@seekrit/cli 0.25.0 → 0.26.0

package/dist/index.js

@@ -51,6 +51,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Maximum environments under a single application.",
 		default: null
 	},
+	"branches.per_app.max": {
+		kind: "limit",
+		label: "Branch configs per application",
+		description: "Maximum ephemeral branch environments under a single application.",
+		default: null
+	},
 	"secrets.per_env.max": {
 		kind: "limit",
 		label: "Secrets per environment",
@@ -144,6 +150,51 @@ const SUBSCRIPTION_STATUSES = [
 	"paused"
 ];
 //#endregion
+//#region ../../packages/core/src/branches.ts
+/**
+* Branch (ephemeral) environments — a per-PR/preview overlay on an existing
+* application environment.
+*
+* A branch is an ordinary environment row with a parent and a TTL. It is an
+* **overlay, not a copy**: resolve returns the parent's layers and then the
+* branch's own on top, so a branch holds only the values that differ and
+* tracks the parent live. Nothing is re-encrypted at creation — a secret's
+* ciphertext is bound to `(environmentId, name)` as AAD, so copying blobs into
+* a new environment could not decrypt anyway, and a snapshot would immediately
+* drift from its base.
+*
+* Two rules keep the read path cheap and predictable, enforced here:
+*
+* - **Depth one.** A branch's parent must not itself be a branch, so resolve
+*   never recurses on the hot path.
+* - **Application environments only.** Group environments are pulled in by
+*   composition (matched by slug) and have no single parent to overlay.
+*/
+/** Longest life a branch may be given. Bounds sprawl even if nobody cleans up. */
+const MAX_BRANCH_TTL_SECONDS = 720 * 60 * 60;
+/**
+* Parse a human TTL — `30m`, `12h`, `7d`, `2w`, or bare seconds — into seconds.
+* Returns null for anything unparseable, so callers can report the input back.
+* `never` / `none` mean "no expiry" and yield `Infinity`, which
+* {@link planBranchCreate} rejects unless passed as an explicit `null`.
+*/
+function parseBranchTtl(input) {
+	const raw = input.trim().toLowerCase();
+	if (raw === "never" || raw === "none") return Number.POSITIVE_INFINITY;
+	const match = /^(\d+)\s*(s|m|h|d|w)?$/.exec(raw);
+	if (!match) return null;
+	const value = Number(match[1]);
+	const multiplier = {
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400,
+		w: 604800
+	}[match[2] ?? "s"];
+	if (multiplier === void 0) return null;
+	return value * multiplier;
+}
+//#endregion
 //#region ../../packages/core/src/interpolate.ts
 /**
 * Secret references: `${OTHER_SECRET}` inside a secret value.
@@ -864,11 +915,22 @@ z.object({
 	*/
 	encryptedPrivateKey: z.string().min(1)
 });
-z.object({
+const grantEnvironmentKeySchema = z.object({
 	principalType: principalTypeSchema,
 	principalId: z.string().min(1),
 	wrappedDek: z.string().min(1)
 });
+z.object({
+	slug: slugSchema,
+	/** Display name; defaults to the slug. */
+	name: nameSchema.optional(),
+	ttlSeconds: z.number().int().min(60).max(MAX_BRANCH_TTL_SECONDS).nullish(),
+	/** The branch's own DEK, wrapped to the creator — generated client-side. */
+	wrappedDek: z.string().min(1),
+	recoveryWrappedDek: z.string().min(1).nullish(),
+	/** The same DEK wrapped to each of the parent's existing grant-holders. */
+	grants: z.array(grantEnvironmentKeySchema).max(500).default([])
+});
 z.object({
 	name: nameSchema,
 	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
@@ -2124,7 +2186,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.25.0";
+var version = "0.26.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -2253,6 +2315,28 @@ var SeekritClient = class {
 	deleteEnv(orgId, envId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
+	/**
+	* The public keys of an environment's grant-holders, so a client can wrap a
+	* new DEK to each of them (see `createBranch`). No key material is returned.
+	*/
+	listGrantees(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/grantees`);
+	}
+	listBranches(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/branches`);
+	}
+	/** Every branch in an application, across all its environments. */
+	listAppBranches(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/branches`);
+	}
+	/** Fork `envId` into an ephemeral branch. `envId` is the parent, not the branch. */
+	createBranch(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/branches`, input);
+	}
+	/** Branches are environments, so tearing one down is `deleteEnv`. */
+	deleteBranch(orgId, branchId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${branchId}`);
+	}
 	listGroups(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/groups`);
 	}
@@ -2288,6 +2372,7 @@ var SeekritClient = class {
 	resolve(query = {}) {
 		const params = new URLSearchParams();
 		if (query.env) params.set("env", query.env);
+		if (query.branch) params.set("branch", query.branch);
 		for (const [group, slug] of Object.entries(query.with ?? {})) params.append("with", `${group}:${slug}`);
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/resolve${qs}`);
@@ -2681,12 +2766,14 @@ async function resolveOrg(ctx, orgSlug) {
 }
 /**
 * Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
+* or the config's app + `--env`), a branch of one (`--branch`), or a group env
+* (`--group --env`).
 */
 async function resolveEnvTarget(ctx, opts) {
 	const org = await resolveOrg(ctx, opts.org);
 	if (!opts.env) fail("specify --env");
 	if (opts.group) {
+		if (opts.branch) fail("--branch applies to application environments, not groups");
 		const { groups } = await ctx.client.listGroups(org.id);
 		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
 		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
@@ -2699,34 +2786,59 @@ async function resolveEnvTarget(ctx, opts) {
 			label: `${group.slug}@${env.slug}`
 		};
 	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const app = await resolveApp(ctx, opts);
 	const { environments } = await ctx.client.listEnvs(org.id, app.id);
 	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
 	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	if (opts.branch) {
+		const branch = await resolveBranch(ctx, app, opts.branch);
+		return {
+			orgId: org.id,
+			envId: branch.id,
+			label: `${app.slug}/${env.slug}#${branch.slug}`
+		};
+	}
 	return {
 		orgId: org.id,
 		envId: env.id,
 		label: `${app.slug}/${env.slug}`
 	};
 }
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
+/** Resolve the target application from a flag or the committed config. */
+async function resolveApp(ctx, opts) {
 	const org = await resolveOrg(ctx, opts.org);
 	const appSlug = opts.app ?? findProjectConfig()?.app;
 	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
 	const { apps } = await ctx.client.listApps(org.id);
 	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
 	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	return {
+		orgId: org.id,
+		orgSlug: org.slug,
+		id: app.id,
+		slug: app.slug
+	};
+}
+/**
+* Find a branch by slug (or id) anywhere in an application. Branch slugs share
+* the application's environment namespace, so one lookup is unambiguous — no
+* need to name the parent environment.
+*/
+async function resolveBranch(ctx, app, branchRef) {
+	const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+	const branch = branches.find((b) => b.slug === branchRef || b.id === branchRef);
+	if (!branch) fail(`no branch "${branchRef}" in ${app.slug}`);
+	return branch;
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	if (!opts.env) fail("specify --env");
+	const app = await resolveApp(ctx, opts);
+	const { environments } = await ctx.client.listEnvs(app.orgId, app.id);
 	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
 	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
 	return {
-		orgId: org.id,
+		orgId: app.orgId,
 		appId: app.id,
 		appSlug: app.slug,
 		envId: env.id,
@@ -2888,198 +3000,6 @@ function registerAwsCommands(program) {
 	});
 }
 //#endregion
-//#region src/dotenv.ts
-/**
-* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
-* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
-* escapes; unquoted values drop trailing ` # comments`). Multiline values are
-* not supported — keep those in seekrit itself.
-*/
-function parseDotenv(content) {
-	const out = {};
-	for (const raw of content.split(/\r?\n/)) {
-		let line = raw.trim();
-		if (!line || line.startsWith("#")) continue;
-		if (line.startsWith("export ")) line = line.slice(7).trimStart();
-		const eq = line.indexOf("=");
-		if (eq === -1) continue;
-		const key = line.slice(0, eq).trim();
-		if (!key) continue;
-		let value = line.slice(eq + 1).trim();
-		const quote = value[0];
-		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
-			value = value.slice(1, -1);
-			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
-		} else {
-			const comment = value.indexOf(" #");
-			if (comment !== -1) value = value.slice(0, comment).trim();
-		}
-		out[key] = value;
-	}
-	return out;
-}
-//#endregion
-//#region src/format.ts
-function needsQuoting(value) {
-	return /[\s"'`$\\#]/.test(value) || value === "";
-}
-function dotenvQuote(value) {
-	if (!needsQuoting(value)) return value;
-	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n")}"`;
-}
-function shellQuote(value) {
-	return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function formatSecrets(values, format) {
-	const names = Object.keys(values).sort();
-	switch (format) {
-		case "json": return JSON.stringify(values, names, 2);
-		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
-		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
-	}
-}
-//#endregion
-//#region src/gcp.ts
-/**
-* `seekrit gcp` — temporary GCP credentials via IAM Credentials
-* `generateAccessToken` (Vault-style dynamic secrets, the tier-2 sibling of
-* `seekrit aws`).
-*
-* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
-* keypair on THIS machine and sends only the public key; GCP mints the token and
-* the broker returns it wrapped to that key, so the control plane only ever
-* relays ciphertext and only this machine can unwrap it. Registering a target
-* wraps the service-account key JSON to the broker's public key locally, so the
-* control plane never sees it either — the source service account needs only
-* `roles/iam.serviceAccountTokenCreator` on the target.
-*/
-/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$5(input) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
-}
-/** Collect a repeatable flag (e.g. --scope) into a list. */
-function collectList$1(value, acc = []) {
-	acc.push(value);
-	return acc;
-}
-/**
-* The service-account key JSON the broker impersonates with. From --key-file or
-* GOOGLE_APPLICATION_CREDENTIALS. Never leaves this machine unwrapped — it is
-* wrapped to the broker key before upload.
-*/
-function resolveServiceAccountKey(opts) {
-	const path = opts.keyFile ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
-	if (!path) fail("provide the source service-account key JSON via --key-file or GOOGLE_APPLICATION_CREDENTIALS (it needs roles/iam.serviceAccountTokenCreator on the target)");
-	const raw = readFileSync(path, "utf8").trim();
-	try {
-		const parsed = JSON.parse(raw);
-		if (typeof parsed.client_email !== "string" || typeof parsed.private_key !== "string") fail(`${path} is not a service-account key JSON (missing client_email/private_key)`);
-	} catch {
-		fail(`${path} is not valid JSON`);
-	}
-	return raw;
-}
-function registerGcpCommands(program) {
-	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
-	const target = gcp.command("target").description("manage GCP service-account targets");
-	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const config = {
-			provider: "gcp",
-			executor: "in_do",
-			serviceAccount: options.serviceAccount,
-			...options.scope?.length ? { scopes: options.scope } : {},
-			...options.delegate?.length ? { delegates: options.delegate } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
-		};
-		const keyJson = resolveServiceAccountKey(options);
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(keyJson), publicKeyJwk);
-		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
-			name: options.name,
-			config,
-			wrappedAdminSecret
-		});
-		console.error(`registered GCP target ${created.name} (${created.id})`);
-		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
-		console.log(gcpSetupInstructions(config));
-	});
-	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		for (const t of targets) {
-			const cfg = t.config;
-			if (cfg.provider !== "gcp") continue;
-			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
-		}
-	});
-	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetId || x.name === targetId);
-		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
-		console.log(gcpSetupInstructions(cfg));
-	});
-	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`deleted ${targetId}`);
-	});
-	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
-		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
-		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
-		const ttlSeconds = parseTtlSeconds$5(options.ttl);
-		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
-		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
-		const recipient = await generateGcpRecipientKeyPair();
-		const { gcp: leased } = await ctx.client.mintLease(org.id, {
-			provider: "gcp",
-			targetId: t.id,
-			recipientPublicKey: recipient.publicKeyJwk,
-			ttlSeconds
-		});
-		const cred = await unwrapGcpCredential(leased.wrappedCredential, recipient.privateKeyJwk);
-		console.error(`leased ${cred.serviceAccount} — expires ${cred.expiration}`);
-		if (options.json) console.log(JSON.stringify(cred, null, 2));
-		else {
-			console.log(`export CLOUDSDK_AUTH_ACCESS_TOKEN=${cred.accessToken}`);
-			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
-		}
-	});
-	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) {
-			if (l.provider !== "gcp") continue;
-			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
-		}
-	});
-	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
-	});
-}
-//#endregion
 //#region src/kms.ts
 /** Collect a repeatable option into a list. */
 function collect$6(value, acc = []) {
@@ -3367,12 +3287,495 @@ function registerKmsCommands(program) {
 	});
 }
 //#endregion
-//#region src/m2m.ts
+//#region src/recovery.ts
+/** Collect a repeatable option into a list. */
+function collect$5(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** Resolve a custodian reference: a `skt_…` token id, otherwise a member email. */
+function resolveCustodian(ctx, orgId, ref) {
+	return ref.startsWith("skt_") ? kmsResolveRecipient(ctx, orgId, { token: ref }) : kmsResolveRecipient(ctx, orgId, { user: ref });
+}
 /**
-* Resolve M2M client credentials from (in order) the process environment, a
-* `.env` overlay (for `seekrit run`), then saved config. Both halves must come
-* through for the credential to be usable.
-*/
+* The env DEK additionally wrapped to the org recovery key, when recovery is
+* enabled — so a newly created environment is recovery-protected from birth.
+* Returns undefined when recovery is off (the env is backfilled by `recovery
+* sync` later).
+*/
+async function recoveryWrapForNewEnv(ctx, orgId, dek) {
+	let recoveryPublicKeyJwk;
+	try {
+		const { recovery } = await ctx.client.getRecovery(orgId);
+		recoveryPublicKeyJwk = recovery.enabled ? recovery.recoveryPublicKeyJwk : null;
+	} catch (e) {
+		if (e instanceof SeekritApiError && (e.status === 403 || e.status === 404)) return void 0;
+		throw e;
+	}
+	if (!recoveryPublicKeyJwk) return void 0;
+	return wrapDek(dek, recoveryPublicKeyJwk);
+}
+/**
+* Wrap every environment the caller can decrypt but that lacks a recovery grant,
+* and upload the grants. Idempotent — safe to re-run and to run from several
+* admins to complete coverage.
+*/
+async function syncRecoveryGrants(ctx, orgId) {
+	const { recovery } = await ctx.client.getRecovery(orgId);
+	if (!recovery.enabled || !recovery.recoveryPublicKeyJwk) fail("recovery is not enabled");
+	const recoveryPublicKeyJwk = recovery.recoveryPublicKeyJwk;
+	const privateKey = await getPrivateKey(ctx);
+	const grants = [];
+	let skipped = 0;
+	for (const environmentId of recovery.coverage.unprotectedEnvIds) {
+		let wrappedDek;
+		try {
+			({wrappedDek} = await ctx.client.getMyEnvKey(orgId, environmentId));
+		} catch (e) {
+			if (e instanceof SeekritApiError && (e.status === 403 || e.status === 404)) {
+				skipped++;
+				continue;
+			}
+			throw e;
+		}
+		const dek = await unwrapDek(wrappedDek, privateKey);
+		grants.push({
+			environmentId,
+			wrappedDek: await wrapDek(dek, recoveryPublicKeyJwk)
+		});
+	}
+	if (grants.length > 0) await ctx.client.uploadRecoveryGrants(orgId, { grants });
+	return {
+		wrapped: grants.length,
+		skipped
+	};
+}
+/** Generate + split a fresh recovery key across the given custodians. */
+async function buildRecoveryConfig(ctx, orgId, thresholdRaw, custodianRefs) {
+	const threshold = Number.parseInt(thresholdRaw, 10);
+	if (!Number.isInteger(threshold) || threshold < 1) fail("--threshold must be a positive integer");
+	if (custodianRefs.length === 0) fail("pass at least one --custodian <email|skt_id>");
+	if (threshold > custodianRefs.length) fail("--threshold cannot exceed the number of custodians");
+	const custodians = await Promise.all(custodianRefs.map((ref) => resolveCustodian(ctx, orgId, ref)));
+	const recovery = await generateRecoveryKey();
+	const shares = await splitRecoveryKey(recovery.privateKeyJwk, threshold, custodians);
+	return {
+		recoveryPublicKeyJwk: recovery.publicKeyJwk,
+		threshold,
+		shares: shares.map((s) => ({
+			principalType: s.principalType,
+			principalId: s.principalId,
+			shareIndex: s.shareIndex,
+			wrappedShare: s.wrappedShare
+		}))
+	};
+}
+function registerRecoveryCommands(program) {
+	const recovery = program.command("recovery").description("customer-controlled M-of-N recovery (zero-knowledge)");
+	recovery.command("status").description("show recovery configuration and environment coverage").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { recovery: status } = await ctx.client.getRecovery(org.id);
+		if (!status.enabled) {
+			console.log("recovery: disabled");
+			return;
+		}
+		console.log(`recovery: enabled (${status.threshold}-of-${status.shareCount})`);
+		console.log(`coverage: ${status.coverage.protected}/${status.coverage.total} environments protected`);
+		console.log("custodians:");
+		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
+		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
+	});
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
+		await ctx.client.configureRecovery(org.id, {
+			...config,
+			grants: []
+		});
+		console.error(`recovery enabled: ${config.threshold}-of-${config.shares.length}`);
+		const { wrapped, skipped } = await syncRecoveryGrants(ctx, org.id);
+		console.error(`recovery-protected ${wrapped} environment(s) you can decrypt`);
+		if (skipped > 0) console.error(`${skipped} environment(s) need another admin to run \`seekrit recovery sync\``);
+	});
+	recovery.command("sync").description("recovery-protect environments you can decrypt but that aren't yet covered").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
+		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
+	});
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
+		await ctx.client.rotateRecovery(org.id, {
+			...config,
+			grants: []
+		});
+		console.error(`recovery rotated: ${config.threshold}-of-${config.shares.length}`);
+		const { wrapped, skipped } = await syncRecoveryGrants(ctx, org.id);
+		console.error(`re-wrapped ${wrapped} environment(s) you can decrypt to the new recovery key`);
+		if (skipped > 0) console.error(`${skipped} environment(s) still need another admin to run \`seekrit recovery sync\``);
+	});
+	recovery.command("disable").description("disable recovery and remove all recovery grants").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.disableRecovery(org.id);
+		console.error("recovery disabled; recovery grants removed");
+	});
+	recovery.command("request").description("start a recovery ceremony (defaults to recovering access for yourself)").option("--target-user <email>", "recover access for another member").option("--target-token <id>", "recover access for a service token").option("--reason <text>", "note recorded in the audit trail").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const target = options.targetUser || options.targetToken ? await kmsResolveRecipient(ctx, org.id, {
+			user: options.targetUser,
+			token: options.targetToken
+		}) : await kmsCallerIdentity(ctx);
+		const { request } = await ctx.client.createRecoveryRequest(org.id, {
+			targetPublicKeyJwk: target.publicKeyJwk,
+			targetType: target.principalType,
+			targetId: target.principalId,
+			reason: options.reason
+		});
+		console.error(`recovery request ${request.id} created (needs ${request.threshold} custodians)`);
+		console.error(`  custodians run:  seekrit recovery approve ${request.id}`);
+		console.error(`  then the target: seekrit recovery complete ${request.id}`);
+	});
+	recovery.command("approve").description("as a custodian, contribute your share to a recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { request } = await ctx.client.getRecoveryRequest(org.id, requestId);
+		const myShare = await ctx.client.getMyRecoveryShare(org.id);
+		const privateKey = await getPrivateKey(ctx);
+		const contributedShare = await rewrapRecoveryShare(await unwrapRecoveryShare(myShare.wrappedShare, privateKey), request.targetPublicKeyJwk);
+		const res = await ctx.client.contributeRecoveryShare(org.id, requestId, {
+			shareIndex: myShare.shareIndex,
+			contributedShare
+		});
+		console.error(`contributed share #${myShare.shareIndex}: ${res.contributed}/${res.threshold} collected${res.quorumReached ? " — quorum reached" : ""}`);
+	});
+	recovery.command("complete").description("as the recovery target, reconstruct the key and restore your access").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { request, contributions, quorumReached } = await ctx.client.getRecoveryRequest(org.id, requestId);
+		if (!quorumReached) fail(`only ${contributions.length}/${request.threshold} custodians have contributed`);
+		const me = await kmsCallerIdentity(ctx);
+		const targetPrivateKey = await getPrivateKey(ctx);
+		const recoveryPrivateKey = await combineRecoveryShares(await Promise.all(contributions.map((cont) => unwrapRecoveryShare(cont.contributedShare, targetPrivateKey))));
+		const { grants: recoveryEnvKeys } = await ctx.client.getRecoveryEnvKeys(org.id);
+		const restored = [];
+		for (const g of recoveryEnvKeys) {
+			const dek = await unwrapDek(g.wrappedDek, recoveryPrivateKey);
+			restored.push({
+				environmentId: g.environmentId,
+				wrappedDek: await wrapDek(dek, me.publicKeyJwk)
+			});
+		}
+		await ctx.client.completeRecoveryRequest(org.id, requestId, {
+			principalType: me.principalType,
+			principalId: me.principalId,
+			grants: restored
+		});
+		console.error(`recovery complete: restored access to ${restored.length} environment(s)`);
+	});
+	recovery.command("cancel").description("cancel an open recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.cancelRecoveryRequest(org.id, requestId);
+		console.error(`recovery request ${requestId} canceled`);
+	});
+}
+//#endregion
+//#region src/branches.ts
+/**
+* Resolve `--from` to the environment being branched.
+*
+* Not just `resolveAppEnv`: branch slugs live in the same namespace but are
+* excluded from the environment list, so naming one lands on "no environment
+* …". Branching a branch is a real thing people will try (depth is capped at
+* one), and it deserves an error that says so.
+*/
+async function resolveBranchParent(ctx, opts) {
+	const app = await resolveApp(ctx, opts);
+	const { environments } = await ctx.client.listEnvs(app.orgId, app.id);
+	const env = environments.find((e) => e.slug === opts.from || e.id === opts.from);
+	if (env) return {
+		orgId: app.orgId,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+	const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+	if (branches.some((b) => b.slug === opts.from || b.id === opts.from)) fail(`"${opts.from}" is itself a branch — branches are one level deep, so branch from the environment it overlays`);
+	fail(`no environment "${opts.from}" in ${app.slug}`);
+}
+/**
+* Branch (ephemeral) configs: `seekrit branch create pr-142 --from dev`.
+*
+* A branch overlays its parent instead of copying it, so creating one encrypts
+* nothing — it mints a data key for the branch's own overrides and wraps that
+* key to whoever should read them. Everything the branch inherits stays where
+* it is, and stays live.
+*/
+function registerBranchCommands(program) {
+	const branch = program.command("branch").description("ephemeral per-PR / preview configs layered on an environment");
+	branch.command("create <slug>").description("fork an environment into an ephemeral branch (inherits its secrets)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <env>", "the environment to branch").option("--name <name>", "display name (defaults to the slug)").option("--ttl <duration>", "lifetime: 12h, 7d, 2w, … or `never`", "7d").option("--no-share", "don't give the parent's other readers access to this branch").action(async (slug, options) => {
+		const ctx = buildContext();
+		const parent = await resolveBranchParent(ctx, {
+			org: options.org,
+			app: options.app,
+			from: options.from
+		});
+		const parsedTtl = parseBranchTtl(options.ttl);
+		if (parsedTtl === null) fail(`invalid --ttl "${options.ttl}" (try 12h, 7d, 2w, or never)`);
+		const ttlSeconds = Number.isFinite(parsedTtl) ? parsedTtl : null;
+		const me = await kmsCallerIdentity(ctx);
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, me.publicKeyJwk);
+		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, parent.orgId, dek);
+		const grants = [];
+		if (options.share !== false) {
+			const { grantees } = await ctx.client.listGrantees(parent.orgId, parent.envId);
+			for (const grantee of grantees) {
+				if (grantee.principalType === me.principalType && grantee.principalId === me.principalId) continue;
+				grants.push({
+					principalType: grantee.principalType,
+					principalId: grantee.principalId,
+					wrappedDek: await wrapDek(dek, grantee.publicKeyJwk)
+				});
+			}
+		}
+		const created = await ctx.client.createBranch(parent.orgId, parent.envId, {
+			slug,
+			name: options.name,
+			ttlSeconds,
+			wrappedDek,
+			recoveryWrappedDek,
+			grants
+		});
+		console.error(`created branch ${parent.appSlug}/${parent.envSlug}#${created.branch.slug} (${created.branch.id})`);
+		console.error(created.branch.expiresAt ? `expires ${created.branch.expiresAt}` : "no expiry — delete it explicitly when the PR closes");
+		if (grants.length > 0) console.error(`shared with ${grants.length} other reader(s)`);
+	});
+	branch.command("list").description("list branches in an application (or of one environment)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").action(async (options) => {
+		const ctx = buildContext();
+		if (options.env) {
+			const parent = await resolveAppEnv(ctx, options);
+			const { branches } = await ctx.client.listBranches(parent.orgId, parent.envId);
+			for (const b of branches) console.log(`${b.slug}\t${b.id}\t${b.expiresAt ?? "never"}`);
+			return;
+		}
+		const app = await resolveApp(ctx, options);
+		const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+		for (const b of branches) console.log(`${b.slug}\t${b.id}\t${b.expiresAt ?? "never"}`);
+	});
+	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").action(async (slug, options) => {
+		const ctx = buildContext();
+		const app = await resolveApp(ctx, options);
+		const target = await resolveBranch(ctx, app, slug);
+		await ctx.client.deleteBranch(app.orgId, target.id);
+		console.error(`deleted branch ${app.slug}#${target.slug}`);
+	});
+}
+//#endregion
+//#region src/dotenv.ts
+/**
+* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
+* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
+* escapes; unquoted values drop trailing ` # comments`). Multiline values are
+* not supported — keep those in seekrit itself.
+*/
+function parseDotenv(content) {
+	const out = {};
+	for (const raw of content.split(/\r?\n/)) {
+		let line = raw.trim();
+		if (!line || line.startsWith("#")) continue;
+		if (line.startsWith("export ")) line = line.slice(7).trimStart();
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		const key = line.slice(0, eq).trim();
+		if (!key) continue;
+		let value = line.slice(eq + 1).trim();
+		const quote = value[0];
+		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
+			value = value.slice(1, -1);
+			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+		} else {
+			const comment = value.indexOf(" #");
+			if (comment !== -1) value = value.slice(0, comment).trim();
+		}
+		out[key] = value;
+	}
+	return out;
+}
+//#endregion
+//#region src/format.ts
+function needsQuoting(value) {
+	return /[\s"'`$\\#]/.test(value) || value === "";
+}
+function dotenvQuote(value) {
+	if (!needsQuoting(value)) return value;
+	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n")}"`;
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function formatSecrets(values, format) {
+	const names = Object.keys(values).sort();
+	switch (format) {
+		case "json": return JSON.stringify(values, names, 2);
+		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
+		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+	}
+}
+//#endregion
+//#region src/gcp.ts
+/**
+* `seekrit gcp` — temporary GCP credentials via IAM Credentials
+* `generateAccessToken` (Vault-style dynamic secrets, the tier-2 sibling of
+* `seekrit aws`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; GCP mints the token and
+* the broker returns it wrapped to that key, so the control plane only ever
+* relays ciphertext and only this machine can unwrap it. Registering a target
+* wraps the service-account key JSON to the broker's public key locally, so the
+* control plane never sees it either — the source service account needs only
+* `roles/iam.serviceAccountTokenCreator` on the target.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$5(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** Collect a repeatable flag (e.g. --scope) into a list. */
+function collectList$1(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* The service-account key JSON the broker impersonates with. From --key-file or
+* GOOGLE_APPLICATION_CREDENTIALS. Never leaves this machine unwrapped — it is
+* wrapped to the broker key before upload.
+*/
+function resolveServiceAccountKey(opts) {
+	const path = opts.keyFile ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (!path) fail("provide the source service-account key JSON via --key-file or GOOGLE_APPLICATION_CREDENTIALS (it needs roles/iam.serviceAccountTokenCreator on the target)");
+	const raw = readFileSync(path, "utf8").trim();
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.client_email !== "string" || typeof parsed.private_key !== "string") fail(`${path} is not a service-account key JSON (missing client_email/private_key)`);
+	} catch {
+		fail(`${path} is not valid JSON`);
+	}
+	return raw;
+}
+function registerGcpCommands(program) {
+	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
+	const target = gcp.command("target").description("manage GCP service-account targets");
+	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = {
+			provider: "gcp",
+			executor: "in_do",
+			serviceAccount: options.serviceAccount,
+			...options.scope?.length ? { scopes: options.scope } : {},
+			...options.delegate?.length ? { delegates: options.delegate } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
+		};
+		const keyJson = resolveServiceAccountKey(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(keyJson), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered GCP target ${created.name} (${created.id})`);
+		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
+		console.log(gcpSetupInstructions(config));
+	});
+	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "gcp") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
+		}
+	});
+	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
+		console.log(gcpSetupInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
+		const ttlSeconds = parseTtlSeconds$5(options.ttl);
+		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
+		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
+		const recipient = await generateGcpRecipientKeyPair();
+		const { gcp: leased } = await ctx.client.mintLease(org.id, {
+			provider: "gcp",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapGcpCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cred.serviceAccount} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify(cred, null, 2));
+		else {
+			console.log(`export CLOUDSDK_AUTH_ACCESS_TOKEN=${cred.accessToken}`);
+			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
+		}
+	});
+	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "gcp") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
+	});
+}
+//#endregion
+//#region src/m2m.ts
+/**
+* Resolve M2M client credentials from (in order) the process environment, a
+* `.env` overlay (for `seekrit run`), then saved config. Both halves must come
+* through for the credential to be usable.
+*/
 function readM2mCreds(dotenvVars = {}) {
 	const config = readGlobalConfig();
 	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
@@ -3463,7 +3866,7 @@ function parseTtlSeconds$4(input) {
 	}[m[2] || "s"] ?? 1);
 }
 /** Collect a repeatable option into an array. */
-function collect$5(value, previous) {
+function collect$4(value, previous) {
 	return [...previous, value];
 }
 /** Parse `readWrite@app` → { role, db } for a custom target. */
@@ -3488,7 +3891,7 @@ function resolveAdminUri(uri) {
 function registerMongoCommands(program) {
 	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
 	const target = mongo.command("target").description("manage MongoDB targets");
-	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$5, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const adminUri = resolveAdminUri(options.uri);
@@ -3648,7 +4051,7 @@ function generateUserName$1(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$4, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$4, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -3749,7 +4152,7 @@ function registerMysqlCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$4(value, acc) {
+function collect$3(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -3786,7 +4189,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -3900,208 +4303,10 @@ function registerPgCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$3(value, acc) {
-	acc.push(value);
-	return acc;
-}
-//#endregion
-//#region src/recovery.ts
-/** Collect a repeatable option into a list. */
-function collect$2(value, acc = []) {
+function collect$2(value, acc) {
 	acc.push(value);
 	return acc;
 }
-/** Resolve a custodian reference: a `skt_…` token id, otherwise a member email. */
-function resolveCustodian(ctx, orgId, ref) {
-	return ref.startsWith("skt_") ? kmsResolveRecipient(ctx, orgId, { token: ref }) : kmsResolveRecipient(ctx, orgId, { user: ref });
-}
-/**
-* The env DEK additionally wrapped to the org recovery key, when recovery is
-* enabled — so a newly created environment is recovery-protected from birth.
-* Returns undefined when recovery is off (the env is backfilled by `recovery
-* sync` later).
-*/
-async function recoveryWrapForNewEnv(ctx, orgId, dek) {
-	let recoveryPublicKeyJwk;
-	try {
-		const { recovery } = await ctx.client.getRecovery(orgId);
-		recoveryPublicKeyJwk = recovery.enabled ? recovery.recoveryPublicKeyJwk : null;
-	} catch (e) {
-		if (e instanceof SeekritApiError && (e.status === 403 || e.status === 404)) return void 0;
-		throw e;
-	}
-	if (!recoveryPublicKeyJwk) return void 0;
-	return wrapDek(dek, recoveryPublicKeyJwk);
-}
-/**
-* Wrap every environment the caller can decrypt but that lacks a recovery grant,
-* and upload the grants. Idempotent — safe to re-run and to run from several
-* admins to complete coverage.
-*/
-async function syncRecoveryGrants(ctx, orgId) {
-	const { recovery } = await ctx.client.getRecovery(orgId);
-	if (!recovery.enabled || !recovery.recoveryPublicKeyJwk) fail("recovery is not enabled");
-	const recoveryPublicKeyJwk = recovery.recoveryPublicKeyJwk;
-	const privateKey = await getPrivateKey(ctx);
-	const grants = [];
-	let skipped = 0;
-	for (const environmentId of recovery.coverage.unprotectedEnvIds) {
-		let wrappedDek;
-		try {
-			({wrappedDek} = await ctx.client.getMyEnvKey(orgId, environmentId));
-		} catch (e) {
-			if (e instanceof SeekritApiError && (e.status === 403 || e.status === 404)) {
-				skipped++;
-				continue;
-			}
-			throw e;
-		}
-		const dek = await unwrapDek(wrappedDek, privateKey);
-		grants.push({
-			environmentId,
-			wrappedDek: await wrapDek(dek, recoveryPublicKeyJwk)
-		});
-	}
-	if (grants.length > 0) await ctx.client.uploadRecoveryGrants(orgId, { grants });
-	return {
-		wrapped: grants.length,
-		skipped
-	};
-}
-/** Generate + split a fresh recovery key across the given custodians. */
-async function buildRecoveryConfig(ctx, orgId, thresholdRaw, custodianRefs) {
-	const threshold = Number.parseInt(thresholdRaw, 10);
-	if (!Number.isInteger(threshold) || threshold < 1) fail("--threshold must be a positive integer");
-	if (custodianRefs.length === 0) fail("pass at least one --custodian <email|skt_id>");
-	if (threshold > custodianRefs.length) fail("--threshold cannot exceed the number of custodians");
-	const custodians = await Promise.all(custodianRefs.map((ref) => resolveCustodian(ctx, orgId, ref)));
-	const recovery = await generateRecoveryKey();
-	const shares = await splitRecoveryKey(recovery.privateKeyJwk, threshold, custodians);
-	return {
-		recoveryPublicKeyJwk: recovery.publicKeyJwk,
-		threshold,
-		shares: shares.map((s) => ({
-			principalType: s.principalType,
-			principalId: s.principalId,
-			shareIndex: s.shareIndex,
-			wrappedShare: s.wrappedShare
-		}))
-	};
-}
-function registerRecoveryCommands(program) {
-	const recovery = program.command("recovery").description("customer-controlled M-of-N recovery (zero-knowledge)");
-	recovery.command("status").description("show recovery configuration and environment coverage").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { recovery: status } = await ctx.client.getRecovery(org.id);
-		if (!status.enabled) {
-			console.log("recovery: disabled");
-			return;
-		}
-		console.log(`recovery: enabled (${status.threshold}-of-${status.shareCount})`);
-		console.log(`coverage: ${status.coverage.protected}/${status.coverage.total} environments protected`);
-		console.log("custodians:");
-		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
-		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
-	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$2, []).option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
-		await ctx.client.configureRecovery(org.id, {
-			...config,
-			grants: []
-		});
-		console.error(`recovery enabled: ${config.threshold}-of-${config.shares.length}`);
-		const { wrapped, skipped } = await syncRecoveryGrants(ctx, org.id);
-		console.error(`recovery-protected ${wrapped} environment(s) you can decrypt`);
-		if (skipped > 0) console.error(`${skipped} environment(s) need another admin to run \`seekrit recovery sync\``);
-	});
-	recovery.command("sync").description("recovery-protect environments you can decrypt but that aren't yet covered").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
-		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
-	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$2, []).option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
-		await ctx.client.rotateRecovery(org.id, {
-			...config,
-			grants: []
-		});
-		console.error(`recovery rotated: ${config.threshold}-of-${config.shares.length}`);
-		const { wrapped, skipped } = await syncRecoveryGrants(ctx, org.id);
-		console.error(`re-wrapped ${wrapped} environment(s) you can decrypt to the new recovery key`);
-		if (skipped > 0) console.error(`${skipped} environment(s) still need another admin to run \`seekrit recovery sync\``);
-	});
-	recovery.command("disable").description("disable recovery and remove all recovery grants").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.disableRecovery(org.id);
-		console.error("recovery disabled; recovery grants removed");
-	});
-	recovery.command("request").description("start a recovery ceremony (defaults to recovering access for yourself)").option("--target-user <email>", "recover access for another member").option("--target-token <id>", "recover access for a service token").option("--reason <text>", "note recorded in the audit trail").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const target = options.targetUser || options.targetToken ? await kmsResolveRecipient(ctx, org.id, {
-			user: options.targetUser,
-			token: options.targetToken
-		}) : await kmsCallerIdentity(ctx);
-		const { request } = await ctx.client.createRecoveryRequest(org.id, {
-			targetPublicKeyJwk: target.publicKeyJwk,
-			targetType: target.principalType,
-			targetId: target.principalId,
-			reason: options.reason
-		});
-		console.error(`recovery request ${request.id} created (needs ${request.threshold} custodians)`);
-		console.error(`  custodians run:  seekrit recovery approve ${request.id}`);
-		console.error(`  then the target: seekrit recovery complete ${request.id}`);
-	});
-	recovery.command("approve").description("as a custodian, contribute your share to a recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { request } = await ctx.client.getRecoveryRequest(org.id, requestId);
-		const myShare = await ctx.client.getMyRecoveryShare(org.id);
-		const privateKey = await getPrivateKey(ctx);
-		const contributedShare = await rewrapRecoveryShare(await unwrapRecoveryShare(myShare.wrappedShare, privateKey), request.targetPublicKeyJwk);
-		const res = await ctx.client.contributeRecoveryShare(org.id, requestId, {
-			shareIndex: myShare.shareIndex,
-			contributedShare
-		});
-		console.error(`contributed share #${myShare.shareIndex}: ${res.contributed}/${res.threshold} collected${res.quorumReached ? " — quorum reached" : ""}`);
-	});
-	recovery.command("complete").description("as the recovery target, reconstruct the key and restore your access").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { request, contributions, quorumReached } = await ctx.client.getRecoveryRequest(org.id, requestId);
-		if (!quorumReached) fail(`only ${contributions.length}/${request.threshold} custodians have contributed`);
-		const me = await kmsCallerIdentity(ctx);
-		const targetPrivateKey = await getPrivateKey(ctx);
-		const recoveryPrivateKey = await combineRecoveryShares(await Promise.all(contributions.map((cont) => unwrapRecoveryShare(cont.contributedShare, targetPrivateKey))));
-		const { grants: recoveryEnvKeys } = await ctx.client.getRecoveryEnvKeys(org.id);
-		const restored = [];
-		for (const g of recoveryEnvKeys) {
-			const dek = await unwrapDek(g.wrappedDek, recoveryPrivateKey);
-			restored.push({
-				environmentId: g.environmentId,
-				wrappedDek: await wrapDek(dek, me.publicKeyJwk)
-			});
-		}
-		await ctx.client.completeRecoveryRequest(org.id, requestId, {
-			principalType: me.principalType,
-			principalId: me.principalId,
-			grants: restored
-		});
-		console.error(`recovery complete: restored access to ${restored.length} environment(s)`);
-	});
-	recovery.command("cancel").description("cancel an open recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.cancelRecoveryRequest(org.id, requestId);
-		console.error(`recovery request ${requestId} canceled`);
-	});
-}
 //#endregion
 //#region src/redis.ts
 /**
@@ -4326,6 +4531,7 @@ async function importSecrets(ctx, orgId, envId, entries) {
 async function materializeEnv(ctx, opts) {
 	const query = {};
 	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (opts.branch) query.branch = opts.branch;
 	if (!isTokenAuth(ctx)) {
 		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
 		query.env = opts.envId;
@@ -4336,7 +4542,10 @@ async function materializeEnv(ctx, opts) {
 	const provenance = {};
 	for (const layer of layers) {
 		const dek = await unwrapDek(layer.wrappedDek, privateKey);
-		const label = layer.source === "group" ? `group:${layer.groupSlug}@${layer.slug}` : `app:${scope.appSlug}/${layer.slug}`;
+		let label;
+		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
+		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
+		else label = `app:${scope.appSlug}/${layer.slug}`;
 		for (const secret of layer.secrets) {
 			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
 			provenance[secret.name] = label;
@@ -4702,7 +4911,7 @@ function parseVersion(raw) {
 }
 /** Attach the environment-selection flags shared by every `secrets` command. */
 function withTarget(cmd) {
-	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>", "environment slug");
+	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").option("--branch <slug>", "operate on a branch of --env").requiredOption("--env <slug>", "environment slug");
 }
 const secrets = program.command("secrets").description("manage secrets in an application or group environment");
 withTarget(secrets.command("list").description("list secret names (no values)")).action(async (options) => {
@@ -4780,6 +4989,7 @@ async function materialize(ctx, options) {
 	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, options)).envId;
 	return materializeEnv(ctx, {
 		envId,
+		branch: options.branch ?? process.env.SEEKRIT_BRANCH,
 		with: options.with,
 		envFiles: options.envFile ?? [".env"],
 		interpolate: options.interpolate
@@ -4800,7 +5010,11 @@ async function materializeForRun(options) {
 		await ensureM2mAdminToken(dotenvVars);
 		const ctx = tryBuildContext(dotenvVars);
 		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
-		return await materialize(ctx, options);
+		const branch = options.branch ?? process.env.SEEKRIT_BRANCH ?? dotenvVars.SEEKRIT_BRANCH;
+		return await materialize(ctx, {
+			...options,
+			branch
+		});
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		console.error(`seekrit: continuing without seekrit-managed secrets: ${message}`);
@@ -4923,7 +5137,7 @@ async function reapStragglers(pids, signal) {
 		process.kill(pid, "SIGKILL");
 	} catch {}
 }
-program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
 	const { values, provenance, interpolated, unresolvedRefs } = await materializeForRun(options);
@@ -4975,7 +5189,7 @@ program.command("run").description("run a command with decrypted secrets injecte
 	});
 	child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
 });
-program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
+program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
 	if (![
 		"dotenv",
 		"json",
@@ -5095,6 +5309,7 @@ token.command("delete <tokenId>").description("permanently delete a revoked serv
 	await ctx.client.deleteToken(orgRef.id, tokenId);
 	console.error(`${tokenId} deleted`);
 });
+registerBranchCommands(program);
 registerPgCommands(program);
 registerMysqlCommands(program);
 registerRedisCommands(program);
@@ -5106,7 +5321,7 @@ registerMongoCommands(program);
 registerKmsCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-COWsshZZ.js");
+	const { runMcpServer } = await import("./mcp-DLplPOvz.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -5120,4 +5335,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { generateMysqlCredential as A, generateSigningKeyMaterial as C, signatureKeyRef as D, signMessage as E, kmsEncrypt as F, wrapDek as I, generateDek as L, generateEncryptKeyMaterial as M, kmsBlobKeyRef as N, verifyMessage as O, kmsDecrypt as P, toBase64 as R, parseServiceToken as S, importVerifyingKey as T, setFailThrows as _, ensureM2mAdminToken as a, createServiceToken as b, kmsResolveKey as c, resolveEnvTarget as d, resolveGroup as f, tryBuildContext as g, isTokenAuth as h, materializeEnv as i, generateDataKey as j, generatePostgresCredential as k, kmsResolveRecipient as l, getDek as m, fetchDecryptedSecrets as n, kmsCallerIdentity as o, resolveOrg as p, fetchDecryptedVersion as r, kmsRecoverMaterial as s, encryptAndSetSecret as t, resolveAppEnv as u, writeProjectConfig as v, importSigningKey as w, isServiceToken as x, version as y };
+export { verifyMessage as A, toBase64 as B, isServiceToken as C, importVerifyingKey as D, importSigningKey as E, kmsBlobKeyRef as F, kmsDecrypt as I, kmsEncrypt as L, generateMysqlCredential as M, generateDataKey as N, signMessage as O, generateEncryptKeyMaterial as P, wrapDek as R, createServiceToken as S, generateSigningKeyMaterial as T, parseBranchTtl as V, isTokenAuth as _, ensureM2mAdminToken as a, writeProjectConfig as b, kmsResolveKey as c, resolveAppEnv as d, resolveBranch as f, getDek as g, resolveOrg as h, materializeEnv as i, generatePostgresCredential as j, signatureKeyRef as k, kmsResolveRecipient as l, resolveGroup as m, fetchDecryptedSecrets as n, kmsCallerIdentity as o, resolveEnvTarget as p, fetchDecryptedVersion as r, kmsRecoverMaterial as s, encryptAndSetSecret as t, resolveApp as u, tryBuildContext as v, parseServiceToken as w, version as x, setFailThrows as y, generateDek as z };