@seekrit/cli 0.27.0 → 0.28.0

package/dist/index.js

@@ -39,6 +39,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Single sign-on beyond the built-in providers.",
 		default: true
 	},
+	"feature.sync": {
+		kind: "feature",
+		label: "Third-party sync",
+		description: "Push environment secrets to external platforms like Vercel.",
+		default: true
+	},
 	"apps.max": {
 		kind: "limit",
 		label: "Applications",
@@ -87,6 +93,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Maximum registered temporary-access targets.",
 		default: null
 	},
+	"sync.connections.max": {
+		kind: "limit",
+		label: "Sync connections",
+		description: "Maximum registered third-party sync destinations.",
+		default: null
+	},
 	members: {
 		kind: "metered",
 		label: "Members",
@@ -135,7 +147,8 @@ const PLAN_FAMILIES = {
 	}
 };
 const PLAN_FAMILY_IDS = Object.keys(PLAN_FAMILIES);
-PLAN_FAMILY_IDS.filter((family) => !PLAN_FAMILIES[family].hidden);
+/** Plan families a plan picker should render. Excludes families marked `hidden`. */
+const VISIBLE_PLAN_FAMILY_IDS = PLAN_FAMILY_IDS.filter((family) => !PLAN_FAMILIES[family].hidden);
 //#endregion
 //#region ../../packages/core/src/billing.ts
 /**
@@ -195,6 +208,24 @@ function parseBranchTtl(input) {
 	return value * multiplier;
 }
 //#endregion
+//#region ../../packages/core/src/ids.ts
+const ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+/**
+* Generate a prefixed, URL-safe random ID, e.g. `org_h9K2x…`.
+* Uses rejection sampling so every character is uniformly distributed.
+*/
+function randomId(prefix, length = 24) {
+	let out = "";
+	while (out.length < length) {
+		const bytes = crypto.getRandomValues(new Uint8Array(length - out.length));
+		for (const byte of bytes) {
+			if (byte < 248) out += ALPHABET[byte % 62];
+			if (out.length === length) break;
+		}
+	}
+	return `${prefix}_${out}`;
+}
+//#endregion
 //#region ../../packages/core/src/interpolate.ts
 /**
 * Secret references: `${OTHER_SECRET}` inside a secret value.
@@ -829,6 +860,84 @@ function sshHostSetupInstructions(config) {
 }
 //#endregion
 //#region ../../packages/core/src/types.ts
+const AUDIT_ACTIONS = [
+	"org.created",
+	"org.updated",
+	"org.member_added",
+	"org.member_removed",
+	"org.member_invited",
+	"org.invite_revoked",
+	"org.mfa_policy_changed",
+	"user.keys_updated",
+	"user.notification_prefs_updated",
+	"app.created",
+	"app.updated",
+	"app.deleted",
+	"group.created",
+	"group.updated",
+	"group.deleted",
+	"env.created",
+	"env.updated",
+	"env.deleted",
+	"env.group_linked",
+	"env.group_unlinked",
+	"env.resolved",
+	"env.resolve_denied",
+	"env.key_granted",
+	"env.key_revoked",
+	"branch.created",
+	"branch.deleted",
+	"branch.expired",
+	"secret.created",
+	"secret.updated",
+	"secret.deleted",
+	"secret.read",
+	"secret.restored",
+	"token.created",
+	"token.revoked",
+	"token.deleted",
+	"cli_session.approved",
+	"cli_session.denied",
+	"cli_session.revoked",
+	"m2m.client_created",
+	"m2m.client_revoked",
+	"lease.target_registered",
+	"lease.target_deleted",
+	"lease.created",
+	"lease.revoked",
+	"lease.expired",
+	"log_sink.configured",
+	"log_sink.deleted",
+	"log_sink.test",
+	"subscription.updated",
+	"subscription.canceled",
+	"entitlement.override_set",
+	"entitlement.override_cleared",
+	"billing.checkout_started",
+	"billing.portal_opened",
+	"kms.key_created",
+	"kms.key_granted",
+	"kms.key_revoked",
+	"kms.key_rotated",
+	"kms.key_disabled",
+	"kms.key_deleted",
+	"recovery.configured",
+	"recovery.rotated",
+	"recovery.disabled",
+	"recovery.env_wrapped",
+	"recovery.requested",
+	"recovery.share_contributed",
+	"recovery.completed",
+	"recovery.canceled",
+	"sync.connection_created",
+	"sync.connection_updated",
+	"sync.connection_deleted",
+	"sync.binding_created",
+	"sync.binding_updated",
+	"sync.binding_deleted",
+	"sync.run_succeeded",
+	"sync.run_failed"
+];
 /**
 * Transactional notification emails seekrit can send. Each id is one
 * user-facing on/off toggle (see `NOTIFICATION_TYPE_META`). These carry only
@@ -844,8 +953,57 @@ const NOTIFICATION_TYPES = [
 	"resolve_denied",
 	"org_welcome",
 	"token_expiring",
-	"lease_expired"
+	"lease_expired",
+	"sync_failed"
 ];
+/** UI-facing copy + default for each notification type. */
+const NOTIFICATION_TYPE_META = {
+	token_created: {
+		label: "Service token created",
+		description: "A new service token that can decrypt secrets was created in one of your organizations.",
+		defaultEnabled: true
+	},
+	token_revoked: {
+		label: "Service token revoked",
+		description: "A service token was revoked in one of your organizations.",
+		defaultEnabled: true
+	},
+	env_access_granted: {
+		label: "Environment access granted",
+		description: "You were granted access to decrypt an environment's secrets.",
+		defaultEnabled: true
+	},
+	env_access_revoked: {
+		label: "Environment access revoked",
+		description: "Your access to an environment's secrets was revoked.",
+		defaultEnabled: true
+	},
+	resolve_denied: {
+		label: "Denied-access alerts",
+		description: "A principal was denied when trying to resolve an environment's secrets (throttled).",
+		defaultEnabled: true
+	},
+	org_welcome: {
+		label: "Welcome & key setup",
+		description: "You joined an organization — a welcome with next steps for finishing encryption key setup.",
+		defaultEnabled: true
+	},
+	token_expiring: {
+		label: "Service token expiring",
+		description: "A service token in one of your organizations is expiring within 7 days.",
+		defaultEnabled: true
+	},
+	lease_expired: {
+		label: "Temporary credential expired",
+		description: "A temporary (leased) credential you own expired and was automatically revoked.",
+		defaultEnabled: true
+	},
+	sync_failed: {
+		label: "Third-party sync failed",
+		description: "A sync to an external destination failed repeatedly and stopped retrying. The destination is now holding stale values.",
+		defaultEnabled: true
+	}
+};
 //#endregion
 //#region ../../packages/core/src/schemas.ts
 /** URL-safe identifier segment: `my-app`, `production`, … */
@@ -1081,6 +1239,128 @@ z.object({
 	resourceType: z.string().optional()
 });
 //#endregion
+//#region ../../packages/core/src/sync.ts
+/**
+* Third-party sync: seekrit as source of truth, pushing an environment's
+* resolved secrets out to a platform that holds its own copy (Vercel project
+* env vars, GitHub Actions secrets, a cloud secret manager, …).
+*
+* This file is the transport-free vocabulary — provider kinds, connection and
+* destination shapes, the name-mapping rules, and the request schemas. The
+* execution side (the per-org `SyncEngine` Durable Object and the connectors)
+* lives in `apps/api`.
+*
+* ## Sync is the one place plaintext exists server-side
+*
+* Every other seekrit feature keeps decryption on the caller's machine. A sync
+* destination needs the plaintext value, and sync runs when nobody is logged
+* in, so the sync engine must be able to decrypt on its own. That capability is
+* granted exactly like any other: an `environment_keys` row of principal type
+* `sync`, whose `principalId` is the **connection id** and whose wrapped DEK is
+* computed client-side by a key holder. No grant, no sync — the control plane
+* cannot manufacture one.
+*
+* Keying per connection (not per org) is deliberate: one stray grant exposes
+* one named destination, and deleting a connection destroys its keypair, which
+* turns every grant to it into dead ciphertext.
+*
+* See `docs/third-party-sync.md`.
+*/
+/** Platforms seekrit can push to. Append-only — persisted in `sync_connections.provider`. */
+const SYNC_PROVIDER_KINDS = ["vercel"];
+z.enum(SYNC_PROVIDER_KINDS);
+/**
+* Vercel account scope. The API token itself is never here — it is wrapped to
+* the connection's public key and stored as ciphertext.
+*
+* `teamId` is required for tokens scoped to a Vercel Team; personal-account
+* tokens omit it. Vercel rejects team-owned project calls that lack it with a
+* bare 403, so we pass it through as `?teamId=` on every request.
+*/
+const vercelConnectionConfigSchema = z.object({
+	provider: z.literal("vercel"),
+	/** Vercel Team id (`team_…`). Omit for a personal account. */
+	teamId: z.string().trim().min(1).max(128).optional()
+});
+const syncConnectionConfigSchema = z.discriminatedUnion("provider", [vercelConnectionConfigSchema]);
+/** Vercel's three deployment targets. A binding writes to one or more. */
+const VERCEL_TARGETS = [
+	"production",
+	"preview",
+	"development"
+];
+const vercelDestinationSchema = z.object({
+	provider: z.literal("vercel"),
+	/** Vercel project id (`prj_…`) or project name. */
+	projectId: z.string().trim().min(1).max(128),
+	/** Which deployment targets receive these values. At least one. */
+	targets: z.array(z.enum(VERCEL_TARGETS)).min(1),
+	/**
+	* Restrict `preview` writes to one git branch. Vercel only honors this when
+	* `targets` includes `preview`; ignored otherwise.
+	*/
+	gitBranch: z.string().trim().min(1).max(255).optional()
+});
+const syncDestinationSchema = z.discriminatedUnion("provider", [vercelDestinationSchema]);
+/**
+* How seekrit secret names become destination key names. Applied in order:
+* explicit `rename` (wins outright), then `prefix`/`suffix`, then `case`.
+*/
+const nameTransformSchema = z.object({
+	prefix: z.string().max(64).regex(/^[A-Za-z0-9_]*$/, "must be alphanumeric or underscore").optional(),
+	suffix: z.string().max(64).regex(/^[A-Za-z0-9_]*$/, "must be alphanumeric or underscore").optional(),
+	case: z.enum([
+		"preserve",
+		"upper",
+		"lower"
+	]).optional(),
+	/** Exact per-secret overrides, seekrit name → destination name. */
+	rename: z.record(secretNameSchema, secretNameSchema).optional()
+});
+z.object({
+	/**
+	* The id the client already fetched a public key for. Connections are a
+	* two-step dance — mint the key, wrap the credential to it, then create the
+	* row — so the id has to be chosen before the row exists. Omit it and the
+	* server generates one (only useful when there is no credential to wrap yet).
+	*/
+	id: z.string().regex(/^syc_[A-Za-z0-9]{24}$/, "must be a connection id from the public-key call").optional(),
+	name: z.string().trim().min(1).max(128),
+	config: syncConnectionConfigSchema,
+	/**
+	* The destination's API credential (a Vercel token), encrypted client-side to
+	* the connection's public key (a `wd1.` wrap). The control plane stores only
+	* this ciphertext; it is unwrapped transiently inside the sync engine DO.
+	*/
+	wrappedCredential: z.string().min(1)
+});
+z.object({ destination: syncDestinationSchema });
+const globListSchema = z.array(z.string().trim().min(1).max(256)).max(100);
+z.object({
+	connectionId: z.string().min(1),
+	environmentId: z.string().min(1),
+	destination: syncDestinationSchema,
+	nameTransform: nameTransformSchema.optional(),
+	include: globListSchema.optional(),
+	exclude: globListSchema.optional(),
+	onDelete: z.enum(["delete", "retain"]).default("delete"),
+	mode: z.enum(["auto", "manual"]).default("auto"),
+	wrappedDeks: z.array(z.object({
+		environmentId: z.string().min(1),
+		wrappedDek: z.string().min(1)
+	})).min(1),
+	acknowledgedDecryption: z.literal(true)
+});
+z.object({
+	destination: syncDestinationSchema.optional(),
+	nameTransform: nameTransformSchema.nullable().optional(),
+	include: globListSchema.nullable().optional(),
+	exclude: globListSchema.nullable().optional(),
+	onDelete: z.enum(["delete", "retain"]).optional(),
+	mode: z.enum(["auto", "manual"]).optional(),
+	enabled: z.boolean().optional()
+});
+//#endregion
 //#region ../../packages/crypto/src/encoding.ts
 const CHUNK = 32768;
 /** Base64url (no padding) — portable across browsers, Workers, and Node. */
@@ -2217,7 +2497,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.27.0";
+var version = "0.28.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -2582,6 +2862,54 @@ var SeekritClient = class {
 	deleteLeaseTarget(orgId, targetId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/leases/targets/${targetId}`);
 	}
+	listSyncConnections(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/sync/connections`);
+	}
+	/**
+	* Mint (or re-read) the keypair for a connection id, *before* the connection
+	* exists. Wrap the destination credential and every environment DEK to this
+	* key, then pass the same id to {@link createSyncConnection}.
+	*/
+	getSyncConnectionKey(orgId, connectionId) {
+		return this.request("GET", `/v1/orgs/${orgId}/sync/connections/${connectionId}/public-key`);
+	}
+	createSyncConnection(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/sync/connections`, input);
+	}
+	/** Test the stored credential against a destination. Never throws on a bad token. */
+	verifySyncConnection(orgId, connectionId, destination) {
+		return this.request("POST", `/v1/orgs/${orgId}/sync/connections/${connectionId}/verify`, { destination });
+	}
+	/** Deletes the connection, its bindings, its key grants, and its keypair. */
+	deleteSyncConnection(orgId, connectionId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/sync/connections/${connectionId}`);
+	}
+	listSyncBindings(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/sync/bindings`);
+	}
+	/**
+	* Enable sync for one environment. `wrappedDeks` must cover the target
+	* environment *and* every group environment it composes, each wrapped to the
+	* connection's public key — the API cannot compute these, which is what keeps
+	* enabling sync a key-holder operation.
+	*/
+	createSyncBinding(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/sync/bindings`, input);
+	}
+	updateSyncBinding(orgId, bindingId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/sync/bindings/${bindingId}`, input);
+	}
+	deleteSyncBinding(orgId, bindingId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/sync/bindings/${bindingId}`);
+	}
+	/** Push now, synchronously. */
+	runSyncBinding(orgId, bindingId) {
+		return this.request("POST", `/v1/orgs/${orgId}/sync/bindings/${bindingId}/run`);
+	}
+	listSyncRuns(orgId, bindingId) {
+		const qs = bindingId ? `?bindingId=${encodeURIComponent(bindingId)}` : "";
+		return this.request("GET", `/v1/orgs/${orgId}/sync/runs${qs}`);
+	}
 	listLeases(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/leases`);
 	}
@@ -2788,6 +3116,31 @@ function promptEnter(question) {
 		});
 	});
 }
+function askYesNo(question) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr,
+		terminal: true
+	});
+	return new Promise((resolve) => {
+		rl.question(`${question} [y/N] `, (answer) => {
+			rl.close();
+			resolve(/^y(es)?$/i.test(answer.trim()));
+		});
+	});
+}
+/**
+* Gate an irreversible action behind an explicit yes.
+*
+* The flag skips the question outright. Without it, an interactive run has to
+* answer; a non-interactive one (a script, CI, an agent) is refused and told
+* about the flag, because a destructive command must never proceed on silence.
+*/
+async function confirmDestructive(confirmed, question, flag = "--yes") {
+	if (confirmed) return;
+	if (!process.stdin.isTTY) fail(`${question} Re-run with ${flag} to confirm.`);
+	if (!await askYesNo(question)) fail("aborted");
+}
 /** Read all of stdin (for `seekrit secrets set NAME -` piping). */
 async function readStdin() {
 	const chunks = [];
@@ -2861,6 +3214,69 @@ async function getDek(ctx, orgId, envId) {
 	return unwrapDek(wrappedDek, privateKey);
 }
 //#endregion
+//#region src/output.ts
+/** Shorthand for a column whose header is fixed and value is one field. */
+function col(header, value) {
+	return {
+		header,
+		value: (row) => stringify(value(row))
+	};
+}
+function stringify(value) {
+	if (value === null || value === void 0) return "-";
+	return String(value);
+}
+/**
+* Print `data` as JSON when `--json` was passed, otherwise run `render`.
+* Keeps the JSON branch identical across commands (and machine-parseable even
+* for detail views, which have no table form).
+*/
+function emit(options, data, render) {
+	if (options.json) {
+		console.log(JSON.stringify(data, null, 2));
+		return;
+	}
+	render();
+}
+/**
+* Render rows as a table. `empty` is the stderr note shown when there is
+* nothing to list — an empty list is a normal answer, not an error, so it must
+* not go to stdout and must not exit non-zero.
+*/
+function printTable(rows, columns, empty = "none") {
+	if (rows.length === 0) {
+		console.error(empty);
+		return;
+	}
+	const cells = rows.map((row) => columns.map((c) => c.value(row)));
+	if (!process.stdout.isTTY) {
+		for (const line of cells) console.log(line.join("	"));
+		return;
+	}
+	const widths = columns.map((c, i) => Math.max(c.header.length, ...cells.map((line) => (line[i] ?? "").length)));
+	const format = (line) => line.map((cell, i) => i === line.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ");
+	console.log(format(columns.map((c) => c.header.toUpperCase())));
+	for (const line of cells) console.log(format(line));
+}
+/**
+* Render a detail view: one `label  value` per line, labels aligned. Null and
+* undefined values are dropped rather than printed as blanks, so a caller can
+* build the list unconditionally and let absent fields disappear.
+*/
+function printFields(fields) {
+	const present = fields.filter(([, value]) => value !== null && value !== void 0);
+	const width = Math.max(0, ...present.map(([label]) => label.length));
+	for (const [label, value] of present) console.log(`${label.padEnd(width)}  ${value}`);
+}
+/**
+* A titled break between the sections of a detail view. Detail views are for
+* reading — a script wanting to parse one should ask for `--json`.
+*/
+function section(title) {
+	console.log("");
+	console.log(title);
+}
+//#endregion
 //#region src/target.ts
 /** Resolve the target org from a flag, the committed config, or a lone org. */
 async function resolveOrg(ctx, orgSlug) {
@@ -2976,144 +3392,149 @@ async function resolveGroup(ctx, opts) {
 	};
 }
 //#endregion
-//#region src/aws.ts
+//#region src/access.ts
 /**
-* `seekrit aws` — temporary AWS credentials via STS AssumeRole (Vault-style
-* dynamic secrets, the tier-2 sibling of `seekrit pg`).
+* Human-readable labels for the principals holding a key grant. `grant list`
+* would otherwise be a column of opaque ids, which is exactly the question
+* ("who can read prod?") it exists to answer.
 *
-* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
-* keypair on THIS machine and sends only the public key; STS mints the
-* credential and the broker returns it wrapped to that key, so the control plane
-* only ever relays ciphertext and only this machine can unwrap it. Registering a
-* target wraps the base IAM credential to the broker's public key locally, so
-* the control plane never sees it either — its only needed permission is
-* `sts:AssumeRole` on the target role.
+* Both lookups are best-effort: `listMembers` is open to any member but
+* `listTokens` may not be, and a grant can outlive the principal it names.
 */
-/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$6(input) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
+async function principalLabels(ctx, orgId) {
+	const labels = /* @__PURE__ */ new Map();
+	const [members, tokens] = await Promise.all([ctx.client.listMembers(orgId).then((r) => r.members).catch(() => []), ctx.client.listTokens(orgId).then((r) => r.tokens).catch(() => [])]);
+	for (const m of members) labels.set(m.userId, m.email);
+	for (const t of tokens) labels.set(t.id, t.name);
+	return labels;
+}
+/** Turn `--user email` / `--token skt_…` into the principal to wrap a DEK to. */
+async function resolvePrincipal(ctx, orgId, options) {
+	if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+	if (options.user) {
+		const { members } = await ctx.client.listMembers(orgId);
+		const member = members.find((m) => m.email === options.user);
+		if (!member) fail(`no member ${options.user}`);
+		if (!member.publicKeyJwk) fail(`${options.user} has not completed key setup`);
+		return {
+			type: "user",
+			id: member.userId,
+			publicKeyJwk: member.publicKeyJwk
+		};
+	}
+	const { tokens } = await ctx.client.listTokens(orgId);
+	const token = tokens.find((t) => t.id === options.token);
+	if (!token) fail(`no service token ${options.token}`);
+	return {
+		type: "service_token",
+		id: token.id,
+		publicKeyJwk: token.publicKeyJwk
+	};
+}
+/** The `--org/--app/--group/--env` selection every grant command shares. */
+function withEnvTarget(cmd) {
+	return cmd.option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>");
 }
 /**
-* The base IAM credential the broker assumes the role with. From flags or the
-* standard AWS env vars; JSON-serialized so the executor can parse it. Never the
-* plaintext leaves this machine unwrapped — it is wrapped to the broker key.
+* Environment key grants — who can decrypt what.
+*
+* `seekrit grant` keeps working as the bare "give access" verb (it is the
+* default subcommand), with `list` and `rm` alongside it so access can be
+* audited and taken back from the CLI rather than only the dashboard.
 */
-function resolveBaseCredential(opts) {
-	const accessKeyId = opts.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID;
-	const secretAccessKey = opts.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY;
-	const sessionToken = process.env.AWS_SESSION_TOKEN;
-	if (!accessKeyId || !secretAccessKey) fail("provide the base IAM credential via --access-key-id/--secret-access-key or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (it needs only sts:AssumeRole on the role)");
-	return JSON.stringify({
-		accessKeyId,
-		secretAccessKey,
-		...sessionToken ? { sessionToken } : {}
-	});
-}
-function registerAwsCommands(program) {
-	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
-	const target = aws.command("target").description("manage AWS role targets");
-	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
+function registerAccessCommands(program) {
+	const grant = program.command("grant").description("manage who can decrypt an environment (`seekrit grant --help`)");
+	withEnvTarget(grant.command("add", { isDefault: true }).description("give a member or service token access to an environment's key").option("--user <email>", "grant to an org member by email").option("--token <tokenId>", "grant to a service token by id (skt_…)")).action(async (options) => {
+		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
-		const config = {
-			provider: "aws",
-			executor: "in_do",
-			roleArn: options.roleArn,
-			region: options.region,
-			...options.externalId ? { externalId: options.externalId } : {},
-			...sessionPolicy ? { sessionPolicy } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$6(options.maxTtl) } : {}
-		};
-		const baseCredential = resolveBaseCredential(options);
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(baseCredential), publicKeyJwk);
-		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
-			name: options.name,
-			config,
-			wrappedAdminSecret
+		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+		const principal = await resolvePrincipal(ctx, orgId, options);
+		const dek = await getDek(ctx, orgId, envId);
+		await ctx.client.grantEnvKey(orgId, envId, {
+			principalType: principal.type,
+			principalId: principal.id,
+			wrappedDek: await wrapDek(dek, principal.publicKeyJwk)
 		});
-		console.error(`registered AWS target ${created.name} (${created.id})`);
-		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
-		console.log(awsTrustPolicyInstructions(config));
+		console.error(`granted ${label} access to ${principal.id}`);
 	});
-	target.command("list").description("list AWS role targets").option("--org <slug>").action(async (options) => {
+	withEnvTarget(grant.command("list").alias("ls").description("list who holds a key for an environment").option("--json", "print the raw API response")).action(async (options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		for (const t of targets) {
-			const cfg = t.config;
-			if (cfg.provider !== "aws") continue;
-			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
-		}
+		const { orgId, envId } = await resolveEnvTarget(ctx, options);
+		const [{ grants }, labels] = await Promise.all([ctx.client.listEnvKeys(orgId, envId), principalLabels(ctx, orgId)]);
+		emit(options, { grants }, () => printTable(grants, [
+			col("principal", (g) => labels.get(g.principalId) ?? g.principalId),
+			col("type", (g) => g.principalType === "service_token" ? "token" : "user"),
+			col("granted", (g) => g.createdAt),
+			col("id", (g) => g.principalId)
+		], "nobody holds a key for this environment"));
 	});
-	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>").action(async (targetId, options) => {
+	withEnvTarget(grant.command("rm").alias("revoke").description("take away a member's or token's access to an environment's key").option("--user <email>", "revoke an org member by email").option("--token <tokenId>", "revoke a service token by id (skt_…)").option("--yes", "skip the confirmation prompt")).action(async (options) => {
+		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetId || x.name === targetId);
-		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
-		console.log(awsTrustPolicyInstructions(cfg));
+		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+		const { grants } = await ctx.client.listEnvKeys(orgId, envId);
+		let principalId = options.token;
+		if (options.user) {
+			const { members } = await ctx.client.listMembers(orgId);
+			principalId = members.find((m) => m.email === options.user)?.userId;
+			if (!principalId) fail(`no member ${options.user}`);
+		}
+		const grantRow = grants.find((g) => g.principalId === principalId);
+		if (!grantRow) fail(`${options.user ?? options.token} holds no key for ${label}`);
+		await confirmDestructive(options.yes, `Revoke ${options.user ?? options.token}'s key for ${label}? Anything already decrypted stays decrypted.`);
+		await ctx.client.revokeEnvKey(orgId, envId, grantRow.id);
+		console.error(`revoked ${options.user ?? options.token}'s access to ${label}`);
 	});
-	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`deleted ${targetId}`);
+}
+//#endregion
+//#region src/account.ts
+function sessionStatus(session) {
+	if (session.revokedAt) return "revoked";
+	if (session.expiresAt && Date.parse(session.expiresAt) < Date.now()) return "expired";
+	return "active";
+}
+/**
+* Your own account: the devices signed in as you, and which emails seekrit
+* sends you. Both are per-user (not per-org), so neither takes `--org`.
+*/
+function registerAccountCommands(program) {
+	const session = program.command("session").description("manage the devices authorized by `seekrit login`");
+	session.command("list").alias("ls").description("list CLI sessions authorized for your account").option("--all", "include revoked and expired sessions").option("--json", "print the raw API response").action(async (options) => {
+		const { sessions, currentSessionId } = await buildContext().client.listCliSessions();
+		const rows = options.all ? sessions : sessions.filter((s) => sessionStatus(s) === "active");
+		emit(options, {
+			sessions: rows,
+			currentSessionId
+		}, () => printTable(rows, [
+			col("device", (s) => s.deviceLabel),
+			col("client", (s) => s.client),
+			col("status", (s) => sessionStatus(s)),
+			col("last used", (s) => s.lastUsedAt),
+			col("ip", (s) => s.ipAddress),
+			col("id", (s) => `${s.id}${s.id === currentSessionId ? " (this one)" : ""}`)
+		], options.all ? "no CLI sessions" : "no active CLI sessions (try --all)"));
 	});
-	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+	session.command("revoke <sessionId>").description("sign a device out — its token stops working immediately").option("--yes", "skip the confirmation prompt").action(async (sessionId, options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
-		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
-		const ttlSeconds = parseTtlSeconds$6(options.ttl);
-		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
-		const recipient = await generateAwsRecipientKeyPair();
-		const { aws: leased } = await ctx.client.mintLease(org.id, {
-			provider: "aws",
-			targetId: t.id,
-			recipientPublicKey: recipient.publicKeyJwk,
-			ttlSeconds
-		});
-		const cred = await unwrapAwsCredential(leased.wrappedCredential, recipient.privateKeyJwk);
-		console.error(`leased ${cfg.roleArn} in ${cred.region} — expires ${cred.expiration}`);
-		if (options.json) console.log(JSON.stringify({
-			...cred,
-			roleArn: cfg.roleArn
-		}, null, 2));
-		else {
-			console.log(`export AWS_ACCESS_KEY_ID=${cred.accessKeyId}`);
-			console.log(`export AWS_SECRET_ACCESS_KEY=${cred.secretAccessKey}`);
-			console.log(`export AWS_SESSION_TOKEN=${cred.sessionToken}`);
-			console.log(`export AWS_REGION=${cred.region}`);
-		}
+		const self = ctx.auth.type === "bearer" && isCliSessionToken(ctx.auth.token) && parseCliSessionToken(ctx.auth.token).sessionId === sessionId;
+		await confirmDestructive(options.yes, self ? `${sessionId} is the session you are using right now — sign it out?` : `Sign out ${sessionId}?`);
+		await ctx.client.revokeCliSession(sessionId);
+		console.error(`${sessionId} revoked${self ? " — run `seekrit login` to sign back in" : ""}`);
 	});
-	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) {
-			if (l.provider !== "aws") continue;
-			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
-		}
+	const notifications = program.command("notifications").description("manage the emails seekrit sends you");
+	notifications.command("list", { isDefault: true }).alias("ls").description("show your notification preferences").option("--json", "print the raw API response").action(async (options) => {
+		const { prefs } = await buildContext().client.getMyNotificationPrefs();
+		emit(options, { prefs }, () => printTable(NOTIFICATION_TYPES, [
+			col("type", (t) => t),
+			col("email", (t) => prefs[t] ? "on" : "off"),
+			col("about", (t) => NOTIFICATION_TYPE_META[t].label)
+		]));
 	});
-	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
+	notifications.command("set <type> <state>").description("turn one notification on or off (`state` is on or off)").action(async (type, state) => {
+		if (state !== "on" && state !== "off") fail("state must be on or off");
+		if (!NOTIFICATION_TYPES.includes(type)) fail(`unknown notification "${type}" — one of: ${NOTIFICATION_TYPES.join(", ")}`);
+		await buildContext().client.setMyNotificationPrefs({ prefs: { [type]: state === "on" } });
+		console.error(`${type} emails ${state}`);
 	});
 }
 //#endregion
@@ -3602,9 +4023,480 @@ function registerRecoveryCommands(program) {
 	});
 }
 //#endregion
-//#region src/branches.ts
+//#region src/apps.ts
 /**
-* Resolve `--from` to the environment being branched.
+* Applications and their environments — the structure everything else hangs
+* off. Creating an environment is the one command here that does crypto: the
+* data key is generated locally and only ciphertext leaves the machine.
+*/
+function registerAppCommands(program) {
+	const app = program.command("app").description("manage applications");
+	app.command("list").alias("ls").description("list applications in an organization").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { apps } = await ctx.client.listApps(ref.id);
+		emit(options, { apps }, () => printTable(apps, [
+			col("slug", (a) => a.slug),
+			col("name", (a) => a.name),
+			col("created", (a) => a.createdAt),
+			col("id", (a) => a.id)
+		], "no applications — create one with `seekrit app create`"));
+	});
+	app.command("show [slug]").description("show an application, its environments, and your access to each").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveApp(ctx, {
+			org: options.org,
+			app: slug ?? options.app
+		});
+		const [{ app: row, environments }, { branches }] = await Promise.all([ctx.client.getApp(ref.orgId, ref.id), ctx.client.listAppBranches(ref.orgId, ref.id)]);
+		emit(options, {
+			app: row,
+			environments,
+			branches
+		}, () => {
+			printFields([
+				["slug", row.slug],
+				["name", row.name],
+				["id", row.id],
+				["org", ref.orgSlug],
+				["created", row.createdAt]
+			]);
+			section("environments");
+			printTable(environments, [
+				col("slug", (e) => e.slug),
+				col("name", (e) => e.name),
+				col("access", (e) => e.canDecrypt ? "can decrypt" : "no key"),
+				col("id", (e) => e.id)
+			], "no environments — create one with `seekrit env create`");
+			if (branches.length > 0) {
+				section("branches");
+				printTable(branches, [
+					col("slug", (b) => b.slug),
+					col("expires", (b) => b.expiresAt ?? "never"),
+					col("id", (b) => b.id)
+				]);
+			}
+		});
+	});
+	app.command("create").description("create an application").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		const created = await ctx.client.createApp(orgRef.id, {
+			name: options.name,
+			slug: options.slug
+		});
+		console.error(`created app ${created.app.slug} (${created.app.id})`);
+	});
+	app.command("rename [slug]").description("change an application's display name (the slug is permanent)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveApp(ctx, {
+			org: options.org,
+			app: slug ?? options.app
+		});
+		const { app: row } = await ctx.client.updateApp(ref.orgId, ref.id, { name: options.name });
+		console.error(`renamed ${row.slug} to "${row.name}"`);
+	});
+	app.command("rm <slug>").alias("delete").description("delete an application and every environment and secret in it").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveApp(ctx, {
+			org: options.org,
+			app: slug
+		});
+		const { environments } = await ctx.client.getApp(ref.orgId, ref.id);
+		await confirmDestructive(options.yes, `Delete ${ref.slug} and its ${environments.length} environment(s), with every secret in them?`);
+		await ctx.client.deleteApp(ref.orgId, ref.id);
+		console.error(`deleted app ${ref.slug}`);
+	});
+	const env = program.command("env").description("manage environments");
+	env.command("list").alias("ls").description("list an application's environments").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveApp(ctx, options);
+		const { environments } = await ctx.client.getApp(ref.orgId, ref.id);
+		emit(options, { environments }, () => printTable(environments, [
+			col("slug", (e) => e.slug),
+			col("name", (e) => e.name),
+			col("access", (e) => e.canDecrypt ? "can decrypt" : "no key"),
+			col("id", (e) => e.id)
+		], "no environments — create one with `seekrit env create`"));
+	});
+	env.command("show").description("show one environment: composed groups, who holds a key, secret count").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const target = await resolveAppEnv(ctx, options);
+		const [{ environment }, { groups }, { secrets }, { branches }] = await Promise.all([
+			ctx.client.getEnv(target.orgId, target.envId),
+			ctx.client.listEnvGroups(target.orgId, target.envId),
+			ctx.client.listSecrets(target.orgId, target.envId),
+			ctx.client.listBranches(target.orgId, target.envId)
+		]);
+		const grants = await ctx.client.listEnvKeys(target.orgId, target.envId).then((r) => r.grants).catch(() => null);
+		emit(options, {
+			environment,
+			groups,
+			secretCount: secrets.length,
+			branches,
+			grants
+		}, () => {
+			printFields([
+				["slug", environment.slug],
+				["name", environment.name],
+				["id", environment.id],
+				["app", target.appSlug],
+				["secrets", secrets.length],
+				["created", environment.createdAt]
+			]);
+			section("composed groups (lowest precedence first)");
+			printTable([...groups].sort((a, b) => a.position - b.position), [
+				col("position", (g) => g.position),
+				col("group", (g) => g.slug),
+				col("name", (g) => g.name)
+			], "none — this environment's secrets are all its own");
+			section("key holders");
+			if (grants === null) console.error("(admin only)");
+			else printTable(grants, [col("type", (g) => g.principalType), col("principal", (g) => g.principalId)], "none");
+			if (branches.length > 0) {
+				section("branches");
+				printTable(branches, [col("slug", (b) => b.slug), col("expires", (b) => b.expiresAt ?? "never")]);
+			}
+		});
+	});
+	env.command("create").description("create an application environment (generates its data key locally)").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		const { apps } = await ctx.client.listApps(orgRef.id);
+		const appRow = apps.find((a) => a.slug === options.app || a.id === options.app);
+		if (!appRow) fail(`no app "${options.app}" in ${orgRef.slug}`);
+		const { user } = await ctx.client.me();
+		if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
+		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, orgRef.id, dek);
+		const created = await ctx.client.createEnv(orgRef.id, appRow.id, {
+			name: options.name,
+			slug: options.slug,
+			wrappedDek,
+			recoveryWrappedDek
+		});
+		console.error(`created environment ${created.environment.slug} (${created.environment.id})`);
+	});
+	env.command("rm").alias("delete").description("delete an environment and every secret in it").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "delete a group environment instead of an app one").requiredOption("--env <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+		const ctx = buildContext();
+		const target = await resolveEnvTarget(ctx, options);
+		const { secrets } = await ctx.client.listSecrets(target.orgId, target.envId);
+		await confirmDestructive(options.yes, `Delete ${target.label} and the ${secrets.length} secret(s) in it?`);
+		await ctx.client.deleteEnv(target.orgId, target.envId);
+		console.error(`deleted ${target.label}`);
+	});
+	const envGroups = env.command("groups").description("compose shared groups into an application environment");
+	envGroups.command("add").description("compose a group into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").option("--position <n>", "precedence among groups (higher wins)").action(async (options) => {
+		const ctx = buildContext();
+		const target = await resolveAppEnv(ctx, options);
+		const group = await resolveGroup(ctx, {
+			org: options.org,
+			group: options.group
+		});
+		await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+			groupId: group.id,
+			position: options.position === void 0 ? void 0 : Number.parseInt(options.position, 10)
+		});
+		console.error(`composed ${group.slug} into ${target.appSlug}/${target.envSlug}`);
+	});
+	envGroups.command("list").alias("ls").description("list groups composed into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const target = await resolveAppEnv(ctx, options);
+		const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
+		emit(options, { groups }, () => printTable([...groups].sort((a, b) => a.position - b.position), [
+			col("position", (g) => g.position),
+			col("group", (g) => g.slug),
+			col("name", (g) => g.name)
+		], "no groups composed into this environment"));
+	});
+	envGroups.command("rm").description("remove a group from an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const target = await resolveAppEnv(ctx, options);
+		const group = await resolveGroup(ctx, {
+			org: options.org,
+			group: options.group
+		});
+		await ctx.client.unlinkEnvGroup(target.orgId, target.envId, group.id);
+		console.error(`removed ${group.slug} from ${target.appSlug}/${target.envSlug}`);
+	});
+}
+//#endregion
+//#region src/audit.ts
+/** The API's per-page ceiling (`auditQuerySchema.limit`). */
+const MAX_PAGE = 200;
+function parseLimit(raw) {
+	const n = Number(raw);
+	if (!Number.isInteger(n) || n < 1) fail(`--limit must be a positive whole number, got "${raw}"`);
+	return Math.min(n, MAX_PAGE);
+}
+/**
+* The org audit trail. Append-only and admin-only, so this is the record of
+* who did what — the CLI needs the same filters the dashboard has, plus
+* pagination, or "find the grant that shouldn't be there" means scrolling.
+*/
+function registerAuditCommands(program) {
+	const audit = program.command("audit").description("read the org audit trail");
+	audit.command("list", { isDefault: true }).alias("ls").description("show the org audit trail").option("--org <slug>").option("--limit <n>", `entries per page (max ${MAX_PAGE})`, "50").option("--action <action>", "only this action, e.g. env.key_granted").option("--resource-type <type>", "only this resource type, e.g. environment").option("--cursor <cursor>", "continue from a previous page's cursor").option("--all", "page through the whole trail, not just the first page").option("--metadata", "include each entry's metadata as JSON").option("--json", "print the raw API response").action(async (options) => {
+		if (options.action && !AUDIT_ACTIONS.includes(options.action)) fail(`unknown action "${options.action}" — see \`seekrit audit actions\``);
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const limit = parseLimit(options.limit);
+		const entries = [];
+		let cursor = options.cursor;
+		let nextCursor = null;
+		do {
+			const page = await ctx.client.listAudit(ref.id, {
+				limit,
+				cursor,
+				action: options.action,
+				resourceType: options.resourceType
+			});
+			entries.push(...page.entries);
+			nextCursor = page.nextCursor;
+			cursor = page.nextCursor ?? void 0;
+		} while (options.all && cursor);
+		emit(options, {
+			entries,
+			nextCursor
+		}, () => {
+			printTable(entries, [
+				col("when", (e) => e.createdAt),
+				col("action", (e) => e.action),
+				col("actor", (e) => `${e.actorType}:${e.actorId}`),
+				col("resource", (e) => `${e.resourceType}${e.resourceId ? `:${e.resourceId}` : ""}`),
+				...options.metadata ? [col("metadata", (e) => e.metadata ? JSON.stringify(e.metadata) : "-")] : []
+			], "no audit entries match");
+			if (nextCursor && !options.all) console.error(`more entries — continue with --cursor ${nextCursor} (or pass --all)`);
+		});
+	});
+	audit.command("actions").description("list every action the audit trail can record (for `audit --action`)").option("--json", "print the raw API response").action((options) => {
+		emit(options, { actions: AUDIT_ACTIONS }, () => {
+			for (const action of AUDIT_ACTIONS) console.log(action);
+		});
+	});
+}
+//#endregion
+//#region src/aws.ts
+/**
+* `seekrit aws` — temporary AWS credentials via STS AssumeRole (Vault-style
+* dynamic secrets, the tier-2 sibling of `seekrit pg`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; STS mints the
+* credential and the broker returns it wrapped to that key, so the control plane
+* only ever relays ciphertext and only this machine can unwrap it. Registering a
+* target wraps the base IAM credential to the broker's public key locally, so
+* the control plane never sees it either — its only needed permission is
+* `sts:AssumeRole` on the target role.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$6(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/**
+* The base IAM credential the broker assumes the role with. From flags or the
+* standard AWS env vars; JSON-serialized so the executor can parse it. Never the
+* plaintext leaves this machine unwrapped — it is wrapped to the broker key.
+*/
+function resolveBaseCredential(opts) {
+	const accessKeyId = opts.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = opts.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY;
+	const sessionToken = process.env.AWS_SESSION_TOKEN;
+	if (!accessKeyId || !secretAccessKey) fail("provide the base IAM credential via --access-key-id/--secret-access-key or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (it needs only sts:AssumeRole on the role)");
+	return JSON.stringify({
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	});
+}
+function registerAwsCommands(program) {
+	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
+	const target = aws.command("target").description("manage AWS role targets");
+	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
+		const config = {
+			provider: "aws",
+			executor: "in_do",
+			roleArn: options.roleArn,
+			region: options.region,
+			...options.externalId ? { externalId: options.externalId } : {},
+			...sessionPolicy ? { sessionPolicy } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$6(options.maxTtl) } : {}
+		};
+		const baseCredential = resolveBaseCredential(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(baseCredential), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered AWS target ${created.name} (${created.id})`);
+		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
+		console.log(awsTrustPolicyInstructions(config));
+	});
+	target.command("list").description("list AWS role targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "aws") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
+		}
+	});
+	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
+		console.log(awsTrustPolicyInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
+		const ttlSeconds = parseTtlSeconds$6(options.ttl);
+		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
+		const recipient = await generateAwsRecipientKeyPair();
+		const { aws: leased } = await ctx.client.mintLease(org.id, {
+			provider: "aws",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapAwsCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cfg.roleArn} in ${cred.region} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify({
+			...cred,
+			roleArn: cfg.roleArn
+		}, null, 2));
+		else {
+			console.log(`export AWS_ACCESS_KEY_ID=${cred.accessKeyId}`);
+			console.log(`export AWS_SECRET_ACCESS_KEY=${cred.secretAccessKey}`);
+			console.log(`export AWS_SESSION_TOKEN=${cred.sessionToken}`);
+			console.log(`export AWS_REGION=${cred.region}`);
+		}
+	});
+	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "aws") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
+	});
+}
+//#endregion
+//#region src/billing.ts
+/** `included: null` means unlimited; an unavailable meter is unknown, not zero. */
+function usageLine(usage) {
+	if (!usage.available) return "unknown";
+	return `${usage.quantity} of ${usage.included ?? "unlimited"}`;
+}
+/**
+* Plan, usage, and self-serve billing.
+*
+* Checkout and the billing portal are browser flows the biller hosts, so those
+* commands print a URL rather than pretending to complete a payment in the
+* terminal.
+*/
+function registerBillingCommands(program) {
+	const billing = program.command("billing").description("plan, usage, and subscription");
+	billing.command("show", { isDefault: true }).description("show the org's plan, what it includes, and current usage").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const info = await ctx.client.getBilling(ref.id);
+		emit(options, info, () => {
+			printFields([
+				["plan", `${info.plan.name} (${info.plan.id})`],
+				["status", info.subscription?.status ?? "no subscription (default plan)"],
+				["renews", info.subscription?.currentPeriodEnd ?? null],
+				["cancels", info.subscription?.cancelAt ?? null],
+				["trial ends", info.subscription?.trialEndsAt ?? null],
+				["limits enforced", info.enforced ? "yes" : "no (informational only)"],
+				["self-serve", [info.manage.checkout ? `checkout (${info.manage.checkoutFamilies.join(", ")})` : null, info.manage.portal ? "portal" : null].filter(Boolean).join(", ") || "unavailable"]
+			]);
+			section("usage");
+			printTable(info.usage, [col("metric", (u) => u.label), col("used", (u) => usageLine(u))], "nothing metered yet");
+			if (info.overrides.length > 0) {
+				section("overrides");
+				printTable(info.overrides, [
+					col("key", (o) => o.key),
+					col("value", (o) => String(o.value)),
+					col("note", (o) => o.note),
+					col("expires", (o) => o.expiresAt)
+				]);
+			}
+		});
+	});
+	billing.command("entitlements").description("list every entitlement this org resolves to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const info = await ctx.client.getBilling(ref.id);
+		emit(options, { entitlements: info.entitlements }, () => printTable(info.entitlements, [
+			col("key", (e) => e.key),
+			col("value", (e) => e.value === null ? "unlimited" : String(e.value)),
+			col("source", (e) => e.source)
+		]));
+	});
+	billing.command("checkout <family>").description(`start a self-serve upgrade (${VISIBLE_PLAN_FAMILY_IDS.join(" | ")}) — prints a URL`).option("--org <slug>").action(async (family, options) => {
+		if (!PLAN_FAMILY_IDS.includes(family)) fail(`unknown plan "${family}" — one of: ${PLAN_FAMILY_IDS.join(", ")}`);
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { url } = await ctx.client.startCheckout(ref.id, { family });
+		console.error("open this to complete checkout:");
+		console.log(url);
+	});
+	billing.command("portal").description("open the billing portal (prints a URL) to manage payment and invoices").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { url } = await ctx.client.openBillingPortal(ref.id);
+		console.error("open this to manage billing:");
+		console.log(url);
+	});
+	billing.command("cancel").description("cancel the subscription and drop back to the Free plan").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Cancel ${ref.slug}'s subscription and move it to the Free plan?`);
+		await ctx.client.cancelSubscription(ref.id);
+		console.error(`${ref.slug} moved to the Free plan`);
+	});
+}
+//#endregion
+//#region src/branches.ts
+/**
+* Resolve `--from` to the environment being branched.
 *
 * Not just `resolveAppEnv`: branch slugs live in the same namespace but are
 * excluded from the environment list, so naming one lands on "no environment
@@ -3674,17 +4566,21 @@ function registerBranchCommands(program) {
 		console.error(created.branch.expiresAt ? `expires ${created.branch.expiresAt}` : "no expiry — delete it explicitly when the PR closes");
 		if (grants.length > 0) console.error(`shared with ${grants.length} other reader(s)`);
 	});
-	branch.command("list").description("list branches in an application (or of one environment)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").action(async (options) => {
+	branch.command("list").alias("ls").description("list branches in an application (or of one environment)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
-		if (options.env) {
+		const branches = options.env ? await (async () => {
 			const parent = await resolveAppEnv(ctx, options);
-			const { branches } = await ctx.client.listBranches(parent.orgId, parent.envId);
-			for (const b of branches) console.log(`${b.slug}\t${b.id}\t${b.expiresAt ?? "never"}`);
-			return;
-		}
-		const app = await resolveApp(ctx, options);
-		const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
-		for (const b of branches) console.log(`${b.slug}\t${b.id}\t${b.expiresAt ?? "never"}`);
+			return (await ctx.client.listBranches(parent.orgId, parent.envId)).branches;
+		})() : await (async () => {
+			const app = await resolveApp(ctx, options);
+			return (await ctx.client.listAppBranches(app.orgId, app.id)).branches;
+		})();
+		emit(options, { branches }, () => printTable(branches, [
+			col("slug", (b) => b.slug),
+			col("expires", (b) => b.expiresAt ?? "never"),
+			col("created", (b) => b.createdAt),
+			col("id", (b) => b.id)
+		], "no branches — create one with `seekrit branch create`"));
 	});
 	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").action(async (slug, options) => {
 		const ctx = buildContext();
@@ -3887,6 +4783,181 @@ function registerGcpCommands(program) {
 	});
 }
 //#endregion
+//#region src/groups.ts
+/**
+* Shared groups: reusable secret bags composed into application environments
+* by matching slug (`seekrit env groups add`). A group holds one environment
+* per slug — the "variants" of the shared values.
+*/
+function registerGroupCommands(program) {
+	const group = program.command("group").description("manage shared groups (reusable secret bags)");
+	group.command("list").alias("ls").description("list shared groups in an organization").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { groups } = await ctx.client.listGroups(ref.id);
+		emit(options, { groups }, () => printTable(groups, [
+			col("slug", (g) => g.slug),
+			col("name", (g) => g.name),
+			col("created", (g) => g.createdAt),
+			col("id", (g) => g.id)
+		], "no groups — create one with `seekrit group create`"));
+	});
+	group.command("show <slug>").description("show a group and the environments (value sets) it holds").option("--org <slug>").option("--json", "print the raw API response").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveGroup(ctx, {
+			org: options.org,
+			group: slug
+		});
+		const { group: row, environments } = await ctx.client.getGroup(ref.orgId, ref.id);
+		emit(options, {
+			group: row,
+			environments
+		}, () => {
+			printFields([
+				["slug", row.slug],
+				["name", row.name],
+				["id", row.id],
+				["created", row.createdAt]
+			]);
+			section("environments");
+			printTable(environments, [
+				col("slug", (e) => e.slug),
+				col("name", (e) => e.name),
+				col("access", (e) => e.canDecrypt ? "can decrypt" : "no key"),
+				col("id", (e) => e.id)
+			], "no environments — create one with `seekrit group env create`");
+		});
+	});
+	group.command("create").description("create a shared group").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		const created = await ctx.client.createGroup(orgRef.id, {
+			name: options.name,
+			slug: options.slug
+		});
+		console.error(`created group ${created.group.slug} (${created.group.id})`);
+	});
+	group.command("rename <slug>").description("change a group's display name (the slug is permanent)").option("--org <slug>").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveGroup(ctx, {
+			org: options.org,
+			group: slug
+		});
+		const { group: row } = await ctx.client.updateGroup(ref.orgId, ref.id, { name: options.name });
+		console.error(`renamed ${row.slug} to "${row.name}"`);
+	});
+	group.command("rm <slug>").alias("delete").description("delete a group, its environments, and their secrets").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveGroup(ctx, {
+			org: options.org,
+			group: slug
+		});
+		const { environments } = await ctx.client.getGroup(ref.orgId, ref.id);
+		await confirmDestructive(options.yes, `Delete group ${ref.slug} and its ${environments.length} environment(s)? Environments composing it will stop receiving these values.`);
+		await ctx.client.deleteGroup(ref.orgId, ref.id);
+		console.error(`deleted group ${ref.slug}`);
+	});
+	const groupEnv = group.command("env").description("manage a group’s environments (per-slug value sets / variants)");
+	groupEnv.command("list").alias("ls").description("list a group's environments").option("--org <slug>").requiredOption("--group <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveGroup(ctx, options);
+		const { environments } = await ctx.client.listGroupEnvs(ref.orgId, ref.id);
+		emit(options, { environments }, () => printTable(environments, [
+			col("slug", (e) => e.slug),
+			col("name", (e) => e.name),
+			col("created", (e) => e.createdAt),
+			col("id", (e) => e.id)
+		], "no environments — create one with `seekrit group env create`"));
+	});
+	groupEnv.command("create").description("create a group environment (generates its data key locally)").option("--org <slug>").requiredOption("--group <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const groupRef = await resolveGroup(ctx, {
+			org: options.org,
+			group: options.group
+		});
+		const { user } = await ctx.client.me();
+		if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
+		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, groupRef.orgId, dek);
+		const created = await ctx.client.createGroupEnv(groupRef.orgId, groupRef.id, {
+			name: options.name,
+			slug: options.slug,
+			wrappedDek,
+			recoveryWrappedDek
+		});
+		console.error(`created ${groupRef.slug}@${created.environment.slug} (${created.environment.id})`);
+	});
+}
+//#endregion
+//#region src/logsink.ts
+/** Collect repeated `--header Name: value` flags into a map. */
+function collectHeader(value, acc = {}) {
+	const sep = value.indexOf(":");
+	if (sep <= 0) fail(`expected "Name: value", got "${value}"`);
+	acc[value.slice(0, sep).trim()] = value.slice(sep + 1).trim();
+	return acc;
+}
+/**
+* The org's OTLP audit-log export — near-real-time shipping of every audit row
+* to a customer SIEM. Header *values* are write-only: they are encrypted at
+* rest and never echoed back, so `show` reports only the header names.
+*/
+function registerLogSinkCommands(program) {
+	const sink = program.command("log-sink").description("stream the audit trail to your own OTLP collector (SIEM)");
+	sink.command("show", { isDefault: true }).description("show the configured log sink and its delivery health").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { sink: config } = await ctx.client.getLogSink(ref.id);
+		emit(options, { sink: config }, () => {
+			if (!config) {
+				console.error("no log sink configured — set one with `seekrit log-sink set`");
+				return;
+			}
+			printFields([
+				["endpoint", config.endpoint],
+				["enabled", config.enabled ? "yes" : "no"],
+				["headers", config.headerNames.length > 0 ? config.headerNames.join(", ") : "none"],
+				["last success", config.lastSuccessAt ?? "never"],
+				["last attempt", config.lastAttemptAt ?? "never"],
+				["last error", config.lastError ?? "none"]
+			]);
+		});
+	});
+	sink.command("set <endpoint>").description("point the audit export at an OTLP/HTTP logs endpoint").option("--org <slug>").option("--header <name: value>", "auth header to send (repeatable; values are write-only)", collectHeader).option("--clear-headers", "send no headers at all (drops the stored ones)").option("--disabled", "save the config but stop shipping").action(async (endpoint, options) => {
+		if (options.header && options.clearHeaders) fail("pass either --header or --clear-headers, not both");
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const headers = options.clearHeaders ? {} : options.header;
+		const { sink: config } = await ctx.client.setLogSink(ref.id, {
+			endpoint,
+			headers,
+			enabled: !options.disabled
+		});
+		console.error(`log sink → ${config.endpoint} (${config.enabled ? "enabled" : "disabled"}) — test it with \`seekrit log-sink test\``);
+	});
+	sink.command("test").description("send a probe to the configured endpoint and report the result").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const result = await ctx.client.testLogSink(ref.id);
+		emit(options, result, () => {
+			printFields([
+				["result", result.ok ? "ok" : "failed"],
+				["status", result.status],
+				["error", result.error]
+			]);
+		});
+		if (!result.ok) process.exitCode = 1;
+	});
+	sink.command("rm").alias("delete").description("stop exporting the audit trail and forget the endpoint").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove ${ref.slug}'s audit log export?`);
+		await ctx.client.deleteLogSink(ref.id);
+		console.error("log sink removed");
+	});
+}
+//#endregion
 //#region src/m2m.ts
 /**
 * Resolve M2M client credentials from (in order) the process environment, a
@@ -4278,6 +5349,164 @@ function collect$3(value, acc) {
 	return acc;
 }
 //#endregion
+//#region src/orgs.ts
+/**
+* Counts for `org show`. Each list is admin-gated to a different degree, so a
+* member who can't read one still gets the rest: a failed call reports as
+* `null`, which `printFields` drops and JSON preserves as "not visible to you".
+*/
+async function countOrNull(load) {
+	try {
+		return await load();
+	} catch {
+		return null;
+	}
+}
+async function orgOverview(ctx, orgId) {
+	const [apps, groups, members, tokens] = await Promise.all([
+		countOrNull(async () => (await ctx.client.listApps(orgId)).apps.length),
+		countOrNull(async () => (await ctx.client.listGroups(orgId)).groups.length),
+		countOrNull(async () => (await ctx.client.listMembers(orgId)).members.length),
+		countOrNull(async () => (await ctx.client.listTokens(orgId)).tokens.length)
+	]);
+	return {
+		apps,
+		groups,
+		members,
+		tokens
+	};
+}
+function registerOrgCommands(program) {
+	const org = program.command("org").description("manage organizations");
+	org.command("list").alias("ls").description("list the organizations you can access").option("--json", "print the raw API response").action(async (options) => {
+		const { orgs } = await buildContext().client.listOrgs();
+		emit(options, { orgs }, () => printTable(orgs, [
+			col("slug", (o) => o.slug),
+			col("name", (o) => o.name),
+			col("role", (o) => o.role),
+			col("id", (o) => o.id)
+		], "no organizations — create one with `seekrit org create`"));
+	});
+	org.command("show [slug]").description("show an organization and what it contains").option("--org <slug>", "organization slug (or pass it as the argument)").option("--json", "print the raw API response").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, slug ?? options.org);
+		const { org: row } = await ctx.client.getOrg(ref.id);
+		const counts = await orgOverview(ctx, ref.id);
+		const shown = (n) => n === null ? "—" : n;
+		emit(options, {
+			org: row,
+			counts
+		}, () => {
+			printFields([
+				["slug", row.slug],
+				["name", row.name],
+				["id", row.id],
+				["your role", row.role],
+				["created", row.createdAt],
+				["applications", shown(counts.apps)],
+				["groups", shown(counts.groups)],
+				["members", shown(counts.members)],
+				["service tokens", shown(counts.tokens)]
+			]);
+		});
+	});
+	org.command("create").description("create an organization (you become its owner)").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+		const created = await buildContext().client.createOrg({
+			name: options.name,
+			slug: options.slug
+		});
+		console.error(`created org ${created.org.slug} (${created.org.id})`);
+	});
+	org.command("rename").description("change an organization's display name (the slug is permanent)").option("--org <slug>").requiredOption("--name <name>", "new display name").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { org: row } = await ctx.client.updateOrg(ref.id, { name: options.name });
+		console.error(`renamed ${row.slug} to "${row.name}"`);
+	});
+	org.command("member").description("view organization members").command("list").alias("ls").description("list members, and whether each has finished key setup").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { members } = await ctx.client.listMembers(ref.id);
+		emit(options, { members }, () => printTable(members, [
+			col("email", (m) => m.email),
+			col("role", (m) => m.role),
+			col("name", (m) => m.name),
+			col("keys", (m) => m.publicKeyJwk ? "ready" : "pending"),
+			col("id", (m) => m.userId)
+		], "no members"));
+	});
+	const invite = org.command("invite").description("manage pending invitations");
+	invite.command("list").alias("ls").description("list outstanding invitations").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { invites } = await ctx.client.listInvites(ref.id);
+		emit(options, { invites }, () => printTable(invites, [
+			col("email", (i) => i.email),
+			col("role", (i) => i.role),
+			col("invited", (i) => i.createdAt),
+			col("id", (i) => i.id)
+		], "no pending invitations"));
+	});
+	invite.command("add <email>").description("invite someone to the organization").option("--org <slug>").option("--role <role>", "admin | member", "member").action(async (email, options) => {
+		if (options.role !== "admin" && options.role !== "member") fail("--role must be admin or member");
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { invite: row } = await ctx.client.createInvite(ref.id, {
+			email,
+			role: options.role
+		});
+		console.error(`invited ${row.email} as ${row.role} (${row.id}) — they join when they first sign in`);
+	});
+	invite.command("rm <inviteId>").description("rescind an invitation").option("--org <slug>").action(async (inviteId, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeInvite(ref.id, inviteId);
+		console.error(`${inviteId} revoked`);
+	});
+	org.command("mfa").description("show or set the org-wide second-factor requirement").option("--org <slug>").option("--set <policy>", "required | optional").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		if (options.set !== void 0 && options.set !== "required" && options.set !== "optional") fail("--set must be required or optional");
+		const policy = options.set === void 0 ? await ctx.client.getMfaPolicy(ref.id) : await ctx.client.setMfaPolicy(ref.id, { required: options.set === "required" });
+		emit(options, policy, () => {
+			if (!policy.configured) {
+				console.error("no identity provider configured — MFA cannot be enforced here");
+				return;
+			}
+			console.log(policy.required ? "required for all members" : "optional");
+		});
+	});
+	org.command("tree").description("print the org's applications, environments, and groups as a tree").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const [{ apps }, { groups }] = await Promise.all([ctx.client.listApps(ref.id), ctx.client.listGroups(ref.id)]);
+		const appTree = await Promise.all(apps.map(async (a) => ({
+			...a,
+			environments: (await ctx.client.listEnvs(ref.id, a.id)).environments
+		})));
+		const groupTree = await Promise.all(groups.map(async (g) => ({
+			...g,
+			environments: (await ctx.client.listGroupEnvs(ref.id, g.id)).environments
+		})));
+		emit(options, {
+			org: ref.slug,
+			apps: appTree,
+			groups: groupTree
+		}, () => {
+			console.log(ref.slug);
+			for (const a of appTree) {
+				console.log(`  app ${a.slug}`);
+				for (const e of a.environments) console.log(`    ${e.slug}`);
+			}
+			for (const g of groupTree) {
+				console.log(`  group ${g.slug}`);
+				for (const e of g.environments) console.log(`    ${e.slug}`);
+			}
+			if (appTree.length === 0 && groupTree.length === 0) console.error("no applications or groups yet");
+		});
+	});
+}
+//#endregion
 //#region src/pg.ts
 /**
 * `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
@@ -4856,6 +6085,208 @@ function collect(value, acc) {
 	return acc;
 }
 //#endregion
+//#region src/sync.ts
+function assertProvider(value) {
+	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
+	return value;
+}
+/** Account-scope config for a connection (never the credential itself). */
+function buildConfig(provider, options) {
+	switch (provider) {
+		case "vercel": return {
+			provider: "vercel",
+			...options.teamId ? { teamId: options.teamId } : {}
+		};
+	}
+}
+/** Where inside the platform a binding writes. */
+function buildDestination(provider, options) {
+	switch (provider) {
+		case "vercel": {
+			if (!options.project) fail("--project is required for vercel (a prj_… id or project name)");
+			const targets = (options.target ?? "production").split(",").map((t) => t.trim());
+			const unknown = targets.filter((t) => !VERCEL_TARGETS.includes(t));
+			if (unknown.length > 0) fail(`unknown --target ${unknown.join(", ")} — one of: ${VERCEL_TARGETS.join(", ")}`);
+			return {
+				provider: "vercel",
+				projectId: options.project,
+				targets,
+				...options.gitBranch ? { gitBranch: options.gitBranch } : {}
+			};
+		}
+	}
+}
+/** One-line description of a destination, for list output. */
+function describeDestination(destination) {
+	switch (destination.provider) {
+		case "vercel": return `${destination.projectId} (${destination.targets.join(", ")}${destination.gitBranch ? ` @${destination.gitBranch}` : ""})`;
+	}
+}
+/** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
+async function resolveConnection(ctx, orgId, ref) {
+	const { connections } = await ctx.client.listSyncConnections(orgId);
+	const matches = connections.filter((c) => c.id === ref || c.name === ref);
+	if (matches.length === 0) fail(`no sync connection "${ref}"`);
+	if (matches.length > 1) fail(`"${ref}" matches ${matches.length} connections — use the id`);
+	return matches[0];
+}
+function registerSyncCommands(program) {
+	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, …)");
+	sync.command("connections").alias("conns").description("list destination accounts seekrit can push to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { connections } = await ctx.client.listSyncConnections(ref.id);
+		emit(options, { connections }, () => printTable(connections, [
+			col("name", (c) => c.name),
+			col("provider", (c) => c.provider),
+			col("status", (c) => c.status),
+			col("error", (c) => c.lastError),
+			col("id", (c) => c.id)
+		], "no connections — add one with `seekrit sync connect`"));
+	});
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").action(async (options) => {
+		const provider = assertProvider(options.provider);
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const credential = (process.stdin.isTTY ? await promptHidden(`${provider} API token: `) : await readStdin()).trim();
+		if (!credential) fail("no API token given");
+		const id = randomId("syc");
+		const { publicKeyJwk } = await ctx.client.getSyncConnectionKey(ref.id, id);
+		const created = await ctx.client.createSyncConnection(ref.id, {
+			id,
+			name: options.name,
+			config: buildConfig(provider, options),
+			wrappedCredential: await wrapDek(new TextEncoder().encode(credential), publicKeyJwk)
+		});
+		console.error(`connected ${created.connection.name} (${created.connection.id})`);
+	});
+	sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--project <id>", "vercel: project id or name").option("--target <list>", "vercel: comma-separated targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--json", "print the raw API response").action(async (connection, options) => {
+		const provider = assertProvider(options.provider);
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const conn = await resolveConnection(ctx, ref.id, connection);
+		const result = await ctx.client.verifySyncConnection(ref.id, conn.id, buildDestination(provider, options));
+		emit(options, result, () => printFields([["result", result.ok ? "ok" : "failed"], ["error", result.error ?? null]]));
+		if (!result.ok) process.exitCode = 1;
+	});
+	sync.command("disconnect <connection>").description("delete a destination account, its bindings, and its keypair").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (connection, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const conn = await resolveConnection(ctx, ref.id, connection);
+		const { bindings } = await ctx.client.listSyncBindings(ref.id);
+		const mine = bindings.filter((b) => b.connectionId === conn.id);
+		await confirmDestructive(options.yes, `Delete connection ${conn.name} and its ${mine.length} binding(s)? Values already pushed stay on the destination.`);
+		await ctx.client.deleteSyncConnection(ref.id, conn.id);
+		console.error(`disconnected ${conn.name}`);
+	});
+	sync.command("bindings").description("list which environments are syncing where").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const [{ bindings }, { connections }] = await Promise.all([ctx.client.listSyncBindings(ref.id), ctx.client.listSyncConnections(ref.id)]);
+		const names = new Map(connections.map((c) => [c.id, c.name]));
+		emit(options, { bindings }, () => printTable(bindings, [
+			col("connection", (b) => names.get(b.connectionId) ?? b.connectionId),
+			col("destination", (b) => describeDestination(b.destination)),
+			col("env", (b) => b.environmentId),
+			col("mode", (b) => b.enabled ? b.mode : "disabled"),
+			col("last run", (b) => b.lastRunAt),
+			col("error", (b) => b.lastError),
+			col("id", (b) => b.id)
+		], "nothing is syncing — enable it with `seekrit sync enable`"));
+	});
+	sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--project <id>", "vercel: project id or name").option("--target <list>", "vercel: comma-separated targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
+		const provider = assertProvider(options.provider);
+		if (options.onDelete !== "delete" && options.onDelete !== "retain") fail("--on-delete must be delete or retain");
+		if (options.mode !== "auto" && options.mode !== "manual") fail("--mode must be auto or manual");
+		const ctx = buildContext();
+		const target = await resolveAppEnv(ctx, options);
+		const conn = await resolveConnection(ctx, target.orgId, options.connection);
+		const destination = buildDestination(provider, options);
+		await confirmDestructive(options.acknowledgeDecryption, `Enabling sync lets seekrit's servers decrypt ${target.appSlug}/${target.envSlug} in memory to push it to ${conn.name}. Continue?`, "--acknowledge-decryption");
+		const resolved = await ctx.client.resolve({ env: target.envId });
+		const privateKey = await getPrivateKey(ctx);
+		const wrappedDeks = await Promise.all(resolved.layers.map(async (layer) => {
+			let dek;
+			try {
+				dek = await unwrapDek(layer.wrappedDek, privateKey);
+			} catch {
+				fail(`you hold no key for ${layer.groupSlug ? `group "${layer.groupSlug}"` : "this environment"}, so sync cannot be granted access to it`);
+			}
+			return {
+				environmentId: layer.environmentId,
+				wrappedDek: await wrapDek(dek, conn.publicKeyJwk)
+			};
+		}));
+		const globs = (raw) => raw ? raw.split(",").map((g) => g.trim()).filter(Boolean) : void 0;
+		const { binding } = await ctx.client.createSyncBinding(target.orgId, {
+			connectionId: conn.id,
+			environmentId: target.envId,
+			destination,
+			...options.prefix ? { nameTransform: { prefix: options.prefix } } : {},
+			...globs(options.include) ? { include: globs(options.include) } : {},
+			...globs(options.exclude) ? { exclude: globs(options.exclude) } : {},
+			onDelete: options.onDelete,
+			mode: options.mode,
+			wrappedDeks,
+			acknowledgedDecryption: true
+		});
+		console.error(`syncing ${target.appSlug}/${target.envSlug} → ${conn.name} ${describeDestination(destination)} (${binding.id})`);
+		if (binding.mode === "manual") console.error("mode is manual — push with `seekrit sync run`");
+	});
+	sync.command("pause <bindingId>").description("stop pushing on this binding without deleting it").option("--org <slug>").action(async (bindingId, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		await ctx.client.updateSyncBinding(ref.id, bindingId, { enabled: false });
+		console.error(`${bindingId} paused`);
+	});
+	sync.command("resume <bindingId>").description("start pushing on a paused binding again").option("--org <slug>").action(async (bindingId, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		await ctx.client.updateSyncBinding(ref.id, bindingId, { enabled: true });
+		console.error(`${bindingId} resumed`);
+	});
+	sync.command("disable <bindingId>").alias("rm").description("stop syncing an environment and revoke seekrit's key for it").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (bindingId, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Delete binding ${bindingId}? Values already pushed stay on the destination.`);
+		await ctx.client.deleteSyncBinding(ref.id, bindingId);
+		console.error(`${bindingId} deleted`);
+	});
+	sync.command("run <bindingId>").description("push now, synchronously, and report what landed").option("--org <slug>").option("--json", "print the raw API response").action(async (bindingId, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { run } = await ctx.client.runSyncBinding(ref.id, bindingId);
+		emit(options, { run }, () => {
+			printFields([
+				["status", run.status],
+				["pushed", run.pushed.length],
+				["deleted", run.deleted.length],
+				["failed", run.failures.length],
+				["error", run.error]
+			]);
+			if (run.failures.length > 0) {
+				section("failures");
+				printTable(run.failures, [col("name", (f) => f.name), col("error", (f) => f.error)]);
+			}
+		});
+		if (run.status !== "succeeded") process.exitCode = 1;
+	});
+	sync.command("runs").description("show the sync run history").option("--org <slug>").option("--binding <id>", "only runs of this binding").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { runs } = await ctx.client.listSyncRuns(ref.id, options.binding);
+		emit(options, { runs }, () => printTable(runs, [
+			col("started", (r) => r.startedAt),
+			col("status", (r) => r.status),
+			col("trigger", (r) => r.trigger),
+			col("pushed", (r) => r.pushedCount),
+			col("deleted", (r) => r.deletedCount),
+			col("error", (r) => r.error),
+			col("binding", (r) => r.bindingId)
+		], "no sync runs yet"));
+	});
+}
+//#endregion
 //#region src/web-login.ts
 /**
 * `seekrit login` — sign in through the browser.
@@ -5121,101 +6552,9 @@ program.command("init").description("link this directory to an org/app (environm
 	});
 	console.error(`linked ${org.slug}/${app.slug} → ${path} (environment is selected by the service token at runtime)`);
 });
-program.command("org").description("manage organizations").command("create").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
-	const created = await buildContext().client.createOrg({
-		name: options.name,
-		slug: options.slug
-	});
-	console.error(`created org ${created.org.slug} (${created.org.id})`);
-});
-program.command("app").description("manage applications").command("create").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
-	const ctx = buildContext();
-	const orgRef = await resolveOrg(ctx, options.org);
-	const created = await ctx.client.createApp(orgRef.id, {
-		name: options.name,
-		slug: options.slug
-	});
-	console.error(`created app ${created.app.slug} (${created.app.id})`);
-});
-const env = program.command("env").description("manage environments");
-env.command("create").description("create an application environment (generates its data key locally)").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
-	const ctx = buildContext();
-	const orgRef = await resolveOrg(ctx, options.org);
-	const { apps } = await ctx.client.listApps(orgRef.id);
-	const appRow = apps.find((a) => a.slug === options.app || a.id === options.app);
-	if (!appRow) fail(`no app "${options.app}" in ${orgRef.slug}`);
-	const { user } = await ctx.client.me();
-	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
-	const dek = generateDek();
-	const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
-	const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, orgRef.id, dek);
-	const created = await ctx.client.createEnv(orgRef.id, appRow.id, {
-		name: options.name,
-		slug: options.slug,
-		wrappedDek,
-		recoveryWrappedDek
-	});
-	console.error(`created environment ${created.environment.slug} (${created.environment.id})`);
-});
-const envGroups = env.command("groups").description("compose shared groups into an application environment");
-envGroups.command("add").description("compose a group into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").option("--position <n>", "precedence among groups (higher wins)").action(async (options) => {
-	const ctx = buildContext();
-	const target = await resolveAppEnv(ctx, options);
-	const group = await resolveGroup(ctx, {
-		org: options.org,
-		group: options.group
-	});
-	await ctx.client.linkEnvGroup(target.orgId, target.envId, {
-		groupId: group.id,
-		position: options.position === void 0 ? void 0 : Number.parseInt(options.position, 10)
-	});
-	console.error(`composed ${group.slug} into ${target.appSlug}/${target.envSlug}`);
-});
-envGroups.command("list").description("list groups composed into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").action(async (options) => {
-	const ctx = buildContext();
-	const target = await resolveAppEnv(ctx, options);
-	const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
-	for (const g of groups) console.log(`${g.position}\t${g.slug}\t${g.name}`);
-});
-envGroups.command("rm").description("remove a group from an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").action(async (options) => {
-	const ctx = buildContext();
-	const target = await resolveAppEnv(ctx, options);
-	const group = await resolveGroup(ctx, {
-		org: options.org,
-		group: options.group
-	});
-	await ctx.client.unlinkEnvGroup(target.orgId, target.envId, group.id);
-	console.error(`removed ${group.slug} from ${target.appSlug}/${target.envSlug}`);
-});
-const group = program.command("group").description("manage shared groups (reusable secret bags)");
-group.command("create").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
-	const ctx = buildContext();
-	const orgRef = await resolveOrg(ctx, options.org);
-	const created = await ctx.client.createGroup(orgRef.id, {
-		name: options.name,
-		slug: options.slug
-	});
-	console.error(`created group ${created.group.slug} (${created.group.id})`);
-});
-group.command("env").description("manage a group’s environments (per-slug value sets / variants)").command("create").description("create a group environment (generates its data key locally)").option("--org <slug>").requiredOption("--group <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
-	const ctx = buildContext();
-	const groupRef = await resolveGroup(ctx, {
-		org: options.org,
-		group: options.group
-	});
-	const { user } = await ctx.client.me();
-	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
-	const dek = generateDek();
-	const wrappedDek = await wrapDek(dek, user.publicKeyJwk);
-	const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, groupRef.orgId, dek);
-	const created = await ctx.client.createGroupEnv(groupRef.orgId, groupRef.id, {
-		name: options.name,
-		slug: options.slug,
-		wrappedDek,
-		recoveryWrappedDek
-	});
-	console.error(`created ${groupRef.slug}@${created.environment.slug} (${created.environment.id})`);
-});
+registerOrgCommands(program);
+registerAppCommands(program);
+registerGroupCommands(program);
 /** Parse a positive integer flag/argument (version numbers, page sizes). */
 function parseVersion(raw) {
 	const n = Number(raw);
@@ -5227,11 +6566,21 @@ function withTarget(cmd) {
 	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").option("--branch <slug>", "operate on a branch of --env").requiredOption("--env <slug>", "environment slug");
 }
 const secrets = program.command("secrets").description("manage secrets in an application or group environment");
-withTarget(secrets.command("list").description("list secret names (no values)")).action(async (options) => {
+withTarget(secrets.command("list").alias("ls").description("list secret names (no values)").option("--json", "print the listing as JSON (metadata only — never values)")).action(async (options) => {
 	const ctx = buildContext();
-	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
 	const { secrets: rows } = await ctx.client.listSecrets(orgId, envId);
-	for (const row of rows) console.log(`${row.name}\tv${row.version}\t${row.updatedAt}`);
+	emit(options, { secrets: rows.map(({ id, name, version, createdAt, updatedAt }) => ({
+		id,
+		name,
+		version,
+		createdAt,
+		updatedAt
+	})) }, () => printTable(rows, [
+		col("name", (s) => s.name),
+		col("version", (s) => `v${s.version}`),
+		col("updated", (s) => s.updatedAt)
+	], `no secrets in ${label}`));
 });
 withTarget(secrets.command("get <name>").description("decrypt and print one secret value").option("--raw", "print the stored value without expanding ${OTHER_SECRET} references").option("--version <n>", "print an earlier version instead of the current one")).action(async (name, options) => {
 	const ctx = buildContext();
@@ -5274,15 +6623,19 @@ withTarget(secrets.command("import [file]").description("bulk-import secrets fro
 	const { created, updated } = await importSecrets(ctx, orgId, envId, entries);
 	console.error(`imported ${created.length + updated.length} secret(s) into ${label} (${created.length} new, ${updated.length} updated)`);
 });
-withTarget(secrets.command("history <name>").description("list a secret's versions (metadata only — no values)").option("--limit <n>", `how many versions to show (max 200)`, "20")).action(async (name, options) => {
+withTarget(secrets.command("history <name>").description("list a secret's versions (metadata only — no values)").option("--limit <n>", `how many versions to show (max 200)`, "20").option("--json", "print the raw API response")).action(async (name, options) => {
 	const ctx = buildContext();
 	const { orgId, envId } = await resolveEnvTarget(ctx, options);
 	const { versions, currentVersion } = await ctx.client.listSecretVersions(orgId, envId, name, { limit: parseVersion(options.limit) });
-	for (const v of versions) {
-		const marks = [v.version === currentVersion ? "current" : null, v.restoredFromVersion === null ? null : `restored from v${v.restoredFromVersion}`].filter(Boolean);
-		const note = marks.length > 0 ? `\t${marks.join(", ")}` : "";
-		console.log(`v${v.version}\t${v.createdAt}\t${v.createdByType}:${v.createdById}${note}`);
-	}
+	emit(options, {
+		versions,
+		currentVersion
+	}, () => printTable(versions, [
+		col("version", (v) => `v${v.version}`),
+		col("when", (v) => v.createdAt),
+		col("by", (v) => `${v.createdByType}:${v.createdById}`),
+		col("note", (v) => [v.version === currentVersion ? "current" : null, v.restoredFromVersion === null ? null : `restored from v${v.restoredFromVersion}`].filter(Boolean).join(", "))
+	], `no versions of ${name}`));
 });
 withTarget(secrets.command("restore <name> <version>").description("roll a secret back to an earlier version (stored as a new version)")).action(async (name, version, options) => {
 	const ctx = buildContext();
@@ -5515,42 +6868,7 @@ program.command("export").description("print decrypted secrets (dotenv, json, or
 	});
 	console.log(formatSecrets(values, options.format));
 });
-program.command("grant").description("give a member or service token access to an environment's key").option("--org <slug>").option("--app <slug>").option("--group <slug>", "grant a group environment instead of an app").requiredOption("--env <slug>").option("--user <email>", "grant to an org member by email").option("--token <tokenId>", "grant to a service token by id (skt_…)").action(async (options) => {
-	if (!options.user === !options.token) fail("pass exactly one of --user or --token");
-	const ctx = buildContext();
-	const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
-	const dek = await getDek(ctx, orgId, envId);
-	let principalType;
-	let principalId;
-	let publicKeyJwk;
-	if (options.user) {
-		const { members } = await ctx.client.listMembers(orgId);
-		const member = members.find((m) => m.email === options.user);
-		if (!member) fail(`no member ${options.user}`);
-		if (!member.publicKeyJwk) fail(`${options.user} has not completed key setup`);
-		[principalType, principalId, publicKeyJwk] = [
-			"user",
-			member.userId,
-			member.publicKeyJwk
-		];
-	} else {
-		const { tokens } = await ctx.client.listTokens(orgId);
-		const token = tokens.find((t) => t.id === options.token);
-		if (!token) fail(`no service token ${options.token}`);
-		[principalType, principalId, publicKeyJwk] = [
-			"service_token",
-			token.id,
-			token.publicKeyJwk
-		];
-	}
-	const wrappedDek = await wrapDek(dek, publicKeyJwk);
-	await ctx.client.grantEnvKey(orgId, envId, {
-		principalType,
-		principalId,
-		wrappedDek
-	});
-	console.error(`granted ${label} access to ${principalId}`);
-});
+registerAccessCommands(program);
 const token = program.command("token").description("manage service tokens (CI, docker, agents)");
 token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
 	const ctx = buildContext();
@@ -5601,14 +6919,19 @@ token.command("create").description("create a service token (runtime, or --admin
 	console.error(`${role} token created${granted ? " and granted" : ""} for ${scope} — save it now, it is not stored:`);
 	console.log(created.token);
 });
-token.command("list").description("list service tokens").option("--org <slug>").action(async (options) => {
+token.command("list").alias("ls").description("list service tokens").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
 	const ctx = buildContext();
 	const orgRef = await resolveOrg(ctx, options.org);
 	const { tokens } = await ctx.client.listTokens(orgRef.id);
-	for (const t of tokens) {
-		const status = t.revokedAt ? "revoked" : t.expiresAt && Date.parse(t.expiresAt) < Date.now() ? "expired" : "active";
-		console.log(`${t.id}\t${t.name}\t${status}\tlast used: ${t.lastUsedAt ?? "never"}`);
-	}
+	const status = (t) => t.revokedAt ? "revoked" : t.expiresAt && Date.parse(t.expiresAt) < Date.now() ? "expired" : "active";
+	emit(options, { tokens }, () => printTable(tokens, [
+		col("name", (t) => t.name),
+		col("role", (t) => t.role),
+		col("status", (t) => status(t)),
+		col("env", (t) => t.environmentId ?? "org-scoped"),
+		col("last used", (t) => t.lastUsedAt ?? "never"),
+		col("id", (t) => t.id)
+	], "no service tokens — create one with `seekrit token create`"));
 });
 token.command("revoke <tokenId>").description("revoke a service token").option("--org <slug>").action(async (tokenId, options) => {
 	const ctx = buildContext();
@@ -5637,12 +6960,11 @@ program.command("mcp").description("run an MCP server over stdio so AI agents ca
 	const { runMcpServer } = await import("./mcp-DLplPOvz.js");
 	await runMcpServer();
 });
-program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
-	const ctx = buildContext();
-	const orgRef = await resolveOrg(ctx, options.org);
-	const { entries } = await ctx.client.listAudit(orgRef.id, { limit: Number.parseInt(options.limit, 10) || 50 });
-	for (const entry of entries) console.log(`${entry.createdAt}\t${entry.action}\t${entry.actorType}:${entry.actorId}\t${entry.resourceType}${entry.resourceId ? `:${entry.resourceId}` : ""}`);
-});
+registerAuditCommands(program);
+registerAccountCommands(program);
+registerLogSinkCommands(program);
+registerSyncCommands(program);
+registerBillingCommands(program);
 const argv = process.argv.map((arg) => arg === "-v" ? "--version" : arg);
 program.parseAsync(argv).catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));