@seekrit/cli 0.0.1 → 0.2.0

package/dist/index.js

@@ -1,921 +1,1172 @@
 #!/usr/bin/env node
-
-// src/index.ts
-import { spawn } from "child_process";
-
-// ../../packages/crypto/src/encoding.ts
-var CHUNK = 32768;
+import { spawn } from "node:child_process";
+import { Command } from "commander";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, parse } from "node:path";
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+//#region ../../packages/crypto/src/encoding.ts
+const CHUNK = 32768;
+/** Base64url (no padding) — portable across browsers, Workers, and Node. */
 function toBase64Url(bytes) {
-  let binary = "";
-  for (let i = 0; i < bytes.length; i += CHUNK) {
-    binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
-  }
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+	let binary = "";
+	for (let i = 0; i < bytes.length; i += CHUNK) binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
 }
 function fromBase64Url(text) {
-  const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-  return bytes;
+	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
+	const binary = atob(base64);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
 }
 function utf8Encode(text) {
-  return new TextEncoder().encode(text);
+	return new TextEncoder().encode(text);
 }
 function utf8Decode(bytes) {
-  return new TextDecoder().decode(bytes);
+	return new TextDecoder().decode(bytes);
 }
-
-// ../../packages/crypto/src/errors.ts
+//#endregion
+//#region ../../packages/crypto/src/errors.ts
 var SeekritCryptoError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "SeekritCryptoError";
-    this.code = code;
-  }
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SeekritCryptoError";
+		this.code = code;
+	}
 };
+/**
+* Split a versioned blob like `sc1.<b64>.<b64>` and verify the prefix.
+* AES-GCM auth failure downstream surfaces as DECRYPT_FAILED — that is also
+* the "wrong passphrase" signal for passphrase-encrypted blobs.
+*/
 function splitBlob(blob, prefix, segments) {
-  const parts = blob.split(".");
-  if (parts[0] !== prefix) {
-    throw new SeekritCryptoError(
-      "UNSUPPORTED_VERSION",
-      `expected a "${prefix}" blob, got "${parts[0] ?? ""}"`
-    );
-  }
-  if (parts.length !== segments + 1 || parts.some((p) => p.length === 0)) {
-    throw new SeekritCryptoError("MALFORMED_BLOB", `malformed "${prefix}" blob`);
-  }
-  return parts.slice(1);
-}
-
-// ../../packages/crypto/src/aes.ts
-var SECRET_PREFIX = "sc1";
-var IV_LENGTH = 12;
+	const parts = blob.split(".");
+	if (parts[0] !== prefix) throw new SeekritCryptoError("UNSUPPORTED_VERSION", `expected a "${prefix}" blob, got "${parts[0] ?? ""}"`);
+	if (parts.length !== segments + 1 || parts.some((p) => p.length === 0)) throw new SeekritCryptoError("MALFORMED_BLOB", `malformed "${prefix}" blob`);
+	return parts.slice(1);
+}
+//#endregion
+//#region ../../packages/crypto/src/aes.ts
+const SECRET_PREFIX = "sc1";
+const IV_LENGTH = 12;
+/** Generate a fresh 256-bit data encryption key for an environment. */
 function generateDek() {
-  return crypto.getRandomValues(new Uint8Array(32));
+	return crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
 }
 async function importDek(dek, usage) {
-  return crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, [usage]);
+	return crypto.subtle.importKey("raw", dek, { name: "AES-GCM" }, false, [usage]);
 }
+/**
+* Encrypt a secret value with the environment DEK.
+*
+* @param aad Authenticated context binding the ciphertext to its location
+*   (e.g. `environmentId/SECRET_NAME`) so blobs cannot be swapped between
+*   secrets or environments without detection.
+*/
 async function encryptSecret(dek, plaintext, aad) {
-  const key = await importDek(dek, "encrypt");
-  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
-  const ciphertext = await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv, additionalData: utf8Encode(aad) },
-    key,
-    utf8Encode(plaintext)
-  );
-  return `${SECRET_PREFIX}.${toBase64Url(iv)}.${toBase64Url(new Uint8Array(ciphertext))}`;
+	const key = await importDek(dek, "encrypt");
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: utf8Encode(aad)
+	}, key, utf8Encode(plaintext));
+	return `${SECRET_PREFIX}.${toBase64Url(iv)}.${toBase64Url(new Uint8Array(ciphertext))}`;
 }
 async function decryptSecret(dek, blob, aad) {
-  const [ivB64, ctB64] = splitBlob(blob, SECRET_PREFIX, 2);
-  const key = await importDek(dek, "decrypt");
-  try {
-    const plaintext = await crypto.subtle.decrypt(
-      {
-        name: "AES-GCM",
-        iv: fromBase64Url(ivB64),
-        additionalData: utf8Encode(aad)
-      },
-      key,
-      fromBase64Url(ctB64)
-    );
-    return utf8Decode(new Uint8Array(plaintext));
-  } catch {
-    throw new SeekritCryptoError(
-      "DECRYPT_FAILED",
-      "secret decryption failed: wrong key, tampered data, or mismatched context"
-    );
-  }
+	const [ivB64, ctB64] = splitBlob(blob, SECRET_PREFIX, 2);
+	const key = await importDek(dek, "decrypt");
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64),
+			additionalData: utf8Encode(aad)
+		}, key, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "secret decryption failed: wrong key, tampered data, or mismatched context");
+	}
 }
+/** AAD binding a secret ciphertext to its environment + name. */
 function secretAad(environmentId, secretName) {
-  return `${environmentId}/${secretName}`;
+	return `${environmentId}/${secretName}`;
 }
-
-// ../../packages/crypto/src/keys.ts
+//#endregion
+//#region ../../packages/crypto/src/keys.ts
 async function generateKeyPair() {
-  const pair = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, [
-    "deriveBits"
-  ]);
-  const [publicJwk, privateJwk] = await Promise.all([
-    crypto.subtle.exportKey("jwk", pair.publicKey),
-    crypto.subtle.exportKey("jwk", pair.privateKey)
-  ]);
-  return {
-    publicKeyJwk: JSON.stringify(publicJwk),
-    privateKeyJwk: JSON.stringify(privateJwk)
-  };
+	const pair = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const [publicJwk, privateJwk] = await Promise.all([crypto.subtle.exportKey("jwk", pair.publicKey), crypto.subtle.exportKey("jwk", pair.privateKey)]);
+	return {
+		publicKeyJwk: JSON.stringify(publicJwk),
+		privateKeyJwk: JSON.stringify(privateJwk)
+	};
 }
 async function importPublicKey(publicKeyJwk) {
-  return crypto.subtle.importKey(
-    "jwk",
-    JSON.parse(publicKeyJwk),
-    { name: "ECDH", namedCurve: "P-256" },
-    true,
-    []
-  );
+	return crypto.subtle.importKey("jwk", JSON.parse(publicKeyJwk), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, []);
 }
 async function importPrivateKey(privateKeyJwk) {
-  return crypto.subtle.importKey(
-    "jwk",
-    JSON.parse(privateKeyJwk),
-    { name: "ECDH", namedCurve: "P-256" },
-    true,
-    ["deriveBits"]
-  );
+	return crypto.subtle.importKey("jwk", JSON.parse(privateKeyJwk), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
 }
 async function exportPrivateKeyPkcs8(key) {
-  return new Uint8Array(await crypto.subtle.exportKey("pkcs8", key));
+	return new Uint8Array(await crypto.subtle.exportKey("pkcs8", key));
 }
 async function importPrivateKeyPkcs8(pkcs8) {
-  return crypto.subtle.importKey(
-    "pkcs8",
-    pkcs8,
-    { name: "ECDH", namedCurve: "P-256" },
-    true,
-    ["deriveBits"]
-  );
-}
-
-// ../../packages/crypto/src/passphrase.ts
-var PK_PREFIX = "pk1";
-var PBKDF2_ITERATIONS = 6e5;
+	return crypto.subtle.importKey("pkcs8", pkcs8, {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+}
+//#endregion
+//#region ../../packages/crypto/src/passphrase.ts
+/**
+* User private keys are stored server-side encrypted under a key derived from
+* the user's passphrase, so any browser or CLI session can fetch and unlock
+* them without the server ever seeing the passphrase or plaintext key.
+*
+* KDF is PBKDF2-HMAC-SHA256 (WebCrypto-native everywhere). The blob embeds
+* its own salt + iteration count for future agility; bumping ITERATIONS only
+* affects newly written blobs. TODO: revisit Argon2id via WASM later.
+*
+* Blob format: `pk1.<iterations>.<salt>.<iv>.<ciphertext>`
+*/
+const PK_PREFIX = "pk1";
+/** OWASP-recommended minimum for PBKDF2-HMAC-SHA256. */
+const PBKDF2_ITERATIONS = 6e5;
 async function deriveKek(passphrase, salt, iterations, usage) {
-  const material = await crypto.subtle.importKey(
-    "raw",
-    utf8Encode(passphrase),
-    "PBKDF2",
-    false,
-    ["deriveKey"]
-  );
-  return crypto.subtle.deriveKey(
-    { name: "PBKDF2", hash: "SHA-256", salt, iterations },
-    material,
-    { name: "AES-GCM", length: 256 },
-    false,
-    [usage]
-  );
+	const material = await crypto.subtle.importKey("raw", utf8Encode(passphrase), "PBKDF2", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "PBKDF2",
+		hash: "SHA-256",
+		salt,
+		iterations
+	}, material, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
 }
 async function encryptPrivateKey(passphrase, privateKeyJwk) {
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const kek = await deriveKek(passphrase, salt, PBKDF2_ITERATIONS, "encrypt");
-  const ciphertext = await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv },
-    kek,
-    utf8Encode(privateKeyJwk)
-  );
-  return [
-    PK_PREFIX,
-    String(PBKDF2_ITERATIONS),
-    toBase64Url(salt),
-    toBase64Url(iv),
-    toBase64Url(new Uint8Array(ciphertext))
-  ].join(".");
+	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const kek = await deriveKek(passphrase, salt, PBKDF2_ITERATIONS, "encrypt");
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, kek, utf8Encode(privateKeyJwk));
+	return [
+		PK_PREFIX,
+		String(PBKDF2_ITERATIONS),
+		toBase64Url(salt),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
 }
+/** Wrong passphrase surfaces as SeekritCryptoError with code DECRYPT_FAILED. */
 async function decryptPrivateKey(passphrase, blob) {
-  const [iterStr, saltB64, ivB64, ctB64] = splitBlob(blob, PK_PREFIX, 4);
-  const iterations = Number.parseInt(iterStr, 10);
-  if (!Number.isFinite(iterations) || iterations < 1) {
-    throw new SeekritCryptoError("MALFORMED_BLOB", "invalid PBKDF2 iteration count");
-  }
-  const kek = await deriveKek(passphrase, fromBase64Url(saltB64), iterations, "decrypt");
-  try {
-    const plaintext = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: fromBase64Url(ivB64) },
-      kek,
-      fromBase64Url(ctB64)
-    );
-    return utf8Decode(new Uint8Array(plaintext));
-  } catch {
-    throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
-  }
-}
-
-// ../../packages/crypto/src/token.ts
-var TOKEN_PREFIX = "skt";
-var TOKEN_ID_LENGTH = 22;
-var ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+	const [iterStr, saltB64, ivB64, ctB64] = splitBlob(blob, PK_PREFIX, 4);
+	const iterations = Number.parseInt(iterStr, 10);
+	if (!Number.isFinite(iterations) || iterations < 1) throw new SeekritCryptoError("MALFORMED_BLOB", "invalid PBKDF2 iteration count");
+	const kek = await deriveKek(passphrase, fromBase64Url(saltB64), iterations, "decrypt");
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64)
+		}, kek, fromBase64Url(ctB64));
+		return utf8Decode(new Uint8Array(plaintext));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "wrong passphrase or corrupted key blob");
+	}
+}
+//#endregion
+//#region ../../packages/crypto/src/token.ts
+/**
+* Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
+* principals: the token string itself carries the private key, so the server
+* never holds it. The server stores only the SHA-256 hash of the full token
+* (for authentication) and the public key (for wrapping DEK grants).
+*
+* Format: `skt_<token id>_<private key pkcs8, base64url>`
+*/
+const TOKEN_PREFIX = "skt";
+const TOKEN_ID_LENGTH = 22;
+const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 function randomTokenId() {
-  let out = "";
-  while (out.length < TOKEN_ID_LENGTH) {
-    const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
-    for (const byte of bytes) {
-      if (byte < 248) out += ID_ALPHABET[byte % 62];
-      if (out.length === TOKEN_ID_LENGTH) break;
-    }
-  }
-  return `${TOKEN_PREFIX}_${out}`;
-}
-async function hashToken(token2) {
-  const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token2));
-  return toBase64Url(new Uint8Array(digest));
+	let out = "";
+	while (out.length < TOKEN_ID_LENGTH) {
+		const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += ID_ALPHABET[byte % 62];
+			if (out.length === TOKEN_ID_LENGTH) break;
+		}
+	}
+	return `${TOKEN_PREFIX}_${out}`;
+}
+async function hashToken(token) {
+	const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token));
+	return toBase64Url(new Uint8Array(digest));
 }
 async function createServiceToken() {
-  const { publicKeyJwk, privateKeyJwk } = await generateKeyPair();
-  const privateKey = await importPrivateKey(privateKeyJwk);
-  const pkcs8 = await exportPrivateKeyPkcs8(privateKey);
-  const tokenId = randomTokenId();
-  const token2 = `${tokenId}_${toBase64Url(pkcs8)}`;
-  return { token: token2, tokenId, tokenHash: await hashToken(token2), publicKeyJwk };
-}
-async function parseServiceToken(token2) {
-  const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token2);
-  if (!match) {
-    throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
-  }
-  const [, tokenId, keyB64] = match;
-  try {
-    const privateKey = await importPrivateKeyPkcs8(fromBase64Url(keyB64));
-    return { tokenId, privateKey };
-  } catch {
-    throw new SeekritCryptoError("MALFORMED_TOKEN", "service token private key is corrupted");
-  }
+	const { publicKeyJwk, privateKeyJwk } = await generateKeyPair();
+	const pkcs8 = await exportPrivateKeyPkcs8(await importPrivateKey(privateKeyJwk));
+	const tokenId = randomTokenId();
+	const token = `${tokenId}_${toBase64Url(pkcs8)}`;
+	return {
+		token,
+		tokenId,
+		tokenHash: await hashToken(token),
+		publicKeyJwk
+	};
+}
+async function parseServiceToken(token) {
+	const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
+	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
+	const [, tokenId, keyB64] = match;
+	try {
+		return {
+			tokenId,
+			privateKey: await importPrivateKeyPkcs8(fromBase64Url(keyB64))
+		};
+	} catch {
+		throw new SeekritCryptoError("MALFORMED_TOKEN", "service token private key is corrupted");
+	}
 }
 function isServiceToken(value) {
-  return value.startsWith(`${TOKEN_PREFIX}_`);
+	return value.startsWith(`${TOKEN_PREFIX}_`);
 }
-
-// ../../packages/crypto/src/wrap.ts
-var WRAP_PREFIX = "wd1";
-var HKDF_INFO = "seekrit/wrap-dek/v1";
+//#endregion
+//#region ../../packages/crypto/src/wrap.ts
+/**
+* ECIES-style key wrapping: an ephemeral P-256 keypair performs ECDH against
+* the recipient's public key; the shared secret is run through HKDF-SHA256 to
+* derive a one-time AES-256-GCM wrapping key. Only the holder of the
+* recipient private key can unwrap.
+*
+* Blob format: `wd1.<ephemeral pub (raw)>.<hkdf salt>.<iv>.<ciphertext>`
+*/
+const WRAP_PREFIX = "wd1";
+const HKDF_INFO = "seekrit/wrap-dek/v1";
 async function deriveWrappingKey(ownPrivateKey, peerPublicKey, salt, usage) {
-  const ecdh = { name: "ECDH", public: peerPublicKey };
-  const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
-  const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    {
-      name: "HKDF",
-      hash: "SHA-256",
-      salt,
-      info: utf8Encode(HKDF_INFO)
-    },
-    hkdfKey,
-    { name: "AES-GCM", length: 256 },
-    false,
-    [usage]
-  );
+	const ecdh = {
+		name: "ECDH",
+		public: peerPublicKey
+	};
+	const sharedBits = await crypto.subtle.deriveBits(ecdh, ownPrivateKey, 256);
+	const hkdfKey = await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt,
+		info: utf8Encode(HKDF_INFO)
+	}, hkdfKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
 }
+/** Wrap an environment DEK to a principal's public key. */
 async function wrapDek(dek, recipientPublicKeyJwk) {
-  const recipientKey = await importPublicKey(recipientPublicKeyJwk);
-  const ephemeral = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, [
-    "deriveBits"
-  ]);
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ciphertext = await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv },
-    wrappingKey,
-    dek
-  );
-  const ephemeralRaw = new Uint8Array(
-    await crypto.subtle.exportKey("raw", ephemeral.publicKey)
-  );
-  return [
-    WRAP_PREFIX,
-    toBase64Url(ephemeralRaw),
-    toBase64Url(salt),
-    toBase64Url(iv),
-    toBase64Url(new Uint8Array(ciphertext))
-  ].join(".");
+	const recipientKey = await importPublicKey(recipientPublicKeyJwk);
+	const ephemeral = await crypto.subtle.generateKey({
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, true, ["deriveBits"]);
+	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, recipientKey, salt, "encrypt");
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, wrappingKey, dek);
+	const ephemeralRaw = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	return [
+		WRAP_PREFIX,
+		toBase64Url(ephemeralRaw),
+		toBase64Url(salt),
+		toBase64Url(iv),
+		toBase64Url(new Uint8Array(ciphertext))
+	].join(".");
 }
+/** Unwrap an environment DEK with the principal's private ECDH key. */
 async function unwrapDek(wrapped, privateKey) {
-  const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
-  const ephemeralKey = await crypto.subtle.importKey(
-    "raw",
-    fromBase64Url(ephB64),
-    { name: "ECDH", namedCurve: "P-256" },
-    false,
-    []
-  );
-  const wrappingKey = await deriveWrappingKey(
-    privateKey,
-    ephemeralKey,
-    fromBase64Url(saltB64),
-    "decrypt"
-  );
-  try {
-    const dek = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: fromBase64Url(ivB64) },
-      wrappingKey,
-      fromBase64Url(ctB64)
-    );
-    return new Uint8Array(dek);
-  } catch {
-    throw new SeekritCryptoError(
-      "DECRYPT_FAILED",
-      "DEK unwrap failed: wrong private key or tampered grant"
-    );
-  }
-}
-
-// src/index.ts
-import { Command } from "commander";
-
-// src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join, parse } from "path";
-var DEFAULT_API_URL = "http://localhost:8787";
-var PROJECT_FILE = "seekrit.json";
+	const [ephB64, saltB64, ivB64, ctB64] = splitBlob(wrapped, WRAP_PREFIX, 4);
+	const wrappingKey = await deriveWrappingKey(privateKey, await crypto.subtle.importKey("raw", fromBase64Url(ephB64), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, false, []), fromBase64Url(saltB64), "decrypt");
+	try {
+		const dek = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64Url(ivB64)
+		}, wrappingKey, fromBase64Url(ctB64));
+		return new Uint8Array(dek);
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "DEK unwrap failed: wrong private key or tampered grant");
+	}
+}
+//#endregion
+//#region package.json
+var version = "0.2.0";
+const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
-  return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
+	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
 }
 function readGlobalConfig() {
-  const path = globalConfigPath();
-  if (!existsSync(path)) return {};
-  return JSON.parse(readFileSync(path, "utf8"));
+	const path = globalConfigPath();
+	if (!existsSync(path)) return {};
+	return JSON.parse(readFileSync(path, "utf8"));
 }
 function writeGlobalConfig(update) {
-  const path = globalConfigPath();
-  const merged = { ...readGlobalConfig(), ...update };
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(merged, null, 2)}
-`, { mode: 384 });
+	const path = globalConfigPath();
+	const merged = {
+		...readGlobalConfig(),
+		...update
+	};
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
 }
+/** Walk up from cwd looking for seekrit.json. */
 function findProjectConfig(startDir = process.cwd()) {
-  let dir = startDir;
-  const { root } = parse(dir);
-  while (true) {
-    const candidate = join(dir, PROJECT_FILE);
-    if (existsSync(candidate)) {
-      return JSON.parse(readFileSync(candidate, "utf8"));
-    }
-    if (dir === root) return null;
-    dir = dirname(dir);
-  }
+	let dir = startDir;
+	const { root } = parse(dir);
+	while (true) {
+		const candidate = join(dir, PROJECT_FILE);
+		if (existsSync(candidate)) return JSON.parse(readFileSync(candidate, "utf8"));
+		if (dir === root) return null;
+		dir = dirname(dir);
+	}
 }
 function writeProjectConfig(config, dir = process.cwd()) {
-  const path = join(dir, PROJECT_FILE);
-  writeFileSync(path, `${JSON.stringify(config, null, 2)}
-`);
-  return path;
+	const path = join(dir, PROJECT_FILE);
+	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`);
+	return path;
 }
-
-// ../../packages/api-client/src/index.ts
+//#endregion
+//#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
-  status;
-  code;
-  constructor(status, code, message) {
-    super(message);
-    this.name = "SeekritApiError";
-    this.status = status;
-    this.code = code;
-  }
+	status;
+	code;
+	constructor(status, code, message) {
+		super(message);
+		this.name = "SeekritApiError";
+		this.status = status;
+		this.code = code;
+	}
 };
 var SeekritClient = class {
-  baseUrl;
-  auth;
-  fetchImpl;
-  constructor(options) {
-    this.baseUrl = options.baseUrl.replace(/\/$/, "");
-    this.auth = options.auth;
-    this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
-  }
-  async request(method, path, body) {
-    const headers = { accept: "application/json" };
-    if (this.auth.type === "bearer") {
-      headers.authorization = `Bearer ${this.auth.token}`;
-    } else if (this.auth.type === "dynamic") {
-      const token2 = await this.auth.getToken();
-      if (!token2) throw new SeekritApiError(401, "unauthorized", "session expired");
-      headers.authorization = `Bearer ${token2}`;
-    } else {
-      headers["x-seekrit-dev-user"] = this.auth.email;
-    }
-    if (body !== void 0) headers["content-type"] = "application/json";
-    const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
-      method,
-      headers,
-      body: body === void 0 ? void 0 : JSON.stringify(body)
-    });
-    if (!res.ok) {
-      const fallback = { error: { code: "internal", message: `HTTP ${res.status}` } };
-      const payload = await res.json().catch(() => fallback);
-      throw new SeekritApiError(
-        res.status,
-        payload.error?.code ?? "internal",
-        payload.error?.message ?? `HTTP ${res.status}`
-      );
-    }
-    return await res.json();
-  }
-  // ── identity ────────────────────────────────────────────────────────────
-  me() {
-    return this.request("GET", "/v1/me");
-  }
-  getMyKeys() {
-    return this.request("GET", "/v1/me/keys");
-  }
-  setMyKeys(input) {
-    return this.request("PUT", "/v1/me/keys", input);
-  }
-  // ── organizations ───────────────────────────────────────────────────────
-  listOrgs() {
-    return this.request("GET", "/v1/orgs");
-  }
-  createOrg(input) {
-    return this.request("POST", "/v1/orgs", input);
-  }
-  getOrg(orgId) {
-    return this.request("GET", `/v1/orgs/${orgId}`);
-  }
-  listMembers(orgId) {
-    return this.request("GET", `/v1/orgs/${orgId}/members`);
-  }
-  // ── applications ────────────────────────────────────────────────────────
-  listApps(orgId) {
-    return this.request("GET", `/v1/orgs/${orgId}/apps`);
-  }
-  createApp(orgId, input) {
-    return this.request("POST", `/v1/orgs/${orgId}/apps`, input);
-  }
-  getApp(orgId, appId) {
-    return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}`);
-  }
-  deleteApp(orgId, appId) {
-    return this.request("DELETE", `/v1/orgs/${orgId}/apps/${appId}`);
-  }
-  // ── environments ────────────────────────────────────────────────────────
-  listEnvs(orgId, appId) {
-    return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/envs`);
-  }
-  createEnv(orgId, appId, input) {
-    return this.request("POST", `/v1/orgs/${orgId}/apps/${appId}/envs`, input);
-  }
-  getEnv(orgId, envId) {
-    return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
-  }
-  deleteEnv(orgId, envId) {
-    return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
-  }
-  // ── secrets (ciphertext only — encrypt/decrypt happens in the caller) ───
-  listSecrets(orgId, envId) {
-    return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/secrets`);
-  }
-  setSecret(orgId, envId, name, ciphertext) {
-    return this.request("PUT", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`, { ciphertext });
-  }
-  deleteSecret(orgId, envId, name) {
-    return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`);
-  }
-  // ── environment key grants ──────────────────────────────────────────────
-  /** The calling principal's wrapped DEK for this environment. */
-  getMyEnvKey(orgId, envId) {
-    return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
-  }
-  listEnvKeys(orgId, envId) {
-    return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/keys`);
-  }
-  grantEnvKey(orgId, envId, input) {
-    return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/keys`, input);
-  }
-  revokeEnvKey(orgId, envId, grantId) {
-    return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/keys/${grantId}`);
-  }
-  // ── service tokens ──────────────────────────────────────────────────────
-  listTokens(orgId) {
-    return this.request("GET", `/v1/orgs/${orgId}/tokens`);
-  }
-  createToken(orgId, input) {
-    return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
-  }
-  revokeToken(orgId, tokenId) {
-    return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
-  }
-  // ── audit ───────────────────────────────────────────────────────────────
-  listAudit(orgId, query = {}) {
-    const params = new URLSearchParams();
-    if (query.cursor) params.set("cursor", query.cursor);
-    if (query.limit) params.set("limit", String(query.limit));
-    if (query.action) params.set("action", query.action);
-    if (query.resourceType) params.set("resourceType", query.resourceType);
-    const qs = params.size > 0 ? `?${params}` : "";
-    return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
-  }
+	baseUrl;
+	auth;
+	fetchImpl;
+	constructor(options) {
+		this.baseUrl = options.baseUrl.replace(/\/$/, "");
+		this.auth = options.auth;
+		this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+	}
+	async request(method, path, body) {
+		const headers = { accept: "application/json" };
+		if (this.auth.type === "bearer") headers.authorization = `Bearer ${this.auth.token}`;
+		else if (this.auth.type === "dynamic") {
+			const token = await this.auth.getToken();
+			if (!token) throw new SeekritApiError(401, "unauthorized", "session expired");
+			headers.authorization = `Bearer ${token}`;
+		} else headers["x-seekrit-dev-user"] = this.auth.email;
+		if (body !== void 0) headers["content-type"] = "application/json";
+		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+			method,
+			headers,
+			body: body === void 0 ? void 0 : JSON.stringify(body)
+		});
+		if (!res.ok) {
+			const fallback = { error: {
+				code: "internal",
+				message: `HTTP ${res.status}`
+			} };
+			const payload = await res.json().catch(() => fallback);
+			throw new SeekritApiError(res.status, payload.error?.code ?? "internal", payload.error?.message ?? `HTTP ${res.status}`);
+		}
+		return await res.json();
+	}
+	me() {
+		return this.request("GET", "/v1/me");
+	}
+	getMyKeys() {
+		return this.request("GET", "/v1/me/keys");
+	}
+	setMyKeys(input) {
+		return this.request("PUT", "/v1/me/keys", input);
+	}
+	listOrgs() {
+		return this.request("GET", "/v1/orgs");
+	}
+	createOrg(input) {
+		return this.request("POST", "/v1/orgs", input);
+	}
+	getOrg(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}`);
+	}
+	listMembers(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/members`);
+	}
+	listApps(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps`);
+	}
+	createApp(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/apps`, input);
+	}
+	getApp(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}`);
+	}
+	deleteApp(orgId, appId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/apps/${appId}`);
+	}
+	listEnvs(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/envs`);
+	}
+	createEnv(orgId, appId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/apps/${appId}/envs`, input);
+	}
+	getEnv(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
+	}
+	deleteEnv(orgId, envId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
+	}
+	listGroups(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups`);
+	}
+	createGroup(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/groups`, input);
+	}
+	getGroup(orgId, groupId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}`);
+	}
+	deleteGroup(orgId, groupId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/groups/${groupId}`);
+	}
+	listGroupEnvs(orgId, groupId) {
+		return this.request("GET", `/v1/orgs/${orgId}/groups/${groupId}/envs`);
+	}
+	createGroupEnv(orgId, groupId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/groups/${groupId}/envs`, input);
+	}
+	listEnvGroups(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/groups`);
+	}
+	linkEnvGroup(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/groups`, input);
+	}
+	unlinkEnvGroup(orgId, envId, groupId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/groups/${groupId}`);
+	}
+	/** Ordered ciphertext layers + wrapped DEKs for the calling principal. */
+	resolve(query = {}) {
+		const params = new URLSearchParams();
+		if (query.env) params.set("env", query.env);
+		for (const [group, slug] of Object.entries(query.with ?? {})) params.append("with", `${group}:${slug}`);
+		const qs = params.size > 0 ? `?${params}` : "";
+		return this.request("GET", `/v1/resolve${qs}`);
+	}
+	listSecrets(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/secrets`);
+	}
+	setSecret(orgId, envId, name, ciphertext) {
+		return this.request("PUT", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`, { ciphertext });
+	}
+	deleteSecret(orgId, envId, name) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`);
+	}
+	/** The calling principal's wrapped DEK for this environment. */
+	getMyEnvKey(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/key`);
+	}
+	listEnvKeys(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/keys`);
+	}
+	grantEnvKey(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/keys`, input);
+	}
+	revokeEnvKey(orgId, envId, grantId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}/keys/${grantId}`);
+	}
+	listTokens(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/tokens`);
+	}
+	createToken(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
+	}
+	revokeToken(orgId, tokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
+	}
+	listAudit(orgId, query = {}) {
+		const params = new URLSearchParams();
+		if (query.cursor) params.set("cursor", query.cursor);
+		if (query.limit) params.set("limit", String(query.limit));
+		if (query.action) params.set("action", query.action);
+		if (query.resourceType) params.set("resourceType", query.resourceType);
+		const qs = params.size > 0 ? `?${params}` : "";
+		return this.request("GET", `/v1/orgs/${orgId}/audit${qs}`);
+	}
 };
-
-// src/io.ts
-import { createInterface } from "readline";
-import { Writable } from "stream";
+//#endregion
+//#region src/io.ts
 function fail(message) {
-  console.error(`error: ${message}`);
-  process.exit(1);
+	console.error(`error: ${message}`);
+	process.exit(1);
 }
+/** Prompt without echoing input (for passphrases). */
 function promptHidden(question) {
-  const muted = new Writable({
-    write(_chunk, _encoding, callback) {
-      callback();
-    }
-  });
-  process.stderr.write(question);
-  const rl = createInterface({ input: process.stdin, output: muted, terminal: true });
-  return new Promise((resolve) => {
-    rl.question("", (answer) => {
-      rl.close();
-      process.stderr.write("\n");
-      resolve(answer);
-    });
-  });
+	const muted = new Writable({ write(_chunk, _encoding, callback) {
+		callback();
+	} });
+	process.stderr.write(question);
+	const rl = createInterface({
+		input: process.stdin,
+		output: muted,
+		terminal: true
+	});
+	return new Promise((resolve) => {
+		rl.question("", (answer) => {
+			rl.close();
+			process.stderr.write("\n");
+			resolve(answer);
+		});
+	});
 }
+/** Read all of stdin (for `seekrit secrets set NAME -` piping). */
 async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8");
+}
+//#endregion
+//#region src/context.ts
+/**
+* Build the client context from configured credentials, or return null when
+* none are set. `seekrit run` uses this to degrade to a plain launcher instead
+* of exiting; every other command goes through `buildContext`, which fails.
+*/
+function tryBuildContext() {
+	const config = readGlobalConfig();
+	const apiUrl = process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "http://localhost:8787";
+	const token = process.env.SEEKRIT_TOKEN ?? config.token;
+	const devUser = process.env.SEEKRIT_DEV_USER ?? config.devUser;
+	let auth;
+	if (token) auth = {
+		type: "bearer",
+		token
+	};
+	else if (devUser) auth = {
+		type: "dev",
+		email: devUser
+	};
+	else return null;
+	return {
+		client: new SeekritClient({
+			baseUrl: apiUrl,
+			auth
+		}),
+		auth
+	};
 }
-
-// src/context.ts
 function buildContext() {
-  const config = readGlobalConfig();
-  const apiUrl = process.env.SEEKRIT_API_URL ?? config.apiUrl ?? DEFAULT_API_URL;
-  const token2 = process.env.SEEKRIT_TOKEN ?? config.token;
-  const devUser = process.env.SEEKRIT_DEV_USER ?? config.devUser;
-  let auth;
-  if (token2) auth = { type: "bearer", token: token2 };
-  else if (devUser) auth = { type: "dev", email: devUser };
-  else {
-    fail(
-      "no credentials found \u2014 run `seekrit login --token skt_\u2026`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER"
-    );
-  }
-  return { client: new SeekritClient({ baseUrl: apiUrl, auth }), auth };
-}
-function requireProject() {
-  const project = findProjectConfig();
-  if (!project) {
-    fail("no seekrit.json found \u2014 run `seekrit init` in your project directory");
-  }
-  return project;
+	const ctx = tryBuildContext();
+	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER");
+	return ctx;
 }
+function isTokenAuth(ctx) {
+	return ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token);
+}
+/**
+* Recover the calling principal's private key:
+*  - service tokens carry their private key in the token string;
+*  - users fetch their passphrase-encrypted key from the API and unlock it.
+*/
+async function getPrivateKey(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { privateKey } = await parseServiceToken(ctx.auth.token);
+		return privateKey;
+	}
+	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
+	return importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey));
+}
+/** Recover one environment's DEK for the current principal. */
 async function getDek(ctx, orgId, envId) {
-  const { wrappedDek } = await ctx.client.getMyEnvKey(orgId, envId);
-  if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
-    const { privateKey } = await parseServiceToken(ctx.auth.token);
-    return unwrapDek(wrappedDek, privateKey);
-  }
-  const { encryptedPrivateKey } = await ctx.client.getMyKeys();
-  const passphrase = process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: ");
-  const privateKeyJwk = await decryptPrivateKey(passphrase, encryptedPrivateKey);
-  return unwrapDek(wrappedDek, await importPrivateKey(privateKeyJwk));
-}
-
-// src/format.ts
+	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
+	return unwrapDek(wrappedDek, privateKey);
+}
+//#endregion
+//#region src/format.ts
 function needsQuoting(value) {
-  return /[\s"'`$\\#]/.test(value) || value === "";
+	return /[\s"'`$\\#]/.test(value) || value === "";
 }
 function dotenvQuote(value) {
-  if (!needsQuoting(value)) return value;
-  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\n", "\\n")}"`;
+	if (!needsQuoting(value)) return value;
+	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n")}"`;
 }
 function shellQuote(value) {
-  return `'${value.replaceAll("'", `'\\''`)}'`;
+	return `'${value.replaceAll("'", `'\\''`)}'`;
 }
 function formatSecrets(values, format) {
-  const names = Object.keys(values).sort();
-  switch (format) {
-    case "json":
-      return JSON.stringify(values, names, 2);
-    case "shell":
-      return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
-    case "dotenv":
-      return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
-  }
-}
-
-// src/secrets.ts
+	const names = Object.keys(values).sort();
+	switch (format) {
+		case "json": return JSON.stringify(values, names, 2);
+		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
+		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+	}
+}
+//#endregion
+//#region src/dotenv.ts
+/**
+* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
+* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
+* escapes; unquoted values drop trailing ` # comments`). Multiline values are
+* not supported — keep those in seekrit itself.
+*/
+function parseDotenv(content) {
+	const out = {};
+	for (const raw of content.split(/\r?\n/)) {
+		let line = raw.trim();
+		if (!line || line.startsWith("#")) continue;
+		if (line.startsWith("export ")) line = line.slice(7).trimStart();
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		const key = line.slice(0, eq).trim();
+		if (!key) continue;
+		let value = line.slice(eq + 1).trim();
+		const quote = value[0];
+		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
+			value = value.slice(1, -1);
+			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+		} else {
+			const comment = value.indexOf(" #");
+			if (comment !== -1) value = value.slice(0, comment).trim();
+		}
+		out[key] = value;
+	}
+	return out;
+}
+//#endregion
+//#region src/secrets.ts
+/** Fetch + decrypt every secret in a single environment. */
 async function fetchDecryptedSecrets(ctx, orgId, envId) {
-  const [dek, { secrets: secrets2 }] = await Promise.all([
-    getDek(ctx, orgId, envId),
-    ctx.client.listSecrets(orgId, envId)
-  ]);
-  const entries = await Promise.all(
-    secrets2.map(
-      async (secret) => [
-        secret.name,
-        await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))
-      ]
-    )
-  );
-  return Object.fromEntries(entries);
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
+	return Object.fromEntries(entries);
 }
 async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
-  const dek = await getDek(ctx, orgId, envId);
-  const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
-  await ctx.client.setSecret(orgId, envId, name, ciphertext);
-}
-
-// package.json
-var version = "0.0.1";
-
-// src/index.ts
-var program = new Command("seekrit").description("End-to-end encrypted secrets manager").version(version).enablePositionalOptions();
-program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_\u2026)").option(
-  "--dev-user <email>",
-  "dev-mode identity (local API with AUTH_MODE=dev)"
-).option("--api-url <url>", "API base URL").action((options) => {
-  if (options.token && !isServiceToken(options.token))
-    fail("token must start with skt_");
-  writeGlobalConfig({
-    ...options.token ? { token: options.token } : {},
-    ...options.devUser ? { devUser: options.devUser } : {},
-    ...options.apiUrl ? { apiUrl: options.apiUrl } : {}
-  });
-  console.error("credentials saved");
+	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
+	await ctx.client.setSecret(orgId, envId, name, ciphertext);
+}
+/**
+* Resolve the full, layered environment for a running app: composed group
+* secrets (lowest precedence) → the app env's own secrets → `.env` files.
+* Each layer's DEK is unwrapped once with the principal's private key and its
+* ciphertext decrypted locally. `process.env` is NOT applied here — callers
+* that spawn a process layer it on top so the live shell always wins.
+*/
+async function materializeEnv(ctx, opts) {
+	const query = {};
+	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (!isTokenAuth(ctx)) {
+		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
+		query.env = opts.envId;
+	}
+	const { scope, layers } = await ctx.client.resolve(query);
+	const privateKey = await getPrivateKey(ctx);
+	const values = {};
+	const provenance = {};
+	for (const layer of layers) {
+		const dek = await unwrapDek(layer.wrappedDek, privateKey);
+		const label = layer.source === "group" ? `group:${layer.groupSlug}@${layer.slug}` : `app:${scope.appSlug}/${layer.slug}`;
+		for (const secret of layer.secrets) {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
+			provenance[secret.name] = label;
+		}
+	}
+	return {
+		values,
+		provenance,
+		scope,
+		loadedEnvFiles: overlayEnvFiles(values, provenance, opts.envFiles)
+	};
+}
+/**
+* Overlay `.env` files onto an existing value/provenance set (later files win).
+* Missing files are skipped. Returns the files that were actually loaded. Used
+* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
+* managed secrets are unavailable but `.env` should still apply.
+*/
+function overlayEnvFiles(values, provenance, envFiles) {
+	const loaded = [];
+	for (const file of envFiles) {
+		if (!existsSync(file)) continue;
+		loaded.push(file);
+		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
+			values[name] = value;
+			provenance[name] = `dotenv:${file}`;
+		}
+	}
+	return loaded;
+}
+/** Print a name → source table to stderr (never the secret values). */
+function printExplain(provenance) {
+	const names = Object.keys(provenance).sort();
+	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
+	for (const name of names) process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}\n`);
+}
+//#endregion
+//#region src/target.ts
+/** Resolve the target org from a flag, the committed config, or a lone org. */
+async function resolveOrg(ctx, orgSlug) {
+	const wanted = orgSlug ?? findProjectConfig()?.org;
+	const { orgs } = await ctx.client.listOrgs();
+	if (wanted) {
+		const org = orgs.find((o) => o.slug === wanted || o.id === wanted);
+		if (!org) fail(`no accessible org "${wanted}"`);
+		return {
+			id: org.id,
+			slug: org.slug
+		};
+	}
+	const only = orgs[0];
+	if (orgs.length === 1 && only) return {
+		id: only.id,
+		slug: only.slug
+	};
+	fail("specify --org (or run `seekrit init`)");
+}
+/**
+* Resolve an environment to operate on — an application env (`--app --env`,
+* or the config's app + `--env`) or a group env (`--group --env`).
+*/
+async function resolveEnvTarget(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.env) fail("specify --env");
+	if (opts.group) {
+		const { groups } = await ctx.client.listGroups(org.id);
+		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+		const { environments } = await ctx.client.listGroupEnvs(org.id, group.id);
+		const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+		if (!env) fail(`no environment "${opts.env}" in group ${group.slug}`);
+		return {
+			orgId: org.id,
+			envId: env.id,
+			label: `${group.slug}@${env.slug}`
+		};
+	}
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		envId: env.id,
+		label: `${app.slug}/${env.slug}`
+	};
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	const appSlug = opts.app ?? findProjectConfig()?.app;
+	if (!appSlug) fail("specify --app (or run `seekrit init`)");
+	if (!opts.env) fail("specify --env");
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
+	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
+	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	return {
+		orgId: org.id,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+}
+/** Resolve a group by slug within the target org. */
+async function resolveGroup(ctx, opts) {
+	const org = await resolveOrg(ctx, opts.org);
+	if (!opts.group) fail("specify --group");
+	const { groups } = await ctx.client.listGroups(org.id);
+	const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
+	if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
+	return {
+		orgId: org.id,
+		id: group.id,
+		slug: group.slug
+	};
+}
+//#endregion
+//#region src/index.ts
+/** Collect repeated `--with group=env` flags into a map. */
+function collectKv(value, acc = {}) {
+	const eq = value.indexOf("=");
+	if (eq === -1) fail(`expected group=env, got "${value}"`);
+	acc[value.slice(0, eq)] = value.slice(eq + 1);
+	return acc;
+}
+/** Collect repeated flags (e.g. --env-file) into a list. */
+function collectList(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+const program = new Command("seekrit").description("End-to-end encrypted secrets manager").version(version).enablePositionalOptions();
+program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_…)").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").action((options) => {
+	if (options.token && !isServiceToken(options.token)) fail("token must start with skt_");
+	writeGlobalConfig({
+		...options.token ? { token: options.token } : {},
+		...options.devUser ? { devUser: options.devUser } : {},
+		...options.apiUrl ? { apiUrl: options.apiUrl } : {}
+	});
+	console.error("credentials saved");
 });
 program.command("whoami").description("show the authenticated identity").action(async () => {
-  const ctx = buildContext();
-  if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
-    const { tokenId } = await parseServiceToken(ctx.auth.token);
-    const { orgs: orgs2 } = await ctx.client.listOrgs();
-    console.log(
-      `service token ${tokenId} (org: ${orgs2[0]?.slug ?? "unknown"})`
-    );
-    return;
-  }
-  const { user, orgs } = await ctx.client.me();
-  console.log(
-    `${user.email}${user.hasKeys ? "" : "  (key setup pending \u2014 run `seekrit keys setup`)"}`
-  );
-  for (const org2 of orgs) console.log(`  ${org2.slug} (${org2.role})`);
+	const ctx = buildContext();
+	if (isTokenAuth(ctx) && ctx.auth.type === "bearer") {
+		const { tokenId } = await parseServiceToken(ctx.auth.token);
+		try {
+			const { scope } = await ctx.client.resolve();
+			console.log(`service token ${tokenId} → ${scope.orgSlug}/${scope.appSlug}/${scope.envSlug}`);
+		} catch {
+			const { orgs } = await ctx.client.listOrgs();
+			console.log(`service token ${tokenId} (org: ${orgs[0]?.slug ?? "unknown"})`);
+		}
+		return;
+	}
+	const { user, orgs } = await ctx.client.me();
+	console.log(`${user.email}${user.hasKeys ? "" : "  (key setup pending — run `seekrit keys setup`)"}`);
+	for (const org of orgs) console.log(`  ${org.slug} (${org.role})`);
+});
+program.command("keys").description("manage your encryption keys").command("setup").description("generate your keypair and protect it with a passphrase").action(async () => {
+	const ctx = buildContext();
+	const passphrase = process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("New passphrase: ");
+	if (!process.env.SEEKRIT_PASSPHRASE) {
+		if (await promptHidden("Confirm passphrase: ") !== passphrase) fail("passphrases do not match");
+	}
+	if (passphrase.length < 8) fail("passphrase must be at least 8 characters");
+	const pair = await generateKeyPair();
+	const encryptedPrivateKey = await encryptPrivateKey(passphrase, pair.privateKeyJwk);
+	await ctx.client.setMyKeys({
+		publicKeyJwk: pair.publicKeyJwk,
+		encryptedPrivateKey
+	});
+	console.error("keys generated and uploaded — your passphrase never leaves this machine");
 });
-var keys = program.command("keys").description("manage your encryption keys");
-keys.command("setup").description("generate your keypair and protect it with a passphrase").action(async () => {
-  const ctx = buildContext();
-  const passphrase = process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("New passphrase: ");
-  if (!process.env.SEEKRIT_PASSPHRASE) {
-    const confirm = await promptHidden("Confirm passphrase: ");
-    if (confirm !== passphrase) fail("passphrases do not match");
-  }
-  if (passphrase.length < 8) fail("passphrase must be at least 8 characters");
-  const pair = await generateKeyPair();
-  const encryptedPrivateKey = await encryptPrivateKey(
-    passphrase,
-    pair.privateKeyJwk
-  );
-  await ctx.client.setMyKeys({
-    publicKeyJwk: pair.publicKeyJwk,
-    encryptedPrivateKey
-  });
-  console.error(
-    "keys generated and uploaded \u2014 your passphrase never leaves this machine"
-  );
+program.command("init").description("link this directory to an org/app (environment comes from the token)").requiredOption("--org <slug>", "organization slug").requiredOption("--app <slug>", "application slug").action(async (options) => {
+	const ctx = buildContext();
+	const org = await resolveOrg(ctx, options.org);
+	const { apps } = await ctx.client.listApps(org.id);
+	const app = apps.find((a) => a.slug === options.app || a.id === options.app);
+	if (!app) fail(`no app "${options.app}" in ${org.slug}`);
+	const path = writeProjectConfig({
+		org: org.slug,
+		app: app.slug
+	});
+	console.error(`linked ${org.slug}/${app.slug} → ${path} (environment is selected by the service token at runtime)`);
 });
-program.command("init").description("link this directory to an org/app/environment").requiredOption("--org <slug>", "organization slug").requiredOption("--app <slug>", "application slug").requiredOption("--env <slug>", "environment slug").action(async (options) => {
-  const ctx = buildContext();
-  const { orgs } = await ctx.client.listOrgs();
-  const org2 = orgs.find(
-    (o) => o.slug === options.org || o.id === options.org
-  );
-  if (!org2) fail(`no accessible org "${options.org}"`);
-  const { apps } = await ctx.client.listApps(org2.id);
-  const app2 = apps.find(
-    (a) => a.slug === options.app || a.id === options.app
-  );
-  if (!app2) fail(`no app "${options.app}" in ${org2.slug}`);
-  const { environments } = await ctx.client.listEnvs(org2.id, app2.id);
-  const env2 = environments.find(
-    (e) => e.slug === options.env || e.id === options.env
-  );
-  if (!env2) fail(`no environment "${options.env}" in ${app2.slug}`);
-  const path = writeProjectConfig({
-    orgId: org2.id,
-    appId: app2.id,
-    envId: env2.id,
-    org: org2.slug,
-    app: app2.slug,
-    env: env2.slug
-  });
-  console.error(`linked ${org2.slug}/${app2.slug}/${env2.slug} \u2192 ${path}`);
+program.command("org").description("manage organizations").command("create").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	const created = await buildContext().client.createOrg({
+		name: options.name,
+		slug: options.slug
+	});
+	console.error(`created org ${created.org.slug} (${created.org.id})`);
 });
-var org = program.command("org").description("manage organizations");
-org.command("create").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
-  const ctx = buildContext();
-  const created = await ctx.client.createOrg({
-    name: options.name,
-    slug: options.slug
-  });
-  console.error(`created org ${created.org.slug} (${created.org.id})`);
+program.command("app").description("manage applications").command("create").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	const ctx = buildContext();
+	const orgRef = await resolveOrg(ctx, options.org);
+	const created = await ctx.client.createApp(orgRef.id, {
+		name: options.name,
+		slug: options.slug
+	});
+	console.error(`created app ${created.app.slug} (${created.app.id})`);
 });
-var app = program.command("app").description("manage applications");
-app.command("create").requiredOption("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
-  const ctx = buildContext();
-  const { orgs } = await ctx.client.listOrgs();
-  const orgRow = orgs.find(
-    (o) => o.slug === options.org || o.id === options.org
-  );
-  if (!orgRow) fail(`no accessible org "${options.org}"`);
-  const created = await ctx.client.createApp(orgRow.id, {
-    name: options.name,
-    slug: options.slug
-  });
-  console.error(`created app ${created.app.slug} (${created.app.id})`);
+const env = program.command("env").description("manage environments");
+env.command("create").description("create an application environment (generates its data key locally)").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	const ctx = buildContext();
+	const orgRef = await resolveOrg(ctx, options.org);
+	const { apps } = await ctx.client.listApps(orgRef.id);
+	const appRow = apps.find((a) => a.slug === options.app || a.id === options.app);
+	if (!appRow) fail(`no app "${options.app}" in ${orgRef.slug}`);
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+	const wrappedDek = await wrapDek(generateDek(), user.publicKeyJwk);
+	const created = await ctx.client.createEnv(orgRef.id, appRow.id, {
+		name: options.name,
+		slug: options.slug,
+		wrappedDek
+	});
+	console.error(`created environment ${created.environment.slug} (${created.environment.id})`);
 });
-var env = program.command("env").description("manage environments");
-env.command("create").description("create an environment (generates its data key locally)").requiredOption("--org <slug>").requiredOption("--app <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(
-  async (options) => {
-    const ctx = buildContext();
-    const { orgs } = await ctx.client.listOrgs();
-    const orgRow = orgs.find(
-      (o) => o.slug === options.org || o.id === options.org
-    );
-    if (!orgRow) fail(`no accessible org "${options.org}"`);
-    const { apps } = await ctx.client.listApps(orgRow.id);
-    const appRow = apps.find(
-      (a) => a.slug === options.app || a.id === options.app
-    );
-    if (!appRow) fail(`no app "${options.app}" in ${orgRow.slug}`);
-    const { user } = await ctx.client.me();
-    if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
-    const dek = generateDek();
-    const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
-    const created = await ctx.client.createEnv(orgRow.id, appRow.id, {
-      name: options.name,
-      slug: options.slug,
-      wrappedDek
-    });
-    console.error(
-      `created environment ${created.environment.slug} (${created.environment.id})`
-    );
-  }
-);
-var secrets = program.command("secrets").description("manage secrets in the linked environment");
-secrets.command("list").description("list secret names (no values)").action(async () => {
-  const ctx = buildContext();
-  const project = requireProject();
-  const { secrets: rows } = await ctx.client.listSecrets(
-    project.orgId,
-    project.envId
-  );
-  for (const row of rows)
-    console.log(`${row.name}	v${row.version}	${row.updatedAt}`);
+const envGroups = env.command("groups").description("compose shared groups into an application environment");
+envGroups.command("add").description("compose a group into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").option("--position <n>", "precedence among groups (higher wins)").action(async (options) => {
+	const ctx = buildContext();
+	const target = await resolveAppEnv(ctx, options);
+	const group = await resolveGroup(ctx, {
+		org: options.org,
+		group: options.group
+	});
+	await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+		groupId: group.id,
+		position: options.position === void 0 ? void 0 : Number.parseInt(options.position, 10)
+	});
+	console.error(`composed ${group.slug} into ${target.appSlug}/${target.envSlug}`);
 });
-secrets.command("get <name>").description("decrypt and print one secret value").action(async (name) => {
-  const ctx = buildContext();
-  const project = requireProject();
-  const values = await fetchDecryptedSecrets(
-    ctx,
-    project.orgId,
-    project.envId
-  );
-  const value = values[name];
-  if (value === void 0) fail(`no secret named ${name}`);
-  process.stdout.write(value);
-  if (process.stdout.isTTY) process.stdout.write("\n");
+envGroups.command("list").description("list groups composed into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").action(async (options) => {
+	const ctx = buildContext();
+	const target = await resolveAppEnv(ctx, options);
+	const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
+	for (const g of groups) console.log(`${g.position}\t${g.slug}\t${g.name}`);
 });
-secrets.command("set <name> [value]").description(
-  "encrypt and store a secret (reads stdin when value is omitted or '-')"
-).action(async (name, value) => {
-  const ctx = buildContext();
-  const project = requireProject();
-  const plaintext = value === void 0 || value === "-" ? (await readStdin()).replace(/\n$/, "") : value;
-  await encryptAndSetSecret(
-    ctx,
-    project.orgId,
-    project.envId,
-    name,
-    plaintext
-  );
-  console.error(`${name} saved`);
+envGroups.command("rm").description("remove a group from an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").action(async (options) => {
+	const ctx = buildContext();
+	const target = await resolveAppEnv(ctx, options);
+	const group = await resolveGroup(ctx, {
+		org: options.org,
+		group: options.group
+	});
+	await ctx.client.unlinkEnvGroup(target.orgId, target.envId, group.id);
+	console.error(`removed ${group.slug} from ${target.appSlug}/${target.envSlug}`);
 });
-secrets.command("rm <name>").description("delete a secret").action(async (name) => {
-  const ctx = buildContext();
-  const project = requireProject();
-  await ctx.client.deleteSecret(project.orgId, project.envId, name);
-  console.error(`${name} deleted`);
+const group = program.command("group").description("manage shared groups (reusable secret bags)");
+group.command("create").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	const ctx = buildContext();
+	const orgRef = await resolveOrg(ctx, options.org);
+	const created = await ctx.client.createGroup(orgRef.id, {
+		name: options.name,
+		slug: options.slug
+	});
+	console.error(`created group ${created.group.slug} (${created.group.id})`);
 });
-program.command("run").description(
-  "run a command with decrypted secrets injected into its environment"
-).passThroughOptions().argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts) => {
-  const ctx = buildContext();
-  const project = requireProject();
-  const values = await fetchDecryptedSecrets(
-    ctx,
-    project.orgId,
-    project.envId
-  );
-  const [cmd, ...args] = commandParts;
-  if (!cmd) fail("no command given");
-  const child = spawn(cmd, args, {
-    stdio: "inherit",
-    env: { ...process.env, ...values }
-  });
-  child.on("exit", (code, signal) => {
-    if (signal) process.kill(process.pid, signal);
-    process.exit(code ?? 1);
-  });
-  child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
+group.command("env").description("manage a group’s environments (per-slug value sets / variants)").command("create").description("create a group environment (generates its data key locally)").option("--org <slug>").requiredOption("--group <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	const ctx = buildContext();
+	const groupRef = await resolveGroup(ctx, {
+		org: options.org,
+		group: options.group
+	});
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+	const wrappedDek = await wrapDek(generateDek(), user.publicKeyJwk);
+	const created = await ctx.client.createGroupEnv(groupRef.orgId, groupRef.id, {
+		name: options.name,
+		slug: options.slug,
+		wrappedDek
+	});
+	console.error(`created ${groupRef.slug}@${created.environment.slug} (${created.environment.id})`);
+});
+/** Attach the environment-selection flags shared by every `secrets` command. */
+function withTarget(cmd) {
+	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>", "environment slug");
+}
+const secrets = program.command("secrets").description("manage secrets in an application or group environment");
+withTarget(secrets.command("list").description("list secret names (no values)")).action(async (options) => {
+	const ctx = buildContext();
+	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	const { secrets: rows } = await ctx.client.listSecrets(orgId, envId);
+	for (const row of rows) console.log(`${row.name}\tv${row.version}\t${row.updatedAt}`);
+});
+withTarget(secrets.command("get <name>").description("decrypt and print one secret value")).action(async (name, options) => {
+	const ctx = buildContext();
+	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	const value = (await fetchDecryptedSecrets(ctx, orgId, envId))[name];
+	if (value === void 0) fail(`no secret named ${name}`);
+	process.stdout.write(value);
+	if (process.stdout.isTTY) process.stdout.write("\n");
+});
+withTarget(secrets.command("set <name> [value]").description("encrypt and store a secret (reads stdin when value is omitted or '-')")).action(async (name, value, options) => {
+	const ctx = buildContext();
+	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	await encryptAndSetSecret(ctx, orgId, envId, name, value === void 0 || value === "-" ? (await readStdin()).replace(/\n$/, "") : value);
+	console.error(`${name} saved`);
+});
+withTarget(secrets.command("rm <name>").description("delete a secret")).action(async (name, options) => {
+	const ctx = buildContext();
+	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	await ctx.client.deleteSecret(orgId, envId, name);
+	console.error(`${name} deleted`);
+});
+/** Resolve the layered environment for the current principal. */
+async function materialize(ctx, options) {
+	let envId;
+	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, options)).envId;
+	return materializeEnv(ctx, {
+		envId,
+		with: options.with,
+		envFiles: options.envFile ?? [".env"]
+	});
+}
+/**
+* Best-effort variant of {@link materialize} for `seekrit run`: if credentials
+* are missing or seekrit can't be reached (network, auth, or decryption
+* failure), log why and fall back to the `.env` overlay alone so the command
+* still runs. This keeps `seekrit run` working across environments that lack a
+* token or API — mirroring the `seekrit-run` launcher.
+*/
+async function materializeForRun(options) {
+	const envFiles = options.envFile ?? [".env"];
+	try {
+		const ctx = tryBuildContext();
+		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
+		return await materialize(ctx, options);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		console.error(`seekrit: continuing without seekrit-managed secrets: ${message}`);
+		const values = {};
+		const provenance = {};
+		overlayEnvFiles(values, provenance, envFiles);
+		return {
+			values,
+			provenance
+		};
+	}
+}
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+	const [cmd, ...args] = commandParts;
+	if (!cmd) fail("no command given");
+	const { values, provenance } = await materializeForRun(options);
+	if (options.explain) {
+		for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
+		printExplain(provenance);
+	}
+	const child = spawn(cmd, args, {
+		stdio: "inherit",
+		env: {
+			...values,
+			...process.env
+		}
+	});
+	child.on("exit", (code, signal) => {
+		if (signal) process.kill(process.pid, signal);
+		process.exit(code ?? 1);
+	});
+	child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
 });
-program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
-  if (!["dotenv", "json", "shell"].includes(options.format)) {
-    fail("format must be dotenv, json, or shell");
-  }
-  const ctx = buildContext();
-  const project = requireProject();
-  const values = await fetchDecryptedSecrets(
-    ctx,
-    project.orgId,
-    project.envId
-  );
-  console.log(formatSecrets(values, options.format));
+program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
+	if (![
+		"dotenv",
+		"json",
+		"shell"
+	].includes(options.format)) fail("format must be dotenv, json, or shell");
+	const { values, provenance } = await materialize(buildContext(), options);
+	if (options.explain) printExplain(provenance);
+	console.log(formatSecrets(values, options.format));
 });
-program.command("grant").description(
-  "give a member or service token access to the linked environment's key"
-).option("--user <email>", "grant to an org member by email").option("--token <tokenId>", "grant to a service token by id (skt_\u2026)").action(async (options) => {
-  if (!options.user === !options.token)
-    fail("pass exactly one of --user or --token");
-  const ctx = buildContext();
-  const project = requireProject();
-  const dek = await getDek(ctx, project.orgId, project.envId);
-  let principalType;
-  let principalId;
-  let publicKeyJwk;
-  if (options.user) {
-    const { members } = await ctx.client.listMembers(project.orgId);
-    const member = members.find((m) => m.email === options.user);
-    if (!member) fail(`no member ${options.user}`);
-    if (!member.publicKeyJwk)
-      fail(`${options.user} has not completed key setup`);
-    [principalType, principalId, publicKeyJwk] = [
-      "user",
-      member.userId,
-      member.publicKeyJwk
-    ];
-  } else {
-    const { tokens } = await ctx.client.listTokens(project.orgId);
-    const token2 = tokens.find((t) => t.id === options.token);
-    if (!token2) fail(`no service token ${options.token}`);
-    [principalType, principalId, publicKeyJwk] = [
-      "service_token",
-      token2.id,
-      token2.publicKeyJwk
-    ];
-  }
-  const wrappedDek = await wrapDek(dek, publicKeyJwk);
-  await ctx.client.grantEnvKey(project.orgId, project.envId, {
-    principalType,
-    principalId,
-    wrappedDek
-  });
-  console.error(
-    `granted ${project.env ?? project.envId} access to ${principalId}`
-  );
+program.command("grant").description("give a member or service token access to an environment's key").option("--org <slug>").option("--app <slug>").option("--group <slug>", "grant a group environment instead of an app").requiredOption("--env <slug>").option("--user <email>", "grant to an org member by email").option("--token <tokenId>", "grant to a service token by id (skt_…)").action(async (options) => {
+	if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+	const ctx = buildContext();
+	const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+	const dek = await getDek(ctx, orgId, envId);
+	let principalType;
+	let principalId;
+	let publicKeyJwk;
+	if (options.user) {
+		const { members } = await ctx.client.listMembers(orgId);
+		const member = members.find((m) => m.email === options.user);
+		if (!member) fail(`no member ${options.user}`);
+		if (!member.publicKeyJwk) fail(`${options.user} has not completed key setup`);
+		[principalType, principalId, publicKeyJwk] = [
+			"user",
+			member.userId,
+			member.publicKeyJwk
+		];
+	} else {
+		const { tokens } = await ctx.client.listTokens(orgId);
+		const token = tokens.find((t) => t.id === options.token);
+		if (!token) fail(`no service token ${options.token}`);
+		[principalType, principalId, publicKeyJwk] = [
+			"service_token",
+			token.id,
+			token.publicKeyJwk
+		];
+	}
+	const wrappedDek = await wrapDek(dek, publicKeyJwk);
+	await ctx.client.grantEnvKey(orgId, envId, {
+		principalType,
+		principalId,
+		wrappedDek
+	});
+	console.error(`granted ${label} access to ${principalId}`);
 });
-var token = program.command("token").description("manage service tokens (CI, docker, agents)");
-token.command("create").description("create a service token; prints the token once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--grant", "also grant access to the linked environment").action(async (options) => {
-  const ctx = buildContext();
-  const project = requireProject();
-  const created = await createServiceToken();
-  await ctx.client.createToken(project.orgId, {
-    name: options.name,
-    tokenId: created.tokenId,
-    tokenHash: created.tokenHash,
-    publicKeyJwk: created.publicKeyJwk
-  });
-  if (options.grant) {
-    const dek = await getDek(ctx, project.orgId, project.envId);
-    const wrappedDek = await wrapDek(dek, created.publicKeyJwk);
-    await ctx.client.grantEnvKey(project.orgId, project.envId, {
-      principalType: "service_token",
-      principalId: created.tokenId,
-      wrappedDek
-    });
-  }
-  console.error(
-    `token created${options.grant ? " and granted" : ""} \u2014 save it now, it is not stored:`
-  );
-  console.log(created.token);
+const token = program.command("token").description("manage service tokens (CI, docker, agents)");
+token.command("create").description("create a service token bound to an app environment; prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>").requiredOption("--app <slug>", "application to bind the token to").requiredOption("--env <slug>", "environment to bind the token to").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
+	const ctx = buildContext();
+	const target = await resolveAppEnv(ctx, options);
+	const created = await createServiceToken();
+	await ctx.client.createToken(target.orgId, {
+		name: options.name,
+		tokenId: created.tokenId,
+		tokenHash: created.tokenHash,
+		publicKeyJwk: created.publicKeyJwk,
+		environmentId: target.envId
+	});
+	const grantEnv = async (envId) => {
+		const dek = await getDek(ctx, target.orgId, envId);
+		await ctx.client.grantEnvKey(target.orgId, envId, {
+			principalType: "service_token",
+			principalId: created.tokenId,
+			wrappedDek: await wrapDek(dek, created.publicKeyJwk)
+		});
+	};
+	if (options.grant !== false) {
+		await grantEnv(target.envId);
+		const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
+		for (const g of groups) {
+			const { environments } = await ctx.client.listGroupEnvs(target.orgId, g.groupId);
+			const slice = environments.find((e) => e.slug === target.envSlug);
+			if (!slice) fail(`group "${g.slug}" has no "${target.envSlug}" environment — create it before granting`);
+			await grantEnv(slice.id);
+		}
+		for (const [groupSlug, envSlug] of Object.entries(options.allow ?? {})) {
+			const groupRef = await resolveGroup(ctx, {
+				org: options.org,
+				group: groupSlug
+			});
+			const { environments } = await ctx.client.listGroupEnvs(target.orgId, groupRef.id);
+			const slice = environments.find((e) => e.slug === envSlug);
+			if (!slice) fail(`group "${groupSlug}" has no "${envSlug}" environment`);
+			await grantEnv(slice.id);
+		}
+	}
+	console.error(`token created${options.grant !== false ? " and granted" : ""} for ${target.appSlug}/${target.envSlug} — save it now, it is not stored:`);
+	console.log(created.token);
 });
-token.command("list").description("list service tokens").action(async () => {
-  const ctx = buildContext();
-  const project = requireProject();
-  const { tokens } = await ctx.client.listTokens(project.orgId);
-  for (const t of tokens) {
-    const status = t.revokedAt ? "revoked" : t.expiresAt && Date.parse(t.expiresAt) < Date.now() ? "expired" : "active";
-    console.log(
-      `${t.id}	${t.name}	${status}	last used: ${t.lastUsedAt ?? "never"}`
-    );
-  }
+token.command("list").description("list service tokens").option("--org <slug>").action(async (options) => {
+	const ctx = buildContext();
+	const orgRef = await resolveOrg(ctx, options.org);
+	const { tokens } = await ctx.client.listTokens(orgRef.id);
+	for (const t of tokens) {
+		const status = t.revokedAt ? "revoked" : t.expiresAt && Date.parse(t.expiresAt) < Date.now() ? "expired" : "active";
+		console.log(`${t.id}\t${t.name}\t${status}\tlast used: ${t.lastUsedAt ?? "never"}`);
+	}
 });
-token.command("revoke <tokenId>").description("revoke a service token").action(async (tokenId) => {
-  const ctx = buildContext();
-  const project = requireProject();
-  await ctx.client.revokeToken(project.orgId, tokenId);
-  console.error(`${tokenId} revoked`);
+token.command("revoke <tokenId>").description("revoke a service token").option("--org <slug>").action(async (tokenId, options) => {
+	const ctx = buildContext();
+	const orgRef = await resolveOrg(ctx, options.org);
+	await ctx.client.revokeToken(orgRef.id, tokenId);
+	console.error(`${tokenId} revoked`);
 });
-program.command("audit").description("show the org audit trail").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
-  const ctx = buildContext();
-  const project = requireProject();
-  const { entries } = await ctx.client.listAudit(project.orgId, {
-    limit: Number.parseInt(options.limit, 10) || 50
-  });
-  for (const entry of entries) {
-    console.log(
-      `${entry.createdAt}	${entry.action}	${entry.actorType}:${entry.actorId}	${entry.resourceType}${entry.resourceId ? `:${entry.resourceId}` : ""}`
-    );
-  }
+program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
+	const ctx = buildContext();
+	const orgRef = await resolveOrg(ctx, options.org);
+	const { entries } = await ctx.client.listAudit(orgRef.id, { limit: Number.parseInt(options.limit, 10) || 50 });
+	for (const entry of entries) console.log(`${entry.createdAt}\t${entry.action}\t${entry.actorType}:${entry.actorId}\t${entry.resourceType}${entry.resourceId ? `:${entry.resourceId}` : ""}`);
 });
 program.parseAsync().catch((err) => {
-  fail(err instanceof Error ? err.message : String(err));
+	fail(err instanceof Error ? err.message : String(err));
 });
+//#endregion
+export {};