@seekrit/cli 0.46.0 → 1.0.0

package/dist/index.js

@@ -2481,7 +2481,8 @@ const SYNC_PROVIDER_KINDS = [
 	"bunnyshell",
 	"github-actions",
 	"gcp-secret-manager",
-	"langgraph-platform"
+	"langgraph-platform",
+	"azure-key-vault"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -2822,6 +2823,54 @@ const langgraphPlatformConnectionConfigSchema = z.object({
 	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
 	path: ["baseUrl"]
 });
+/**
+* The Azure clouds a vault can live in.
+*
+* Unlike AWS, where the China partition can be read off the region string
+* (`cn-…`), nothing about a tenant id or a vault name says which cloud it
+* belongs to — and two hosts have to agree with the answer: the Entra authority
+* that issues the token and the DNS suffix the vault answers on. Getting either
+* wrong is a failure inside an alarm with nobody watching, so it is stated.
+*/
+const AZURE_CLOUDS = [
+	"public",
+	"usgov",
+	"china"
+];
+/**
+* A Microsoft Entra directory (tenant) or application (client) id.
+*
+* Both are GUIDs. Entra accepts a verified domain name in place of a tenant id
+* in the token URL, but not a client id, and taking only the GUID for both
+* keeps one rule — a tenant's GUID is on the same admin-center page as the
+* client id it pairs with, so nothing is harder to find.
+*/
+const azureGuidSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a GUID, as the Entra admin center shows it");
+/**
+* Azure account scope: which directory to authenticate against, as which app.
+*
+* The split follows AWS's, and for the same reason. A service principal's
+* **client secret** is the credential and is wrapped to the connection's key;
+* the tenant and client ids are *identifiers* — they appear in the token
+* request URL, in sign-in logs, and on the app registration blade. Keeping them
+* here lets the dashboard say which principal a connection authenticates as,
+* which is the first thing worth knowing when a connection starts failing after
+* a secret expires.
+*
+* Client secrets are the only credential kind here: a certificate or federated
+* credential would need a private key or a trust relationship the sync engine
+* has nowhere to keep, and Entra caps a client secret at 24 months, which is a
+* rotation the connection's `lastError` will make loud.
+*/
+const azureKeyVaultConnectionConfigSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Entra directory (tenant) ID. */
+	tenantId: azureGuidSchema,
+	/** Application (client) ID of the service principal seekrit signs in as. */
+	clientId: azureGuidSchema,
+	/** Which Azure cloud the tenant and its vaults live in. */
+	cloud: z.enum(AZURE_CLOUDS).default("public")
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -2839,7 +2888,8 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	bunnyshellConnectionConfigSchema,
 	githubActionsConnectionConfigSchema,
 	gcpSecretManagerConnectionConfigSchema,
-	langgraphPlatformConnectionConfigSchema
+	langgraphPlatformConnectionConfigSchema,
+	azureKeyVaultConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -3571,6 +3621,65 @@ const langgraphPlatformDestinationSchema = z.object({
 	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
 	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
 });
+/**
+* A Key Vault's name — the leftmost label of its DNS name, so the vault
+* `acme-prod` answers at `acme-prod.vault.azure.net`.
+*
+* Azure's own rule, stated here because the failure it prevents is confusing:
+* 3–24 characters, alphanumerics and hyphens, starting with a letter, ending
+* with a letter or digit, and no run of two hyphens. A name that breaks it
+* cannot exist, so a typo is a DNS failure rather than a 404 — an error that
+* says nothing about what was wrong.
+*
+* The *base URL* is not taken instead. It would let a connection be pointed at
+* any host, and the whole address seekrit needs is this label plus the cloud
+* already named on the connection.
+*/
+const azureVaultNameSchema = z.string().trim().regex(/^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/, "must be a Key Vault name: 3–24 letters, digits, and single hyphens, starting with a letter");
+/**
+* What to do with a name Key Vault cannot store.
+*
+* Key Vault secret names are `^[0-9a-zA-Z-]+$` — **no underscores** — and
+* `DATABASE_URL` is what a secret is actually called nearly everywhere. So this
+* is not an edge case to fail on: it is the common case, and a connector that
+* rejected it would push nothing at all.
+*
+* - `dash` — `_` becomes `-`, so `DATABASE_URL` is stored as `DATABASE-URL`.
+*   The default, and what every other tool bridging this gap does. The rename
+*   is visible: the dashboard and the run ledger both show it.
+* - `reject` — fail each such name instead, for an operator who would rather
+*   name every secret explicitly with the binding's `rename` than have seekrit
+*   choose. Nothing is renamed silently under either setting; this one just
+*   refuses rather than translating.
+*
+* Translating can make two seekrit names collide (`A_B` and `A-B` both give
+* `A-B`). That is caught per run and fails *both* names rather than letting
+* whichever sorts last win — the same rule, and the same reasoning, as
+* {@link mapSecretNames}.
+*/
+const AZURE_KEY_VAULT_NAME_MODES = ["dash", "reject"];
+/**
+* Which vault a binding writes to, and under what names.
+*
+* There is no layout choice as Secrets Manager has: the reason a `json-bundle`
+* exists there is billing — AWS charges per secret per month — and Key Vault
+* charges per *operation*, so fifty names cost the same stored fifty ways. One
+* secret per name is simply correct here.
+*/
+const azureKeyVaultDestinationSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Vault name, e.g. `acme-prod` for `acme-prod.vault.azure.net`. */
+	vault: azureVaultNameSchema,
+	/**
+	* Prepended to every secret name, e.g. `storefront-`. Key Vault has no
+	* hierarchy — its names are flat, and `/` is not among the characters it
+	* accepts — so unlike Parameter Store's `path` this is a naming convention
+	* and nothing more. Worth setting in a vault that holds anything else.
+	*/
+	prefix: z.string().trim().max(64).regex(/^[A-Za-z0-9-]*$/, "may contain letters, digits, and hyphens").optional(),
+	/** What to do with a name Key Vault cannot store — see {@link AZURE_KEY_VAULT_NAME_MODES}. */
+	nameMode: z.enum(AZURE_KEY_VAULT_NAME_MODES).default("dash")
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -3588,7 +3697,8 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	bunnyshellDestinationSchema,
 	githubActionsDestinationSchema,
 	gcpSecretManagerDestinationSchema,
-	langgraphPlatformDestinationSchema
+	langgraphPlatformDestinationSchema,
+	azureKeyVaultDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -4876,7 +4986,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "0.46.0";
+var version = "1.0.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -5655,7 +5765,18 @@ function parseDurationSeconds(input, flag) {
 		d: 86400
 	}[m[2] || "s"] ?? 1);
 }
-/** Prompt without echoing input (for passphrases). */
+/**
+* Prompt without echoing input (for passphrases).
+*
+* Piping the answer in (`echo … | seekrit secrets get …`) is supported and
+* common in CI, so this reads stdin rather than insisting on a TTY. But stdin
+* can also close with nothing on it — `< /dev/null`, a closed pipe, an agent
+* spawning us with no stdin — and readline signals that by emitting `close`
+* without ever calling the `question` callback. Left unhandled the promise
+* never settles, the event loop drains, and Node exits **0** having printed
+* nothing: `V=$(seekrit secrets get X)` silently yields an empty value and a
+* success status. So treat EOF-without-an-answer as the error it is.
+*/
 function promptHidden(question) {
 	const muted = new Writable({ write(_chunk, _encoding, callback) {
 		callback();
@@ -5666,8 +5787,15 @@ function promptHidden(question) {
 		output: muted,
 		terminal: true
 	});
-	return new Promise((resolve) => {
+	return new Promise((resolve, reject) => {
+		let answered = false;
+		rl.on("close", () => {
+			if (answered) return;
+			process.stderr.write("\n");
+			reject(/* @__PURE__ */ new Error("no passphrase on stdin — set SEEKRIT_PASSPHRASE, pipe it in, or run this in a terminal"));
+		});
 		rl.question("", (answer) => {
+			answered = true;
 			rl.close();
 			process.stderr.write("\n");
 			resolve(answer);
@@ -5743,9 +5871,23 @@ const CLI_CLIENT = `cli/${version}`;
 * `flag > env > .env` credential resolution. Empty for every command but
 * `seekrit run`, which loads `.env` before authenticating.
 */
+/**
+* A `SEEKRIT_*` value, or undefined if it is absent *or blank*.
+*
+* Blank has to mean absent. An unset CI secret, a `${VAR}` that expanded to
+* nothing, a bare `export SEEKRIT_TOKEN=` — all arrive as `""`, and `??` only
+* falls back on null/undefined. Left alone, an empty `SEEKRIT_API_URL` makes
+* every request relative and an empty `SEEKRIT_TOKEN` authenticates as a
+* bearer of nothing: a 401 where the honest answer is "you have no
+* credentials", pointing at the API instead of at the missing variable.
+*/
+function present(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
 function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
-	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const fromEnv = (key) => present(process.env[key]) ?? present(dotenvVars[key]);
 	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
 	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token ?? config.sessionToken;
 	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
@@ -5778,6 +5920,24 @@ function isTokenAuth(ctx) {
 	return ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token);
 }
 /**
+* Render an unhandled error for the top-level handler.
+*
+* `fetch` reports every transport failure as the same opaque `TypeError: fetch
+* failed` and hides the reason (ECONNREFUSED, DNS, TLS) in `cause`. That is the
+* single most common thing to go wrong — a stale `SEEKRIT_API_URL`, a dev
+* server that isn't up, a VPN that is down — and "error: fetch failed" names
+* neither the address we tried nor why it failed. So unwrap it and say both.
+*/
+function describeError(err) {
+	if (!(err instanceof Error)) return String(err);
+	if (err.message !== "fetch failed") return err.message;
+	const config = readGlobalConfig();
+	const apiUrl = present(process.env.SEEKRIT_API_URL) ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const cause = err.cause;
+	const reason = cause instanceof Error ? cause.code ?? cause.message : void 0;
+	return `cannot reach the seekrit API at ${apiUrl}${reason ? ` (${reason})` : ""} — check SEEKRIT_API_URL, your network, and that the API is up`;
+}
+/**
 * Recover the calling principal's private key:
 *  - service tokens carry their private key in the token string;
 *  - users fetch their passphrase-encrypted key from the API and unlock it.
@@ -6040,7 +6200,7 @@ async function resolvePrincipal(ctx, orgId, options) {
 }
 /** The `--org/--app/--group/--env` selection every grant command shares. */
 function withEnvTarget(cmd) {
-	return cmd.option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>");
+	return cmd.option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>", "environment slug");
 }
 /**
 * Environment key grants — who can decrypt what.
@@ -6075,7 +6235,7 @@ function registerAccessCommands(program) {
 			col("id", (g) => g.principalId)
 		], "nobody holds a key for this environment"));
 	});
-	withEnvTarget(grant.command("rm").alias("revoke").description("take away a member's or token's access to an environment's key").option("--user <email>", "revoke an org member by email").option("--token <tokenId>", "revoke a service token by id (skt_…)").option("--yes", "skip the confirmation prompt")).action(async (options) => {
+	withEnvTarget(grant.command("rm").alias("revoke").description("take away a member's or token's access to an environment's key").option("--user <email>", "revoke an org member by email").option("--token <tokenId>", "revoke a service token by id (skt_…)").option("-y, --yes", "skip the confirmation prompt")).action(async (options) => {
 		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
 		const ctx = buildContext();
 		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
@@ -6121,7 +6281,7 @@ function registerAccountCommands(program) {
 			col("id", (s) => `${s.id}${s.id === currentSessionId ? " (this one)" : ""}`)
 		], options.all ? "no CLI sessions" : "no active CLI sessions (try --all)"));
 	});
-	session.command("revoke <sessionId>").description("sign a device out — its token stops working immediately").option("--yes", "skip the confirmation prompt").action(async (sessionId, options) => {
+	session.command("revoke <sessionId>").description("sign a device out — its token stops working immediately").option("-y, --yes", "skip the confirmation prompt").action(async (sessionId, options) => {
 		const ctx = buildContext();
 		const self = ctx.auth.type === "bearer" && isCliSessionToken(ctx.auth.token) && parseCliSessionToken(ctx.auth.token).sessionId === sessionId;
 		await confirmDestructive(options.yes, self ? `${sessionId} is the session you are using right now — sign it out?` : `Sign out ${sessionId}?`);
@@ -6852,7 +7012,7 @@ async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
 }
 function registerKmsCommands(program) {
 	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
 		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
 		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
@@ -6905,7 +7065,7 @@ function registerKmsCommands(program) {
 		const { key } = await ctx.client.createKmsKey(org.id, input);
 		console.error(`created ${key.purpose} key ${key.name} (${key.id}), ${grants.length} grant(s)`);
 	});
-	kms.command("ls").description("list keys you can see").option("--org <slug>").action(async (options) => {
+	kms.command("ls").description("list keys you can see").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { keys } = await ctx.client.listKmsKeys(org.id);
@@ -6919,7 +7079,7 @@ function registerKmsCommands(program) {
 			console.log(`${k.name}\t${k.purpose}\tv${k.currentVersion}\t${scope}\t${k.id}${state}`);
 		}
 	});
-	kms.command("grant").description("grant a principal use of a key's current version").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--user <email>", "grant an org member").option("--token <tokenId>", "grant a service token").action(async (options) => {
+	kms.command("grant").description("grant a principal use of a key's current version").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <email>", "grant an org member").option("--token <tokenId>", "grant a service token").action(async (options) => {
 		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
@@ -6933,19 +7093,20 @@ function registerKmsCommands(program) {
 		});
 		console.error(`granted ${key.name} to ${recipient.principalId}`);
 	});
-	kms.command("revoke").description("revoke a principal from a key (all versions)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--user <email>").option("--token <tokenId>").action(async (options) => {
+	kms.command("revoke").description("revoke a principal from a key (all versions)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <email>", "revoke this user's grant").option("--token <tokenId>", "revoke this service token's grant").option("-y, --yes", "skip the confirmation").action(async (options) => {
 		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
 		const recipient = await kmsResolveRecipient(ctx, org.id, options);
+		await confirmDestructive(options.yes, `Revoke ${recipient.principalId} from ${key.name}? Anything already decrypted stays decrypted.`);
 		await ctx.client.revokeKmsKey(org.id, key.id, {
 			principalType: recipient.principalType,
 			principalId: recipient.principalId
 		});
 		console.error(`revoked ${recipient.principalId} from ${key.name}`);
 	});
-	kms.command("rotate").description("add a new key version and re-wrap it for every current grantee").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("rotate").description("add a new key version and re-wrap it for every current grantee").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -6979,21 +7140,23 @@ function registerKmsCommands(program) {
 		});
 		console.error(`rotated ${rotated.name} to v${rotated.currentVersion} (${grants.length} grantees)`);
 	});
-	kms.command("disable").description("disable a key (blocks all use: encrypt/decrypt/sign and new grants/rotations)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("disable").description("disable a key (blocks all use: encrypt/decrypt/sign and new grants/rotations)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
+		await confirmDestructive(options.yes, `Disable ${key.name}? Every encrypt, decrypt, and sign against it starts failing.`);
 		await ctx.client.disableKmsKey(org.id, key.id);
 		console.error(`disabled ${key.name}`);
 	});
-	kms.command("delete").description("delete a key (hides it from all listings; the name frees up for reuse)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("delete").description("delete a key (hides it from all listings; the name frees up for reuse)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
+		await confirmDestructive(options.yes, `Delete ${key.name}? Any ciphertext or signature still relying on it becomes unrecoverable.`);
 		await ctx.client.deleteKmsKey(org.id, key.id);
 		console.error(`deleted ${key.name}`);
 	});
-	kms.command("encrypt").description("encrypt stdin under a key (prints a ce1 ciphertext blob)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "encryption context bound as AAD (required identically to decrypt)").action(async (options) => {
+	kms.command("encrypt").description("encrypt stdin under a key (prints a ce1 ciphertext blob)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--context <ctx>", "encryption context bound as AAD (required identically to decrypt)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7006,7 +7169,7 @@ function registerKmsCommands(program) {
 		}, plaintext, options.context ?? "");
 		console.log(blob);
 	});
-	kms.command("decrypt").description("decrypt a ce1 blob from stdin").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "the same encryption context used to encrypt").action(async (options) => {
+	kms.command("decrypt").description("decrypt a ce1 blob from stdin").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--context <ctx>", "the same encryption context used to encrypt").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7015,7 +7178,7 @@ function registerKmsCommands(program) {
 		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id, ref.version);
 		console.log(await kmsDecrypt(material, blob, options.context ?? ""));
 	});
-	kms.command("generate-data-key").description("generate a data key: prints JSON {plaintextBase64, wrapped}").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("generate-data-key").description("generate a data key: prints JSON {plaintextBase64, wrapped}").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7030,7 +7193,7 @@ function registerKmsCommands(program) {
 			wrapped: dk.wrapped
 		}));
 	});
-	kms.command("open-data-key").description("recover a data key from a dk1 blob on stdin (prints plaintext base64)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("open-data-key").description("recover a data key from a dk1 blob on stdin (prints plaintext base64)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7039,7 +7202,7 @@ function registerKmsCommands(program) {
 		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id, ref.version);
 		console.log(toBase64(await decryptDataKey(material, wrapped)));
 	});
-	kms.command("sign").description("sign stdin with a signing key (prints an sg1 signature)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("sign").description("sign stdin with a signing key (prints an sg1 signature)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7052,7 +7215,7 @@ function registerKmsCommands(program) {
 			version: currentVersion
 		}, message));
 	});
-	kms.command("verify").description("verify an sg1 signature over stdin (exit 0 = valid)").requiredOption("--key <name>", "key name or id").requiredOption("--signature <sg1>", "the signature blob").option("--org <slug>").action(async (options) => {
+	kms.command("verify").description("verify an sg1 signature over stdin (exit 0 = valid)").requiredOption("--key <name>", "key name or id").requiredOption("--signature <sg1>", "the signature blob").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7154,7 +7317,7 @@ async function buildRecoveryConfig(ctx, orgId, thresholdRaw, custodianRefs) {
 }
 function registerRecoveryCommands(program) {
 	const recovery = program.command("recovery").description("customer-controlled M-of-N recovery (zero-knowledge)");
-	recovery.command("status").description("show recovery configuration and environment coverage").option("--org <slug>").action(async (options) => {
+	recovery.command("status").description("show recovery configuration and environment coverage").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { recovery: status } = await ctx.client.getRecovery(org.id);
@@ -7168,7 +7331,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7181,12 +7344,12 @@ function registerRecoveryCommands(program) {
 		console.error(`recovery-protected ${wrapped} environment(s) you can decrypt`);
 		if (skipped > 0) console.error(`${skipped} environment(s) need another admin to run \`seekrit recovery sync\``);
 	});
-	recovery.command("sync").description("recovery-protect environments you can decrypt but that aren't yet covered").option("--org <slug>").action(async (options) => {
+	recovery.command("sync").description("recovery-protect environments you can decrypt but that aren't yet covered").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7199,13 +7362,14 @@ function registerRecoveryCommands(program) {
 		console.error(`re-wrapped ${wrapped} environment(s) you can decrypt to the new recovery key`);
 		if (skipped > 0) console.error(`${skipped} environment(s) still need another admin to run \`seekrit recovery sync\``);
 	});
-	recovery.command("disable").description("disable recovery and remove all recovery grants").option("--org <slug>").action(async (options) => {
+	recovery.command("disable").description("disable recovery and remove all recovery grants").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Disable recovery for ${org.slug}? Every custodian share is dropped, and the org loses its break-glass path.`);
 		await ctx.client.disableRecovery(org.id);
 		console.error("recovery disabled; recovery grants removed");
 	});
-	recovery.command("request").description("start a recovery ceremony (defaults to recovering access for yourself)").option("--target-user <email>", "recover access for another member").option("--target-token <id>", "recover access for a service token").option("--reason <text>", "note recorded in the audit trail").option("--org <slug>").action(async (options) => {
+	recovery.command("request").description("start a recovery ceremony (defaults to recovering access for yourself)").option("--target-user <email>", "recover access for another member").option("--target-token <id>", "recover access for a service token").option("--reason <text>", "note recorded in the audit trail").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const target = options.targetUser || options.targetToken ? await kmsResolveRecipient(ctx, org.id, {
@@ -7222,7 +7386,7 @@ function registerRecoveryCommands(program) {
 		console.error(`  custodians run:  seekrit recovery approve ${request.id}`);
 		console.error(`  then the target: seekrit recovery complete ${request.id}`);
 	});
-	recovery.command("approve").description("as a custodian, contribute your share to a recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+	recovery.command("approve").description("as a custodian, contribute your share to a recovery request").argument("<requestId>").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (requestId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { request } = await ctx.client.getRecoveryRequest(org.id, requestId);
@@ -7235,7 +7399,7 @@ function registerRecoveryCommands(program) {
 		});
 		console.error(`contributed share #${myShare.shareIndex}: ${res.contributed}/${res.threshold} collected${res.quorumReached ? " — quorum reached" : ""}`);
 	});
-	recovery.command("complete").description("as the recovery target, reconstruct the key and restore your access").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+	recovery.command("complete").description("as the recovery target, reconstruct the key and restore your access").argument("<requestId>").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (requestId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { request, contributions, quorumReached } = await ctx.client.getRecoveryRequest(org.id, requestId);
@@ -7259,9 +7423,10 @@ function registerRecoveryCommands(program) {
 		});
 		console.error(`recovery complete: restored access to ${restored.length} environment(s)`);
 	});
-	recovery.command("cancel").description("cancel an open recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+	recovery.command("cancel").description("cancel an open recovery request").argument("<requestId>").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (requestId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Cancel recovery request ${requestId}? Approvals already collected are discarded.`);
 		await ctx.client.cancelRecoveryRequest(org.id, requestId);
 		console.error(`recovery request ${requestId} canceled`);
 	});
@@ -7275,7 +7440,7 @@ function registerRecoveryCommands(program) {
 */
 function registerAppCommands(program) {
 	const app = program.command("app").description("manage applications");
-	app.command("list").alias("ls").description("list applications in an organization").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	app.command("list").alias("ls").description("list applications in an organization").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { apps } = await ctx.client.listApps(ref.id);
@@ -7286,7 +7451,7 @@ function registerAppCommands(program) {
 			col("id", (a) => a.id)
 		], "no applications — create one with `seekrit app create`"));
 	});
-	app.command("show [slug]").description("show an application, its environments, and your access to each").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (slug, options) => {
+	app.command("show [slug]").description("show an application, its environments, and your access to each").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, {
 			org: options.org,
@@ -7322,7 +7487,7 @@ function registerAppCommands(program) {
 			}
 		});
 	});
-	app.command("create").description("create an application").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	app.command("create").description("create an application").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const created = await ctx.client.createApp(orgRef.id, {
@@ -7331,7 +7496,7 @@ function registerAppCommands(program) {
 		});
 		console.error(`created app ${created.app.slug} (${created.app.id})`);
 	});
-	app.command("rename [slug]").description("change an application's display name (the slug is permanent)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
+	app.command("rename [slug]").description("change an application's display name (the slug is permanent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, {
 			org: options.org,
@@ -7340,7 +7505,7 @@ function registerAppCommands(program) {
 		const { app: row } = await ctx.client.updateApp(ref.orgId, ref.id, { name: options.name });
 		console.error(`renamed ${row.slug} to "${row.name}"`);
 	});
-	app.command("rm <slug>").alias("delete").description("delete an application and every environment and secret in it").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (slug, options) => {
+	app.command("rm <slug>").alias("delete").description("delete an application and every environment and secret in it").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, {
 			org: options.org,
@@ -7352,7 +7517,7 @@ function registerAppCommands(program) {
 		console.error(`deleted app ${ref.slug}`);
 	});
 	const env = program.command("env").description("manage environments");
-	env.command("list").alias("ls").description("list an application's environments").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (options) => {
+	env.command("list").alias("ls").description("list an application's environments").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, options);
 		const { environments } = await ctx.client.getApp(ref.orgId, ref.id);
@@ -7363,7 +7528,7 @@ function registerAppCommands(program) {
 			col("id", (e) => e.id)
 		], "no environments — create one with `seekrit env create`"));
 	});
-	env.command("show").description("show one environment: composed groups, who holds a key, secret count").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>").option("--json", "print the raw API response").action(async (options) => {
+	env.command("show").description("show one environment: composed groups, who holds a key, secret count").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "environment slug").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveAppEnv(ctx, options);
 		const [{ environment }, { groups }, { secrets }, { branches }] = await Promise.all([
@@ -7403,7 +7568,7 @@ function registerAppCommands(program) {
 			}
 		});
 	});
-	env.command("create").description("create an application environment (generates its data key locally)").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	env.command("create").description("create an application environment (generates its data key locally)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--app <slug>", "application slug").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const { apps } = await ctx.client.listApps(orgRef.id);
@@ -7422,7 +7587,7 @@ function registerAppCommands(program) {
 		});
 		console.error(`created environment ${created.environment.slug} (${created.environment.id})`);
 	});
-	env.command("rm").alias("delete").description("delete an environment and every secret in it").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "delete a group environment instead of an app one").requiredOption("--env <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+	env.command("rm").alias("delete").description("delete an environment and every secret in it").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "delete a group environment instead of an app one").requiredOption("--env <slug>", "environment slug").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveEnvTarget(ctx, options);
 		const { secrets } = await ctx.client.listSecrets(target.orgId, target.envId);
@@ -7431,7 +7596,7 @@ function registerAppCommands(program) {
 		console.error(`deleted ${target.label}`);
 	});
 	const envGroups = env.command("groups").description("compose shared groups into an application environment");
-	envGroups.command("add").description("compose a group into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").option("--position <n>", "precedence among groups (higher wins)").action(async (options) => {
+	envGroups.command("add").description("compose a group into an app environment").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--app <slug>", "application slug").requiredOption("--env <slug>", "environment slug").requiredOption("--group <slug>", "group slug").option("--position <n>", "precedence among groups (higher wins)").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveAppEnv(ctx, options);
 		const group = await resolveGroup(ctx, {
@@ -7444,7 +7609,7 @@ function registerAppCommands(program) {
 		});
 		console.error(`composed ${group.slug} into ${target.appSlug}/${target.envSlug}`);
 	});
-	envGroups.command("list").alias("ls").description("list groups composed into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").option("--json", "print the raw API response").action(async (options) => {
+	envGroups.command("list").alias("ls").description("list groups composed into an app environment").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--app <slug>", "application slug").requiredOption("--env <slug>", "environment slug").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveAppEnv(ctx, options);
 		const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
@@ -7454,13 +7619,14 @@ function registerAppCommands(program) {
 			col("name", (g) => g.name)
 		], "no groups composed into this environment"));
 	});
-	envGroups.command("rm").description("remove a group from an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").action(async (options) => {
+	envGroups.command("rm").description("remove a group from an app environment").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--app <slug>", "application slug").requiredOption("--env <slug>", "environment slug").requiredOption("--group <slug>", "group slug").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveAppEnv(ctx, options);
 		const group = await resolveGroup(ctx, {
 			org: options.org,
 			group: options.group
 		});
+		await confirmDestructive(options.yes, `Remove ${group.slug} from ${target.appSlug}/${target.envSlug}? Everything it contributed disappears from that environment.`);
 		await ctx.client.unlinkEnvGroup(target.orgId, target.envId, group.id);
 		console.error(`removed ${group.slug} from ${target.appSlug}/${target.envSlug}`);
 	});
@@ -8483,7 +8649,7 @@ async function decryptArchive(archive, key, filter) {
 }
 function registerArchiveCommands(program) {
 	const archive = program.command("archive").description("export the whole org as one signed file, and open it offline");
-	archive.command("create").description("download a signed archive of everything seekrit stores for the org").option("--org <slug>").option("-o, --out <file>", "write the archive here (default: ./seekrit-<org>-<date>.json)").option("--no-versions", "omit each secret's ciphertext history").option("--no-audit", "omit the audit trail").option("--audit-limit <n>", "keep at most this many of the newest audit rows", Number).option("--json", "print the archive to stdout instead of writing a file").action(async (options) => {
+	archive.command("create").description("download a signed archive of everything seekrit stores for the org").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-o, --out <file>", "write the archive here (default: ./seekrit-<org>-<date>.json)").option("--no-versions", "omit each secret's ciphertext history").option("--no-audit", "omit the audit trail").option("--audit-limit <n>", "keep at most this many of the newest audit rows", Number).option("--json", "print the archive to stdout instead of writing a file").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const input = {
@@ -8596,7 +8762,7 @@ function registerArchiveCommands(program) {
 		} catch {}
 		fail("none of the recovery shares in this archive unwrap with that key");
 	});
-	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("--yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
 		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
 		if (![
 			"dotenv",
@@ -8654,7 +8820,7 @@ function parseLimit(raw) {
 */
 function registerAuditCommands(program) {
 	const audit = program.command("audit").description("read the org audit trail");
-	audit.command("list", { isDefault: true }).alias("ls").description("show the org audit trail").option("--org <slug>").option("--limit <n>", `entries per page (max ${MAX_PAGE})`, "50").option("--action <action>", "only this action, e.g. env.key_granted").option("--resource-type <type>", "only this resource type, e.g. environment").option("--cursor <cursor>", "continue from a previous page's cursor").option("--all", "page through the whole trail, not just the first page").option("--metadata", "include each entry's metadata as JSON").option("--json", "print the raw API response").action(async (options) => {
+	audit.command("list", { isDefault: true }).alias("ls").description("show the org audit trail").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--limit <n>", `entries per page (max ${MAX_PAGE})`, "50").option("--action <action>", "only this action, e.g. env.key_granted").option("--resource-type <type>", "only this resource type, e.g. environment").option("--cursor <cursor>", "continue from a previous page's cursor").option("--all", "page through the whole trail, not just the first page").option("--metadata", "include each entry's metadata as JSON").option("--json", "print the raw API response").action(async (options) => {
 		if (options.action && !AUDIT_ACTIONS.includes(options.action)) fail(`unknown action "${options.action}" — see \`seekrit audit actions\``);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -8737,7 +8903,7 @@ function resolveBaseCredential(opts) {
 function registerAwsCommands(program) {
 	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
 	const target = aws.command("target").description("manage AWS role targets");
-	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
+	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
@@ -8762,7 +8928,7 @@ function registerAwsCommands(program) {
 		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
 		console.log(awsTrustPolicyInstructions(config));
 	});
-	target.command("list").description("list AWS role targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list AWS role targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -8772,7 +8938,7 @@ function registerAwsCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
 		}
 	});
-	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -8782,13 +8948,14 @@ function registerAwsCommands(program) {
 		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
 		console.log(awsTrustPolicyInstructions(cfg));
 	});
-	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -8818,7 +8985,7 @@ function registerAwsCommands(program) {
 			console.log(`export AWS_REGION=${cred.region}`);
 		}
 	});
-	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -8827,9 +8994,10 @@ function registerAwsCommands(program) {
 			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
 		}
 	});
-	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId}? Credentials already issued stay valid until they expire.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
 	});
@@ -8850,7 +9018,7 @@ function usageLine(usage) {
 */
 function registerBillingCommands(program) {
 	const billing = program.command("billing").description("plan, usage, and subscription");
-	billing.command("show", { isDefault: true }).description("show the org's plan, what it includes, and current usage").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	billing.command("show", { isDefault: true }).description("show the org's plan, what it includes, and current usage").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const info = await ctx.client.getBilling(ref.id);
@@ -8877,7 +9045,7 @@ function registerBillingCommands(program) {
 			}
 		});
 	});
-	billing.command("entitlements").description("list every entitlement this org resolves to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	billing.command("entitlements").description("list every entitlement this org resolves to").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const info = await ctx.client.getBilling(ref.id);
@@ -8887,7 +9055,7 @@ function registerBillingCommands(program) {
 			col("source", (e) => e.source)
 		]));
 	});
-	billing.command("checkout <family>").description(`start a self-serve upgrade (${VISIBLE_PLAN_FAMILY_IDS.join(" | ")}) — prints a URL`).option("--org <slug>").action(async (family, options) => {
+	billing.command("checkout <family>").description(`start a self-serve upgrade (${VISIBLE_PLAN_FAMILY_IDS.join(" | ")}) — prints a URL`).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (family, options) => {
 		if (!PLAN_FAMILY_IDS.includes(family)) fail(`unknown plan "${family}" — one of: ${PLAN_FAMILY_IDS.join(", ")}`);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -8895,14 +9063,14 @@ function registerBillingCommands(program) {
 		console.error("open this to complete checkout:");
 		console.log(url);
 	});
-	billing.command("portal").description("open the billing portal (prints a URL) to manage payment and invoices").option("--org <slug>").action(async (options) => {
+	billing.command("portal").description("open the billing portal (prints a URL) to manage payment and invoices").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { url } = await ctx.client.openBillingPortal(ref.id);
 		console.error("open this to manage billing:");
 		console.log(url);
 	});
-	billing.command("cancel").description("cancel the subscription and drop back to the Free plan").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+	billing.command("cancel").description("cancel the subscription and drop back to the Free plan").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await confirmDestructive(options.yes, `Cancel ${ref.slug}'s subscription and move it to the Free plan?`);
@@ -8945,7 +9113,7 @@ async function resolveBranchParent(ctx, opts) {
 */
 function registerBranchCommands(program) {
 	const branch = program.command("branch").description("ephemeral per-PR / preview configs layered on an environment");
-	branch.command("create <slug>").description("fork an environment into an ephemeral branch (inherits its secrets)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <env>", "the environment to branch").option("--name <name>", "display name (defaults to the slug)").option("--ttl <duration>", "lifetime: 12h, 7d, 2w, … or `never`", "7d").option("--no-share", "don't give the parent's other readers access to this branch").action(async (slug, options) => {
+	branch.command("create <slug>").description("fork an environment into an ephemeral branch (inherits its secrets)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <env>", "the environment to branch").option("--name <name>", "display name (defaults to the slug)").option("--ttl <duration>", "lifetime: 12h, 7d, 2w, … or `never`", "7d").option("--no-share", "don't give the parent's other readers access to this branch").action(async (slug, options) => {
 		const ctx = buildContext();
 		const parent = await resolveBranchParent(ctx, {
 			org: options.org,
@@ -8983,7 +9151,7 @@ function registerBranchCommands(program) {
 		console.error(created.branch.expiresAt ? `expires ${created.branch.expiresAt}` : "no expiry — delete it explicitly when the PR closes");
 		if (grants.length > 0) console.error(`shared with ${grants.length} other reader(s)`);
 	});
-	branch.command("list").alias("ls").description("list branches in an application (or of one environment)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").option("--json", "print the raw API response").action(async (options) => {
+	branch.command("list").alias("ls").description("list branches in an application (or of one environment)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const branches = options.env ? await (async () => {
 			const parent = await resolveAppEnv(ctx, options);
@@ -8999,10 +9167,11 @@ function registerBranchCommands(program) {
 			col("id", (b) => b.id)
 		], "no branches — create one with `seekrit branch create`"));
 	});
-	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").action(async (slug, options) => {
+	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("-y, --yes", "skip the confirmation").action(async (slug, options) => {
 		const ctx = buildContext();
 		const app = await resolveApp(ctx, options);
 		const target = await resolveBranch(ctx, app, slug);
+		await confirmDestructive(options.yes, `Tear down branch ${app.slug}#${target.slug} and every override in it?`);
 		await ctx.client.deleteBranch(app.orgId, target.id);
 		console.error(`deleted branch ${app.slug}#${target.slug}`);
 	});
@@ -9215,7 +9384,7 @@ function resolveServiceAccountKey(opts) {
 function registerGcpCommands(program) {
 	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
 	const target = gcp.command("target").description("manage GCP service-account targets");
-	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
+	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = {
@@ -9238,7 +9407,7 @@ function registerGcpCommands(program) {
 		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
 		console.log(gcpSetupInstructions(config));
 	});
-	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list GCP service-account targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9248,7 +9417,7 @@ function registerGcpCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
 		}
 	});
-	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9258,13 +9427,14 @@ function registerGcpCommands(program) {
 		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
 		console.log(gcpSetupInstructions(cfg));
 	});
-	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9289,7 +9459,7 @@ function registerGcpCommands(program) {
 			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
 		}
 	});
-	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -9298,9 +9468,10 @@ function registerGcpCommands(program) {
 			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
 		}
 	});
-	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId}? Tokens already issued stay valid until they expire.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
 	});
@@ -9314,7 +9485,7 @@ function registerGcpCommands(program) {
 */
 function registerGroupCommands(program) {
 	const group = program.command("group").description("manage shared groups (reusable secret bags)");
-	group.command("list").alias("ls").description("list shared groups in an organization").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	group.command("list").alias("ls").description("list shared groups in an organization").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { groups } = await ctx.client.listGroups(ref.id);
@@ -9325,7 +9496,7 @@ function registerGroupCommands(program) {
 			col("id", (g) => g.id)
 		], "no groups — create one with `seekrit group create`"));
 	});
-	group.command("show <slug>").description("show a group and the environments (value sets) it holds").option("--org <slug>").option("--json", "print the raw API response").action(async (slug, options) => {
+	group.command("show <slug>").description("show a group and the environments (value sets) it holds").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveGroup(ctx, {
 			org: options.org,
@@ -9351,7 +9522,7 @@ function registerGroupCommands(program) {
 			], "no environments — create one with `seekrit group env create`");
 		});
 	});
-	group.command("create").description("create a shared group").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	group.command("create").description("create a shared group").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const created = await ctx.client.createGroup(orgRef.id, {
@@ -9360,7 +9531,7 @@ function registerGroupCommands(program) {
 		});
 		console.error(`created group ${created.group.slug} (${created.group.id})`);
 	});
-	group.command("rename <slug>").description("change a group's display name (the slug is permanent)").option("--org <slug>").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
+	group.command("rename <slug>").description("change a group's display name (the slug is permanent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveGroup(ctx, {
 			org: options.org,
@@ -9369,7 +9540,7 @@ function registerGroupCommands(program) {
 		const { group: row } = await ctx.client.updateGroup(ref.orgId, ref.id, { name: options.name });
 		console.error(`renamed ${row.slug} to "${row.name}"`);
 	});
-	group.command("rm <slug>").alias("delete").description("delete a group, its environments, and their secrets").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (slug, options) => {
+	group.command("rm <slug>").alias("delete").description("delete a group, its environments, and their secrets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveGroup(ctx, {
 			org: options.org,
@@ -9381,7 +9552,7 @@ function registerGroupCommands(program) {
 		console.error(`deleted group ${ref.slug}`);
 	});
 	const groupEnv = group.command("env").description("manage a group’s environments (per-slug value sets / variants)");
-	groupEnv.command("list").alias("ls").description("list a group's environments").option("--org <slug>").requiredOption("--group <slug>").option("--json", "print the raw API response").action(async (options) => {
+	groupEnv.command("list").alias("ls").description("list a group's environments").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--group <slug>", "group slug").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveGroup(ctx, options);
 		const { environments } = await ctx.client.listGroupEnvs(ref.orgId, ref.id);
@@ -9392,7 +9563,7 @@ function registerGroupCommands(program) {
 			col("id", (e) => e.id)
 		], "no environments — create one with `seekrit group env create`"));
 	});
-	groupEnv.command("create").description("create a group environment (generates its data key locally)").option("--org <slug>").requiredOption("--group <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	groupEnv.command("create").description("create a group environment (generates its data key locally)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--group <slug>", "group slug").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const ctx = buildContext();
 		const groupRef = await resolveGroup(ctx, {
 			org: options.org,
@@ -9424,7 +9595,7 @@ function registerGroupCommands(program) {
 */
 function registerHoneyTokenCommands(program) {
 	const honey = program.command("honey-token").description("plant decoy credentials that alert when anyone tries to use them");
-	honey.command("create").description("mint a decoy credential; prints it once").requiredOption("--name <name>", "display name, e.g. legacy-ci-bait").option("--org <slug>").option("--placement <note>", "where you're planting it (echoed in the alert email)").action(async (options) => {
+	honey.command("create").description("mint a decoy credential; prints it once").requiredOption("--name <name>", "display name, e.g. legacy-ci-bait").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--placement <note>", "where you're planting it (echoed in the alert email)").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const created = await createHoneyToken();
@@ -9437,7 +9608,7 @@ function registerHoneyTokenCommands(program) {
 		console.error("decoy created — save it now, it is not stored. Plant it somewhere a thief would look, NOT anywhere your own tooling reads: a deploy script that tries it by mistake trips the alarm just as loudly. It grants nothing.");
 		console.log(created.token);
 	});
-	honey.command("list").alias("ls").description("list decoy credentials and whether any have been tripped").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	honey.command("list").alias("ls").description("list decoy credentials and whether any have been tripped").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const { honeyTokens } = await ctx.client.listHoneyTokens(orgRef.id);
@@ -9450,7 +9621,7 @@ function registerHoneyTokenCommands(program) {
 			col("id", (t) => t.id)
 		], "no decoys planted — create one with `seekrit honey-token create`"));
 	});
-	honey.command("delete <honeyTokenId>").alias("rm").description("delete a decoy (stops it alerting)").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (honeyTokenId, options) => {
+	honey.command("delete <honeyTokenId>").alias("rm").description("delete a decoy (stops it alerting)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (honeyTokenId, options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		await confirmDestructive(options.yes, `Delete ${honeyTokenId}? Wherever you planted it goes back to being unwatched — pull the bait too.`);
@@ -9474,7 +9645,7 @@ function collectHeader(value, acc = {}) {
 */
 function registerLogSinkCommands(program) {
 	const sink = program.command("log-sink").description("stream the audit trail to your own OTLP collector (SIEM)");
-	sink.command("show", { isDefault: true }).description("show the configured log sink and its delivery health").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	sink.command("show", { isDefault: true }).description("show the configured log sink and its delivery health").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { sink: config } = await ctx.client.getLogSink(ref.id);
@@ -9493,7 +9664,7 @@ function registerLogSinkCommands(program) {
 			]);
 		});
 	});
-	sink.command("set <endpoint>").description("point the audit export at an OTLP/HTTP logs endpoint").option("--org <slug>").option("--header <name: value>", "auth header to send (repeatable; values are write-only)", collectHeader).option("--clear-headers", "send no headers at all (drops the stored ones)").option("--disabled", "save the config but stop shipping").action(async (endpoint, options) => {
+	sink.command("set <endpoint>").description("point the audit export at an OTLP/HTTP logs endpoint").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--header <name: value>", "auth header to send (repeatable; values are write-only)", collectHeader).option("--clear-headers", "send no headers at all (drops the stored ones)").option("--disabled", "save the config but stop shipping").action(async (endpoint, options) => {
 		if (options.header && options.clearHeaders) fail("pass either --header or --clear-headers, not both");
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -9505,7 +9676,7 @@ function registerLogSinkCommands(program) {
 		});
 		console.error(`log sink → ${config.endpoint} (${config.enabled ? "enabled" : "disabled"}) — test it with \`seekrit log-sink test\``);
 	});
-	sink.command("test").description("send a probe to the configured endpoint and report the result").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	sink.command("test").description("send a probe to the configured endpoint and report the result").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const result = await ctx.client.testLogSink(ref.id);
@@ -9518,7 +9689,7 @@ function registerLogSinkCommands(program) {
 		});
 		if (!result.ok) process.exitCode = 1;
 	});
-	sink.command("rm").alias("delete").description("stop exporting the audit trail and forget the endpoint").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+	sink.command("rm").alias("delete").description("stop exporting the audit trail and forget the endpoint").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await confirmDestructive(options.yes, `Remove ${ref.slug}'s audit log export?`);
@@ -9652,7 +9823,7 @@ function resolveAdminUri(uri) {
 function registerMongoCommands(program) {
 	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
 	const target = mongo.command("target").description("manage MongoDB targets");
-	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const adminUri = resolveAdminUri(options.uri);
@@ -9683,7 +9854,7 @@ function registerMongoCommands(program) {
 		console.error("\nEnsure a provisioning user exists, then `seekrit mongodb lease`:\n");
 		console.log(mongoAdminSetupInstructions(config));
 	});
-	target.command("list").description("list MongoDB targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list MongoDB targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9694,13 +9865,14 @@ function registerMongoCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${host}\t${cfg.connection.database}\t${cfg.accessLevel ?? "readonly"}`);
 		}
 	});
-	target.command("rm <targetId>").description("delete a MongoDB target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("delete a MongoDB target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	mongo.command("lease <target>").description("mint short-lived MongoDB credentials; prints a ready-to-use connection URI").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 30m, 1h, 8h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+	mongo.command("lease <target>").description("mint short-lived MongoDB credentials; prints a ready-to-use connection URI").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--ttl <duration>", "credential lifetime, e.g. 30m, 1h, 8h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9719,7 +9891,7 @@ function registerMongoCommands(program) {
 		if (options.json) console.log(JSON.stringify(cred, null, 2));
 		else console.log(`export MONGODB_URI='${cred.uri}'`);
 	});
-	mongo.command("leases").description("list MongoDB leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	mongo.command("leases").description("list MongoDB leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -9728,9 +9900,10 @@ function registerMongoCommands(program) {
 			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
 		}
 	});
-	mongo.command("revoke <leaseId>").description("revoke a lease now (drops the MongoDB user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+	mongo.command("revoke <leaseId>").description("revoke a lease now (drops the MongoDB user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its MongoDB user is dropped immediately.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId} (the MongoDB user has been dropped)`);
 	});
@@ -9812,7 +9985,7 @@ function generateUserName$1(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -9854,7 +10027,7 @@ function registerMysqlCommands(program) {
 		});
 		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
 	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list provisioning targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9864,13 +10037,14 @@ function registerMysqlCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`removed ${targetId}`);
 	});
-	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9896,7 +10070,7 @@ function registerMysqlCommands(program) {
 		}, null, 2));
 		else console.log(url);
 	});
-	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -9905,9 +10079,10 @@ function registerMysqlCommands(program) {
 			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
 		}
 	});
-	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its MySQL user is dropped immediately.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId}`);
 	});
@@ -9979,20 +10154,20 @@ function registerOrgCommands(program) {
 			]);
 		});
 	});
-	org.command("create").description("create an organization (you become its owner)").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	org.command("create").description("create an organization (you become its owner)").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const created = await buildContext().client.createOrg({
 			name: options.name,
 			slug: options.slug
 		});
 		console.error(`created org ${created.org.slug} (${created.org.id})`);
 	});
-	org.command("rename").description("change an organization's display name (the slug is permanent)").option("--org <slug>").requiredOption("--name <name>", "new display name").action(async (options) => {
+	org.command("rename").description("change an organization's display name (the slug is permanent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "new display name").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { org: row } = await ctx.client.updateOrg(ref.id, { name: options.name });
 		console.error(`renamed ${row.slug} to "${row.name}"`);
 	});
-	org.command("member").description("view organization members").command("list").alias("ls").description("list members, and whether each has finished key setup").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	org.command("member").description("view organization members").command("list").alias("ls").description("list members, and whether each has finished key setup").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { members } = await ctx.client.listMembers(ref.id);
@@ -10005,7 +10180,7 @@ function registerOrgCommands(program) {
 		], "no members"));
 	});
 	const invite = org.command("invite").description("manage pending invitations");
-	invite.command("list").alias("ls").description("list outstanding invitations").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	invite.command("list").alias("ls").description("list outstanding invitations").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { invites } = await ctx.client.listInvites(ref.id);
@@ -10016,7 +10191,7 @@ function registerOrgCommands(program) {
 			col("id", (i) => i.id)
 		], "no pending invitations"));
 	});
-	invite.command("add <email>").description("invite someone to the organization").option("--org <slug>").option("--role <role>", "admin | member", "member").action(async (email, options) => {
+	invite.command("add <email>").description("invite someone to the organization").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--role <role>", "admin | member", "member").action(async (email, options) => {
 		if (options.role !== "admin" && options.role !== "member") fail("--role must be admin or member");
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -10026,13 +10201,13 @@ function registerOrgCommands(program) {
 		});
 		console.error(`invited ${row.email} as ${row.role} (${row.id}) — they join when they first sign in`);
 	});
-	invite.command("rm <inviteId>").description("rescind an invitation").option("--org <slug>").action(async (inviteId, options) => {
+	invite.command("rm <inviteId>").description("rescind an invitation").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (inviteId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await ctx.client.revokeInvite(ref.id, inviteId);
 		console.error(`${inviteId} revoked`);
 	});
-	org.command("mfa").description("show or set the org-wide second-factor requirement").option("--org <slug>").option("--set <policy>", "required | optional").option("--json", "print the raw API response").action(async (options) => {
+	org.command("mfa").description("show or set the org-wide second-factor requirement").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--set <policy>", "required | optional").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		if (options.set !== void 0 && options.set !== "required" && options.set !== "optional") fail("--set must be required or optional");
@@ -10045,7 +10220,7 @@ function registerOrgCommands(program) {
 			console.log(policy.required ? "required for all members" : "optional");
 		});
 	});
-	org.command("tree").description("print the org's applications, environments, and groups as a tree").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	org.command("tree").description("print the org's applications, environments, and groups as a tree").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const [{ apps }, { groups }] = await Promise.all([ctx.client.listApps(ref.id), ctx.client.listGroups(ref.id)]);
@@ -10911,7 +11086,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -10957,7 +11132,7 @@ function registerPgCommands(program) {
 			console.log(bootstrap);
 		}
 	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list provisioning targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -10967,7 +11142,7 @@ function registerPgCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
-	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -10979,13 +11154,14 @@ function registerPgCommands(program) {
 		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
 		console.log(bootstrap);
 	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`removed ${targetId}`);
 	});
-	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -11011,15 +11187,16 @@ function registerPgCommands(program) {
 		}, null, 2));
 		else console.log(url);
 	});
-	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
 		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
 	});
-	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
+	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its Postgres role is dropped immediately.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId}`);
 	});
@@ -11516,7 +11693,7 @@ function generateUserName(prefix = "tmp") {
 function registerRedisCommands(program) {
 	const redis = program.command("redis").description("temporary Redis credentials (short-lived, zero-knowledge)");
 	const target = redis.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Redis server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-cache").option("--org <slug>").requiredOption("--host <host>", "redis host").option("--port <port>", "redis port", "6379").option("--db <index>", "logical database index (the /<n> in the URL)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin redis:// (or rediss://) connection string (or set SEEKRIT_REDIS_ADMIN_URL); wrapped locally").option("--create-statement <cmd>", "custom SETUSER template (repeatable)", collect$1, []).option("--revoke-statement <cmd>", "custom DELUSER template (repeatable)", collect$1, []).action(async (options) => {
+	target.command("add").description("register a Redis server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-cache").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "redis host").option("--port <port>", "redis port", "6379").option("--db <index>", "logical database index (the /<n> in the URL)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin redis:// (or rediss://) connection string (or set SEEKRIT_REDIS_ADMIN_URL); wrapped locally").option("--create-statement <cmd>", "custom SETUSER template (repeatable)", collect$1, []).option("--revoke-statement <cmd>", "custom DELUSER template (repeatable)", collect$1, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -11557,7 +11734,7 @@ function registerRedisCommands(program) {
 		});
 		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
 	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list provisioning targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -11568,13 +11745,14 @@ function registerRedisCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${db}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`removed ${targetId}`);
 	});
-	redis.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "ACL user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+	redis.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <name>", "ACL user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -11600,7 +11778,7 @@ function registerRedisCommands(program) {
 		}, null, 2));
 		else console.log(url);
 	});
-	redis.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	redis.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -11609,9 +11787,10 @@ function registerRedisCommands(program) {
 			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
 		}
 	});
-	redis.command("revoke <leaseId>").description("revoke a lease now (deletes the ACL user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+	redis.command("revoke <leaseId>").description("revoke a lease now (deletes the ACL user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its Redis ACL user is deleted immediately.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId}`);
 	});
@@ -11703,7 +11882,7 @@ function buildConfig$1(kind, options) {
 }
 function registerRotationCommands(program) {
 	const rotation = program.command("rotation").description("managed rotation of stored secret values (scheduled, zero-knowledge)");
-	rotation.command("enable <secretName>").description("configure rotation for an existing secret").option("--org <slug>").option("--app <slug>").option("--group <slug>", "rotate a secret in a group environment").requiredOption("--env <slug>").requiredOption("--kind <kind>", "generated | postgres | mysql | redis").requiredOption("--every <duration>", "rotation cadence, e.g. 24h, 30d").option("--username <name>", "the EXISTING database account to re-key (db kinds)").option("--target <idOrName>", "registered lease target to rotate against (db kinds)").option("--user-host <host>", "MySQL account host part (default %)").option("--length <n>", "generated value length", "32").option("--alphabet <set>", "generated kind only: alphanumeric | hex | base64url | printable", "alphanumeric").option("--now", "rotate immediately as well as on the schedule").action(async (secretName, options) => {
+	rotation.command("enable <secretName>").description("configure rotation for an existing secret").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "rotate a secret in a group environment").requiredOption("--env <slug>", "environment slug").requiredOption("--kind <kind>", "generated | postgres | mysql | redis").requiredOption("--every <duration>", "rotation cadence, e.g. 24h, 30d").option("--username <name>", "the EXISTING database account to re-key (db kinds)").option("--target <idOrName>", "registered lease target to rotate against (db kinds)").option("--user-host <host>", "MySQL account host part (default %)").option("--length <n>", "generated value length", "32").option("--alphabet <set>", "generated kind only: alphanumeric | hex | base64url | printable", "alphanumeric").option("--now", "rotate immediately as well as on the schedule").action(async (secretName, options) => {
 		const ctx = buildContext();
 		const target = await resolveEnvTarget(ctx, options);
 		const config = buildConfig$1(options.kind, options);
@@ -11733,7 +11912,7 @@ function registerRotationCommands(program) {
 		else console.error(`first rotation: ${created.nextRotateAt}`);
 		console.log(created.id);
 	});
-	rotation.command("list").description("list rotation policies (schedules only — never values)").option("--org <slug>").option("--json", "print the full policies as JSON").action(async (options) => {
+	rotation.command("list").description("list rotation policies (schedules only — never values)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the full policies as JSON").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { rotations } = await ctx.client.listRotations(org.id);
@@ -11747,43 +11926,44 @@ function registerRotationCommands(program) {
 		}
 		for (const r of rotations) console.log(rotationLine(r));
 	});
-	rotation.command("show <rotationOrSecret>").description("show one policy, including the last failure if any").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("show <rotationOrSecret>").description("show one policy, including the last failure if any").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const r = await resolveRotation(ctx, (await resolveOrg(ctx, options.org)).id, ref);
 		console.log(JSON.stringify(r, null, 2));
 	});
-	rotation.command("rotate <rotationOrSecret>").description("rotate now (the same path the scheduler uses)").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("rotate <rotationOrSecret>").description("rotate now (the same path the scheduler uses)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
 		const { version, rotatedAt } = await ctx.client.rotateSecretNow(org.id, r.id);
 		console.error(`rotated ${r.secretName} at ${rotatedAt} — now at version ${version}. Read it with \`seekrit secrets get ${r.secretName}\`.`);
 	});
-	rotation.command("pause <rotationOrSecret>").description("stop rotating, keeping the policy").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("pause <rotationOrSecret>").description("stop rotating, keeping the policy").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
 		await ctx.client.updateRotation(org.id, r.id, { status: "paused" });
 		console.error(`paused rotation of ${r.secretName}`);
 	});
-	rotation.command("resume <rotationOrSecret>").description("resume rotating (also clears a failed streak)").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("resume <rotationOrSecret>").description("resume rotating (also clears a failed streak)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
 		const { rotation: updated } = await ctx.client.updateRotation(org.id, r.id, { status: "active" });
 		console.error(`resumed rotation of ${r.secretName} — next ${updated.nextRotateAt}`);
 	});
-	rotation.command("set-interval <rotationOrSecret>").description("change the cadence").requiredOption("--every <duration>", "new cadence, e.g. 24h, 30d").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("set-interval <rotationOrSecret>").description("change the cadence").requiredOption("--every <duration>", "new cadence, e.g. 24h, 30d").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
 		const { rotation: updated } = await ctx.client.updateRotation(org.id, r.id, { intervalSeconds: parseDurationSeconds(options.every, "--every") });
 		console.error(`${updated.secretName} now rotates every ${formatInterval(updated.intervalSeconds)} — next ${updated.nextRotateAt}`);
 	});
-	rotation.command("disable <rotationOrSecret>").description("stop rotating and remove the policy (the secret is untouched)").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("disable <rotationOrSecret>").description("stop rotating and remove the policy (the secret is untouched)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Stop rotating ${r.secretName} and delete its policy? The current value stays as it is.`);
 		const { rotatorRevoked } = await ctx.client.disableRotation(org.id, r.id);
 		console.error(`disabled rotation of ${r.secretName}${rotatorRevoked ? " — rotator key access revoked for this environment" : ""}`);
 	});
@@ -12002,7 +12182,7 @@ function parseTtlSeconds(input) {
 function registerSshCommands(program) {
 	const ssh = program.command("ssh").description("temporary SSH access (short-lived certificates, zero-knowledge)");
 	const target = ssh.command("target").description("manage SSH CA targets");
-	target.command("add").description("create an SSH certificate authority to issue certs from").requiredOption("--name <name>", "display name, e.g. prod-fleet").option("--org <slug>").option("--host <host>", "default host the printed ssh command connects to").option("--user <login>", "default login user (a cert principal)").option("--principal <name>", "allow-list a principal certs may request (repeatable)", collect, []).option("--extension <name>", "cert extension to grant, e.g. permit-pty (repeatable)", collect, []).option("--max-ttl <duration>", "clamp requested cert lifetime, e.g. 8h").action(async (options) => {
+	target.command("add").description("create an SSH certificate authority to issue certs from").requiredOption("--name <name>", "display name, e.g. prod-fleet").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--host <host>", "default host the printed ssh command connects to").option("--user <login>", "default login user (a cert principal)").option("--principal <name>", "allow-list a principal certs may request (repeatable)", collect, []).option("--extension <name>", "cert extension to grant, e.g. permit-pty (repeatable)", collect, []).option("--max-ttl <duration>", "clamp requested cert lifetime, e.g. 8h").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const ca = await generateSshCaKeyPair(`seekrit-ca:${options.name}`);
@@ -12029,7 +12209,7 @@ function registerSshCommands(program) {
 		console.error("\nInstall the CA on your hosts, then issue certs with `seekrit ssh lease`:\n");
 		console.log(sshHostSetupInstructions(config));
 	});
-	target.command("list").description("list SSH CA targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list SSH CA targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -12041,7 +12221,7 @@ function registerSshCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${where}\tprincipals=${principals}`);
 		}
 	});
-	target.command("setup <targetId>").description("reprint the one-time host setup for an SSH target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("setup <targetId>").description("reprint the one-time host setup for an SSH target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -12051,13 +12231,14 @@ function registerSshCommands(program) {
 		if (cfg.provider !== "ssh") fail("not an ssh target (see `seekrit pg`)");
 		console.log(sshHostSetupInstructions(cfg));
 	});
-	target.command("rm <targetId>").description("delete an SSH CA target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("delete an SSH CA target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	ssh.command("lease <target>").description("mint a short-lived SSH certificate; prints a ready-to-run ssh command").option("--org <slug>").option("--principal <name>", "login user to request (repeatable; default from target)", collect, []).option("--ttl <duration>", "certificate lifetime, e.g. 30m, 1h, 8h", "1h").option("--out <dir>", "directory to write the key + cert (default: a temp dir)").option("--json", "print key/cert paths and the certificate as JSON").action(async (targetRef, options) => {
+	ssh.command("lease <target>").description("mint a short-lived SSH certificate; prints a ready-to-run ssh command").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--principal <name>", "login user to request (repeatable; default from target)", collect, []).option("--ttl <duration>", "certificate lifetime, e.g. 30m, 1h, 8h", "1h").option("--out <dir>", "directory to write the key + cert (default: a temp dir)").option("--json", "print key/cert paths and the certificate as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -12095,7 +12276,7 @@ function registerSshCommands(program) {
 		}, null, 2));
 		else console.log(command);
 	});
-	ssh.command("leases").description("list SSH leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	ssh.command("leases").description("list SSH leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -12104,9 +12285,10 @@ function registerSshCommands(program) {
 			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
 		}
 	});
-	ssh.command("revoke <leaseId>").description("mark a lease revoked in the ledger (the cert stays valid until it expires)").option("--org <slug>").action(async (leaseId, options) => {
+	ssh.command("revoke <leaseId>").description("mark a lease revoked in the ledger (the cert stays valid until it expires)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId}? Certificates already issued stay valid until they expire.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId} (issued certs remain valid until they expire)`);
 	});
@@ -12271,8 +12453,21 @@ function credentialNoun(provider) {
 	if (provider.startsWith("aws-")) return "secret access key";
 	if (provider === "gcp-secret-manager") return "service-account key JSON";
 	if (provider === "langgraph-platform") return "LangSmith API key";
+	if (provider === "azure-key-vault") return "client secret";
 	return "API token";
 }
+/**
+* Entra takes a verified domain name in place of a tenant id, but never in
+* place of a client id — so both are held to the GUID, which keeps one rule
+* and costs nothing: the admin center shows a tenant's GUID on the same page
+* as the application id it pairs with.
+*/
+function assertAzureGuid(value, flag, what) {
+	if (!value) fail(`${flag} is required for azure-key-vault (${what})`);
+	const id = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} "${id}" is not a GUID — the Entra admin center shows it under ${what}`);
+	return id;
+}
 /** Account-scope config for a connection (never the credential itself). */
 function buildConfig(provider, options) {
 	switch (provider) {
@@ -12338,6 +12533,15 @@ function buildConfig(provider, options) {
 				...options.langgraphTenant ? { tenantId: options.langgraphTenant.trim() } : {}
 			};
 		}
+		case "azure-key-vault": {
+			const cloud = assertMembers(list(options.azureCloud, "public"), AZURE_CLOUDS, "--azure-cloud")[0];
+			return {
+				provider: "azure-key-vault",
+				tenantId: assertAzureGuid(options.azureTenantId, "--azure-tenant-id", "Directory (tenant) ID"),
+				clientId: assertAzureGuid(options.azureClientId, "--azure-client-id", "Application (client) ID"),
+				cloud: cloud ?? "public"
+			};
+		}
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -12540,6 +12744,17 @@ function buildDestination(provider, options) {
 			provider: "langgraph-platform",
 			deploymentId: assertLanggraphDeploymentId(options.langgraphDeployment)
 		};
+		case "azure-key-vault": {
+			if (!options.vault) fail("--vault is required for azure-key-vault — the vault name, e.g. acme-prod");
+			const prefix = options.path?.trim();
+			const nameMode = assertMembers(list(options.nameMode, "dash"), AZURE_KEY_VAULT_NAME_MODES, "--name-mode")[0];
+			return {
+				provider: "azure-key-vault",
+				vault: options.vault.trim(),
+				...prefix ? { prefix } : {},
+				nameMode: nameMode ?? "dash"
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -12561,6 +12776,7 @@ function describeDestination(destination) {
 		case "bunnyshell": return destination.kind === "environment" ? `environment ${destination.environmentId}` : `project ${destination.projectId} (inherited by new environments)`;
 		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
 		case "langgraph-platform": return `deployment ${destination.deploymentId}`;
+		case "azure-key-vault": return `${destination.vault}${destination.prefix ? ` (${destination.prefix}*)` : ""}`;
 		case "github-actions": switch (destination.kind) {
 			case "repo": return `${destination.owner}/${destination.repo}`;
 			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
@@ -12576,7 +12792,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager, azure-key-vault: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version").option("--vault <name>", "azure-key-vault: vault name, e.g. acme-prod").option("--name-mode <mode>", `azure-key-vault: ${AZURE_KEY_VAULT_NAME_MODES.join(" | ")} — Key Vault stores no underscores, so DATABASE_URL becomes DATABASE-URL unless you reject instead`);
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -12588,7 +12804,7 @@ async function resolveConnection(ctx, orgId, ref) {
 }
 function registerSyncCommands(program) {
 	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, Cloudflare, …)");
-	sync.command("connections").alias("conns").description("list destination accounts seekrit can push to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	sync.command("connections").alias("conns").description("list destination accounts seekrit can push to").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { connections } = await ctx.client.listSyncConnections(ref.id);
@@ -12600,7 +12816,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--azure-tenant-id <id>", "azure-key-vault: Entra Directory (tenant) ID, a GUID").option("--azure-client-id <id>", "azure-key-vault: Application (client) ID of the service principal, a GUID (its client secret is read from stdin)").option("--azure-cloud <cloud>", `azure-key-vault: ${AZURE_CLOUDS.join(" | ")}`, "public").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -12617,7 +12833,7 @@ function registerSyncCommands(program) {
 		});
 		console.error(`connected ${created.connection.name} (${created.connection.id})`);
 	});
-	destinationOptions(sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--json", "print the raw API response").action(async (connection, options) => {
+	destinationOptions(sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--json", "print the raw API response").action(async (connection, options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -12626,7 +12842,7 @@ function registerSyncCommands(program) {
 		emit(options, result, () => printFields([["result", result.ok ? "ok" : "failed"], ["error", result.error ?? null]]));
 		if (!result.ok) process.exitCode = 1;
 	});
-	sync.command("disconnect <connection>").description("delete a destination account, its bindings, and its keypair").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (connection, options) => {
+	sync.command("disconnect <connection>").description("delete a destination account, its bindings, and its keypair").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (connection, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const conn = await resolveConnection(ctx, ref.id, connection);
@@ -12636,7 +12852,7 @@ function registerSyncCommands(program) {
 		await ctx.client.deleteSyncConnection(ref.id, conn.id);
 		console.error(`disconnected ${conn.name}`);
 	});
-	sync.command("bindings").description("list which environments are syncing where").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	sync.command("bindings").description("list which environments are syncing where").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const [{ bindings }, { connections }] = await Promise.all([ctx.client.listSyncBindings(ref.id), ctx.client.listSyncConnections(ref.id)]);
@@ -12651,7 +12867,7 @@ function registerSyncCommands(program) {
 			col("id", (b) => b.id)
 		], "nothing is syncing — enable it with `seekrit sync enable`"));
 	});
-	destinationOptions(sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
+	destinationOptions(sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		if (options.onDelete !== "delete" && options.onDelete !== "retain") fail("--on-delete must be delete or retain");
 		if (options.mode !== "auto" && options.mode !== "manual") fail("--mode must be auto or manual");
@@ -12690,26 +12906,26 @@ function registerSyncCommands(program) {
 		console.error(`syncing ${target.appSlug}/${target.envSlug} → ${conn.name} ${describeDestination(destination)} (${binding.id})`);
 		if (binding.mode === "manual") console.error("mode is manual — push with `seekrit sync run`");
 	});
-	sync.command("pause <bindingId>").description("stop pushing on this binding without deleting it").option("--org <slug>").action(async (bindingId, options) => {
+	sync.command("pause <bindingId>").description("stop pushing on this binding without deleting it").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (bindingId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await ctx.client.updateSyncBinding(ref.id, bindingId, { enabled: false });
 		console.error(`${bindingId} paused`);
 	});
-	sync.command("resume <bindingId>").description("start pushing on a paused binding again").option("--org <slug>").action(async (bindingId, options) => {
+	sync.command("resume <bindingId>").description("start pushing on a paused binding again").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (bindingId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await ctx.client.updateSyncBinding(ref.id, bindingId, { enabled: true });
 		console.error(`${bindingId} resumed`);
 	});
-	sync.command("disable <bindingId>").alias("rm").description("stop syncing an environment and revoke seekrit's key for it").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (bindingId, options) => {
+	sync.command("disable <bindingId>").alias("rm").description("stop syncing an environment and revoke seekrit's key for it").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (bindingId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await confirmDestructive(options.yes, `Delete binding ${bindingId}? Values already pushed stay on the destination.`);
 		await ctx.client.deleteSyncBinding(ref.id, bindingId);
 		console.error(`${bindingId} deleted`);
 	});
-	sync.command("run <bindingId>").description("push now, synchronously, and report what landed").option("--org <slug>").option("--json", "print the raw API response").action(async (bindingId, options) => {
+	sync.command("run <bindingId>").description("push now, synchronously, and report what landed").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (bindingId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { run } = await ctx.client.runSyncBinding(ref.id, bindingId);
@@ -12728,7 +12944,7 @@ function registerSyncCommands(program) {
 		});
 		if (run.status !== "succeeded") process.exitCode = 1;
 	});
-	sync.command("runs").description("show the sync run history").option("--org <slug>").option("--binding <id>", "only runs of this binding").option("--json", "print the raw API response").action(async (options) => {
+	sync.command("runs").description("show the sync run history").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--binding <id>", "only runs of this binding").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { runs } = await ctx.client.listSyncRuns(ref.id, options.binding);
@@ -12894,6 +13110,7 @@ async function runLogout() {
 		console.error("not signed in");
 		return;
 	}
+	if (!sessionToken) console.error(config.token ? "signed out — the stored service token was removed from this machine" : "signed out");
 	if (sessionToken) {
 		const api = new SeekritClient({
 			baseUrl: process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "https://api.seekrit.dev",
@@ -13111,9 +13328,10 @@ withTarget(secrets.command("restore <name> <version>").description("roll a secre
 	const { secret, restoredFrom } = await ctx.client.restoreSecret(orgId, envId, name, parseVersion(version));
 	console.error(`${name} restored from v${restoredFrom} — now v${secret.version}`);
 });
-withTarget(secrets.command("rm <name>").description("delete a secret")).action(async (name, options) => {
+withTarget(secrets.command("rm <name>").description("delete a secret and its whole version history").option("-y, --yes", "skip the confirmation")).action(async (name, options) => {
 	const ctx = buildContext();
-	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+	await confirmDestructive(options.yes, `Delete ${name} from ${label}, including every earlier version? This cannot be undone.`);
 	await ctx.client.deleteSecret(orgId, envId, name);
 	console.error(`${name} deleted`);
 });
@@ -13198,8 +13416,7 @@ async function materializeForRun(options) {
 			branch
 		}, dotenvVars);
 	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		console.error(`seekrit: continuing without seekrit-managed secrets: ${message}`);
+		console.error(`seekrit: continuing without seekrit-managed secrets: ${describeError(err)}`);
 		const values = {};
 		const provenance = {};
 		overlayEnvFiles(values, provenance, envFiles);
@@ -13319,7 +13536,7 @@ async function reapStragglers(pids, signal) {
 		process.kill(pid, "SIGKILL");
 	} catch {}
 }
-program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
 	const { values, provenance, interpolated, unresolvedRefs } = await materializeForRun(options);
@@ -13371,7 +13588,7 @@ program.command("run").description("run a command with decrypted secrets injecte
 	});
 	child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
 });
-program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
+program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
 	if (![
 		"dotenv",
 		"json",
@@ -13387,7 +13604,7 @@ program.command("export").description("print decrypted secrets (dotenv, json, or
 registerAccessCommands(program);
 registerHoneyTokenCommands(program);
 const token = program.command("token").description("manage service tokens (CI, docker, agents)");
-token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
+token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
 	const ctx = buildContext();
 	const role = options.admin ? "admin" : "member";
 	const boundToEnv = Boolean(options.app || options.env);
@@ -13436,7 +13653,7 @@ token.command("create").description("create a service token (runtime, or --admin
 	console.error(`${role} token created${granted ? " and granted" : ""} for ${scope} — save it now, it is not stored:`);
 	console.log(created.token);
 });
-token.command("list").alias("ls").description("list service tokens").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+token.command("list").alias("ls").description("list service tokens").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 	const ctx = buildContext();
 	const orgRef = await resolveOrg(ctx, options.org);
 	const { tokens } = await ctx.client.listTokens(orgRef.id);
@@ -13450,15 +13667,17 @@ token.command("list").alias("ls").description("list service tokens").option("--o
 		col("id", (t) => t.id)
 	], "no service tokens — create one with `seekrit token create`"));
 });
-token.command("revoke <tokenId>").description("revoke a service token").option("--org <slug>").action(async (tokenId, options) => {
+token.command("revoke <tokenId>").description("revoke a service token").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (tokenId, options) => {
 	const ctx = buildContext();
 	const orgRef = await resolveOrg(ctx, options.org);
+	await confirmDestructive(options.yes, `Revoke ${tokenId}? Anything still presenting it stops resolving immediately.`);
 	await ctx.client.revokeToken(orgRef.id, tokenId);
 	console.error(`${tokenId} revoked`);
 });
-token.command("delete <tokenId>").description("permanently delete a revoked service token (revoke it first)").option("--org <slug>").action(async (tokenId, options) => {
+token.command("delete <tokenId>").description("permanently delete a revoked service token (revoke it first)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (tokenId, options) => {
 	const ctx = buildContext();
 	const orgRef = await resolveOrg(ctx, options.org);
+	await confirmDestructive(options.yes, `Permanently delete ${tokenId}? Its audit history keeps the id, but the token row is gone.`);
 	await ctx.client.deleteToken(orgRef.id, tokenId);
 	console.error(`${tokenId} deleted`);
 });
@@ -13489,7 +13708,7 @@ registerSyncCommands(program);
 registerBillingCommands(program);
 const argv = process.argv.map((arg) => arg === "-v" ? "--version" : arg);
 program.parseAsync(argv).catch((err) => {
-	fail(err instanceof Error ? err.message : String(err));
+	fail(describeError(err));
 });
 //#endregion
 export { verifyMessage as A, toBase64 as B, isServiceToken as C, importVerifyingKey as D, importSigningKey as E, kmsBlobKeyRef as F, kmsDecrypt as I, kmsEncrypt as L, generateMysqlCredential as M, generateDataKey as N, signMessage as O, generateEncryptKeyMaterial as P, wrapDek as R, createServiceToken as S, generateSigningKeyMaterial as T, parseBranchTtl as V, isTokenAuth as _, ensureM2mAdminToken as a, writeProjectConfig as b, kmsResolveKey as c, resolveAppEnv as d, resolveBranch as f, getDek as g, resolveOrg as h, materializeEnv as i, generatePostgresCredential as j, signatureKeyRef as k, kmsResolveRecipient as l, resolveGroup as m, fetchDecryptedSecrets as n, kmsCallerIdentity as o, resolveEnvTarget as p, fetchDecryptedVersion as r, kmsRecoverMaterial as s, encryptAndSetSecret as t, resolveApp as u, tryBuildContext as v, parseServiceToken as w, version as x, setFailThrows as y, generateDek as z };