope.branchOf ? `${scope.appSlug}/${scope.branchOf.envSlug}#${scope.envSlug}` : `${scope.appSlug}/${scope.envSlug}`;
+	if (opts.org && opts.org !== scope.orgSlug && opts.org !== scope.orgId) fail(`this token belongs to ${scope.orgSlug}, not "${opts.org}"`);
+	if (opts.env && opts.env !== env.envSlug && opts.env !== env.envId) fail(`this token is bound to ${scope.appSlug}/${env.envSlug}, not "${opts.env}" — add --app (or --group) to target another environment you hold a key for`);
+	return {
+		orgId: scope.orgId,
+		envId: scope.envId,
+		label
+	};
+}
+/**
 * Resolve an environment to operate on — an application env (`--app --env`,
 * or the config's app + `--env`), a branch of one (`--branch`), or a group env
 * (`--group --env`).
+*
+* `--env` is optional for a service token that names no `--app`/`--group`: it is
+* already bound to exactly one environment, so requiring the flag made every
+* documented one-liner (`seekrit secrets list`) fail for the CI job and the
+* agent that are the point of a token. The local MCP server has always inferred
+* it this way; this is the same rule, in one place, for both.
 */
 async function resolveEnvTarget(ctx, opts) {
+	if (!opts.app && !opts.group && isTokenAuth(ctx)) return boundEnvTarget(ctx, opts);
 	const org = await resolveOrg(ctx, opts.org);
 	if (!opts.env) fail("specify --env");
 	if (opts.group) {
@@ -4636,22 +4869,6 @@ const targetShape = {
 	group: z.string().optional().describe("target a group environment instead of an app"),
 	env: z.string().optional().describe("environment slug or id (a service token infers its own)")
 };
-/**
-* Resolve which environment a secret tool addresses. A service token with no
-* explicit app/group targets its own bound environment (no flags needed);
-* everyone else names app|group + env.
-*/
-async function resolveTargetEnv(ctx, o) {
-	if (isTokenAuth(ctx) && !o.app && !o.group) {
-		const { scope } = await ctx.client.resolve();
-		return {
-			orgId: scope.orgId,
-			envId: scope.envId,
-			label: `${scope.appSlug}/${scope.envSlug}`
-		};
-	}
-	return resolveEnvTarget(ctx, o);
-}
 async function runMcpServer(options = {}) {
 	setFailThrows(true);
 	await ensureM2mAdminToken();
@@ -4932,7 +5149,7 @@ async function runMcpServer(options = {}) {
 	});
 	tool("list_secrets", "List secret names + versions in an environment (never values).", ro, targetShape, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { secrets } = await ctx.client.listSecrets(orgId, envId);
 		return secrets.map((s) => ({
 			name: s.name,
@@ -5121,7 +5338,7 @@ async function runMcpServer(options = {}) {
 	}, async (o) => {
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		await encryptAndSetSecret(ctx, orgId, envId, o.name, o.value);
 		return {
 			ok: true,
@@ -5136,7 +5353,7 @@ async function runMcpServer(options = {}) {
 		version: z.number().int().positive().optional().describe("an earlier version from list_secret_versions (default: current)")
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		if (!o.reveal) {
 			const { secrets } = await ctx.client.listSecrets(orgId, envId);
 			const row = secrets.find((s) => s.name === o.name);
@@ -5171,7 +5388,7 @@ async function runMcpServer(options = {}) {
 		limit: z.number().int().min(1).max(200).optional().describe("default 20")
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { versions, currentVersion } = await ctx.client.listSecretVersions(orgId, envId, o.name, { limit: o.limit ?? 20 });
 		return {
 			currentVersion,
@@ -5189,7 +5406,7 @@ async function runMcpServer(options = {}) {
 		version: z.number().int().positive()
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { secret, restoredFrom } = await ctx.client.restoreSecret(orgId, envId, o.name, o.version);
 		return {
 			ok: true,
@@ -5203,7 +5420,7 @@ async function runMcpServer(options = {}) {
 		name: z.string()
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		await ctx.client.deleteSecret(orgId, envId, o.name);
 		return {
 			ok: true,
@@ -5326,7 +5543,7 @@ async function runMcpServer(options = {}) {
 		if (Boolean(o.user) === Boolean(o.token)) throw new Error("pass exactly one of user or token");
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
-		const { orgId, envId, label } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId, label } = await resolveEnvTarget(ctx, o);
 		const dek = await getDek(ctx, orgId, envId);
 		let principalType;
 		let principalId;
@@ -5504,7 +5721,7 @@ async function runMcpServer(options = {}) {
 * `seekrit mcp`. tsdown bundles the shared server source in at build time, so the
 * published package is self-contained and needs no `@seekrit/cli` install.
 */
-runMcpServer({ version: "0.8.0" }).catch((err) => {
+runMcpServer({ version: "0.8.1" }).catch((err) => {
 	const message = err instanceof Error ? err.message : String(err);
 	process.stderr.write(`seekrit-mcp: fatal: ${message}\n`);
 	process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/mcp",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "npx-able MCP server for seekrit — let Claude Code and other MCP clients provision, manage, and inject end-to-end encrypted secrets.",
   "mcpName": "dev.seekrit/mcp",
   "type": "module",
@@ -17,14 +17,14 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "zod": "^4.4.3"
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
-    "vitest": "^4.1.9",
-    "@seekrit/cli": "0.46.0"
+    "vitest": "^4.1.11",
+    "@seekrit/cli": "1.2.2"
   },
   "scripts": {
     "build": "tsdown",