@seekrit/cli 0.25.0 → 0.27.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
-import { homedir, tmpdir } from "node:os";
+import { homedir, hostname, tmpdir, userInfo } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
@@ -51,6 +51,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Maximum environments under a single application.",
 		default: null
 	},
+	"branches.per_app.max": {
+		kind: "limit",
+		label: "Branch configs per application",
+		description: "Maximum ephemeral branch environments under a single application.",
+		default: null
+	},
 	"secrets.per_env.max": {
 		kind: "limit",
 		label: "Secrets per environment",
@@ -144,6 +150,51 @@ const SUBSCRIPTION_STATUSES = [
 	"paused"
 ];
 //#endregion
+//#region ../../packages/core/src/branches.ts
+/**
+* Branch (ephemeral) environments — a per-PR/preview overlay on an existing
+* application environment.
+*
+* A branch is an ordinary environment row with a parent and a TTL. It is an
+* **overlay, not a copy**: resolve returns the parent's layers and then the
+* branch's own on top, so a branch holds only the values that differ and
+* tracks the parent live. Nothing is re-encrypted at creation — a secret's
+* ciphertext is bound to `(environmentId, name)` as AAD, so copying blobs into
+* a new environment could not decrypt anyway, and a snapshot would immediately
+* drift from its base.
+*
+* Two rules keep the read path cheap and predictable, enforced here:
+*
+* - **Depth one.** A branch's parent must not itself be a branch, so resolve
+*   never recurses on the hot path.
+* - **Application environments only.** Group environments are pulled in by
+*   composition (matched by slug) and have no single parent to overlay.
+*/
+/** Longest life a branch may be given. Bounds sprawl even if nobody cleans up. */
+const MAX_BRANCH_TTL_SECONDS = 720 * 60 * 60;
+/**
+* Parse a human TTL — `30m`, `12h`, `7d`, `2w`, or bare seconds — into seconds.
+* Returns null for anything unparseable, so callers can report the input back.
+* `never` / `none` mean "no expiry" and yield `Infinity`, which
+* {@link planBranchCreate} rejects unless passed as an explicit `null`.
+*/
+function parseBranchTtl(input) {
+	const raw = input.trim().toLowerCase();
+	if (raw === "never" || raw === "none") return Number.POSITIVE_INFINITY;
+	const match = /^(\d+)\s*(s|m|h|d|w)?$/.exec(raw);
+	if (!match) return null;
+	const value = Number(match[1]);
+	const multiplier = {
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400,
+		w: 604800
+	}[match[2] ?? "s"];
+	if (multiplier === void 0) return null;
+	return value * multiplier;
+}
+//#endregion
 //#region ../../packages/core/src/interpolate.ts
 /**
 * Secret references: `${OTHER_SECRET}` inside a secret value.
@@ -864,11 +915,22 @@ z.object({
 	*/
 	encryptedPrivateKey: z.string().min(1)
 });
-z.object({
+const grantEnvironmentKeySchema = z.object({
 	principalType: principalTypeSchema,
 	principalId: z.string().min(1),
 	wrappedDek: z.string().min(1)
 });
+z.object({
+	slug: slugSchema,
+	/** Display name; defaults to the slug. */
+	name: nameSchema.optional(),
+	ttlSeconds: z.number().int().min(60).max(MAX_BRANCH_TTL_SECONDS).nullish(),
+	/** The branch's own DEK, wrapped to the creator — generated client-side. */
+	wrappedDek: z.string().min(1),
+	recoveryWrappedDek: z.string().min(1).nullish(),
+	/** The same DEK wrapped to each of the parent's existing grant-holders. */
+	grants: z.array(grantEnvironmentKeySchema).max(500).default([])
+});
 z.object({
 	name: nameSchema,
 	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
@@ -1002,6 +1064,16 @@ z.object({
 	expiresAt: z.iso.datetime().nullish()
 });
 z.object({ family: planFamilySchema });
+z.object({
+	sessionId: z.string().regex(/^skc_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full session token string. */
+	tokenHash: z.string().min(1).max(128),
+	/** Display-only, e.g. `miles@studio.local`. */
+	deviceLabel: z.string().trim().min(1).max(120),
+	/** Display-only, e.g. `cli/0.4.2`. */
+	client: z.string().trim().max(60).optional()
+});
+z.object({ code: z.string().trim().min(1).max(32) });
 z.object({
 	cursor: z.string().optional(),
 	limit: z.coerce.number().int().min(1).max(200).default(50),
@@ -2077,9 +2149,12 @@ function encodeOpensshPrivateKey(seed, pub, comment) {
 * Format: `skt_<token id>_<private key pkcs8, base64url>`
 */
 const TOKEN_PREFIX = "skt";
+const CLI_SESSION_PREFIX = "skc";
 const TOKEN_ID_LENGTH = 22;
 const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-function randomTokenId() {
+/** 32 bytes of entropy for the CLI session secret. */
+const CLI_SESSION_SECRET_BYTES = 32;
+function randomTokenId(prefix = TOKEN_PREFIX) {
 	let out = "";
 	while (out.length < TOKEN_ID_LENGTH) {
 		const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
@@ -2088,7 +2163,7 @@ function randomTokenId() {
 			if (out.length === TOKEN_ID_LENGTH) break;
 		}
 	}
-	return `${TOKEN_PREFIX}_${out}`;
+	return `${prefix}_${out}`;
 }
 async function hashToken(token) {
 	const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token));
@@ -2122,9 +2197,27 @@ async function parseServiceToken(token) {
 function isServiceToken(value) {
 	return value.startsWith(`${TOKEN_PREFIX}_`);
 }
+async function createCliSessionToken() {
+	const sessionId = randomTokenId(CLI_SESSION_PREFIX);
+	const token = `${sessionId}_${toBase64Url(crypto.getRandomValues(new Uint8Array(CLI_SESSION_SECRET_BYTES)))}`;
+	return {
+		token,
+		sessionId,
+		tokenHash: await hashToken(token)
+	};
+}
+/** The public `skc_…` id embedded in a CLI session token. */
+function parseCliSessionToken(token) {
+	const match = /^(skc_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
+	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit CLI session token");
+	return { sessionId: match[1] };
+}
+function isCliSessionToken(value) {
+	return value.startsWith(`${CLI_SESSION_PREFIX}_`);
+}
 //#endregion
 //#region package.json
-var version = "0.25.0";
+var version = "0.27.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -2186,6 +2279,32 @@ var SeekritClient = class {
 	getMyNotificationPrefs() {
 		return this.request("GET", "/v1/me/notifications");
 	}
+	/**
+	* Devices this user has authorized. `currentSessionId` is set when the caller
+	* *is* a CLI session, so it can label (or revoke) itself.
+	*/
+	listCliSessions() {
+		return this.request("GET", "/v1/me/cli-sessions");
+	}
+	/** Sign a device out. Its token stops authenticating immediately. */
+	revokeCliSession(sessionId) {
+		return this.request("DELETE", `/v1/me/cli-sessions/${sessionId}`);
+	}
+	/** What a pending login request is asking for — for the approval screen. */
+	getCliLoginRequest(code) {
+		return this.request("GET", `/v1/cli-login/${encodeURIComponent(code)}`);
+	}
+	/**
+	* Authorize a device. Requires a browser session; members with a second
+	* factor must have re-entered it just now, else this rejects with
+	* `mfa_required` (recoverable — prompt for a code and retry).
+	*/
+	approveCliLogin(code) {
+		return this.request("POST", `/v1/cli-login/${encodeURIComponent(code)}/approve`);
+	}
+	denyCliLogin(code) {
+		return this.request("POST", `/v1/cli-login/${encodeURIComponent(code)}/deny`);
+	}
 	setMyNotificationPrefs(input) {
 		return this.request("PUT", "/v1/me/notifications", input);
 	}
@@ -2253,6 +2372,28 @@ var SeekritClient = class {
 	deleteEnv(orgId, envId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
+	/**
+	* The public keys of an environment's grant-holders, so a client can wrap a
+	* new DEK to each of them (see `createBranch`). No key material is returned.
+	*/
+	listGrantees(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/grantees`);
+	}
+	listBranches(orgId, envId) {
+		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}/branches`);
+	}
+	/** Every branch in an application, across all its environments. */
+	listAppBranches(orgId, appId) {
+		return this.request("GET", `/v1/orgs/${orgId}/apps/${appId}/branches`);
+	}
+	/** Fork `envId` into an ephemeral branch. `envId` is the parent, not the branch. */
+	createBranch(orgId, envId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/envs/${envId}/branches`, input);
+	}
+	/** Branches are environments, so tearing one down is `deleteEnv`. */
+	deleteBranch(orgId, branchId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${branchId}`);
+	}
 	listGroups(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/groups`);
 	}
@@ -2288,6 +2429,7 @@ var SeekritClient = class {
 	resolve(query = {}) {
 		const params = new URLSearchParams();
 		if (query.env) params.set("env", query.env);
+		if (query.branch) params.set("branch", query.branch);
 		for (const [group, slug] of Object.entries(query.with ?? {})) params.append("with", `${group}:${slug}`);
 		const qs = params.size > 0 ? `?${params}` : "";
 		return this.request("GET", `/v1/resolve${qs}`);
@@ -2506,6 +2648,39 @@ var SeekritClient = class {
 		return this.request("POST", `/v1/orgs/${orgId}/billing/cancel`);
 	}
 };
+async function unauthenticatedPost(baseUrl, path, body, fetchImpl, client) {
+	const headers = {
+		accept: "application/json",
+		"content-type": "application/json"
+	};
+	if (client) headers["x-seekrit-client"] = client;
+	const res = await fetchImpl(`${baseUrl.replace(/\/$/, "")}${path}`, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(body)
+	});
+	if (!res.ok) {
+		const fallback = { error: {
+			code: "internal",
+			message: `HTTP ${res.status}`
+		} };
+		const payload = await res.json().catch(() => fallback);
+		throw new SeekritApiError(res.status, payload.error?.code ?? "internal", payload.error?.message ?? `HTTP ${res.status}`);
+	}
+	return await res.json();
+}
+/**
+* Open a browser-approved login request. `input.tokenHash` is the SHA-256 of a
+* session token the caller minted locally and keeps — never send the token.
+*/
+function startCliLogin(baseUrl, input, options = {}) {
+	return unauthenticatedPost(baseUrl, "/v1/cli-login", input, options.fetch ?? ((...args) => fetch(...args)), options.client);
+}
+/** Ask whether a human has authorized the request yet. */
+function pollCliLogin(baseUrl, code, options = {}) {
+	const fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+	return unauthenticatedPost(baseUrl, "/v1/cli-login/poll", { code }, fetchImpl, options.client);
+}
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -2515,6 +2690,10 @@ function readGlobalConfig() {
 	if (!existsSync(path)) return {};
 	return JSON.parse(readFileSync(path, "utf8"));
 }
+/**
+* Merge into the saved config. A key set to `undefined` is *removed* (JSON
+* drops it), which is how the login paths clear a credential they replace.
+*/
 function writeGlobalConfig(update) {
 	const path = globalConfigPath();
 	const merged = {
@@ -2586,6 +2765,29 @@ function promptHidden(question) {
 		});
 	});
 }
+/**
+* Wait for the user to press Enter (or Ctrl-C). Resolves immediately when stdin
+* isn't a TTY — a piped or CI invocation has nobody to press a key, and blocking
+* there would hang `seekrit login` forever.
+*/
+function promptEnter(question) {
+	if (!process.stdin.isTTY) {
+		process.stderr.write("\n");
+		return Promise.resolve();
+	}
+	process.stderr.write(question);
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr,
+		terminal: true
+	});
+	return new Promise((resolve) => {
+		rl.question("", () => {
+			rl.close();
+			resolve();
+		});
+	});
+}
 /** Read all of stdin (for `seekrit secrets set NAME -` piping). */
 async function readStdin() {
 	const chunks = [];
@@ -2611,7 +2813,7 @@ function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
 	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
 	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
-	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token;
+	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token ?? config.sessionToken;
 	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
 	let auth;
 	if (token) auth = {
@@ -2634,7 +2836,7 @@ function tryBuildContext(dotenvVars = {}) {
 }
 function buildContext() {
 	const ctx = tryBuildContext();
-	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…` (or `--client-id … --client-secret …`), or set SEEKRIT_TOKEN / SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET / SEEKRIT_DEV_USER");
+	if (!ctx) fail("no credentials found — run `seekrit login` to sign in through your browser (or `seekrit login --token skt_…` / `--client-id … --client-secret …`), or set SEEKRIT_TOKEN / SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET / SEEKRIT_DEV_USER");
 	return ctx;
 }
 function isTokenAuth(ctx) {
@@ -2681,12 +2883,14 @@ async function resolveOrg(ctx, orgSlug) {
 }
 /**
 * Resolve an environment to operate on — an application env (`--app --env`,
-* or the config's app + `--env`) or a group env (`--group --env`).
+* or the config's app + `--env`), a branch of one (`--branch`), or a group env
+* (`--group --env`).
 */
 async function resolveEnvTarget(ctx, opts) {
 	const org = await resolveOrg(ctx, opts.org);
 	if (!opts.env) fail("specify --env");
 	if (opts.group) {
+		if (opts.branch) fail("--branch applies to application environments, not groups");
 		const { groups } = await ctx.client.listGroups(org.id);
 		const group = groups.find((g) => g.slug === opts.group || g.id === opts.group);
 		if (!group) fail(`no group "${opts.group}" in ${org.slug}`);
@@ -2699,34 +2903,59 @@ async function resolveEnvTarget(ctx, opts) {
 			label: `${group.slug}@${env.slug}`
 		};
 	}
-	const appSlug = opts.app ?? findProjectConfig()?.app;
-	if (!appSlug) fail("specify --app or --group (or run `seekrit init`)");
-	const { apps } = await ctx.client.listApps(org.id);
-	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
-	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
+	const app = await resolveApp(ctx, opts);
 	const { environments } = await ctx.client.listEnvs(org.id, app.id);
 	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
 	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
+	if (opts.branch) {
+		const branch = await resolveBranch(ctx, app, opts.branch);
+		return {
+			orgId: org.id,
+			envId: branch.id,
+			label: `${app.slug}/${env.slug}#${branch.slug}`
+		};
+	}
 	return {
 		orgId: org.id,
 		envId: env.id,
 		label: `${app.slug}/${env.slug}`
 	};
 }
-/** Resolve an application environment, keeping ids + slugs (for token binding). */
-async function resolveAppEnv(ctx, opts) {
+/** Resolve the target application from a flag or the committed config. */
+async function resolveApp(ctx, opts) {
 	const org = await resolveOrg(ctx, opts.org);
 	const appSlug = opts.app ?? findProjectConfig()?.app;
 	if (!appSlug) fail("specify --app (or run `seekrit init`)");
-	if (!opts.env) fail("specify --env");
 	const { apps } = await ctx.client.listApps(org.id);
 	const app = apps.find((a) => a.slug === appSlug || a.id === appSlug);
 	if (!app) fail(`no app "${appSlug}" in ${org.slug}`);
-	const { environments } = await ctx.client.listEnvs(org.id, app.id);
+	return {
+		orgId: org.id,
+		orgSlug: org.slug,
+		id: app.id,
+		slug: app.slug
+	};
+}
+/**
+* Find a branch by slug (or id) anywhere in an application. Branch slugs share
+* the application's environment namespace, so one lookup is unambiguous — no
+* need to name the parent environment.
+*/
+async function resolveBranch(ctx, app, branchRef) {
+	const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+	const branch = branches.find((b) => b.slug === branchRef || b.id === branchRef);
+	if (!branch) fail(`no branch "${branchRef}" in ${app.slug}`);
+	return branch;
+}
+/** Resolve an application environment, keeping ids + slugs (for token binding). */
+async function resolveAppEnv(ctx, opts) {
+	if (!opts.env) fail("specify --env");
+	const app = await resolveApp(ctx, opts);
+	const { environments } = await ctx.client.listEnvs(app.orgId, app.id);
 	const env = environments.find((e) => e.slug === opts.env || e.id === opts.env);
 	if (!env) fail(`no environment "${opts.env}" in ${app.slug}`);
 	return {
-		orgId: org.id,
+		orgId: app.orgId,
 		appId: app.id,
 		appSlug: app.slug,
 		envId: env.id,
@@ -2888,271 +3117,79 @@ function registerAwsCommands(program) {
 	});
 }
 //#endregion
-//#region src/dotenv.ts
-/**
-* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
-* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
-* escapes; unquoted values drop trailing ` # comments`). Multiline values are
-* not supported — keep those in seekrit itself.
-*/
-function parseDotenv(content) {
-	const out = {};
-	for (const raw of content.split(/\r?\n/)) {
-		let line = raw.trim();
-		if (!line || line.startsWith("#")) continue;
-		if (line.startsWith("export ")) line = line.slice(7).trimStart();
-		const eq = line.indexOf("=");
-		if (eq === -1) continue;
-		const key = line.slice(0, eq).trim();
-		if (!key) continue;
-		let value = line.slice(eq + 1).trim();
-		const quote = value[0];
-		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
-			value = value.slice(1, -1);
-			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
-		} else {
-			const comment = value.indexOf(" #");
-			if (comment !== -1) value = value.slice(0, comment).trim();
-		}
-		out[key] = value;
-	}
-	return out;
-}
-//#endregion
-//#region src/format.ts
-function needsQuoting(value) {
-	return /[\s"'`$\\#]/.test(value) || value === "";
-}
-function dotenvQuote(value) {
-	if (!needsQuoting(value)) return value;
-	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n")}"`;
-}
-function shellQuote(value) {
-	return `'${value.replaceAll("'", `'\\''`)}'`;
+//#region src/kms.ts
+/** Collect a repeatable option into a list. */
+function collect$6(value, acc = []) {
+	acc.push(value);
+	return acc;
 }
-function formatSecrets(values, format) {
-	const names = Object.keys(values).sort();
-	switch (format) {
-		case "json": return JSON.stringify(values, names, 2);
-		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
-		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+/** The calling principal's identity + public key (for a self-grant). */
+async function kmsCallerIdentity(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return {
+			principalType: "service_token",
+			principalId: tokenId,
+			publicKeyJwk: JSON.stringify(pub)
+		};
 	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+	return {
+		principalType: "user",
+		principalId: user.id,
+		publicKeyJwk: user.publicKeyJwk
+	};
 }
-//#endregion
-//#region src/gcp.ts
-/**
-* `seekrit gcp` — temporary GCP credentials via IAM Credentials
-* `generateAccessToken` (Vault-style dynamic secrets, the tier-2 sibling of
-* `seekrit aws`).
-*
-* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
-* keypair on THIS machine and sends only the public key; GCP mints the token and
-* the broker returns it wrapped to that key, so the control plane only ever
-* relays ciphertext and only this machine can unwrap it. Registering a target
-* wraps the service-account key JSON to the broker's public key locally, so the
-* control plane never sees it either — the source service account needs only
-* `roles/iam.serviceAccountTokenCreator` on the target.
-*/
-/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$5(input) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
+/** Look up an org member (by email) or service token (by id) as a grant recipient. */
+async function kmsResolveRecipient(ctx, orgId, who) {
+	if (who.user) {
+		const { members } = await ctx.client.listMembers(orgId);
+		const m = members.find((x) => x.email === who.user);
+		if (!m) fail(`no member ${who.user}`);
+		if (!m.publicKeyJwk) fail(`${who.user} has not completed key setup`);
+		return {
+			principalType: "user",
+			principalId: m.userId,
+			publicKeyJwk: m.publicKeyJwk
+		};
+	}
+	if (who.token) {
+		const { tokens } = await ctx.client.listTokens(orgId);
+		const t = tokens.find((x) => x.id === who.token);
+		if (!t) fail(`no service token ${who.token}`);
+		return {
+			principalType: "service_token",
+			principalId: t.id,
+			publicKeyJwk: t.publicKeyJwk
+		};
+	}
+	fail("specify --user <email> or --token <id>");
 }
-/** Collect a repeatable flag (e.g. --scope) into a list. */
-function collectList$1(value, acc = []) {
-	acc.push(value);
-	return acc;
+async function kmsResolveKey(ctx, orgId, ref) {
+	const { keys } = await ctx.client.listKmsKeys(orgId);
+	const key = keys.find((k) => k.id === ref || k.name === ref);
+	if (!key) fail(`no KMS key "${ref}"`);
+	return key;
 }
-/**
-* The service-account key JSON the broker impersonates with. From --key-file or
-* GOOGLE_APPLICATION_CREDENTIALS. Never leaves this machine unwrapped — it is
-* wrapped to the broker key before upload.
-*/
-function resolveServiceAccountKey(opts) {
-	const path = opts.keyFile ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
-	if (!path) fail("provide the source service-account key JSON via --key-file or GOOGLE_APPLICATION_CREDENTIALS (it needs roles/iam.serviceAccountTokenCreator on the target)");
-	const raw = readFileSync(path, "utf8").trim();
-	try {
-		const parsed = JSON.parse(raw);
-		if (typeof parsed.client_email !== "string" || typeof parsed.private_key !== "string") fail(`${path} is not a service-account key JSON (missing client_email/private_key)`);
-	} catch {
-		fail(`${path} is not valid JSON`);
-	}
-	return raw;
+/** Recover a key's material for one version (default: current), for the caller. */
+async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
+	const mat = await ctx.client.getMyKmsKey(orgId, keyId);
+	const v = version ?? mat.currentVersion;
+	const grant = mat.grants.find((g) => g.version === v);
+	if (!grant) fail(`no grant for version ${v} of this key`);
+	return {
+		material: await unwrapDek(grant.wrappedKey, await getPrivateKey(ctx)),
+		version: v,
+		currentVersion: mat.currentVersion
+	};
 }
-function registerGcpCommands(program) {
-	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
-	const target = gcp.command("target").description("manage GCP service-account targets");
-	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const config = {
-			provider: "gcp",
-			executor: "in_do",
-			serviceAccount: options.serviceAccount,
-			...options.scope?.length ? { scopes: options.scope } : {},
-			...options.delegate?.length ? { delegates: options.delegate } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
-		};
-		const keyJson = resolveServiceAccountKey(options);
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(keyJson), publicKeyJwk);
-		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
-			name: options.name,
-			config,
-			wrappedAdminSecret
-		});
-		console.error(`registered GCP target ${created.name} (${created.id})`);
-		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
-		console.log(gcpSetupInstructions(config));
-	});
-	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		for (const t of targets) {
-			const cfg = t.config;
-			if (cfg.provider !== "gcp") continue;
-			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
-		}
-	});
-	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetId || x.name === targetId);
-		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
-		console.log(gcpSetupInstructions(cfg));
-	});
-	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`deleted ${targetId}`);
-	});
-	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
-		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
-		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
-		const ttlSeconds = parseTtlSeconds$5(options.ttl);
-		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
-		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
-		const recipient = await generateGcpRecipientKeyPair();
-		const { gcp: leased } = await ctx.client.mintLease(org.id, {
-			provider: "gcp",
-			targetId: t.id,
-			recipientPublicKey: recipient.publicKeyJwk,
-			ttlSeconds
-		});
-		const cred = await unwrapGcpCredential(leased.wrappedCredential, recipient.privateKeyJwk);
-		console.error(`leased ${cred.serviceAccount} — expires ${cred.expiration}`);
-		if (options.json) console.log(JSON.stringify(cred, null, 2));
-		else {
-			console.log(`export CLOUDSDK_AUTH_ACCESS_TOKEN=${cred.accessToken}`);
-			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
-		}
-	});
-	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) {
-			if (l.provider !== "gcp") continue;
-			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
-		}
-	});
-	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
-	});
-}
-//#endregion
-//#region src/kms.ts
-/** Collect a repeatable option into a list. */
-function collect$6(value, acc = []) {
-	acc.push(value);
-	return acc;
-}
-/** The calling principal's identity + public key (for a self-grant). */
-async function kmsCallerIdentity(ctx) {
-	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
-		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
-		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
-		return {
-			principalType: "service_token",
-			principalId: tokenId,
-			publicKeyJwk: JSON.stringify(pub)
-		};
-	}
-	const { user } = await ctx.client.me();
-	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
-	return {
-		principalType: "user",
-		principalId: user.id,
-		publicKeyJwk: user.publicKeyJwk
-	};
-}
-/** Look up an org member (by email) or service token (by id) as a grant recipient. */
-async function kmsResolveRecipient(ctx, orgId, who) {
-	if (who.user) {
-		const { members } = await ctx.client.listMembers(orgId);
-		const m = members.find((x) => x.email === who.user);
-		if (!m) fail(`no member ${who.user}`);
-		if (!m.publicKeyJwk) fail(`${who.user} has not completed key setup`);
-		return {
-			principalType: "user",
-			principalId: m.userId,
-			publicKeyJwk: m.publicKeyJwk
-		};
-	}
-	if (who.token) {
-		const { tokens } = await ctx.client.listTokens(orgId);
-		const t = tokens.find((x) => x.id === who.token);
-		if (!t) fail(`no service token ${who.token}`);
-		return {
-			principalType: "service_token",
-			principalId: t.id,
-			publicKeyJwk: t.publicKeyJwk
-		};
-	}
-	fail("specify --user <email> or --token <id>");
-}
-async function kmsResolveKey(ctx, orgId, ref) {
-	const { keys } = await ctx.client.listKmsKeys(orgId);
-	const key = keys.find((k) => k.id === ref || k.name === ref);
-	if (!key) fail(`no KMS key "${ref}"`);
-	return key;
-}
-/** Recover a key's material for one version (default: current), for the caller. */
-async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
-	const mat = await ctx.client.getMyKmsKey(orgId, keyId);
-	const v = version ?? mat.currentVersion;
-	const grant = mat.grants.find((g) => g.version === v);
-	if (!grant) fail(`no grant for version ${v} of this key`);
-	return {
-		material: await unwrapDek(grant.wrappedKey, await getPrivateKey(ctx)),
-		version: v,
-		currentVersion: mat.currentVersion
-	};
-}
-function registerKmsCommands(program) {
-	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$6, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$6, []).action(async (options) => {
-		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
-		if (options.app && options.group) fail("pass at most one of --app or --group");
+function registerKmsCommands(program) {
+	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$6, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$6, []).action(async (options) => {
+		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
+		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		let toWrap;
@@ -3367,6 +3404,489 @@ function registerKmsCommands(program) {
 	});
 }
 //#endregion
+//#region src/recovery.ts
+/** Collect a repeatable option into a list. */
+function collect$5(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** Resolve a custodian reference: a `skt_…` token id, otherwise a member email. */
+function resolveCustodian(ctx, orgId, ref) {
+	return ref.startsWith("skt_") ? kmsResolveRecipient(ctx, orgId, { token: ref }) : kmsResolveRecipient(ctx, orgId, { user: ref });
+}
+/**
+* The env DEK additionally wrapped to the org recovery key, when recovery is
+* enabled — so a newly created environment is recovery-protected from birth.
+* Returns undefined when recovery is off (the env is backfilled by `recovery
+* sync` later).
+*/
+async function recoveryWrapForNewEnv(ctx, orgId, dek) {
+	let recoveryPublicKeyJwk;
+	try {
+		const { recovery } = await ctx.client.getRecovery(orgId);
+		recoveryPublicKeyJwk = recovery.enabled ? recovery.recoveryPublicKeyJwk : null;
+	} catch (e) {
+		if (e instanceof SeekritApiError && (e.status === 403 || e.status === 404)) return void 0;
+		throw e;
+	}
+	if (!recoveryPublicKeyJwk) return void 0;
+	return wrapDek(dek, recoveryPublicKeyJwk);
+}
+/**
+* Wrap every environment the caller can decrypt but that lacks a recovery grant,
+* and upload the grants. Idempotent — safe to re-run and to run from several
+* admins to complete coverage.
+*/
+async function syncRecoveryGrants(ctx, orgId) {
+	const { recovery } = await ctx.client.getRecovery(orgId);
+	if (!recovery.enabled || !recovery.recoveryPublicKeyJwk) fail("recovery is not enabled");
+	const recoveryPublicKeyJwk = recovery.recoveryPublicKeyJwk;
+	const privateKey = await getPrivateKey(ctx);
+	const grants = [];
+	let skipped = 0;
+	for (const environmentId of recovery.coverage.unprotectedEnvIds) {
+		let wrappedDek;
+		try {
+			({wrappedDek} = await ctx.client.getMyEnvKey(orgId, environmentId));
+		} catch (e) {
+			if (e instanceof SeekritApiError && (e.status === 403 || e.status === 404)) {
+				skipped++;
+				continue;
+			}
+			throw e;
+		}
+		const dek = await unwrapDek(wrappedDek, privateKey);
+		grants.push({
+			environmentId,
+			wrappedDek: await wrapDek(dek, recoveryPublicKeyJwk)
+		});
+	}
+	if (grants.length > 0) await ctx.client.uploadRecoveryGrants(orgId, { grants });
+	return {
+		wrapped: grants.length,
+		skipped
+	};
+}
+/** Generate + split a fresh recovery key across the given custodians. */
+async function buildRecoveryConfig(ctx, orgId, thresholdRaw, custodianRefs) {
+	const threshold = Number.parseInt(thresholdRaw, 10);
+	if (!Number.isInteger(threshold) || threshold < 1) fail("--threshold must be a positive integer");
+	if (custodianRefs.length === 0) fail("pass at least one --custodian <email|skt_id>");
+	if (threshold > custodianRefs.length) fail("--threshold cannot exceed the number of custodians");
+	const custodians = await Promise.all(custodianRefs.map((ref) => resolveCustodian(ctx, orgId, ref)));
+	const recovery = await generateRecoveryKey();
+	const shares = await splitRecoveryKey(recovery.privateKeyJwk, threshold, custodians);
+	return {
+		recoveryPublicKeyJwk: recovery.publicKeyJwk,
+		threshold,
+		shares: shares.map((s) => ({
+			principalType: s.principalType,
+			principalId: s.principalId,
+			shareIndex: s.shareIndex,
+			wrappedShare: s.wrappedShare
+		}))
+	};
+}
+function registerRecoveryCommands(program) {
+	const recovery = program.command("recovery").description("customer-controlled M-of-N recovery (zero-knowledge)");
+	recovery.command("status").description("show recovery configuration and environment coverage").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { recovery: status } = await ctx.client.getRecovery(org.id);
+		if (!status.enabled) {
+			console.log("recovery: disabled");
+			return;
+		}
+		console.log(`recovery: enabled (${status.threshold}-of-${status.shareCount})`);
+		console.log(`coverage: ${status.coverage.protected}/${status.coverage.total} environments protected`);
+		console.log("custodians:");
+		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
+		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
+	});
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
+		await ctx.client.configureRecovery(org.id, {
+			...config,
+			grants: []
+		});
+		console.error(`recovery enabled: ${config.threshold}-of-${config.shares.length}`);
+		const { wrapped, skipped } = await syncRecoveryGrants(ctx, org.id);
+		console.error(`recovery-protected ${wrapped} environment(s) you can decrypt`);
+		if (skipped > 0) console.error(`${skipped} environment(s) need another admin to run \`seekrit recovery sync\``);
+	});
+	recovery.command("sync").description("recovery-protect environments you can decrypt but that aren't yet covered").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
+		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
+	});
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$5, []).option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
+		await ctx.client.rotateRecovery(org.id, {
+			...config,
+			grants: []
+		});
+		console.error(`recovery rotated: ${config.threshold}-of-${config.shares.length}`);
+		const { wrapped, skipped } = await syncRecoveryGrants(ctx, org.id);
+		console.error(`re-wrapped ${wrapped} environment(s) you can decrypt to the new recovery key`);
+		if (skipped > 0) console.error(`${skipped} environment(s) still need another admin to run \`seekrit recovery sync\``);
+	});
+	recovery.command("disable").description("disable recovery and remove all recovery grants").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.disableRecovery(org.id);
+		console.error("recovery disabled; recovery grants removed");
+	});
+	recovery.command("request").description("start a recovery ceremony (defaults to recovering access for yourself)").option("--target-user <email>", "recover access for another member").option("--target-token <id>", "recover access for a service token").option("--reason <text>", "note recorded in the audit trail").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const target = options.targetUser || options.targetToken ? await kmsResolveRecipient(ctx, org.id, {
+			user: options.targetUser,
+			token: options.targetToken
+		}) : await kmsCallerIdentity(ctx);
+		const { request } = await ctx.client.createRecoveryRequest(org.id, {
+			targetPublicKeyJwk: target.publicKeyJwk,
+			targetType: target.principalType,
+			targetId: target.principalId,
+			reason: options.reason
+		});
+		console.error(`recovery request ${request.id} created (needs ${request.threshold} custodians)`);
+		console.error(`  custodians run:  seekrit recovery approve ${request.id}`);
+		console.error(`  then the target: seekrit recovery complete ${request.id}`);
+	});
+	recovery.command("approve").description("as a custodian, contribute your share to a recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { request } = await ctx.client.getRecoveryRequest(org.id, requestId);
+		const myShare = await ctx.client.getMyRecoveryShare(org.id);
+		const privateKey = await getPrivateKey(ctx);
+		const contributedShare = await rewrapRecoveryShare(await unwrapRecoveryShare(myShare.wrappedShare, privateKey), request.targetPublicKeyJwk);
+		const res = await ctx.client.contributeRecoveryShare(org.id, requestId, {
+			shareIndex: myShare.shareIndex,
+			contributedShare
+		});
+		console.error(`contributed share #${myShare.shareIndex}: ${res.contributed}/${res.threshold} collected${res.quorumReached ? " — quorum reached" : ""}`);
+	});
+	recovery.command("complete").description("as the recovery target, reconstruct the key and restore your access").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { request, contributions, quorumReached } = await ctx.client.getRecoveryRequest(org.id, requestId);
+		if (!quorumReached) fail(`only ${contributions.length}/${request.threshold} custodians have contributed`);
+		const me = await kmsCallerIdentity(ctx);
+		const targetPrivateKey = await getPrivateKey(ctx);
+		const recoveryPrivateKey = await combineRecoveryShares(await Promise.all(contributions.map((cont) => unwrapRecoveryShare(cont.contributedShare, targetPrivateKey))));
+		const { grants: recoveryEnvKeys } = await ctx.client.getRecoveryEnvKeys(org.id);
+		const restored = [];
+		for (const g of recoveryEnvKeys) {
+			const dek = await unwrapDek(g.wrappedDek, recoveryPrivateKey);
+			restored.push({
+				environmentId: g.environmentId,
+				wrappedDek: await wrapDek(dek, me.publicKeyJwk)
+			});
+		}
+		await ctx.client.completeRecoveryRequest(org.id, requestId, {
+			principalType: me.principalType,
+			principalId: me.principalId,
+			grants: restored
+		});
+		console.error(`recovery complete: restored access to ${restored.length} environment(s)`);
+	});
+	recovery.command("cancel").description("cancel an open recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.cancelRecoveryRequest(org.id, requestId);
+		console.error(`recovery request ${requestId} canceled`);
+	});
+}
+//#endregion
+//#region src/branches.ts
+/**
+* Resolve `--from` to the environment being branched.
+*
+* Not just `resolveAppEnv`: branch slugs live in the same namespace but are
+* excluded from the environment list, so naming one lands on "no environment
+* …". Branching a branch is a real thing people will try (depth is capped at
+* one), and it deserves an error that says so.
+*/
+async function resolveBranchParent(ctx, opts) {
+	const app = await resolveApp(ctx, opts);
+	const { environments } = await ctx.client.listEnvs(app.orgId, app.id);
+	const env = environments.find((e) => e.slug === opts.from || e.id === opts.from);
+	if (env) return {
+		orgId: app.orgId,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+	const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+	if (branches.some((b) => b.slug === opts.from || b.id === opts.from)) fail(`"${opts.from}" is itself a branch — branches are one level deep, so branch from the environment it overlays`);
+	fail(`no environment "${opts.from}" in ${app.slug}`);
+}
+/**
+* Branch (ephemeral) configs: `seekrit branch create pr-142 --from dev`.
+*
+* A branch overlays its parent instead of copying it, so creating one encrypts
+* nothing — it mints a data key for the branch's own overrides and wraps that
+* key to whoever should read them. Everything the branch inherits stays where
+* it is, and stays live.
+*/
+function registerBranchCommands(program) {
+	const branch = program.command("branch").description("ephemeral per-PR / preview configs layered on an environment");
+	branch.command("create <slug>").description("fork an environment into an ephemeral branch (inherits its secrets)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <env>", "the environment to branch").option("--name <name>", "display name (defaults to the slug)").option("--ttl <duration>", "lifetime: 12h, 7d, 2w, … or `never`", "7d").option("--no-share", "don't give the parent's other readers access to this branch").action(async (slug, options) => {
+		const ctx = buildContext();
+		const parent = await resolveBranchParent(ctx, {
+			org: options.org,
+			app: options.app,
+			from: options.from
+		});
+		const parsedTtl = parseBranchTtl(options.ttl);
+		if (parsedTtl === null) fail(`invalid --ttl "${options.ttl}" (try 12h, 7d, 2w, or never)`);
+		const ttlSeconds = Number.isFinite(parsedTtl) ? parsedTtl : null;
+		const me = await kmsCallerIdentity(ctx);
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, me.publicKeyJwk);
+		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, parent.orgId, dek);
+		const grants = [];
+		if (options.share !== false) {
+			const { grantees } = await ctx.client.listGrantees(parent.orgId, parent.envId);
+			for (const grantee of grantees) {
+				if (grantee.principalType === me.principalType && grantee.principalId === me.principalId) continue;
+				grants.push({
+					principalType: grantee.principalType,
+					principalId: grantee.principalId,
+					wrappedDek: await wrapDek(dek, grantee.publicKeyJwk)
+				});
+			}
+		}
+		const created = await ctx.client.createBranch(parent.orgId, parent.envId, {
+			slug,
+			name: options.name,
+			ttlSeconds,
+			wrappedDek,
+			recoveryWrappedDek,
+			grants
+		});
+		console.error(`created branch ${parent.appSlug}/${parent.envSlug}#${created.branch.slug} (${created.branch.id})`);
+		console.error(created.branch.expiresAt ? `expires ${created.branch.expiresAt}` : "no expiry — delete it explicitly when the PR closes");
+		if (grants.length > 0) console.error(`shared with ${grants.length} other reader(s)`);
+	});
+	branch.command("list").description("list branches in an application (or of one environment)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").action(async (options) => {
+		const ctx = buildContext();
+		if (options.env) {
+			const parent = await resolveAppEnv(ctx, options);
+			const { branches } = await ctx.client.listBranches(parent.orgId, parent.envId);
+			for (const b of branches) console.log(`${b.slug}\t${b.id}\t${b.expiresAt ?? "never"}`);
+			return;
+		}
+		const app = await resolveApp(ctx, options);
+		const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+		for (const b of branches) console.log(`${b.slug}\t${b.id}\t${b.expiresAt ?? "never"}`);
+	});
+	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").action(async (slug, options) => {
+		const ctx = buildContext();
+		const app = await resolveApp(ctx, options);
+		const target = await resolveBranch(ctx, app, slug);
+		await ctx.client.deleteBranch(app.orgId, target.id);
+		console.error(`deleted branch ${app.slug}#${target.slug}`);
+	});
+}
+//#endregion
+//#region src/dotenv.ts
+/**
+* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
+* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
+* escapes; unquoted values drop trailing ` # comments`). Multiline values are
+* not supported — keep those in seekrit itself.
+*/
+function parseDotenv(content) {
+	const out = {};
+	for (const raw of content.split(/\r?\n/)) {
+		let line = raw.trim();
+		if (!line || line.startsWith("#")) continue;
+		if (line.startsWith("export ")) line = line.slice(7).trimStart();
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		const key = line.slice(0, eq).trim();
+		if (!key) continue;
+		let value = line.slice(eq + 1).trim();
+		const quote = value[0];
+		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
+			value = value.slice(1, -1);
+			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+		} else {
+			const comment = value.indexOf(" #");
+			if (comment !== -1) value = value.slice(0, comment).trim();
+		}
+		out[key] = value;
+	}
+	return out;
+}
+//#endregion
+//#region src/format.ts
+function needsQuoting(value) {
+	return /[\s"'`$\\#]/.test(value) || value === "";
+}
+function dotenvQuote(value) {
+	if (!needsQuoting(value)) return value;
+	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n")}"`;
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function formatSecrets(values, format) {
+	const names = Object.keys(values).sort();
+	switch (format) {
+		case "json": return JSON.stringify(values, names, 2);
+		case "shell": return names.map((name) => `export ${name}=${shellQuote(values[name] ?? "")}`).join("\n");
+		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
+	}
+}
+//#endregion
+//#region src/gcp.ts
+/**
+* `seekrit gcp` — temporary GCP credentials via IAM Credentials
+* `generateAccessToken` (Vault-style dynamic secrets, the tier-2 sibling of
+* `seekrit aws`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; GCP mints the token and
+* the broker returns it wrapped to that key, so the control plane only ever
+* relays ciphertext and only this machine can unwrap it. Registering a target
+* wraps the service-account key JSON to the broker's public key locally, so the
+* control plane never sees it either — the source service account needs only
+* `roles/iam.serviceAccountTokenCreator` on the target.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$5(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** Collect a repeatable flag (e.g. --scope) into a list. */
+function collectList$1(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* The service-account key JSON the broker impersonates with. From --key-file or
+* GOOGLE_APPLICATION_CREDENTIALS. Never leaves this machine unwrapped — it is
+* wrapped to the broker key before upload.
+*/
+function resolveServiceAccountKey(opts) {
+	const path = opts.keyFile ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (!path) fail("provide the source service-account key JSON via --key-file or GOOGLE_APPLICATION_CREDENTIALS (it needs roles/iam.serviceAccountTokenCreator on the target)");
+	const raw = readFileSync(path, "utf8").trim();
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.client_email !== "string" || typeof parsed.private_key !== "string") fail(`${path} is not a service-account key JSON (missing client_email/private_key)`);
+	} catch {
+		fail(`${path} is not valid JSON`);
+	}
+	return raw;
+}
+function registerGcpCommands(program) {
+	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
+	const target = gcp.command("target").description("manage GCP service-account targets");
+	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const config = {
+			provider: "gcp",
+			executor: "in_do",
+			serviceAccount: options.serviceAccount,
+			...options.scope?.length ? { scopes: options.scope } : {},
+			...options.delegate?.length ? { delegates: options.delegate } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
+		};
+		const keyJson = resolveServiceAccountKey(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(keyJson), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered GCP target ${created.name} (${created.id})`);
+		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
+		console.log(gcpSetupInstructions(config));
+	});
+	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "gcp") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
+		}
+	});
+	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
+		console.log(gcpSetupInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
+		const ttlSeconds = parseTtlSeconds$5(options.ttl);
+		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
+		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
+		const recipient = await generateGcpRecipientKeyPair();
+		const { gcp: leased } = await ctx.client.mintLease(org.id, {
+			provider: "gcp",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapGcpCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cred.serviceAccount} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify(cred, null, 2));
+		else {
+			console.log(`export CLOUDSDK_AUTH_ACCESS_TOKEN=${cred.accessToken}`);
+			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
+		}
+	});
+	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "gcp") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
+	});
+}
+//#endregion
 //#region src/m2m.ts
 /**
 * Resolve M2M client credentials from (in order) the process environment, a
@@ -3384,12 +3904,16 @@ function readM2mCreds(dotenvVars = {}) {
 		clientSecret
 	};
 }
-/** True when a service/dev credential is already configured explicitly. */
+/**
+* True when a service/session/dev credential is already configured explicitly.
+* A browser-authorized session counts: a human who ran `seekrit login` must not
+* be silently swapped onto a machine identity.
+*/
 function hasExplicitCredential(dotenvVars) {
 	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
 	if (fromEnv("SEEKRIT_TOKEN") || fromEnv("SEEKRIT_DEV_USER")) return true;
 	const config = readGlobalConfig();
-	return Boolean(config.token || config.devUser);
+	return Boolean(config.token || config.sessionToken || config.devUser);
 }
 /** Mint a fresh org-scoped admin token using M2M credentials (keyless). */
 async function mintAdminToken(apiUrl, creds) {
@@ -3463,7 +3987,7 @@ function parseTtlSeconds$4(input) {
 	}[m[2] || "s"] ?? 1);
 }
 /** Collect a repeatable option into an array. */
-function collect$5(value, previous) {
+function collect$4(value, previous) {
 	return [...previous, value];
 }
 /** Parse `readWrite@app` → { role, db } for a custom target. */
@@ -3488,7 +4012,7 @@ function resolveAdminUri(uri) {
 function registerMongoCommands(program) {
 	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
 	const target = mongo.command("target").description("manage MongoDB targets");
-	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$5, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const adminUri = resolveAdminUri(options.uri);
@@ -3648,7 +4172,7 @@ function generateUserName$1(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$4, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$4, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -3749,7 +4273,7 @@ function registerMysqlCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$4(value, acc) {
+function collect$3(value, acc) {
 	acc.push(value);
 	return acc;
 }
@@ -3786,7 +4310,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -3900,208 +4424,10 @@ function registerPgCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$3(value, acc) {
-	acc.push(value);
-	return acc;
-}
-//#endregion
-//#region src/recovery.ts
-/** Collect a repeatable option into a list. */
-function collect$2(value, acc = []) {
+function collect$2(value, acc) {
 	acc.push(value);
 	return acc;
 }
-/** Resolve a custodian reference: a `skt_…` token id, otherwise a member email. */
-function resolveCustodian(ctx, orgId, ref) {
-	return ref.startsWith("skt_") ? kmsResolveRecipient(ctx, orgId, { token: ref }) : kmsResolveRecipient(ctx, orgId, { user: ref });
-}
-/**
-* The env DEK additionally wrapped to the org recovery key, when recovery is
-* enabled — so a newly created environment is recovery-protected from birth.
-* Returns undefined when recovery is off (the env is backfilled by `recovery
-* sync` later).
-*/
-async function recoveryWrapForNewEnv(ctx, orgId, dek) {
-	let recoveryPublicKeyJwk;
-	try {
-		const { recovery } = await ctx.client.getRecovery(orgId);
-		recoveryPublicKeyJwk = recovery.enabled ? recovery.recoveryPublicKeyJwk : null;
-	} catch (e) {
-		if (e instanceof SeekritApiError && (e.status === 403 || e.status === 404)) return void 0;
-		throw e;
-	}
-	if (!recoveryPublicKeyJwk) return void 0;
-	return wrapDek(dek, recoveryPublicKeyJwk);
-}
-/**
-* Wrap every environment the caller can decrypt but that lacks a recovery grant,
-* and upload the grants. Idempotent — safe to re-run and to run from several
-* admins to complete coverage.
-*/
-async function syncRecoveryGrants(ctx, orgId) {
-	const { recovery } = await ctx.client.getRecovery(orgId);
-	if (!recovery.enabled || !recovery.recoveryPublicKeyJwk) fail("recovery is not enabled");
-	const recoveryPublicKeyJwk = recovery.recoveryPublicKeyJwk;
-	const privateKey = await getPrivateKey(ctx);
-	const grants = [];
-	let skipped = 0;
-	for (const environmentId of recovery.coverage.unprotectedEnvIds) {
-		let wrappedDek;
-		try {
-			({wrappedDek} = await ctx.client.getMyEnvKey(orgId, environmentId));
-		} catch (e) {
-			if (e instanceof SeekritApiError && (e.status === 403 || e.status === 404)) {
-				skipped++;
-				continue;
-			}
-			throw e;
-		}
-		const dek = await unwrapDek(wrappedDek, privateKey);
-		grants.push({
-			environmentId,
-			wrappedDek: await wrapDek(dek, recoveryPublicKeyJwk)
-		});
-	}
-	if (grants.length > 0) await ctx.client.uploadRecoveryGrants(orgId, { grants });
-	return {
-		wrapped: grants.length,
-		skipped
-	};
-}
-/** Generate + split a fresh recovery key across the given custodians. */
-async function buildRecoveryConfig(ctx, orgId, thresholdRaw, custodianRefs) {
-	const threshold = Number.parseInt(thresholdRaw, 10);
-	if (!Number.isInteger(threshold) || threshold < 1) fail("--threshold must be a positive integer");
-	if (custodianRefs.length === 0) fail("pass at least one --custodian <email|skt_id>");
-	if (threshold > custodianRefs.length) fail("--threshold cannot exceed the number of custodians");
-	const custodians = await Promise.all(custodianRefs.map((ref) => resolveCustodian(ctx, orgId, ref)));
-	const recovery = await generateRecoveryKey();
-	const shares = await splitRecoveryKey(recovery.privateKeyJwk, threshold, custodians);
-	return {
-		recoveryPublicKeyJwk: recovery.publicKeyJwk,
-		threshold,
-		shares: shares.map((s) => ({
-			principalType: s.principalType,
-			principalId: s.principalId,
-			shareIndex: s.shareIndex,
-			wrappedShare: s.wrappedShare
-		}))
-	};
-}
-function registerRecoveryCommands(program) {
-	const recovery = program.command("recovery").description("customer-controlled M-of-N recovery (zero-knowledge)");
-	recovery.command("status").description("show recovery configuration and environment coverage").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { recovery: status } = await ctx.client.getRecovery(org.id);
-		if (!status.enabled) {
-			console.log("recovery: disabled");
-			return;
-		}
-		console.log(`recovery: enabled (${status.threshold}-of-${status.shareCount})`);
-		console.log(`coverage: ${status.coverage.protected}/${status.coverage.total} environments protected`);
-		console.log("custodians:");
-		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
-		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
-	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$2, []).option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
-		await ctx.client.configureRecovery(org.id, {
-			...config,
-			grants: []
-		});
-		console.error(`recovery enabled: ${config.threshold}-of-${config.shares.length}`);
-		const { wrapped, skipped } = await syncRecoveryGrants(ctx, org.id);
-		console.error(`recovery-protected ${wrapped} environment(s) you can decrypt`);
-		if (skipped > 0) console.error(`${skipped} environment(s) need another admin to run \`seekrit recovery sync\``);
-	});
-	recovery.command("sync").description("recovery-protect environments you can decrypt but that aren't yet covered").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
-		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
-	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$2, []).option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
-		await ctx.client.rotateRecovery(org.id, {
-			...config,
-			grants: []
-		});
-		console.error(`recovery rotated: ${config.threshold}-of-${config.shares.length}`);
-		const { wrapped, skipped } = await syncRecoveryGrants(ctx, org.id);
-		console.error(`re-wrapped ${wrapped} environment(s) you can decrypt to the new recovery key`);
-		if (skipped > 0) console.error(`${skipped} environment(s) still need another admin to run \`seekrit recovery sync\``);
-	});
-	recovery.command("disable").description("disable recovery and remove all recovery grants").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.disableRecovery(org.id);
-		console.error("recovery disabled; recovery grants removed");
-	});
-	recovery.command("request").description("start a recovery ceremony (defaults to recovering access for yourself)").option("--target-user <email>", "recover access for another member").option("--target-token <id>", "recover access for a service token").option("--reason <text>", "note recorded in the audit trail").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const target = options.targetUser || options.targetToken ? await kmsResolveRecipient(ctx, org.id, {
-			user: options.targetUser,
-			token: options.targetToken
-		}) : await kmsCallerIdentity(ctx);
-		const { request } = await ctx.client.createRecoveryRequest(org.id, {
-			targetPublicKeyJwk: target.publicKeyJwk,
-			targetType: target.principalType,
-			targetId: target.principalId,
-			reason: options.reason
-		});
-		console.error(`recovery request ${request.id} created (needs ${request.threshold} custodians)`);
-		console.error(`  custodians run:  seekrit recovery approve ${request.id}`);
-		console.error(`  then the target: seekrit recovery complete ${request.id}`);
-	});
-	recovery.command("approve").description("as a custodian, contribute your share to a recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { request } = await ctx.client.getRecoveryRequest(org.id, requestId);
-		const myShare = await ctx.client.getMyRecoveryShare(org.id);
-		const privateKey = await getPrivateKey(ctx);
-		const contributedShare = await rewrapRecoveryShare(await unwrapRecoveryShare(myShare.wrappedShare, privateKey), request.targetPublicKeyJwk);
-		const res = await ctx.client.contributeRecoveryShare(org.id, requestId, {
-			shareIndex: myShare.shareIndex,
-			contributedShare
-		});
-		console.error(`contributed share #${myShare.shareIndex}: ${res.contributed}/${res.threshold} collected${res.quorumReached ? " — quorum reached" : ""}`);
-	});
-	recovery.command("complete").description("as the recovery target, reconstruct the key and restore your access").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { request, contributions, quorumReached } = await ctx.client.getRecoveryRequest(org.id, requestId);
-		if (!quorumReached) fail(`only ${contributions.length}/${request.threshold} custodians have contributed`);
-		const me = await kmsCallerIdentity(ctx);
-		const targetPrivateKey = await getPrivateKey(ctx);
-		const recoveryPrivateKey = await combineRecoveryShares(await Promise.all(contributions.map((cont) => unwrapRecoveryShare(cont.contributedShare, targetPrivateKey))));
-		const { grants: recoveryEnvKeys } = await ctx.client.getRecoveryEnvKeys(org.id);
-		const restored = [];
-		for (const g of recoveryEnvKeys) {
-			const dek = await unwrapDek(g.wrappedDek, recoveryPrivateKey);
-			restored.push({
-				environmentId: g.environmentId,
-				wrappedDek: await wrapDek(dek, me.publicKeyJwk)
-			});
-		}
-		await ctx.client.completeRecoveryRequest(org.id, requestId, {
-			principalType: me.principalType,
-			principalId: me.principalId,
-			grants: restored
-		});
-		console.error(`recovery complete: restored access to ${restored.length} environment(s)`);
-	});
-	recovery.command("cancel").description("cancel an open recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.cancelRecoveryRequest(org.id, requestId);
-		console.error(`recovery request ${requestId} canceled`);
-	});
-}
 //#endregion
 //#region src/redis.ts
 /**
@@ -4326,6 +4652,7 @@ async function importSecrets(ctx, orgId, envId, entries) {
 async function materializeEnv(ctx, opts) {
 	const query = {};
 	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (opts.branch) query.branch = opts.branch;
 	if (!isTokenAuth(ctx)) {
 		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
 		query.env = opts.envId;
@@ -4336,7 +4663,10 @@ async function materializeEnv(ctx, opts) {
 	const provenance = {};
 	for (const layer of layers) {
 		const dek = await unwrapDek(layer.wrappedDek, privateKey);
-		const label = layer.source === "group" ? `group:${layer.groupSlug}@${layer.slug}` : `app:${scope.appSlug}/${layer.slug}`;
+		let label;
+		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
+		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
+		else label = `app:${scope.appSlug}/${layer.slug}`;
 		for (const secret of layer.secrets) {
 			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
 			provenance[secret.name] = label;
@@ -4526,6 +4856,181 @@ function collect(value, acc) {
 	return acc;
 }
 //#endregion
+//#region src/web-login.ts
+/**
+* `seekrit login` — sign in through the browser.
+*
+* The credential is born here and never leaves: we mint a CLI session token
+* locally, register only its SHA-256 hash, and wait for a human to authorize
+* that hash in the dashboard. When they do, we already hold the token — the
+* approval round-trip carries nothing secret, so there is no window in which the
+* API (or anything watching it) could learn our credential.
+*
+* The saved session authenticates as *you*, which is why it needs no org, app,
+* or environment selection: commands see every org you're a member of, and
+* decryption still runs through your own passphrase-unlocked key. Machines want
+* the opposite trade — a scoped, key-carrying credential — and keep using
+* `seekrit login --token skt_…`.
+*/
+/** Open a URL in the platform's default browser. Best-effort and silent. */
+function openBrowser(url) {
+	const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", [
+		"/c",
+		"start",
+		"",
+		url
+	]] : ["xdg-open", [url]];
+	try {
+		const child = spawn(command, args, {
+			stdio: "ignore",
+			detached: true
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+/** A frame of the waiting spinner, or a static line on a non-TTY. */
+const SPINNER = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+function startWaitingIndicator(message) {
+	if (!process.stderr.isTTY) {
+		process.stderr.write(`${message}\n`);
+		return () => void 0;
+	}
+	let frame = 0;
+	const timer = setInterval(() => {
+		process.stderr.write(`\r${SPINNER[frame % SPINNER.length]} ${message}`);
+		frame++;
+	}, 80);
+	return () => {
+		clearInterval(timer);
+		process.stderr.write(`\r${" ".repeat(message.length + 2)}\r`);
+	};
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function runWebLogin(options) {
+	const config = readGlobalConfig();
+	const apiUrl = options.apiUrl ?? process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const client = `cli/${version}`;
+	const session = await createCliSessionToken();
+	const deviceLabel = `${userInfo().username}@${hostname()}`;
+	const started = await startCliLogin(apiUrl, {
+		sessionId: session.sessionId,
+		tokenHash: session.tokenHash,
+		deviceLabel,
+		client
+	}, { client }).catch((err) => {
+		fail(`couldn't start sign-in: ${err instanceof Error ? err.message : String(err)}`);
+	});
+	console.error(`Sign in to seekrit to authorize this device (${deviceLabel}).\n`);
+	console.error(`  ${started.verifyUrl}\n`);
+	console.error(`  code: ${started.code}   — check it matches the one in your browser\n`);
+	if (options.browser === false) console.error("Open that URL to continue.\n");
+	else {
+		await promptEnter("Press [Enter] to open it in your browser (Ctrl-C to cancel)… ");
+		openBrowser(started.verifyUrl);
+	}
+	const stopWaiting = startWaitingIndicator("Waiting for you to authorize…");
+	try {
+		const deadline = Date.parse(started.requestExpiresAt);
+		while (true) {
+			const result = await pollCliLogin(apiUrl, started.code, { client }).catch(() => null);
+			if (result?.status === "approved") {
+				writeGlobalConfig({
+					sessionToken: session.token,
+					token: void 0,
+					...options.apiUrl ? { apiUrl: options.apiUrl } : {}
+				});
+				stopWaiting();
+				const who = result.email ?? "your account";
+				console.error(`Signed in as ${who} — this device is authorized for 90 days.`);
+				if (config.token) console.error("(the service token saved here was replaced; SEEKRIT_TOKEN still wins)");
+				await reportOrgs(apiUrl, session.token, client);
+				return;
+			}
+			if (result?.status === "denied") {
+				stopWaiting();
+				fail("sign-in was declined in the browser");
+			}
+			if (result?.status === "expired" || Date.now() > deadline) {
+				stopWaiting();
+				fail("sign-in request expired — run `seekrit login` again");
+			}
+			await sleep(started.pollIntervalSeconds * 1e3);
+		}
+	} finally {
+		stopWaiting();
+	}
+}
+/**
+* Print what the new session can reach, so a successful login ends with proof it
+* works rather than a bare "ok". Best-effort: a hiccup here doesn't undo a
+* login that already succeeded.
+*/
+async function reportOrgs(apiUrl, token, client) {
+	try {
+		const { user, orgs } = await new SeekritClient({
+			baseUrl: apiUrl,
+			auth: {
+				type: "bearer",
+				token
+			},
+			client
+		}).me();
+		for (const org of orgs) console.error(`  ${org.slug} (${org.role})`);
+		if (!user.hasKeys) console.error("\nNext: run `seekrit keys setup` to create your encryption keys.");
+	} catch {}
+}
+/**
+* `seekrit logout` — drop the saved credential, and revoke it server-side when
+* it's a CLI session (the one credential this machine owns outright). A service
+* token is shared infrastructure that other machines may hold, so it is only
+* removed locally, never revoked out from under them.
+*/
+async function runLogout() {
+	const config = readGlobalConfig();
+	const sessionToken = config.sessionToken;
+	if (!sessionToken && !config.token && !config.devUser && !config.clientId) {
+		console.error("not signed in");
+		return;
+	}
+	if (sessionToken) {
+		const api = new SeekritClient({
+			baseUrl: process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "https://api.seekrit.dev",
+			auth: {
+				type: "bearer",
+				token: sessionToken
+			},
+			client: `cli/${version}`
+		});
+		try {
+			const { currentSessionId } = await api.listCliSessions();
+			if (currentSessionId) await api.revokeCliSession(currentSessionId);
+			console.error("signed out — this device is no longer authorized");
+		} catch (err) {
+			console.error(`signed out locally, but couldn't revoke the session: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
+	writeGlobalConfig({
+		sessionToken: void 0,
+		token: void 0,
+		devUser: void 0
+	});
+	if (config.clientId) console.error("(machine client credentials are kept — remove them with `seekrit login`)");
+}
+//#endregion
 //#region src/index.ts
 /** Collect repeated `--with group=env` flags into a map. */
 function collectKv(value, acc = {}) {
@@ -4543,11 +5048,21 @@ const program = new Command("seekrit").description("End-to-end encrypted secrets
 program.hook("preAction", async () => {
 	await ensureM2mAdminToken();
 });
-program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_…)").option("--client-id <id>", "machine (M2M) client id — auto-mints an admin token").option("--client-secret <secret>", "machine (M2M) client secret").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").action((options) => {
+program.command("login").description("sign in through the browser (or pass a credential to store one directly)").option("--token <token>", "service token (skt_…) — skips the browser").option("--client-id <id>", "machine (M2M) client id — auto-mints an admin token").option("--client-secret <secret>", "machine (M2M) client secret").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").option("--no-browser", "print the sign-in URL instead of opening it").action(async (options) => {
 	if (options.token && !isServiceToken(options.token)) fail("token must start with skt_");
 	if (Boolean(options.clientId) !== Boolean(options.clientSecret)) fail("--client-id and --client-secret must be given together");
+	if (!(options.token || options.clientId || options.devUser)) {
+		await runWebLogin({
+			apiUrl: options.apiUrl,
+			browser: options.browser
+		});
+		return;
+	}
 	writeGlobalConfig({
-		...options.token ? { token: options.token } : {},
+		...options.token ? {
+			token: options.token,
+			sessionToken: void 0
+		} : {},
 		...options.clientId ? { clientId: options.clientId } : {},
 		...options.clientSecret ? { clientSecret: options.clientSecret } : {},
 		...options.devUser ? { devUser: options.devUser } : {},
@@ -4555,6 +5070,9 @@ program.command("login").description("store credentials for the API").option("--
 	});
 	console.error("credentials saved");
 });
+program.command("logout").description("forget the saved credentials (revokes a browser-authorized session)").action(async () => {
+	await runLogout();
+});
 program.command("whoami").description("show the authenticated identity").action(async () => {
 	const ctx = buildContext();
 	if (isTokenAuth(ctx) && ctx.auth.type === "bearer") {
@@ -4571,6 +5089,10 @@ program.command("whoami").description("show the authenticated identity").action(
 	const { user, orgs } = await ctx.client.me();
 	console.log(`${user.email}${user.hasKeys ? "" : "  (key setup pending — run `seekrit keys setup`)"}`);
 	for (const org of orgs) console.log(`  ${org.slug} (${org.role})`);
+	if (ctx.auth.type === "bearer" && isCliSessionToken(ctx.auth.token)) {
+		const { sessionId } = parseCliSessionToken(ctx.auth.token);
+		console.log(`  via CLI session ${sessionId} (revoke it with \`seekrit logout\`)`);
+	}
 });
 program.command("keys").description("manage your encryption keys").command("setup").description("generate your keypair and protect it with a passphrase").action(async () => {
 	const ctx = buildContext();
@@ -4702,7 +5224,7 @@ function parseVersion(raw) {
 }
 /** Attach the environment-selection flags shared by every `secrets` command. */
 function withTarget(cmd) {
-	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>", "environment slug");
+	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").option("--branch <slug>", "operate on a branch of --env").requiredOption("--env <slug>", "environment slug");
 }
 const secrets = program.command("secrets").description("manage secrets in an application or group environment");
 withTarget(secrets.command("list").description("list secret names (no values)")).action(async (options) => {
@@ -4780,6 +5302,7 @@ async function materialize(ctx, options) {
 	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, options)).envId;
 	return materializeEnv(ctx, {
 		envId,
+		branch: options.branch ?? process.env.SEEKRIT_BRANCH,
 		with: options.with,
 		envFiles: options.envFile ?? [".env"],
 		interpolate: options.interpolate
@@ -4800,7 +5323,11 @@ async function materializeForRun(options) {
 		await ensureM2mAdminToken(dotenvVars);
 		const ctx = tryBuildContext(dotenvVars);
 		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
-		return await materialize(ctx, options);
+		const branch = options.branch ?? process.env.SEEKRIT_BRANCH ?? dotenvVars.SEEKRIT_BRANCH;
+		return await materialize(ctx, {
+			...options,
+			branch
+		});
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		console.error(`seekrit: continuing without seekrit-managed secrets: ${message}`);
@@ -4923,7 +5450,7 @@ async function reapStragglers(pids, signal) {
 		process.kill(pid, "SIGKILL");
 	} catch {}
 }
-program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
 	const { values, provenance, interpolated, unresolvedRefs } = await materializeForRun(options);
@@ -4975,7 +5502,7 @@ program.command("run").description("run a command with decrypted secrets injecte
 	});
 	child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
 });
-program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
+program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
 	if (![
 		"dotenv",
 		"json",
@@ -5095,6 +5622,7 @@ token.command("delete <tokenId>").description("permanently delete a revoked serv
 	await ctx.client.deleteToken(orgRef.id, tokenId);
 	console.error(`${tokenId} deleted`);
 });
+registerBranchCommands(program);
 registerPgCommands(program);
 registerMysqlCommands(program);
 registerRedisCommands(program);
@@ -5106,7 +5634,7 @@ registerMongoCommands(program);
 registerKmsCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-COWsshZZ.js");
+	const { runMcpServer } = await import("./mcp-DLplPOvz.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
@@ -5120,4 +5648,4 @@ program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export { generateMysqlCredential as A, generateSigningKeyMaterial as C, signatureKeyRef as D, signMessage as E, kmsEncrypt as F, wrapDek as I, generateDek as L, generateEncryptKeyMaterial as M, kmsBlobKeyRef as N, verifyMessage as O, kmsDecrypt as P, toBase64 as R, parseServiceToken as S, importVerifyingKey as T, setFailThrows as _, ensureM2mAdminToken as a, createServiceToken as b, kmsResolveKey as c, resolveEnvTarget as d, resolveGroup as f, tryBuildContext as g, isTokenAuth as h, materializeEnv as i, generateDataKey as j, generatePostgresCredential as k, kmsResolveRecipient as l, getDek as m, fetchDecryptedSecrets as n, kmsCallerIdentity as o, resolveOrg as p, fetchDecryptedVersion as r, kmsRecoverMaterial as s, encryptAndSetSecret as t, resolveAppEnv as u, writeProjectConfig as v, importSigningKey as w, isServiceToken as x, version as y };
+export { verifyMessage as A, toBase64 as B, isServiceToken as C, importVerifyingKey as D, importSigningKey as E, kmsBlobKeyRef as F, kmsDecrypt as I, kmsEncrypt as L, generateMysqlCredential as M, generateDataKey as N, signMessage as O, generateEncryptKeyMaterial as P, wrapDek as R, createServiceToken as S, generateSigningKeyMaterial as T, parseBranchTtl as V, isTokenAuth as _, ensureM2mAdminToken as a, writeProjectConfig as b, kmsResolveKey as c, resolveAppEnv as d, resolveBranch as f, getDek as g, resolveOrg as h, materializeEnv as i, generatePostgresCredential as j, signatureKeyRef as k, kmsResolveRecipient as l, resolveGroup as m, fetchDecryptedSecrets as n, kmsCallerIdentity as o, resolveEnvTarget as p, fetchDecryptedVersion as r, kmsRecoverMaterial as s, encryptAndSetSecret as t, resolveApp as u, tryBuildContext as v, parseServiceToken as w, version as x, setFailThrows as y, generateDek as z };