@seekrit/cli 0.47.0 → 1.1.0

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
 import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
@@ -8,6 +8,7 @@ import { dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
 /** Default lifetime of a published bundle (7 days), in seconds. */
 const POLICY_DEFAULT_TTL_SECONDS = 10080 * 60;
 /** Bounds on a bundle's lifetime: an hour at the short end, 90 days at the long. */
@@ -4986,7 +4987,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "0.47.0";
+var version = "1.1.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -5765,7 +5766,18 @@ function parseDurationSeconds(input, flag) {
 		d: 86400
 	}[m[2] || "s"] ?? 1);
 }
-/** Prompt without echoing input (for passphrases). */
+/**
+* Prompt without echoing input (for passphrases).
+*
+* Piping the answer in (`echo … | seekrit secrets get …`) is supported and
+* common in CI, so this reads stdin rather than insisting on a TTY. But stdin
+* can also close with nothing on it — `< /dev/null`, a closed pipe, an agent
+* spawning us with no stdin — and readline signals that by emitting `close`
+* without ever calling the `question` callback. Left unhandled the promise
+* never settles, the event loop drains, and Node exits **0** having printed
+* nothing: `V=$(seekrit secrets get X)` silently yields an empty value and a
+* success status. So treat EOF-without-an-answer as the error it is.
+*/
 function promptHidden(question) {
 	const muted = new Writable({ write(_chunk, _encoding, callback) {
 		callback();
@@ -5776,8 +5788,15 @@ function promptHidden(question) {
 		output: muted,
 		terminal: true
 	});
-	return new Promise((resolve) => {
+	return new Promise((resolve, reject) => {
+		let answered = false;
+		rl.on("close", () => {
+			if (answered) return;
+			process.stderr.write("\n");
+			reject(/* @__PURE__ */ new Error("no passphrase on stdin — set SEEKRIT_PASSPHRASE, pipe it in, or run this in a terminal"));
+		});
 		rl.question("", (answer) => {
+			answered = true;
 			rl.close();
 			process.stderr.write("\n");
 			resolve(answer);
@@ -5853,9 +5872,23 @@ const CLI_CLIENT = `cli/${version}`;
 * `flag > env > .env` credential resolution. Empty for every command but
 * `seekrit run`, which loads `.env` before authenticating.
 */
+/**
+* A `SEEKRIT_*` value, or undefined if it is absent *or blank*.
+*
+* Blank has to mean absent. An unset CI secret, a `${VAR}` that expanded to
+* nothing, a bare `export SEEKRIT_TOKEN=` — all arrive as `""`, and `??` only
+* falls back on null/undefined. Left alone, an empty `SEEKRIT_API_URL` makes
+* every request relative and an empty `SEEKRIT_TOKEN` authenticates as a
+* bearer of nothing: a 401 where the honest answer is "you have no
+* credentials", pointing at the API instead of at the missing variable.
+*/
+function present(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
 function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
-	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const fromEnv = (key) => present(process.env[key]) ?? present(dotenvVars[key]);
 	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
 	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token ?? config.sessionToken;
 	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
@@ -5888,6 +5921,24 @@ function isTokenAuth(ctx) {
 	return ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token);
 }
 /**
+* Render an unhandled error for the top-level handler.
+*
+* `fetch` reports every transport failure as the same opaque `TypeError: fetch
+* failed` and hides the reason (ECONNREFUSED, DNS, TLS) in `cause`. That is the
+* single most common thing to go wrong — a stale `SEEKRIT_API_URL`, a dev
+* server that isn't up, a VPN that is down — and "error: fetch failed" names
+* neither the address we tried nor why it failed. So unwrap it and say both.
+*/
+function describeError(err) {
+	if (!(err instanceof Error)) return String(err);
+	if (err.message !== "fetch failed") return err.message;
+	const config = readGlobalConfig();
+	const apiUrl = present(process.env.SEEKRIT_API_URL) ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const cause = err.cause;
+	const reason = cause instanceof Error ? cause.code ?? cause.message : void 0;
+	return `cannot reach the seekrit API at ${apiUrl}${reason ? ` (${reason})` : ""} — check SEEKRIT_API_URL, your network, and that the API is up`;
+}
+/**
 * Recover the calling principal's private key:
 *  - service tokens carry their private key in the token string;
 *  - users fetch their passphrase-encrypted key from the API and unlock it.
@@ -6150,7 +6201,7 @@ async function resolvePrincipal(ctx, orgId, options) {
 }
 /** The `--org/--app/--group/--env` selection every grant command shares. */
 function withEnvTarget(cmd) {
-	return cmd.option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>");
+	return cmd.option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").requiredOption("--env <slug>", "environment slug");
 }
 /**
 * Environment key grants — who can decrypt what.
@@ -6185,7 +6236,7 @@ function registerAccessCommands(program) {
 			col("id", (g) => g.principalId)
 		], "nobody holds a key for this environment"));
 	});
-	withEnvTarget(grant.command("rm").alias("revoke").description("take away a member's or token's access to an environment's key").option("--user <email>", "revoke an org member by email").option("--token <tokenId>", "revoke a service token by id (skt_…)").option("--yes", "skip the confirmation prompt")).action(async (options) => {
+	withEnvTarget(grant.command("rm").alias("revoke").description("take away a member's or token's access to an environment's key").option("--user <email>", "revoke an org member by email").option("--token <tokenId>", "revoke a service token by id (skt_…)").option("-y, --yes", "skip the confirmation prompt")).action(async (options) => {
 		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
 		const ctx = buildContext();
 		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
@@ -6231,7 +6282,7 @@ function registerAccountCommands(program) {
 			col("id", (s) => `${s.id}${s.id === currentSessionId ? " (this one)" : ""}`)
 		], options.all ? "no CLI sessions" : "no active CLI sessions (try --all)"));
 	});
-	session.command("revoke <sessionId>").description("sign a device out — its token stops working immediately").option("--yes", "skip the confirmation prompt").action(async (sessionId, options) => {
+	session.command("revoke <sessionId>").description("sign a device out — its token stops working immediately").option("-y, --yes", "skip the confirmation prompt").action(async (sessionId, options) => {
 		const ctx = buildContext();
 		const self = ctx.auth.type === "bearer" && isCliSessionToken(ctx.auth.token) && parseCliSessionToken(ctx.auth.token).sessionId === sessionId;
 		await confirmDestructive(options.yes, self ? `${sessionId} is the session you are using right now — sign it out?` : `Sign out ${sessionId}?`);
@@ -6962,7 +7013,7 @@ async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
 }
 function registerKmsCommands(program) {
 	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
 		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
 		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
@@ -7015,7 +7066,7 @@ function registerKmsCommands(program) {
 		const { key } = await ctx.client.createKmsKey(org.id, input);
 		console.error(`created ${key.purpose} key ${key.name} (${key.id}), ${grants.length} grant(s)`);
 	});
-	kms.command("ls").description("list keys you can see").option("--org <slug>").action(async (options) => {
+	kms.command("ls").description("list keys you can see").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { keys } = await ctx.client.listKmsKeys(org.id);
@@ -7029,7 +7080,7 @@ function registerKmsCommands(program) {
 			console.log(`${k.name}\t${k.purpose}\tv${k.currentVersion}\t${scope}\t${k.id}${state}`);
 		}
 	});
-	kms.command("grant").description("grant a principal use of a key's current version").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--user <email>", "grant an org member").option("--token <tokenId>", "grant a service token").action(async (options) => {
+	kms.command("grant").description("grant a principal use of a key's current version").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <email>", "grant an org member").option("--token <tokenId>", "grant a service token").action(async (options) => {
 		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
@@ -7043,19 +7094,20 @@ function registerKmsCommands(program) {
 		});
 		console.error(`granted ${key.name} to ${recipient.principalId}`);
 	});
-	kms.command("revoke").description("revoke a principal from a key (all versions)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--user <email>").option("--token <tokenId>").action(async (options) => {
+	kms.command("revoke").description("revoke a principal from a key (all versions)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <email>", "revoke this user's grant").option("--token <tokenId>", "revoke this service token's grant").option("-y, --yes", "skip the confirmation").action(async (options) => {
 		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
 		const recipient = await kmsResolveRecipient(ctx, org.id, options);
+		await confirmDestructive(options.yes, `Revoke ${recipient.principalId} from ${key.name}? Anything already decrypted stays decrypted.`);
 		await ctx.client.revokeKmsKey(org.id, key.id, {
 			principalType: recipient.principalType,
 			principalId: recipient.principalId
 		});
 		console.error(`revoked ${recipient.principalId} from ${key.name}`);
 	});
-	kms.command("rotate").description("add a new key version and re-wrap it for every current grantee").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("rotate").description("add a new key version and re-wrap it for every current grantee").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7089,21 +7141,23 @@ function registerKmsCommands(program) {
 		});
 		console.error(`rotated ${rotated.name} to v${rotated.currentVersion} (${grants.length} grantees)`);
 	});
-	kms.command("disable").description("disable a key (blocks all use: encrypt/decrypt/sign and new grants/rotations)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("disable").description("disable a key (blocks all use: encrypt/decrypt/sign and new grants/rotations)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
+		await confirmDestructive(options.yes, `Disable ${key.name}? Every encrypt, decrypt, and sign against it starts failing.`);
 		await ctx.client.disableKmsKey(org.id, key.id);
 		console.error(`disabled ${key.name}`);
 	});
-	kms.command("delete").description("delete a key (hides it from all listings; the name frees up for reuse)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("delete").description("delete a key (hides it from all listings; the name frees up for reuse)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
+		await confirmDestructive(options.yes, `Delete ${key.name}? Any ciphertext or signature still relying on it becomes unrecoverable.`);
 		await ctx.client.deleteKmsKey(org.id, key.id);
 		console.error(`deleted ${key.name}`);
 	});
-	kms.command("encrypt").description("encrypt stdin under a key (prints a ce1 ciphertext blob)").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "encryption context bound as AAD (required identically to decrypt)").action(async (options) => {
+	kms.command("encrypt").description("encrypt stdin under a key (prints a ce1 ciphertext blob)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--context <ctx>", "encryption context bound as AAD (required identically to decrypt)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7116,7 +7170,7 @@ function registerKmsCommands(program) {
 		}, plaintext, options.context ?? "");
 		console.log(blob);
 	});
-	kms.command("decrypt").description("decrypt a ce1 blob from stdin").requiredOption("--key <name>", "key name or id").option("--org <slug>").option("--context <ctx>", "the same encryption context used to encrypt").action(async (options) => {
+	kms.command("decrypt").description("decrypt a ce1 blob from stdin").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--context <ctx>", "the same encryption context used to encrypt").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7125,7 +7179,7 @@ function registerKmsCommands(program) {
 		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id, ref.version);
 		console.log(await kmsDecrypt(material, blob, options.context ?? ""));
 	});
-	kms.command("generate-data-key").description("generate a data key: prints JSON {plaintextBase64, wrapped}").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("generate-data-key").description("generate a data key: prints JSON {plaintextBase64, wrapped}").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7140,7 +7194,7 @@ function registerKmsCommands(program) {
 			wrapped: dk.wrapped
 		}));
 	});
-	kms.command("open-data-key").description("recover a data key from a dk1 blob on stdin (prints plaintext base64)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("open-data-key").description("recover a data key from a dk1 blob on stdin (prints plaintext base64)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7149,7 +7203,7 @@ function registerKmsCommands(program) {
 		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id, ref.version);
 		console.log(toBase64(await decryptDataKey(material, wrapped)));
 	});
-	kms.command("sign").description("sign stdin with a signing key (prints an sg1 signature)").requiredOption("--key <name>", "key name or id").option("--org <slug>").action(async (options) => {
+	kms.command("sign").description("sign stdin with a signing key (prints an sg1 signature)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7162,7 +7216,7 @@ function registerKmsCommands(program) {
 			version: currentVersion
 		}, message));
 	});
-	kms.command("verify").description("verify an sg1 signature over stdin (exit 0 = valid)").requiredOption("--key <name>", "key name or id").requiredOption("--signature <sg1>", "the signature blob").option("--org <slug>").action(async (options) => {
+	kms.command("verify").description("verify an sg1 signature over stdin (exit 0 = valid)").requiredOption("--key <name>", "key name or id").requiredOption("--signature <sg1>", "the signature blob").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const key = await kmsResolveKey(ctx, org.id, options.key);
@@ -7264,7 +7318,7 @@ async function buildRecoveryConfig(ctx, orgId, thresholdRaw, custodianRefs) {
 }
 function registerRecoveryCommands(program) {
 	const recovery = program.command("recovery").description("customer-controlled M-of-N recovery (zero-knowledge)");
-	recovery.command("status").description("show recovery configuration and environment coverage").option("--org <slug>").action(async (options) => {
+	recovery.command("status").description("show recovery configuration and environment coverage").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { recovery: status } = await ctx.client.getRecovery(org.id);
@@ -7278,7 +7332,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7291,12 +7345,12 @@ function registerRecoveryCommands(program) {
 		console.error(`recovery-protected ${wrapped} environment(s) you can decrypt`);
 		if (skipped > 0) console.error(`${skipped} environment(s) need another admin to run \`seekrit recovery sync\``);
 	});
-	recovery.command("sync").description("recovery-protect environments you can decrypt but that aren't yet covered").option("--org <slug>").action(async (options) => {
+	recovery.command("sync").description("recovery-protect environments you can decrypt but that aren't yet covered").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7309,13 +7363,14 @@ function registerRecoveryCommands(program) {
 		console.error(`re-wrapped ${wrapped} environment(s) you can decrypt to the new recovery key`);
 		if (skipped > 0) console.error(`${skipped} environment(s) still need another admin to run \`seekrit recovery sync\``);
 	});
-	recovery.command("disable").description("disable recovery and remove all recovery grants").option("--org <slug>").action(async (options) => {
+	recovery.command("disable").description("disable recovery and remove all recovery grants").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Disable recovery for ${org.slug}? Every custodian share is dropped, and the org loses its break-glass path.`);
 		await ctx.client.disableRecovery(org.id);
 		console.error("recovery disabled; recovery grants removed");
 	});
-	recovery.command("request").description("start a recovery ceremony (defaults to recovering access for yourself)").option("--target-user <email>", "recover access for another member").option("--target-token <id>", "recover access for a service token").option("--reason <text>", "note recorded in the audit trail").option("--org <slug>").action(async (options) => {
+	recovery.command("request").description("start a recovery ceremony (defaults to recovering access for yourself)").option("--target-user <email>", "recover access for another member").option("--target-token <id>", "recover access for a service token").option("--reason <text>", "note recorded in the audit trail").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const target = options.targetUser || options.targetToken ? await kmsResolveRecipient(ctx, org.id, {
@@ -7332,7 +7387,7 @@ function registerRecoveryCommands(program) {
 		console.error(`  custodians run:  seekrit recovery approve ${request.id}`);
 		console.error(`  then the target: seekrit recovery complete ${request.id}`);
 	});
-	recovery.command("approve").description("as a custodian, contribute your share to a recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+	recovery.command("approve").description("as a custodian, contribute your share to a recovery request").argument("<requestId>").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (requestId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { request } = await ctx.client.getRecoveryRequest(org.id, requestId);
@@ -7345,7 +7400,7 @@ function registerRecoveryCommands(program) {
 		});
 		console.error(`contributed share #${myShare.shareIndex}: ${res.contributed}/${res.threshold} collected${res.quorumReached ? " — quorum reached" : ""}`);
 	});
-	recovery.command("complete").description("as the recovery target, reconstruct the key and restore your access").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+	recovery.command("complete").description("as the recovery target, reconstruct the key and restore your access").argument("<requestId>").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (requestId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { request, contributions, quorumReached } = await ctx.client.getRecoveryRequest(org.id, requestId);
@@ -7369,9 +7424,10 @@ function registerRecoveryCommands(program) {
 		});
 		console.error(`recovery complete: restored access to ${restored.length} environment(s)`);
 	});
-	recovery.command("cancel").description("cancel an open recovery request").argument("<requestId>").option("--org <slug>").action(async (requestId, options) => {
+	recovery.command("cancel").description("cancel an open recovery request").argument("<requestId>").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (requestId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Cancel recovery request ${requestId}? Approvals already collected are discarded.`);
 		await ctx.client.cancelRecoveryRequest(org.id, requestId);
 		console.error(`recovery request ${requestId} canceled`);
 	});
@@ -7385,7 +7441,7 @@ function registerRecoveryCommands(program) {
 */
 function registerAppCommands(program) {
 	const app = program.command("app").description("manage applications");
-	app.command("list").alias("ls").description("list applications in an organization").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	app.command("list").alias("ls").description("list applications in an organization").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { apps } = await ctx.client.listApps(ref.id);
@@ -7396,7 +7452,7 @@ function registerAppCommands(program) {
 			col("id", (a) => a.id)
 		], "no applications — create one with `seekrit app create`"));
 	});
-	app.command("show [slug]").description("show an application, its environments, and your access to each").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (slug, options) => {
+	app.command("show [slug]").description("show an application, its environments, and your access to each").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, {
 			org: options.org,
@@ -7432,7 +7488,7 @@ function registerAppCommands(program) {
 			}
 		});
 	});
-	app.command("create").description("create an application").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	app.command("create").description("create an application").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const created = await ctx.client.createApp(orgRef.id, {
@@ -7441,7 +7497,7 @@ function registerAppCommands(program) {
 		});
 		console.error(`created app ${created.app.slug} (${created.app.id})`);
 	});
-	app.command("rename [slug]").description("change an application's display name (the slug is permanent)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
+	app.command("rename [slug]").description("change an application's display name (the slug is permanent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, {
 			org: options.org,
@@ -7450,7 +7506,7 @@ function registerAppCommands(program) {
 		const { app: row } = await ctx.client.updateApp(ref.orgId, ref.id, { name: options.name });
 		console.error(`renamed ${row.slug} to "${row.name}"`);
 	});
-	app.command("rm <slug>").alias("delete").description("delete an application and every environment and secret in it").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (slug, options) => {
+	app.command("rm <slug>").alias("delete").description("delete an application and every environment and secret in it").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, {
 			org: options.org,
@@ -7462,7 +7518,7 @@ function registerAppCommands(program) {
 		console.error(`deleted app ${ref.slug}`);
 	});
 	const env = program.command("env").description("manage environments");
-	env.command("list").alias("ls").description("list an application's environments").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (options) => {
+	env.command("list").alias("ls").description("list an application's environments").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, options);
 		const { environments } = await ctx.client.getApp(ref.orgId, ref.id);
@@ -7473,7 +7529,7 @@ function registerAppCommands(program) {
 			col("id", (e) => e.id)
 		], "no environments — create one with `seekrit env create`"));
 	});
-	env.command("show").description("show one environment: composed groups, who holds a key, secret count").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>").option("--json", "print the raw API response").action(async (options) => {
+	env.command("show").description("show one environment: composed groups, who holds a key, secret count").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "environment slug").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveAppEnv(ctx, options);
 		const [{ environment }, { groups }, { secrets }, { branches }] = await Promise.all([
@@ -7513,7 +7569,7 @@ function registerAppCommands(program) {
 			}
 		});
 	});
-	env.command("create").description("create an application environment (generates its data key locally)").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	env.command("create").description("create an application environment (generates its data key locally)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--app <slug>", "application slug").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const { apps } = await ctx.client.listApps(orgRef.id);
@@ -7532,7 +7588,7 @@ function registerAppCommands(program) {
 		});
 		console.error(`created environment ${created.environment.slug} (${created.environment.id})`);
 	});
-	env.command("rm").alias("delete").description("delete an environment and every secret in it").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "delete a group environment instead of an app one").requiredOption("--env <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+	env.command("rm").alias("delete").description("delete an environment and every secret in it").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "delete a group environment instead of an app one").requiredOption("--env <slug>", "environment slug").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveEnvTarget(ctx, options);
 		const { secrets } = await ctx.client.listSecrets(target.orgId, target.envId);
@@ -7541,7 +7597,7 @@ function registerAppCommands(program) {
 		console.error(`deleted ${target.label}`);
 	});
 	const envGroups = env.command("groups").description("compose shared groups into an application environment");
-	envGroups.command("add").description("compose a group into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").option("--position <n>", "precedence among groups (higher wins)").action(async (options) => {
+	envGroups.command("add").description("compose a group into an app environment").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--app <slug>", "application slug").requiredOption("--env <slug>", "environment slug").requiredOption("--group <slug>", "group slug").option("--position <n>", "precedence among groups (higher wins)").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveAppEnv(ctx, options);
 		const group = await resolveGroup(ctx, {
@@ -7554,7 +7610,7 @@ function registerAppCommands(program) {
 		});
 		console.error(`composed ${group.slug} into ${target.appSlug}/${target.envSlug}`);
 	});
-	envGroups.command("list").alias("ls").description("list groups composed into an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").option("--json", "print the raw API response").action(async (options) => {
+	envGroups.command("list").alias("ls").description("list groups composed into an app environment").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--app <slug>", "application slug").requiredOption("--env <slug>", "environment slug").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveAppEnv(ctx, options);
 		const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
@@ -7564,13 +7620,14 @@ function registerAppCommands(program) {
 			col("name", (g) => g.name)
 		], "no groups composed into this environment"));
 	});
-	envGroups.command("rm").description("remove a group from an app environment").option("--org <slug>").requiredOption("--app <slug>").requiredOption("--env <slug>").requiredOption("--group <slug>").action(async (options) => {
+	envGroups.command("rm").description("remove a group from an app environment").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--app <slug>", "application slug").requiredOption("--env <slug>", "environment slug").requiredOption("--group <slug>", "group slug").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
 		const ctx = buildContext();
 		const target = await resolveAppEnv(ctx, options);
 		const group = await resolveGroup(ctx, {
 			org: options.org,
 			group: options.group
 		});
+		await confirmDestructive(options.yes, `Remove ${group.slug} from ${target.appSlug}/${target.envSlug}? Everything it contributed disappears from that environment.`);
 		await ctx.client.unlinkEnvGroup(target.orgId, target.envId, group.id);
 		console.error(`removed ${group.slug} from ${target.appSlug}/${target.envSlug}`);
 	});
@@ -8593,7 +8650,7 @@ async function decryptArchive(archive, key, filter) {
 }
 function registerArchiveCommands(program) {
 	const archive = program.command("archive").description("export the whole org as one signed file, and open it offline");
-	archive.command("create").description("download a signed archive of everything seekrit stores for the org").option("--org <slug>").option("-o, --out <file>", "write the archive here (default: ./seekrit-<org>-<date>.json)").option("--no-versions", "omit each secret's ciphertext history").option("--no-audit", "omit the audit trail").option("--audit-limit <n>", "keep at most this many of the newest audit rows", Number).option("--json", "print the archive to stdout instead of writing a file").action(async (options) => {
+	archive.command("create").description("download a signed archive of everything seekrit stores for the org").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-o, --out <file>", "write the archive here (default: ./seekrit-<org>-<date>.json)").option("--no-versions", "omit each secret's ciphertext history").option("--no-audit", "omit the audit trail").option("--audit-limit <n>", "keep at most this many of the newest audit rows", Number).option("--json", "print the archive to stdout instead of writing a file").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const input = {
@@ -8706,7 +8763,7 @@ function registerArchiveCommands(program) {
 		} catch {}
 		fail("none of the recovery shares in this archive unwrap with that key");
 	});
-	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("--yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
 		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
 		if (![
 			"dotenv",
@@ -8764,7 +8821,7 @@ function parseLimit(raw) {
 */
 function registerAuditCommands(program) {
 	const audit = program.command("audit").description("read the org audit trail");
-	audit.command("list", { isDefault: true }).alias("ls").description("show the org audit trail").option("--org <slug>").option("--limit <n>", `entries per page (max ${MAX_PAGE})`, "50").option("--action <action>", "only this action, e.g. env.key_granted").option("--resource-type <type>", "only this resource type, e.g. environment").option("--cursor <cursor>", "continue from a previous page's cursor").option("--all", "page through the whole trail, not just the first page").option("--metadata", "include each entry's metadata as JSON").option("--json", "print the raw API response").action(async (options) => {
+	audit.command("list", { isDefault: true }).alias("ls").description("show the org audit trail").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--limit <n>", `entries per page (max ${MAX_PAGE})`, "50").option("--action <action>", "only this action, e.g. env.key_granted").option("--resource-type <type>", "only this resource type, e.g. environment").option("--cursor <cursor>", "continue from a previous page's cursor").option("--all", "page through the whole trail, not just the first page").option("--metadata", "include each entry's metadata as JSON").option("--json", "print the raw API response").action(async (options) => {
 		if (options.action && !AUDIT_ACTIONS.includes(options.action)) fail(`unknown action "${options.action}" — see \`seekrit audit actions\``);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -8847,7 +8904,7 @@ function resolveBaseCredential(opts) {
 function registerAwsCommands(program) {
 	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
 	const target = aws.command("target").description("manage AWS role targets");
-	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
+	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
@@ -8872,7 +8929,7 @@ function registerAwsCommands(program) {
 		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
 		console.log(awsTrustPolicyInstructions(config));
 	});
-	target.command("list").description("list AWS role targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list AWS role targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -8882,7 +8939,7 @@ function registerAwsCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
 		}
 	});
-	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -8892,13 +8949,14 @@ function registerAwsCommands(program) {
 		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
 		console.log(awsTrustPolicyInstructions(cfg));
 	});
-	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -8928,7 +8986,7 @@ function registerAwsCommands(program) {
 			console.log(`export AWS_REGION=${cred.region}`);
 		}
 	});
-	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -8937,9 +8995,10 @@ function registerAwsCommands(program) {
 			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
 		}
 	});
-	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId}? Credentials already issued stay valid until they expire.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
 	});
@@ -8960,7 +9019,7 @@ function usageLine(usage) {
 */
 function registerBillingCommands(program) {
 	const billing = program.command("billing").description("plan, usage, and subscription");
-	billing.command("show", { isDefault: true }).description("show the org's plan, what it includes, and current usage").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	billing.command("show", { isDefault: true }).description("show the org's plan, what it includes, and current usage").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const info = await ctx.client.getBilling(ref.id);
@@ -8987,7 +9046,7 @@ function registerBillingCommands(program) {
 			}
 		});
 	});
-	billing.command("entitlements").description("list every entitlement this org resolves to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	billing.command("entitlements").description("list every entitlement this org resolves to").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const info = await ctx.client.getBilling(ref.id);
@@ -8997,7 +9056,7 @@ function registerBillingCommands(program) {
 			col("source", (e) => e.source)
 		]));
 	});
-	billing.command("checkout <family>").description(`start a self-serve upgrade (${VISIBLE_PLAN_FAMILY_IDS.join(" | ")}) — prints a URL`).option("--org <slug>").action(async (family, options) => {
+	billing.command("checkout <family>").description(`start a self-serve upgrade (${VISIBLE_PLAN_FAMILY_IDS.join(" | ")}) — prints a URL`).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (family, options) => {
 		if (!PLAN_FAMILY_IDS.includes(family)) fail(`unknown plan "${family}" — one of: ${PLAN_FAMILY_IDS.join(", ")}`);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -9005,14 +9064,14 @@ function registerBillingCommands(program) {
 		console.error("open this to complete checkout:");
 		console.log(url);
 	});
-	billing.command("portal").description("open the billing portal (prints a URL) to manage payment and invoices").option("--org <slug>").action(async (options) => {
+	billing.command("portal").description("open the billing portal (prints a URL) to manage payment and invoices").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { url } = await ctx.client.openBillingPortal(ref.id);
 		console.error("open this to manage billing:");
 		console.log(url);
 	});
-	billing.command("cancel").description("cancel the subscription and drop back to the Free plan").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+	billing.command("cancel").description("cancel the subscription and drop back to the Free plan").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await confirmDestructive(options.yes, `Cancel ${ref.slug}'s subscription and move it to the Free plan?`);
@@ -9055,7 +9114,7 @@ async function resolveBranchParent(ctx, opts) {
 */
 function registerBranchCommands(program) {
 	const branch = program.command("branch").description("ephemeral per-PR / preview configs layered on an environment");
-	branch.command("create <slug>").description("fork an environment into an ephemeral branch (inherits its secrets)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <env>", "the environment to branch").option("--name <name>", "display name (defaults to the slug)").option("--ttl <duration>", "lifetime: 12h, 7d, 2w, … or `never`", "7d").option("--no-share", "don't give the parent's other readers access to this branch").action(async (slug, options) => {
+	branch.command("create <slug>").description("fork an environment into an ephemeral branch (inherits its secrets)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <env>", "the environment to branch").option("--name <name>", "display name (defaults to the slug)").option("--ttl <duration>", "lifetime: 12h, 7d, 2w, … or `never`", "7d").option("--no-share", "don't give the parent's other readers access to this branch").action(async (slug, options) => {
 		const ctx = buildContext();
 		const parent = await resolveBranchParent(ctx, {
 			org: options.org,
@@ -9093,7 +9152,7 @@ function registerBranchCommands(program) {
 		console.error(created.branch.expiresAt ? `expires ${created.branch.expiresAt}` : "no expiry — delete it explicitly when the PR closes");
 		if (grants.length > 0) console.error(`shared with ${grants.length} other reader(s)`);
 	});
-	branch.command("list").alias("ls").description("list branches in an application (or of one environment)").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").option("--json", "print the raw API response").action(async (options) => {
+	branch.command("list").alias("ls").description("list branches in an application (or of one environment)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const branches = options.env ? await (async () => {
 			const parent = await resolveAppEnv(ctx, options);
@@ -9109,10 +9168,11 @@ function registerBranchCommands(program) {
 			col("id", (b) => b.id)
 		], "no branches — create one with `seekrit branch create`"));
 	});
-	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>").option("--app <slug>", "application slug (defaults to seekrit.json)").action(async (slug, options) => {
+	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("-y, --yes", "skip the confirmation").action(async (slug, options) => {
 		const ctx = buildContext();
 		const app = await resolveApp(ctx, options);
 		const target = await resolveBranch(ctx, app, slug);
+		await confirmDestructive(options.yes, `Tear down branch ${app.slug}#${target.slug} and every override in it?`);
 		await ctx.client.deleteBranch(app.orgId, target.id);
 		console.error(`deleted branch ${app.slug}#${target.slug}`);
 	});
@@ -9325,7 +9385,7 @@ function resolveServiceAccountKey(opts) {
 function registerGcpCommands(program) {
 	const gcp = program.command("gcp").description("temporary GCP credentials (IAM generateAccessToken, zero-knowledge)");
 	const target = gcp.command("target").description("manage GCP service-account targets");
-	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
+	target.command("add").description("register an impersonable service account to issue temporary tokens from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--service-account <email>", "the service account to impersonate, name@project.iam.gserviceaccount.com").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--scope <scope>", "OAuth scope to grant (repeatable; default cloud-platform)", collectList$1).option("--delegate <email>", "delegation-chain service account (repeatable)", collectList$1).option("--max-ttl <duration>", "clamp requested token lifetime, e.g. 1h").option("--key-file <path>", "source SA key JSON (else GOOGLE_APPLICATION_CREDENTIALS)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = {
@@ -9348,7 +9408,7 @@ function registerGcpCommands(program) {
 		console.error("\nGrant the source SA the token-creator role, then `seekrit gcp lease`:\n");
 		console.log(gcpSetupInstructions(config));
 	});
-	target.command("list").description("list GCP service-account targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list GCP service-account targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9358,7 +9418,7 @@ function registerGcpCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.serviceAccount}`);
 		}
 	});
-	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("setup <targetId>").description("reprint the IAM setup for a GCP target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9368,13 +9428,14 @@ function registerGcpCommands(program) {
 		if (cfg.provider !== "gcp") fail("not a gcp target (see `seekrit aws`/`seekrit ssh`)");
 		console.log(gcpSetupInstructions(cfg));
 	});
-	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("delete a GCP service-account target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+	gcp.command("lease <target>").description("mint a short-lived GCP access token; prints ready-to-source export lines").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--ttl <duration>", "token lifetime, e.g. 15m, 1h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9399,7 +9460,7 @@ function registerGcpCommands(program) {
 			console.log(`export GOOGLE_OAUTH_ACCESS_TOKEN=${cred.accessToken}`);
 		}
 	});
-	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	gcp.command("leases").description("list GCP leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -9408,9 +9469,10 @@ function registerGcpCommands(program) {
 			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
 		}
 	});
-	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>").action(async (leaseId, options) => {
+	gcp.command("revoke <leaseId>").description("mark a lease revoked in the ledger (tokens stay valid until they expire)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId}? Tokens already issued stay valid until they expire.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId} (issued tokens remain valid until they expire)`);
 	});
@@ -9424,7 +9486,7 @@ function registerGcpCommands(program) {
 */
 function registerGroupCommands(program) {
 	const group = program.command("group").description("manage shared groups (reusable secret bags)");
-	group.command("list").alias("ls").description("list shared groups in an organization").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	group.command("list").alias("ls").description("list shared groups in an organization").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { groups } = await ctx.client.listGroups(ref.id);
@@ -9435,7 +9497,7 @@ function registerGroupCommands(program) {
 			col("id", (g) => g.id)
 		], "no groups — create one with `seekrit group create`"));
 	});
-	group.command("show <slug>").description("show a group and the environments (value sets) it holds").option("--org <slug>").option("--json", "print the raw API response").action(async (slug, options) => {
+	group.command("show <slug>").description("show a group and the environments (value sets) it holds").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveGroup(ctx, {
 			org: options.org,
@@ -9461,7 +9523,7 @@ function registerGroupCommands(program) {
 			], "no environments — create one with `seekrit group env create`");
 		});
 	});
-	group.command("create").description("create a shared group").option("--org <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	group.command("create").description("create a shared group").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const created = await ctx.client.createGroup(orgRef.id, {
@@ -9470,7 +9532,7 @@ function registerGroupCommands(program) {
 		});
 		console.error(`created group ${created.group.slug} (${created.group.id})`);
 	});
-	group.command("rename <slug>").description("change a group's display name (the slug is permanent)").option("--org <slug>").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
+	group.command("rename <slug>").description("change a group's display name (the slug is permanent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "new display name").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveGroup(ctx, {
 			org: options.org,
@@ -9479,7 +9541,7 @@ function registerGroupCommands(program) {
 		const { group: row } = await ctx.client.updateGroup(ref.orgId, ref.id, { name: options.name });
 		console.error(`renamed ${row.slug} to "${row.name}"`);
 	});
-	group.command("rm <slug>").alias("delete").description("delete a group, its environments, and their secrets").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (slug, options) => {
+	group.command("rm <slug>").alias("delete").description("delete a group, its environments, and their secrets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (slug, options) => {
 		const ctx = buildContext();
 		const ref = await resolveGroup(ctx, {
 			org: options.org,
@@ -9491,7 +9553,7 @@ function registerGroupCommands(program) {
 		console.error(`deleted group ${ref.slug}`);
 	});
 	const groupEnv = group.command("env").description("manage a group’s environments (per-slug value sets / variants)");
-	groupEnv.command("list").alias("ls").description("list a group's environments").option("--org <slug>").requiredOption("--group <slug>").option("--json", "print the raw API response").action(async (options) => {
+	groupEnv.command("list").alias("ls").description("list a group's environments").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--group <slug>", "group slug").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveGroup(ctx, options);
 		const { environments } = await ctx.client.listGroupEnvs(ref.orgId, ref.id);
@@ -9502,7 +9564,7 @@ function registerGroupCommands(program) {
 			col("id", (e) => e.id)
 		], "no environments — create one with `seekrit group env create`"));
 	});
-	groupEnv.command("create").description("create a group environment (generates its data key locally)").option("--org <slug>").requiredOption("--group <slug>").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
+	groupEnv.command("create").description("create a group environment (generates its data key locally)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--group <slug>", "group slug").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
 		const ctx = buildContext();
 		const groupRef = await resolveGroup(ctx, {
 			org: options.org,
@@ -9523,6 +9585,224 @@ function registerGroupCommands(program) {
 	});
 }
 //#endregion
+//#region src/hermes.ts
+/**
+* `seekrit hermes` — wire seekrit into [Hermes Agent](https://hermes-agent.nousresearch.com)
+* as a **secret source**.
+*
+* Hermes reads credentials from `~/.hermes/.env` and the process environment, and
+* a *secret source* is the documented way to fill that environment from
+* somewhere else at startup. Implementing one is Python, and it lives in the
+* Python SDK (`seekrit.hermes`) rather than here — a `SecretSource` subclass and
+* the `register(ctx)` hook Hermes calls. This command exists for the two parts
+* that are not Python: the `config.yaml` block, and the plugin directory for a
+* Hermes install that cannot see the SDK's entry point.
+*
+* **`config.yaml` is printed, not written.** It is YAML that belongs to
+* somebody's agent, with comments and anchors this CLI carries no parser for;
+* a rewrite through a JSON round trip would delete them. The plugin directory
+* *is* written, because those two files are entirely ours.
+*
+* There are two sources, and which one to use is a real choice rather than a
+* default. `seekrit` is **bulk**: one environment, whole, nothing to enumerate.
+* `seekrit_refs` is **mapped**: explicit `VAR: skt://NAME` bindings, which is
+* what you need to rename a secret, read more than one environment, or win a
+* contested variable — Hermes lets a mapped claim beat a bulk one.
+*/
+/** The two source names `seekrit.hermes` registers. */
+const BULK_SOURCE = "seekrit";
+const MAPPED_SOURCE = "seekrit_refs";
+/** Hermes' home: `$HERMES_HOME`, else `~/.hermes`. */
+function hermesHome(env = process.env) {
+	const home = env.HERMES_HOME?.trim();
+	return home && home.length > 0 ? resolve(home) : join(homedir(), ".hermes");
+}
+const NAME_RE$1 = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* Build an `skt://` reference.
+*
+* A service token is bound to one environment, so a reference names a *token*
+* (by the alias its `tokens:` map gives it) and a secret in that token's
+* environment — not an arbitrary app and env, which nothing on the read path
+* could resolve.
+*/
+function reference(name, tokenAlias) {
+	return `skt://${tokenAlias ? `${tokenAlias}/` : ""}${name}`;
+}
+/**
+* The `secrets:` block for `~/.hermes/config.yaml`.
+*
+* Hand-rolled rather than serialized, because the shape is fixed and small and
+* the output is meant to be *read* — a generic emitter would quote keys and
+* flow-fold lists in ways that make a config someone has to paste look foreign.
+*/
+function configBlock(options = {}) {
+	const source = options.mapped ? MAPPED_SOURCE : BULK_SOURCE;
+	const lines = [
+		"secrets:",
+		`  sources: [${source}]`,
+		`  ${source}:`,
+		"    enabled: true"
+	];
+	if (options.tokenEnv && options.tokenEnv !== "SEEKRIT_TOKEN") lines.push(`    token_env: ${options.tokenEnv}`);
+	if (options.mapped) {
+		const tokens = Object.entries(options.tokens ?? {});
+		if (tokens.length > 0) {
+			lines.push("    tokens:");
+			for (const [alias, variable] of tokens) lines.push(`      ${alias}: ${variable}`);
+		}
+		lines.push("    env:");
+		const bindings = options.bindings ?? [];
+		if (bindings.length === 0) lines.push(`      OPENAI_API_KEY: ${reference("OPENAI_API_KEY")}`);
+		else for (const b of bindings) lines.push(`      ${b.variable}: ${reference(b.name, b.tokenAlias)}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+/** `plugin.yaml` for the directory-install path. */
+function pluginYaml() {
+	return [
+		"name: seekrit",
+		"description: >-",
+		"  Resolve Hermes provider credentials from seekrit — end-to-end encrypted",
+		"  secrets, decrypted in this process by your own service token.",
+		""
+	].join("\n");
+}
+/**
+* `__init__.py` for the directory-install path.
+*
+* Re-exporting `register` is the whole file: the implementation lives in the
+* published SDK, so a plugin scaffolded once keeps up with SDK releases instead
+* of pinning a copy of the resolver into somebody's home directory.
+*/
+function pluginInit() {
+	return [
+		"\"\"\"seekrit secret sources for Hermes Agent.",
+		"",
+		"Hermes calls `register(ctx)` from this module. The implementation lives in",
+		"the `seekrit` package (`pip install seekrit`), so this file stays a re-export",
+		"and never has to be regenerated.",
+		"\"\"\"",
+		"",
+		"from seekrit.hermes import register  # noqa: F401",
+		""
+	].join("\n");
+}
+/**
+* Parse a `VAR=NAME` or `VAR=alias/NAME` binding for `--bind`.
+*
+* The left side is the environment variable Hermes will set; the right side is
+* the seekrit secret it comes from. They differ often enough — that is most of
+* why the mapped source exists — that inferring one from the other would be
+* wrong more than it was convenient.
+*/
+function parseBinding(raw) {
+	const eq = raw.indexOf("=");
+	if (eq <= 0) return void 0;
+	const variable = raw.slice(0, eq).trim();
+	const target = raw.slice(eq + 1).trim();
+	if (!NAME_RE$1.test(variable) || target.length === 0) return void 0;
+	const slash = target.indexOf("/");
+	if (slash === -1) return NAME_RE$1.test(target) ? {
+		variable,
+		name: target
+	} : void 0;
+	const tokenAlias = target.slice(0, slash).trim();
+	const name = target.slice(slash + 1).trim();
+	if (tokenAlias.length === 0 || !NAME_RE$1.test(name)) return void 0;
+	return {
+		variable,
+		name,
+		tokenAlias
+	};
+}
+/** Parse a `--token alias=VAR` pair. */
+function parseTokenAlias(raw) {
+	const eq = raw.indexOf("=");
+	if (eq <= 0) return void 0;
+	const alias = raw.slice(0, eq).trim();
+	const variable = raw.slice(eq + 1).trim();
+	if (alias.length === 0 || !NAME_RE$1.test(variable)) return void 0;
+	return {
+		alias,
+		variable
+	};
+}
+function registerHermesCommands(program) {
+	const hermes = program.command("hermes").description("wire seekrit into a Hermes Agent as a secret source (`seekrit hermes --help`)");
+	hermes.command("init").description("print the Hermes config that resolves credentials from seekrit").option("--mapped", `use the ${MAPPED_SOURCE} source (explicit VAR -> secret bindings)`).option("--token-env <var>", "variable holding the service token", "SEEKRIT_TOKEN").option("--bind <VAR=NAME...>", "a mapped binding, e.g. OPENAI_API_KEY=OPENAI_KEY").option("--token <alias=VAR...>", "name a second token, e.g. billing=SEEKRIT_TOKEN_BILLING").option("--plugin-dir", "also scaffold $HERMES_HOME/plugins/seekrit (for a pip-less install)").option("--home <path>", "Hermes home (default: $HERMES_HOME or ~/.hermes)").option("--json", "machine-readable output").action((options) => {
+		const bindings = (options.bind ?? []).map((raw) => {
+			const parsed = parseBinding(raw);
+			if (!parsed) fail(`--bind must be VAR=NAME or VAR=alias/NAME (got "${raw}")`);
+			return parsed;
+		});
+		const tokens = {};
+		for (const raw of options.token ?? []) {
+			const parsed = parseTokenAlias(raw);
+			if (!parsed) fail(`--token must be alias=VARIABLE (got "${raw}")`);
+			tokens[parsed.alias] = parsed.variable;
+		}
+		for (const binding of bindings) if (binding.tokenAlias && !tokens[binding.tokenAlias]) fail(`--bind ${binding.variable} names token alias "${binding.tokenAlias}", so pass --token ${binding.tokenAlias}=<VARIABLE> too`);
+		if (!options.mapped && (bindings.length > 0 || Object.keys(tokens).length > 0)) fail("--bind and --token describe the mapped source: pass --mapped as well");
+		const source = options.mapped ? MAPPED_SOURCE : BULK_SOURCE;
+		const block = configBlock({
+			mapped: options.mapped,
+			tokenEnv: options.tokenEnv,
+			bindings,
+			tokens
+		});
+		const home = options.home ? resolve(options.home) : hermesHome();
+		const pluginDir = join(home, "plugins", "seekrit");
+		const written = [];
+		if (options.pluginDir) {
+			mkdirSync(pluginDir, { recursive: true });
+			const files = [["plugin.yaml", pluginYaml()], ["__init__.py", pluginInit()]];
+			for (const [name, contents] of files) {
+				const path = join(pluginDir, name);
+				writeFileSync(path, contents);
+				written.push(path);
+			}
+		}
+		emit(options, {
+			source,
+			configPath: join(home, "config.yaml"),
+			block,
+			written
+		}, () => {
+			section("hermes secret source");
+			printFields([
+				["source", source],
+				["shape", options.mapped ? "mapped (explicit bindings)" : "bulk (whole environment)"],
+				["config", join(home, "config.yaml")],
+				["plugin dir", options.pluginDir ? pluginDir : "not scaffolded"]
+			]);
+			console.log();
+			console.log("1. Install the SDK into the environment Hermes runs in:");
+			console.log("     pip install seekrit");
+			console.log();
+			console.log("2. Put the service token in ~/.hermes/.env (not config.yaml):");
+			console.log(`     ${options.tokenEnv ?? "SEEKRIT_TOKEN"}=skt_...`);
+			console.log();
+			console.log("3. Enable the plugin and merge this into ~/.hermes/config.yaml:");
+			console.log("     hermes plugins enable seekrit");
+			console.log();
+			console.log(block.trimEnd());
+			console.log();
+			if (written.length > 0) {
+				console.log("Scaffolded:");
+				for (const path of written) console.log(`  ${path}`);
+				console.log();
+			}
+			console.log("The source overrides values already in .env or your shell, so a rotation wins — list a variable under `preserve_existing` when a local override is the point.");
+		});
+	});
+	hermes.command("ref <name>").description("print the skt:// reference to bind a Hermes variable to").option("--token-alias <alias>", "resolve through a second token named in `tokens:`").option("--json", "machine-readable output").action((name, options) => {
+		if (!NAME_RE$1.test(name)) fail(`not a valid secret name: "${name}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
+		const ref = reference(name, options.tokenAlias);
+		emit(options, { reference: ref }, () => console.log(ref));
+	});
+}
+//#endregion
 //#region src/honey.ts
 /**
 * Honey tokens — decoy credentials that unlock nothing and alert when used.
@@ -9534,7 +9814,7 @@ function registerGroupCommands(program) {
 */
 function registerHoneyTokenCommands(program) {
 	const honey = program.command("honey-token").description("plant decoy credentials that alert when anyone tries to use them");
-	honey.command("create").description("mint a decoy credential; prints it once").requiredOption("--name <name>", "display name, e.g. legacy-ci-bait").option("--org <slug>").option("--placement <note>", "where you're planting it (echoed in the alert email)").action(async (options) => {
+	honey.command("create").description("mint a decoy credential; prints it once").requiredOption("--name <name>", "display name, e.g. legacy-ci-bait").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--placement <note>", "where you're planting it (echoed in the alert email)").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const created = await createHoneyToken();
@@ -9547,7 +9827,7 @@ function registerHoneyTokenCommands(program) {
 		console.error("decoy created — save it now, it is not stored. Plant it somewhere a thief would look, NOT anywhere your own tooling reads: a deploy script that tries it by mistake trips the alarm just as loudly. It grants nothing.");
 		console.log(created.token);
 	});
-	honey.command("list").alias("ls").description("list decoy credentials and whether any have been tripped").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	honey.command("list").alias("ls").description("list decoy credentials and whether any have been tripped").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		const { honeyTokens } = await ctx.client.listHoneyTokens(orgRef.id);
@@ -9560,7 +9840,7 @@ function registerHoneyTokenCommands(program) {
 			col("id", (t) => t.id)
 		], "no decoys planted — create one with `seekrit honey-token create`"));
 	});
-	honey.command("delete <honeyTokenId>").alias("rm").description("delete a decoy (stops it alerting)").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (honeyTokenId, options) => {
+	honey.command("delete <honeyTokenId>").alias("rm").description("delete a decoy (stops it alerting)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (honeyTokenId, options) => {
 		const ctx = buildContext();
 		const orgRef = await resolveOrg(ctx, options.org);
 		await confirmDestructive(options.yes, `Delete ${honeyTokenId}? Wherever you planted it goes back to being unwatched — pull the bait too.`);
@@ -9584,7 +9864,7 @@ function collectHeader(value, acc = {}) {
 */
 function registerLogSinkCommands(program) {
 	const sink = program.command("log-sink").description("stream the audit trail to your own OTLP collector (SIEM)");
-	sink.command("show", { isDefault: true }).description("show the configured log sink and its delivery health").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	sink.command("show", { isDefault: true }).description("show the configured log sink and its delivery health").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { sink: config } = await ctx.client.getLogSink(ref.id);
@@ -9603,7 +9883,7 @@ function registerLogSinkCommands(program) {
 			]);
 		});
 	});
-	sink.command("set <endpoint>").description("point the audit export at an OTLP/HTTP logs endpoint").option("--org <slug>").option("--header <name: value>", "auth header to send (repeatable; values are write-only)", collectHeader).option("--clear-headers", "send no headers at all (drops the stored ones)").option("--disabled", "save the config but stop shipping").action(async (endpoint, options) => {
+	sink.command("set <endpoint>").description("point the audit export at an OTLP/HTTP logs endpoint").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--header <name: value>", "auth header to send (repeatable; values are write-only)", collectHeader).option("--clear-headers", "send no headers at all (drops the stored ones)").option("--disabled", "save the config but stop shipping").action(async (endpoint, options) => {
 		if (options.header && options.clearHeaders) fail("pass either --header or --clear-headers, not both");
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -9615,7 +9895,7 @@ function registerLogSinkCommands(program) {
 		});
 		console.error(`log sink → ${config.endpoint} (${config.enabled ? "enabled" : "disabled"}) — test it with \`seekrit log-sink test\``);
 	});
-	sink.command("test").description("send a probe to the configured endpoint and report the result").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	sink.command("test").description("send a probe to the configured endpoint and report the result").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const result = await ctx.client.testLogSink(ref.id);
@@ -9628,7 +9908,7 @@ function registerLogSinkCommands(program) {
 		});
 		if (!result.ok) process.exitCode = 1;
 	});
-	sink.command("rm").alias("delete").description("stop exporting the audit trail and forget the endpoint").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (options) => {
+	sink.command("rm").alias("delete").description("stop exporting the audit trail and forget the endpoint").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await confirmDestructive(options.yes, `Remove ${ref.slug}'s audit log export?`);
@@ -9762,7 +10042,7 @@ function resolveAdminUri(uri) {
 function registerMongoCommands(program) {
 	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
 	const target = mongo.command("target").description("manage MongoDB targets");
-	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const adminUri = resolveAdminUri(options.uri);
@@ -9793,7 +10073,7 @@ function registerMongoCommands(program) {
 		console.error("\nEnsure a provisioning user exists, then `seekrit mongodb lease`:\n");
 		console.log(mongoAdminSetupInstructions(config));
 	});
-	target.command("list").description("list MongoDB targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list MongoDB targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9804,13 +10084,14 @@ function registerMongoCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${host}\t${cfg.connection.database}\t${cfg.accessLevel ?? "readonly"}`);
 		}
 	});
-	target.command("rm <targetId>").description("delete a MongoDB target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("delete a MongoDB target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	mongo.command("lease <target>").description("mint short-lived MongoDB credentials; prints a ready-to-use connection URI").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 30m, 1h, 8h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+	mongo.command("lease <target>").description("mint short-lived MongoDB credentials; prints a ready-to-use connection URI").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--ttl <duration>", "credential lifetime, e.g. 30m, 1h, 8h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9829,7 +10110,7 @@ function registerMongoCommands(program) {
 		if (options.json) console.log(JSON.stringify(cred, null, 2));
 		else console.log(`export MONGODB_URI='${cred.uri}'`);
 	});
-	mongo.command("leases").description("list MongoDB leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	mongo.command("leases").description("list MongoDB leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -9838,9 +10119,10 @@ function registerMongoCommands(program) {
 			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
 		}
 	});
-	mongo.command("revoke <leaseId>").description("revoke a lease now (drops the MongoDB user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+	mongo.command("revoke <leaseId>").description("revoke a lease now (drops the MongoDB user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its MongoDB user is dropped immediately.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId} (the MongoDB user has been dropped)`);
 	});
@@ -9922,7 +10204,7 @@ function generateUserName$1(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -9964,7 +10246,7 @@ function registerMysqlCommands(program) {
 		});
 		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
 	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list provisioning targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -9974,13 +10256,14 @@ function registerMysqlCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`removed ${targetId}`);
 	});
-	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -10006,7 +10289,7 @@ function registerMysqlCommands(program) {
 		}, null, 2));
 		else console.log(url);
 	});
-	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -10015,9 +10298,10 @@ function registerMysqlCommands(program) {
 			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
 		}
 	});
-	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its MySQL user is dropped immediately.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId}`);
 	});
@@ -10027,106 +10311,695 @@ function collect$3(value, acc) {
 	acc.push(value);
 	return acc;
 }
-//#endregion
-//#region src/orgs.ts
 /**
-* Counts for `org show`. Each list is admin-gated to a different degree, so a
-* member who can't read one still gets the rest: a failed call reports as
-* `null`, which `printFields` drops and JSON preserves as "not visible to you".
+* Fetch + decrypt every secret in a single environment.
+*
+* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
+* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
+* scope here — a reference to a secret inherited from a composed group is left
+* literal, because the group layers aren't fetched. `materializeEnv` is the
+* fully-layered view.
 */
-async function countOrNull(load) {
+async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
+	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
+}
+/**
+* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
+* the CLI's standard fatal exit — it is a config bug with no correct value to
+* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
+*/
+function interpolateValues(values, enabled = true) {
+	if (!enabled) return {
+		values,
+		interpolated: [],
+		unresolvedRefs: []
+	};
 	try {
-		return await load();
-	} catch {
-		return null;
+		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
+		return {
+			values: expandedValues,
+			interpolated: expanded,
+			unresolvedRefs: unresolved
+		};
+	} catch (err) {
+		return fail(err instanceof Error ? err.message : String(err));
 	}
 }
-async function orgOverview(ctx, orgId) {
-	const [apps, groups, members, tokens] = await Promise.all([
-		countOrNull(async () => (await ctx.client.listApps(orgId)).apps.length),
-		countOrNull(async () => (await ctx.client.listGroups(orgId)).groups.length),
-		countOrNull(async () => (await ctx.client.listMembers(orgId)).members.length),
-		countOrNull(async () => (await ctx.client.listTokens(orgId)).tokens.length)
-	]);
+/**
+* Decrypt one historical version of a secret. Ciphertext is bound to
+* `(envId, name)` as AAD and neither changes across versions, so an old blob
+* opens with the environment's current data key — no special handling needed.
+*/
+async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
+	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
+	const row = versions.find((v) => v.version === version);
+	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
+	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
+}
+async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
+	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
+	await ctx.client.setSecret(orgId, envId, name, ciphertext);
+}
+/**
+* Encrypt and store many secrets into one environment. The DEK is fetched once
+* (so user auth prompts for the passphrase a single time, not per variable),
+* then each value is encrypted locally and written. Existing names are
+* overwritten; the result splits them into created vs. updated for a summary.
+* Callers validate the names first — a rejected name aborts before any write.
+*/
+async function importSecrets(ctx, orgId, envId, entries) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const existing = new Set(secrets.map((s) => s.name));
+	const result = {
+		created: [],
+		updated: []
+	};
+	for (const [name, value] of Object.entries(entries)) {
+		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
+		await ctx.client.setSecret(orgId, envId, name, ciphertext);
+		(existing.has(name) ? result.updated : result.created).push(name);
+	}
+	return result;
+}
+/**
+* Resolve the full, layered environment for a running app: composed group
+* secrets (lowest precedence) → the app env's own secrets → `.env` files.
+* Each layer's DEK is unwrapped once with the principal's private key and its
+* ciphertext decrypted locally. `process.env` is NOT applied here — callers
+* that spawn a process layer it on top so the live shell always wins.
+*
+* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
+* reference always resolves to whichever layer won the name.
+*/
+async function materializeEnv(ctx, opts) {
+	const query = {};
+	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (opts.branch) query.branch = opts.branch;
+	if (!isTokenAuth(ctx)) {
+		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
+		query.env = opts.envId;
+	}
+	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
+	const privateKey = await getPrivateKey(ctx);
+	const values = {};
+	const provenance = {};
+	for (const layer of layers) {
+		const dek = await unwrapDek(layer.wrappedDek, privateKey);
+		let label;
+		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
+		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
+		else label = `app:${scope.appSlug}/${layer.slug}`;
+		for (const secret of layer.secrets) {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
+			provenance[secret.name] = label;
+		}
+	}
+	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
 	return {
-		apps,
-		groups,
-		members,
-		tokens
+		...interpolateValues(values, opts.interpolate !== false),
+		provenance,
+		scope,
+		loadedEnvFiles
 	};
 }
-function registerOrgCommands(program) {
-	const org = program.command("org").description("manage organizations");
-	org.command("list").alias("ls").description("list the organizations you can access").option("--json", "print the raw API response").action(async (options) => {
-		const { orgs } = await buildContext().client.listOrgs();
-		emit(options, { orgs }, () => printTable(orgs, [
-			col("slug", (o) => o.slug),
-			col("name", (o) => o.name),
-			col("role", (o) => o.role),
-			col("id", (o) => o.id)
-		], "no organizations — create one with `seekrit org create`"));
-	});
-	org.command("show [slug]").description("show an organization and what it contains").option("--org <slug>", "organization slug (or pass it as the argument)").option("--json", "print the raw API response").action(async (slug, options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, slug ?? options.org);
-		const { org: row } = await ctx.client.getOrg(ref.id);
-		const counts = await orgOverview(ctx, ref.id);
-		const shown = (n) => n === null ? "—" : n;
-		emit(options, {
-			org: row,
-			counts
-		}, () => {
-			printFields([
-				["slug", row.slug],
-				["name", row.name],
-				["id", row.id],
-				["your role", row.role],
-				["created", row.createdAt],
-				["applications", shown(counts.apps)],
-				["groups", shown(counts.groups)],
-				["members", shown(counts.members)],
-				["service tokens", shown(counts.tokens)]
-			]);
-		});
-	});
-	org.command("create").description("create an organization (you become its owner)").requiredOption("--name <name>").requiredOption("--slug <slug>").action(async (options) => {
-		const created = await buildContext().client.createOrg({
-			name: options.name,
-			slug: options.slug
-		});
-		console.error(`created org ${created.org.slug} (${created.org.id})`);
-	});
-	org.command("rename").description("change an organization's display name (the slug is permanent)").option("--org <slug>").requiredOption("--name <name>", "new display name").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { org: row } = await ctx.client.updateOrg(ref.id, { name: options.name });
-		console.error(`renamed ${row.slug} to "${row.name}"`);
-	});
-	org.command("member").description("view organization members").command("list").alias("ls").description("list members, and whether each has finished key setup").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { members } = await ctx.client.listMembers(ref.id);
-		emit(options, { members }, () => printTable(members, [
-			col("email", (m) => m.email),
-			col("role", (m) => m.role),
-			col("name", (m) => m.name),
-			col("keys", (m) => m.publicKeyJwk ? "ready" : "pending"),
-			col("id", (m) => m.userId)
-		], "no members"));
-	});
-	const invite = org.command("invite").description("manage pending invitations");
-	invite.command("list").alias("ls").description("list outstanding invitations").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { invites } = await ctx.client.listInvites(ref.id);
-		emit(options, { invites }, () => printTable(invites, [
-			col("email", (i) => i.email),
+/**
+* Resolve, going through the last-known-good cache when one is configured.
+*
+* Always live first: the cache exists for when the call cannot land, not to
+* save a round trip, so a recovered network is picked up on the very next
+* invocation. A *refused* resolve (401/403/…) drops the entry rather than
+* falling back to it — otherwise revoking a token would keep working offline
+* until the entry aged out.
+*/
+async function resolveWithCache(ctx, query, cache) {
+	if (!cache) return ctx.client.resolve(query);
+	try {
+		const response = await ctx.client.resolve(query);
+		try {
+			cache.write(JSON.stringify(response));
+		} catch (err) {
+			warn(`could not update the cache: ${errorMessage(err)}`);
+		}
+		return response;
+	} catch (err) {
+		if (!mayFallBack(err)) {
+			cache.invalidate();
+			throw err;
+		}
+		const found = cache.read();
+		if (found.kind === "hit") {
+			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
+			return JSON.parse(found.body);
+		}
+		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
+		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
+		throw err;
+	}
+}
+function warn(text) {
+	process.stderr.write(`seekrit: ${text}\n`);
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* Overlay `.env` files onto an existing value/provenance set (later files win).
+* Missing files are skipped. Returns the files that were actually loaded. Used
+* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
+* managed secrets are unavailable but `.env` should still apply.
+*/
+function overlayEnvFiles(values, provenance, envFiles) {
+	const loaded = [];
+	for (const file of envFiles) {
+		if (!existsSync(file)) continue;
+		loaded.push(file);
+		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
+			values[name] = value;
+			provenance[name] = `dotenv:${file}`;
+		}
+	}
+	return loaded;
+}
+/**
+* Print a name → source table to stderr (never the secret values). Names whose
+* value had references expanded are marked, and dangling references are called
+* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
+* deliberately passed through as literal text.
+*/
+function printExplain(provenance, refs = {}) {
+	const interpolated = new Set(refs.interpolated ?? []);
+	const names = Object.keys(provenance).sort();
+	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
+	for (const name of names) {
+		const marker = interpolated.has(name) ? "  (interpolated)" : "";
+		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
+	}
+	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
+}
+/** Plugin id and integration id declared by `@seekrit/openclaw-plugin`. */
+const PLUGIN_ID = "seekrit";
+const PLUGIN_INTEGRATION_ID = "seekrit";
+/** The provider alias written into `secrets.providers`. */
+const PROVIDER_ALIAS = "seekrit";
+/**
+* Environment the resolver needs, and nothing else.
+*
+* OpenClaw hands an exec provider an empty environment apart from this
+* allowlist, which is a feature: it is the difference between "the resolver can
+* read the credential it needs" and "the resolver inherits the whole gateway
+* environment". `PATH` is here because Node's own startup needs it, `HOME` for
+* the CLI's login session, and the `SEEKRIT_*` set is how a machine credential
+* reaches a process nobody gets to pass flags to.
+*/
+const PASS_ENV = [
+	"PATH",
+	"HOME",
+	"USERPROFILE",
+	"APPDATA",
+	"LOCALAPPDATA",
+	"TEMP",
+	"TMP",
+	"SYSTEMROOT",
+	"WINDIR",
+	"XDG_CONFIG_HOME",
+	"XDG_CACHE_HOME",
+	"NODE_EXTRA_CA_CERTS",
+	"SEEKRIT_TOKEN",
+	"SEEKRIT_CLIENT_ID",
+	"SEEKRIT_CLIENT_SECRET",
+	"SEEKRIT_API_URL",
+	"SEEKRIT_ORG",
+	"SEEKRIT_APP",
+	"SEEKRIT_ENV",
+	"SEEKRIT_BRANCH"
+];
+/**
+* Generous, because the first resolve of a cold start does real work — an M2M
+* token mint, a resolve, and a key unwrap — and OpenClaw fails startup rather
+* than degrading when this expires. The 1Password integration picks 90s for the
+* same reason (its CLI may prompt for biometrics); 30s is enough here because
+* nothing in this path is interactive.
+*/
+const TIMEOUT_MS = 3e4;
+/** A seekrit secret name: what `seekrit secrets set` accepts. */
+const NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Slugs as the API spells them. */
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+/**
+* Parse an exec SecretRef id.
+*
+* Two shapes, mirroring 1Password's `op://vault/item/field` — a bare name for
+* the environment the credential already points at, and an explicit
+* `app/env/NAME` triple for a provider serving more than one environment:
+*
+*     OPENAI_API_KEY
+*     billing-api/production/STRIPE_SECRET_KEY
+*
+* A bare name is the common case and the one a service token wants, since the
+* token is already bound to an environment and there is nothing to disambiguate.
+*/
+function parseSecretId(id) {
+	const trimmed = id.trim();
+	if (trimmed.length === 0) return void 0;
+	const parts = trimmed.split("/");
+	if (parts.length === 1) {
+		const [name = ""] = parts;
+		return NAME_RE.test(name) ? { name } : void 0;
+	}
+	if (parts.length !== 3) return void 0;
+	const [app = "", env = "", name = ""] = parts;
+	if (!SLUG_RE.test(app) || !SLUG_RE.test(env) || !NAME_RE.test(name)) return void 0;
+	return {
+		app,
+		env,
+		name
+	};
+}
+/** The (app, env) pair an id resolves against — `""` for the credential's own. */
+function scopeKey(id) {
+	return id.app && id.env ? `${id.app}/${id.env}` : "";
+}
+/**
+* Parse a request, tolerantly in exactly one direction.
+*
+* Non-string and empty ids are dropped rather than rejected — a request whose
+* shape we do not recognize should still resolve the ids we do, because the
+* alternative fails OpenClaw's whole startup over one malformed entry. A body
+* that is not an object with an `ids` array is a different matter: there is
+* nothing to answer, so it throws.
+*/
+function parseExecRequest(input) {
+	const parsed = JSON.parse(input);
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("exec SecretRef request must be a JSON object");
+	const ids = parsed.ids;
+	if (!Array.isArray(ids)) throw new Error("exec SecretRef request must carry an `ids` array");
+	return { ids: ids.filter((id) => typeof id === "string" && id.trim().length > 0) };
+}
+/** Assemble a response, omitting `errors` entirely when everything resolved. */
+function buildExecResponse(values, errors) {
+	return {
+		protocolVersion: 1,
+		values,
+		...Object.keys(errors).length > 0 ? { errors } : {}
+	};
+}
+/**
+* Resolve every requested id, reading each distinct environment exactly once.
+*
+* A batch is normally one environment, but a provider may serve several, and
+* resolving per id would mean an unwrap per id. Grouping keeps a 40-variable
+* gateway to one round trip.
+*
+* `resolveScope` is injected so the protocol can be tested without a network,
+* an API, or a key.
+*/
+async function resolveIds(ids, resolveScope) {
+	const values = {};
+	const errors = {};
+	const byScope = /* @__PURE__ */ new Map();
+	for (const id of ids) {
+		const parsed = parseSecretId(id);
+		if (!parsed) {
+			errors[id] = { code: "INVALID_ID" };
+			continue;
+		}
+		const key = scopeKey(parsed);
+		const bucket = byScope.get(key) ?? {
+			scope: parsed,
+			ids: []
+		};
+		bucket.ids.push({
+			id,
+			name: parsed.name
+		});
+		byScope.set(key, bucket);
+	}
+	for (const { scope, ids: wanted } of byScope.values()) {
+		let resolved;
+		try {
+			resolved = await resolveScope(scope);
+		} catch (err) {
+			const code = classify(err);
+			for (const { id } of wanted) errors[id] = { code };
+			continue;
+		}
+		for (const { id, name } of wanted) {
+			const value = resolved[name];
+			if (value === void 0) errors[id] = { code: "NOT_FOUND" };
+			else values[id] = value;
+		}
+	}
+	return buildExecResponse(values, errors);
+}
+/**
+* Bucket a failure into a code an operator can act on.
+*
+* Deliberately coarse and deliberately message-free: it reads the error's own
+* text to pick a bucket and then throws that text away, because the text may
+* quote a token.
+*/
+function classify(err) {
+	const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
+	if (/unauthor|forbidden|token|credential|passphrase|decrypt|sign in|log in|login/.test(message)) return "UNAUTHORIZED";
+	return "UNAVAILABLE";
+}
+/** OpenClaw's config directory: `$OPENCLAW_HOME`, else `~/.openclaw`. */
+function openclawHome(env = process.env) {
+	const home = env.OPENCLAW_HOME?.trim();
+	return home && home.length > 0 ? resolve(home) : join(homedir(), ".openclaw");
+}
+/**
+* The provider block for an installed `@seekrit/openclaw-plugin`.
+*
+* Preferred over the exec shape below for one reason that matters on upgrade:
+* OpenClaw reads the command out of the plugin's manifest at every startup, so
+* a plugin release that moves its resolver keeps working. A copied command is a
+* path pinned in someone's config forever.
+*/
+function pluginProvider() {
+	return {
+		source: "exec",
+		pluginIntegration: {
+			pluginId: PLUGIN_ID,
+			integrationId: PLUGIN_INTEGRATION_ID
+		}
+	};
+}
+/**
+* The provider block for a plain CLI install, with no plugin.
+*
+* `realpathSync` on both paths is not tidiness. OpenClaw's guard rejects a
+* symlinked command outright, and a Node installed by a version manager is
+* almost always reached through one — so resolving here is the difference
+* between a provider that works and a startup failure whose message points at
+* the config rather than at the shim.
+*/
+function execProvider(cliEntry, nodeBinary = process.execPath) {
+	const command = realTo(nodeBinary);
+	const entry = realTo(cliEntry);
+	return {
+		source: "exec",
+		command,
+		args: [
+			entry,
+			"openclaw",
+			"resolve"
+		],
+		passEnv: [...PASS_ENV],
+		jsonOnly: true,
+		timeoutMs: TIMEOUT_MS,
+		noOutputTimeoutMs: TIMEOUT_MS,
+		trustedDirs: [.../* @__PURE__ */ new Set([dirname(command), dirname(entry)])]
+	};
+}
+function realTo(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+/** This CLI's own entry file — what `execProvider` hands to Node. */
+function cliEntryPath() {
+	return fileURLToPath(new URL("index.js", import.meta.url));
+}
+/**
+* Add the seekrit provider to a parsed config without disturbing anything else.
+*
+* An existing `seekrit` entry that differs is left alone unless forced, for the
+* same reason `seekrit paperclip init` leaves an existing MCP server alone:
+* someone who pinned a timeout or narrowed `passEnv` did it deliberately, and
+* silently reverting a security narrowing is the worst kind of helpful.
+*/
+function mergeProvider(existing, provider, force) {
+	const secrets = { ...existing.secrets ?? {} };
+	const providers = { ...secrets.providers ?? {} };
+	const current = providers[PROVIDER_ALIAS];
+	if (current && !force && JSON.stringify(current) !== JSON.stringify(provider)) return {
+		merged: existing,
+		changed: false
+	};
+	if (current && JSON.stringify(current) === JSON.stringify(provider)) return {
+		merged: existing,
+		changed: false
+	};
+	providers[PROVIDER_ALIAS] = provider;
+	return {
+		merged: {
+			...existing,
+			secrets: {
+				...secrets,
+				providers
+			}
+		},
+		changed: true
+	};
+}
+/** A SecretRef pointing at this provider — what replaces a plaintext key. */
+function secretRef(id) {
+	return {
+		source: "exec",
+		provider: PROVIDER_ALIAS,
+		id
+	};
+}
+/**
+* Read `openclaw.json`, or decline to.
+*
+* The file is JSON5: comments and trailing commas are legal, and a parse/write
+* round trip through `JSON` would delete every comment in someone's gateway
+* config. So a file that is not also valid strict JSON is not edited at all —
+* the caller prints the block to paste instead. Losing a config's comments to
+* be helpful is worse than asking for one paste.
+*/
+function readOpenclawConfig(path) {
+	if (!existsSync(path)) return { config: {} };
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (err) {
+		fail(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (raw.trim().length === 0) return { config: {} };
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { json5: true };
+		return { config: parsed };
+	} catch {
+		return { json5: true };
+	}
+}
+function registerOpenclawCommands(program) {
+	const openclaw = program.command("openclaw").description("wire seekrit into OpenClaw as a SecretRef provider (`seekrit openclaw --help`)");
+	openclaw.command("init").description("add the seekrit exec SecretRef provider to openclaw.json").option("--config <path>", "path to openclaw.json (default: $OPENCLAW_HOME/openclaw.json)").option("--plugin", "point at an installed @seekrit/openclaw-plugin (recommended)").option("--exec", "point directly at this CLI, with no plugin installed").option("--write", "write the file instead of printing the block to paste").option("--force", "replace a seekrit provider entry that already differs").option("--json", "machine-readable output").action((options) => {
+		if (options.plugin && options.exec) fail("--plugin and --exec are mutually exclusive");
+		const usePlugin = options.exec !== true;
+		let provider;
+		if (usePlugin) provider = pluginProvider();
+		else {
+			const entry = cliEntryPath();
+			if (!existsSync(entry)) fail(`cannot find this CLI's entry file at ${entry} — --exec needs an installed seekrit (npm i -g @seekrit/cli), or use --plugin`);
+			provider = execProvider(entry);
+		}
+		const path = options.config ? resolve(options.config) : join(openclawHome(), "openclaw.json");
+		const read = readOpenclawConfig(path);
+		const json5 = "json5" in read;
+		const merged = json5 ? void 0 : mergeProvider(read.config, provider, options.force === true);
+		const wrote = Boolean(options.write) && merged?.changed === true;
+		if (wrote && merged) writeFileSync(path, `${JSON.stringify(merged.merged, null, 2)}\n`, { mode: 384 });
+		emit(options, {
+			path,
+			provider,
+			wrote,
+			json5
+		}, () => {
+			section("openclaw secret provider");
+			printFields([
+				["config", path],
+				["provider", PROVIDER_ALIAS],
+				["shape", usePlugin ? "plugin integration" : "exec (this CLI)"],
+				["written", wrote ? "yes" : "no"]
+			]);
+			console.log();
+			if (json5) {
+				console.log(`${path} is JSON5 (comments or trailing commas), which a rewrite here would delete.`);
+				console.log("Merge this into it by hand:");
+			} else if (!options.write) console.log("Merge this into your config, or re-run with --write:");
+			else if (!wrote) console.log(`A different \`${PROVIDER_ALIAS}\` provider is already configured — left as it is. Re-run with --force to replace it.`);
+			else console.log("Written. The block now in your config:");
+			console.log();
+			console.log(JSON.stringify({ secrets: { providers: { [PROVIDER_ALIAS]: provider } } }, null, 2));
+			console.log();
+			if (usePlugin) {
+				console.log("Install the plugin, if you have not already:");
+				console.log("  openclaw plugins install npm:@seekrit/openclaw-plugin");
+				console.log("  openclaw plugins enable seekrit");
+				console.log();
+			}
+			console.log("Then replace a plaintext credential with a ref, e.g.:");
+			console.log(`  ${JSON.stringify(secretRef("OPENAI_API_KEY"))}`);
+			console.log();
+			console.log("And check your work:");
+			console.log("  openclaw secrets audit --check --allow-exec");
+			console.log();
+			console.log("Resolution is eager: OpenClaw reads every ref once at startup. After a rotation, run `openclaw secrets reload`.");
+		});
+	});
+	openclaw.command("ref <name>").description("print the SecretRef object to paste in place of a plaintext credential").option("--app <slug>", "address a specific application (with --env)").option("--env <slug>", "address a specific environment (with --app)").option("--json", "machine-readable output").action((name, options) => {
+		if (Boolean(options.app) !== Boolean(options.env)) fail("--app and --env go together (an id names both, or neither)");
+		const id = options.app && options.env ? `${options.app}/${options.env}/${name}` : name;
+		if (!parseSecretId(id)) fail(`not a valid SecretRef id: "${id}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
+		const ref = secretRef(id);
+		emit(options, ref, () => console.log(JSON.stringify(ref)));
+	});
+	openclaw.command("resolve").description("resolve exec SecretRef ids from stdin (OpenClaw calls this; not for humans)").action(async () => {
+		setFailThrows(true);
+		let request;
+		try {
+			request = parseExecRequest(await readStdin());
+		} catch (err) {
+			process.stderr.write(`seekrit: ${err instanceof Error ? err.message : String(err)}\n`);
+			process.exitCode = 2;
+			return;
+		}
+		const scopes = /* @__PURE__ */ new Map();
+		let ctx;
+		const response = await resolveIds(request.ids, (scope) => {
+			const key = scopeKey(scope);
+			const cached = scopes.get(key);
+			if (cached) return cached;
+			ctx ??= buildContext();
+			const pending = resolveEnvironment(ctx, scope);
+			scopes.set(key, pending);
+			return pending;
+		});
+		process.stdout.write(`${JSON.stringify(response)}\n`);
+	});
+}
+/**
+* Resolve one environment's full variable set.
+*
+* `.env` overlays are deliberately switched off (`envFiles: []`). Everywhere
+* else in this CLI they are a convenience for a developer's shell; here the
+* working directory belongs to the OpenClaw gateway, and letting a file in it
+* override a gateway credential would make a stray `.env` a privilege
+* escalation. Reference expansion stays on — a `${OTHER_SECRET}` reference is
+* stored data, not a local override.
+*/
+async function resolveEnvironment(ctx, scope) {
+	let envId;
+	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, {
+		app: scope.app,
+		env: scope.env
+	})).envId;
+	const { values } = await materializeEnv(ctx, {
+		envId,
+		envFiles: []
+	});
+	return values;
+}
+//#endregion
+//#region src/orgs.ts
+/**
+* Counts for `org show`. Each list is admin-gated to a different degree, so a
+* member who can't read one still gets the rest: a failed call reports as
+* `null`, which `printFields` drops and JSON preserves as "not visible to you".
+*/
+async function countOrNull(load) {
+	try {
+		return await load();
+	} catch {
+		return null;
+	}
+}
+async function orgOverview(ctx, orgId) {
+	const [apps, groups, members, tokens] = await Promise.all([
+		countOrNull(async () => (await ctx.client.listApps(orgId)).apps.length),
+		countOrNull(async () => (await ctx.client.listGroups(orgId)).groups.length),
+		countOrNull(async () => (await ctx.client.listMembers(orgId)).members.length),
+		countOrNull(async () => (await ctx.client.listTokens(orgId)).tokens.length)
+	]);
+	return {
+		apps,
+		groups,
+		members,
+		tokens
+	};
+}
+function registerOrgCommands(program) {
+	const org = program.command("org").description("manage organizations");
+	org.command("list").alias("ls").description("list the organizations you can access").option("--json", "print the raw API response").action(async (options) => {
+		const { orgs } = await buildContext().client.listOrgs();
+		emit(options, { orgs }, () => printTable(orgs, [
+			col("slug", (o) => o.slug),
+			col("name", (o) => o.name),
+			col("role", (o) => o.role),
+			col("id", (o) => o.id)
+		], "no organizations — create one with `seekrit org create`"));
+	});
+	org.command("show [slug]").description("show an organization and what it contains").option("--org <slug>", "organization slug (or pass it as the argument)").option("--json", "print the raw API response").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, slug ?? options.org);
+		const { org: row } = await ctx.client.getOrg(ref.id);
+		const counts = await orgOverview(ctx, ref.id);
+		const shown = (n) => n === null ? "—" : n;
+		emit(options, {
+			org: row,
+			counts
+		}, () => {
+			printFields([
+				["slug", row.slug],
+				["name", row.name],
+				["id", row.id],
+				["your role", row.role],
+				["created", row.createdAt],
+				["applications", shown(counts.apps)],
+				["groups", shown(counts.groups)],
+				["members", shown(counts.members)],
+				["service tokens", shown(counts.tokens)]
+			]);
+		});
+	});
+	org.command("create").description("create an organization (you become its owner)").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
+		const created = await buildContext().client.createOrg({
+			name: options.name,
+			slug: options.slug
+		});
+		console.error(`created org ${created.org.slug} (${created.org.id})`);
+	});
+	org.command("rename").description("change an organization's display name (the slug is permanent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "new display name").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { org: row } = await ctx.client.updateOrg(ref.id, { name: options.name });
+		console.error(`renamed ${row.slug} to "${row.name}"`);
+	});
+	org.command("member").description("view organization members").command("list").alias("ls").description("list members, and whether each has finished key setup").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { members } = await ctx.client.listMembers(ref.id);
+		emit(options, { members }, () => printTable(members, [
+			col("email", (m) => m.email),
+			col("role", (m) => m.role),
+			col("name", (m) => m.name),
+			col("keys", (m) => m.publicKeyJwk ? "ready" : "pending"),
+			col("id", (m) => m.userId)
+		], "no members"));
+	});
+	const invite = org.command("invite").description("manage pending invitations");
+	invite.command("list").alias("ls").description("list outstanding invitations").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { invites } = await ctx.client.listInvites(ref.id);
+		emit(options, { invites }, () => printTable(invites, [
+			col("email", (i) => i.email),
 			col("role", (i) => i.role),
 			col("invited", (i) => i.createdAt),
 			col("id", (i) => i.id)
 		], "no pending invitations"));
 	});
-	invite.command("add <email>").description("invite someone to the organization").option("--org <slug>").option("--role <role>", "admin | member", "member").action(async (email, options) => {
+	invite.command("add <email>").description("invite someone to the organization").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--role <role>", "admin | member", "member").action(async (email, options) => {
 		if (options.role !== "admin" && options.role !== "member") fail("--role must be admin or member");
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -10136,13 +11009,13 @@ function registerOrgCommands(program) {
 		});
 		console.error(`invited ${row.email} as ${row.role} (${row.id}) — they join when they first sign in`);
 	});
-	invite.command("rm <inviteId>").description("rescind an invitation").option("--org <slug>").action(async (inviteId, options) => {
+	invite.command("rm <inviteId>").description("rescind an invitation").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (inviteId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await ctx.client.revokeInvite(ref.id, inviteId);
 		console.error(`${inviteId} revoked`);
 	});
-	org.command("mfa").description("show or set the org-wide second-factor requirement").option("--org <slug>").option("--set <policy>", "required | optional").option("--json", "print the raw API response").action(async (options) => {
+	org.command("mfa").description("show or set the org-wide second-factor requirement").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--set <policy>", "required | optional").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		if (options.set !== void 0 && options.set !== "required" && options.set !== "optional") fail("--set must be required or optional");
@@ -10155,7 +11028,7 @@ function registerOrgCommands(program) {
 			console.log(policy.required ? "required for all members" : "optional");
 		});
 	});
-	org.command("tree").description("print the org's applications, environments, and groups as a tree").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	org.command("tree").description("print the org's applications, environments, and groups as a tree").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const [{ apps }, { groups }] = await Promise.all([ctx.client.listApps(ref.id), ctx.client.listGroups(ref.id)]);
@@ -11021,7 +11894,7 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -11067,7 +11940,7 @@ function registerPgCommands(program) {
 			console.log(bootstrap);
 		}
 	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list provisioning targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -11077,7 +11950,7 @@ function registerPgCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
-	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -11089,13 +11962,14 @@ function registerPgCommands(program) {
 		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
 		console.log(bootstrap);
 	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`removed ${targetId}`);
 	});
-	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -11121,15 +11995,16 @@ function registerPgCommands(program) {
 		}, null, 2));
 		else console.log(url);
 	});
-	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
 		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
 	});
-	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
+	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its Postgres role is dropped immediately.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId}`);
 	});
@@ -11626,7 +12501,7 @@ function generateUserName(prefix = "tmp") {
 function registerRedisCommands(program) {
 	const redis = program.command("redis").description("temporary Redis credentials (short-lived, zero-knowledge)");
 	const target = redis.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Redis server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-cache").option("--org <slug>").requiredOption("--host <host>", "redis host").option("--port <port>", "redis port", "6379").option("--db <index>", "logical database index (the /<n> in the URL)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin redis:// (or rediss://) connection string (or set SEEKRIT_REDIS_ADMIN_URL); wrapped locally").option("--create-statement <cmd>", "custom SETUSER template (repeatable)", collect$1, []).option("--revoke-statement <cmd>", "custom DELUSER template (repeatable)", collect$1, []).action(async (options) => {
+	target.command("add").description("register a Redis server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-cache").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "redis host").option("--port <port>", "redis port", "6379").option("--db <index>", "logical database index (the /<n> in the URL)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin redis:// (or rediss://) connection string (or set SEEKRIT_REDIS_ADMIN_URL); wrapped locally").option("--create-statement <cmd>", "custom SETUSER template (repeatable)", collect$1, []).option("--revoke-statement <cmd>", "custom DELUSER template (repeatable)", collect$1, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -11667,7 +12542,7 @@ function registerRedisCommands(program) {
 		});
 		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
 	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list provisioning targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -11678,13 +12553,14 @@ function registerRedisCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${db}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`removed ${targetId}`);
 	});
-	redis.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--user <name>", "ACL user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+	redis.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <name>", "ACL user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -11710,7 +12586,7 @@ function registerRedisCommands(program) {
 		}, null, 2));
 		else console.log(url);
 	});
-	redis.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	redis.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -11719,9 +12595,10 @@ function registerRedisCommands(program) {
 			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
 		}
 	});
-	redis.command("revoke <leaseId>").description("revoke a lease now (deletes the ACL user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+	redis.command("revoke <leaseId>").description("revoke a lease now (deletes the ACL user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its Redis ACL user is deleted immediately.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId}`);
 	});
@@ -11813,7 +12690,7 @@ function buildConfig$1(kind, options) {
 }
 function registerRotationCommands(program) {
 	const rotation = program.command("rotation").description("managed rotation of stored secret values (scheduled, zero-knowledge)");
-	rotation.command("enable <secretName>").description("configure rotation for an existing secret").option("--org <slug>").option("--app <slug>").option("--group <slug>", "rotate a secret in a group environment").requiredOption("--env <slug>").requiredOption("--kind <kind>", "generated | postgres | mysql | redis").requiredOption("--every <duration>", "rotation cadence, e.g. 24h, 30d").option("--username <name>", "the EXISTING database account to re-key (db kinds)").option("--target <idOrName>", "registered lease target to rotate against (db kinds)").option("--user-host <host>", "MySQL account host part (default %)").option("--length <n>", "generated value length", "32").option("--alphabet <set>", "generated kind only: alphanumeric | hex | base64url | printable", "alphanumeric").option("--now", "rotate immediately as well as on the schedule").action(async (secretName, options) => {
+	rotation.command("enable <secretName>").description("configure rotation for an existing secret").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "rotate a secret in a group environment").requiredOption("--env <slug>", "environment slug").requiredOption("--kind <kind>", "generated | postgres | mysql | redis").requiredOption("--every <duration>", "rotation cadence, e.g. 24h, 30d").option("--username <name>", "the EXISTING database account to re-key (db kinds)").option("--target <idOrName>", "registered lease target to rotate against (db kinds)").option("--user-host <host>", "MySQL account host part (default %)").option("--length <n>", "generated value length", "32").option("--alphabet <set>", "generated kind only: alphanumeric | hex | base64url | printable", "alphanumeric").option("--now", "rotate immediately as well as on the schedule").action(async (secretName, options) => {
 		const ctx = buildContext();
 		const target = await resolveEnvTarget(ctx, options);
 		const config = buildConfig$1(options.kind, options);
@@ -11843,7 +12720,7 @@ function registerRotationCommands(program) {
 		else console.error(`first rotation: ${created.nextRotateAt}`);
 		console.log(created.id);
 	});
-	rotation.command("list").description("list rotation policies (schedules only — never values)").option("--org <slug>").option("--json", "print the full policies as JSON").action(async (options) => {
+	rotation.command("list").description("list rotation policies (schedules only — never values)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the full policies as JSON").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { rotations } = await ctx.client.listRotations(org.id);
@@ -11857,234 +12734,48 @@ function registerRotationCommands(program) {
 		}
 		for (const r of rotations) console.log(rotationLine(r));
 	});
-	rotation.command("show <rotationOrSecret>").description("show one policy, including the last failure if any").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("show <rotationOrSecret>").description("show one policy, including the last failure if any").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const r = await resolveRotation(ctx, (await resolveOrg(ctx, options.org)).id, ref);
 		console.log(JSON.stringify(r, null, 2));
 	});
-	rotation.command("rotate <rotationOrSecret>").description("rotate now (the same path the scheduler uses)").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("rotate <rotationOrSecret>").description("rotate now (the same path the scheduler uses)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
 		const { version, rotatedAt } = await ctx.client.rotateSecretNow(org.id, r.id);
 		console.error(`rotated ${r.secretName} at ${rotatedAt} — now at version ${version}. Read it with \`seekrit secrets get ${r.secretName}\`.`);
 	});
-	rotation.command("pause <rotationOrSecret>").description("stop rotating, keeping the policy").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("pause <rotationOrSecret>").description("stop rotating, keeping the policy").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
 		await ctx.client.updateRotation(org.id, r.id, { status: "paused" });
 		console.error(`paused rotation of ${r.secretName}`);
 	});
-	rotation.command("resume <rotationOrSecret>").description("resume rotating (also clears a failed streak)").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("resume <rotationOrSecret>").description("resume rotating (also clears a failed streak)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
 		const { rotation: updated } = await ctx.client.updateRotation(org.id, r.id, { status: "active" });
 		console.error(`resumed rotation of ${r.secretName} — next ${updated.nextRotateAt}`);
 	});
-	rotation.command("set-interval <rotationOrSecret>").description("change the cadence").requiredOption("--every <duration>", "new cadence, e.g. 24h, 30d").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("set-interval <rotationOrSecret>").description("change the cadence").requiredOption("--every <duration>", "new cadence, e.g. 24h, 30d").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
 		const { rotation: updated } = await ctx.client.updateRotation(org.id, r.id, { intervalSeconds: parseDurationSeconds(options.every, "--every") });
 		console.error(`${updated.secretName} now rotates every ${formatInterval(updated.intervalSeconds)} — next ${updated.nextRotateAt}`);
 	});
-	rotation.command("disable <rotationOrSecret>").description("stop rotating and remove the policy (the secret is untouched)").option("--org <slug>").action(async (ref, options) => {
+	rotation.command("disable <rotationOrSecret>").description("stop rotating and remove the policy (the secret is untouched)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const r = await resolveRotation(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Stop rotating ${r.secretName} and delete its policy? The current value stays as it is.`);
 		const { rotatorRevoked } = await ctx.client.disableRotation(org.id, r.id);
 		console.error(`disabled rotation of ${r.secretName}${rotatorRevoked ? " — rotator key access revoked for this environment" : ""}`);
 	});
 }
-/**
-* Fetch + decrypt every secret in a single environment.
-*
-* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
-* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
-* scope here — a reference to a secret inherited from a composed group is left
-* literal, because the group layers aren't fetched. `materializeEnv` is the
-* fully-layered view.
-*/
-async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
-	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
-}
-/**
-* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
-* the CLI's standard fatal exit — it is a config bug with no correct value to
-* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
-*/
-function interpolateValues(values, enabled = true) {
-	if (!enabled) return {
-		values,
-		interpolated: [],
-		unresolvedRefs: []
-	};
-	try {
-		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
-		return {
-			values: expandedValues,
-			interpolated: expanded,
-			unresolvedRefs: unresolved
-		};
-	} catch (err) {
-		return fail(err instanceof Error ? err.message : String(err));
-	}
-}
-/**
-* Decrypt one historical version of a secret. Ciphertext is bound to
-* `(envId, name)` as AAD and neither changes across versions, so an old blob
-* opens with the environment's current data key — no special handling needed.
-*/
-async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
-	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
-	const row = versions.find((v) => v.version === version);
-	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
-	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
-}
-async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
-	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
-	await ctx.client.setSecret(orgId, envId, name, ciphertext);
-}
-/**
-* Encrypt and store many secrets into one environment. The DEK is fetched once
-* (so user auth prompts for the passphrase a single time, not per variable),
-* then each value is encrypted locally and written. Existing names are
-* overwritten; the result splits them into created vs. updated for a summary.
-* Callers validate the names first — a rejected name aborts before any write.
-*/
-async function importSecrets(ctx, orgId, envId, entries) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const existing = new Set(secrets.map((s) => s.name));
-	const result = {
-		created: [],
-		updated: []
-	};
-	for (const [name, value] of Object.entries(entries)) {
-		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
-		await ctx.client.setSecret(orgId, envId, name, ciphertext);
-		(existing.has(name) ? result.updated : result.created).push(name);
-	}
-	return result;
-}
-/**
-* Resolve the full, layered environment for a running app: composed group
-* secrets (lowest precedence) → the app env's own secrets → `.env` files.
-* Each layer's DEK is unwrapped once with the principal's private key and its
-* ciphertext decrypted locally. `process.env` is NOT applied here — callers
-* that spawn a process layer it on top so the live shell always wins.
-*
-* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
-* reference always resolves to whichever layer won the name.
-*/
-async function materializeEnv(ctx, opts) {
-	const query = {};
-	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
-	if (opts.branch) query.branch = opts.branch;
-	if (!isTokenAuth(ctx)) {
-		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
-		query.env = opts.envId;
-	}
-	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
-	const privateKey = await getPrivateKey(ctx);
-	const values = {};
-	const provenance = {};
-	for (const layer of layers) {
-		const dek = await unwrapDek(layer.wrappedDek, privateKey);
-		let label;
-		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
-		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
-		else label = `app:${scope.appSlug}/${layer.slug}`;
-		for (const secret of layer.secrets) {
-			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
-			provenance[secret.name] = label;
-		}
-	}
-	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
-	return {
-		...interpolateValues(values, opts.interpolate !== false),
-		provenance,
-		scope,
-		loadedEnvFiles
-	};
-}
-/**
-* Resolve, going through the last-known-good cache when one is configured.
-*
-* Always live first: the cache exists for when the call cannot land, not to
-* save a round trip, so a recovered network is picked up on the very next
-* invocation. A *refused* resolve (401/403/…) drops the entry rather than
-* falling back to it — otherwise revoking a token would keep working offline
-* until the entry aged out.
-*/
-async function resolveWithCache(ctx, query, cache) {
-	if (!cache) return ctx.client.resolve(query);
-	try {
-		const response = await ctx.client.resolve(query);
-		try {
-			cache.write(JSON.stringify(response));
-		} catch (err) {
-			warn(`could not update the cache: ${errorMessage(err)}`);
-		}
-		return response;
-	} catch (err) {
-		if (!mayFallBack(err)) {
-			cache.invalidate();
-			throw err;
-		}
-		const found = cache.read();
-		if (found.kind === "hit") {
-			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
-			return JSON.parse(found.body);
-		}
-		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
-		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
-		throw err;
-	}
-}
-function warn(text) {
-	process.stderr.write(`seekrit: ${text}\n`);
-}
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-/**
-* Overlay `.env` files onto an existing value/provenance set (later files win).
-* Missing files are skipped. Returns the files that were actually loaded. Used
-* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
-* managed secrets are unavailable but `.env` should still apply.
-*/
-function overlayEnvFiles(values, provenance, envFiles) {
-	const loaded = [];
-	for (const file of envFiles) {
-		if (!existsSync(file)) continue;
-		loaded.push(file);
-		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
-			values[name] = value;
-			provenance[name] = `dotenv:${file}`;
-		}
-	}
-	return loaded;
-}
-/**
-* Print a name → source table to stderr (never the secret values). Names whose
-* value had references expanded are marked, and dangling references are called
-* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
-* deliberately passed through as literal text.
-*/
-function printExplain(provenance, refs = {}) {
-	const interpolated = new Set(refs.interpolated ?? []);
-	const names = Object.keys(provenance).sort();
-	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
-	for (const name of names) {
-		const marker = interpolated.has(name) ? "  (interpolated)" : "";
-		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
-	}
-	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
-}
 //#endregion
 //#region src/ssh.ts
 /**
@@ -12112,7 +12803,7 @@ function parseTtlSeconds(input) {
 function registerSshCommands(program) {
 	const ssh = program.command("ssh").description("temporary SSH access (short-lived certificates, zero-knowledge)");
 	const target = ssh.command("target").description("manage SSH CA targets");
-	target.command("add").description("create an SSH certificate authority to issue certs from").requiredOption("--name <name>", "display name, e.g. prod-fleet").option("--org <slug>").option("--host <host>", "default host the printed ssh command connects to").option("--user <login>", "default login user (a cert principal)").option("--principal <name>", "allow-list a principal certs may request (repeatable)", collect, []).option("--extension <name>", "cert extension to grant, e.g. permit-pty (repeatable)", collect, []).option("--max-ttl <duration>", "clamp requested cert lifetime, e.g. 8h").action(async (options) => {
+	target.command("add").description("create an SSH certificate authority to issue certs from").requiredOption("--name <name>", "display name, e.g. prod-fleet").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--host <host>", "default host the printed ssh command connects to").option("--user <login>", "default login user (a cert principal)").option("--principal <name>", "allow-list a principal certs may request (repeatable)", collect, []).option("--extension <name>", "cert extension to grant, e.g. permit-pty (repeatable)", collect, []).option("--max-ttl <duration>", "clamp requested cert lifetime, e.g. 8h").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const ca = await generateSshCaKeyPair(`seekrit-ca:${options.name}`);
@@ -12139,7 +12830,7 @@ function registerSshCommands(program) {
 		console.error("\nInstall the CA on your hosts, then issue certs with `seekrit ssh lease`:\n");
 		console.log(sshHostSetupInstructions(config));
 	});
-	target.command("list").description("list SSH CA targets").option("--org <slug>").action(async (options) => {
+	target.command("list").description("list SSH CA targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -12151,7 +12842,7 @@ function registerSshCommands(program) {
 			console.log(`${t.id}\t${t.name}\t${where}\tprincipals=${principals}`);
 		}
 	});
-	target.command("setup <targetId>").description("reprint the one-time host setup for an SSH target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("setup <targetId>").description("reprint the one-time host setup for an SSH target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -12161,13 +12852,14 @@ function registerSshCommands(program) {
 		if (cfg.provider !== "ssh") fail("not an ssh target (see `seekrit pg`)");
 		console.log(sshHostSetupInstructions(cfg));
 	});
-	target.command("rm <targetId>").description("delete an SSH CA target").option("--org <slug>").action(async (targetId, options) => {
+	target.command("rm <targetId>").description("delete an SSH CA target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
 		await ctx.client.deleteLeaseTarget(org.id, targetId);
 		console.error(`deleted ${targetId}`);
 	});
-	ssh.command("lease <target>").description("mint a short-lived SSH certificate; prints a ready-to-run ssh command").option("--org <slug>").option("--principal <name>", "login user to request (repeatable; default from target)", collect, []).option("--ttl <duration>", "certificate lifetime, e.g. 30m, 1h, 8h", "1h").option("--out <dir>", "directory to write the key + cert (default: a temp dir)").option("--json", "print key/cert paths and the certificate as JSON").action(async (targetRef, options) => {
+	ssh.command("lease <target>").description("mint a short-lived SSH certificate; prints a ready-to-run ssh command").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--principal <name>", "login user to request (repeatable; default from target)", collect, []).option("--ttl <duration>", "certificate lifetime, e.g. 30m, 1h, 8h", "1h").option("--out <dir>", "directory to write the key + cert (default: a temp dir)").option("--json", "print key/cert paths and the certificate as JSON").action(async (targetRef, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
@@ -12205,7 +12897,7 @@ function registerSshCommands(program) {
 		}, null, 2));
 		else console.log(command);
 	});
-	ssh.command("leases").description("list SSH leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+	ssh.command("leases").description("list SSH leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const { leases } = await ctx.client.listLeases(org.id);
@@ -12214,9 +12906,10 @@ function registerSshCommands(program) {
 			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
 		}
 	});
-	ssh.command("revoke <leaseId>").description("mark a lease revoked in the ledger (the cert stays valid until it expires)").option("--org <slug>").action(async (leaseId, options) => {
+	ssh.command("revoke <leaseId>").description("mark a lease revoked in the ledger (the cert stays valid until it expires)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId}? Certificates already issued stay valid until they expire.`);
 		await ctx.client.revokeLease(org.id, leaseId);
 		console.error(`revoked ${leaseId} (issued certs remain valid until they expire)`);
 	});
@@ -12732,7 +13425,7 @@ async function resolveConnection(ctx, orgId, ref) {
 }
 function registerSyncCommands(program) {
 	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, Cloudflare, …)");
-	sync.command("connections").alias("conns").description("list destination accounts seekrit can push to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	sync.command("connections").alias("conns").description("list destination accounts seekrit can push to").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { connections } = await ctx.client.listSyncConnections(ref.id);
@@ -12744,7 +13437,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--azure-tenant-id <id>", "azure-key-vault: Entra Directory (tenant) ID, a GUID").option("--azure-client-id <id>", "azure-key-vault: Application (client) ID of the service principal, a GUID (its client secret is read from stdin)").option("--azure-cloud <cloud>", `azure-key-vault: ${AZURE_CLOUDS.join(" | ")}`, "public").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--azure-tenant-id <id>", "azure-key-vault: Entra Directory (tenant) ID, a GUID").option("--azure-client-id <id>", "azure-key-vault: Application (client) ID of the service principal, a GUID (its client secret is read from stdin)").option("--azure-cloud <cloud>", `azure-key-vault: ${AZURE_CLOUDS.join(" | ")}`, "public").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -12761,7 +13454,7 @@ function registerSyncCommands(program) {
 		});
 		console.error(`connected ${created.connection.name} (${created.connection.id})`);
 	});
-	destinationOptions(sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--json", "print the raw API response").action(async (connection, options) => {
+	destinationOptions(sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--json", "print the raw API response").action(async (connection, options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -12770,7 +13463,7 @@ function registerSyncCommands(program) {
 		emit(options, result, () => printFields([["result", result.ok ? "ok" : "failed"], ["error", result.error ?? null]]));
 		if (!result.ok) process.exitCode = 1;
 	});
-	sync.command("disconnect <connection>").description("delete a destination account, its bindings, and its keypair").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (connection, options) => {
+	sync.command("disconnect <connection>").description("delete a destination account, its bindings, and its keypair").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (connection, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const conn = await resolveConnection(ctx, ref.id, connection);
@@ -12780,7 +13473,7 @@ function registerSyncCommands(program) {
 		await ctx.client.deleteSyncConnection(ref.id, conn.id);
 		console.error(`disconnected ${conn.name}`);
 	});
-	sync.command("bindings").description("list which environments are syncing where").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+	sync.command("bindings").description("list which environments are syncing where").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const [{ bindings }, { connections }] = await Promise.all([ctx.client.listSyncBindings(ref.id), ctx.client.listSyncConnections(ref.id)]);
@@ -12795,7 +13488,7 @@ function registerSyncCommands(program) {
 			col("id", (b) => b.id)
 		], "nothing is syncing — enable it with `seekrit sync enable`"));
 	});
-	destinationOptions(sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
+	destinationOptions(sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		if (options.onDelete !== "delete" && options.onDelete !== "retain") fail("--on-delete must be delete or retain");
 		if (options.mode !== "auto" && options.mode !== "manual") fail("--mode must be auto or manual");
@@ -12834,26 +13527,26 @@ function registerSyncCommands(program) {
 		console.error(`syncing ${target.appSlug}/${target.envSlug} → ${conn.name} ${describeDestination(destination)} (${binding.id})`);
 		if (binding.mode === "manual") console.error("mode is manual — push with `seekrit sync run`");
 	});
-	sync.command("pause <bindingId>").description("stop pushing on this binding without deleting it").option("--org <slug>").action(async (bindingId, options) => {
+	sync.command("pause <bindingId>").description("stop pushing on this binding without deleting it").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (bindingId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await ctx.client.updateSyncBinding(ref.id, bindingId, { enabled: false });
 		console.error(`${bindingId} paused`);
 	});
-	sync.command("resume <bindingId>").description("start pushing on a paused binding again").option("--org <slug>").action(async (bindingId, options) => {
+	sync.command("resume <bindingId>").description("start pushing on a paused binding again").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (bindingId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await ctx.client.updateSyncBinding(ref.id, bindingId, { enabled: true });
 		console.error(`${bindingId} resumed`);
 	});
-	sync.command("disable <bindingId>").alias("rm").description("stop syncing an environment and revoke seekrit's key for it").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (bindingId, options) => {
+	sync.command("disable <bindingId>").alias("rm").description("stop syncing an environment and revoke seekrit's key for it").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (bindingId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		await confirmDestructive(options.yes, `Delete binding ${bindingId}? Values already pushed stay on the destination.`);
 		await ctx.client.deleteSyncBinding(ref.id, bindingId);
 		console.error(`${bindingId} deleted`);
 	});
-	sync.command("run <bindingId>").description("push now, synchronously, and report what landed").option("--org <slug>").option("--json", "print the raw API response").action(async (bindingId, options) => {
+	sync.command("run <bindingId>").description("push now, synchronously, and report what landed").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (bindingId, options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { run } = await ctx.client.runSyncBinding(ref.id, bindingId);
@@ -12872,7 +13565,7 @@ function registerSyncCommands(program) {
 		});
 		if (run.status !== "succeeded") process.exitCode = 1;
 	});
-	sync.command("runs").description("show the sync run history").option("--org <slug>").option("--binding <id>", "only runs of this binding").option("--json", "print the raw API response").action(async (options) => {
+	sync.command("runs").description("show the sync run history").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--binding <id>", "only runs of this binding").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
 		const { runs } = await ctx.client.listSyncRuns(ref.id, options.binding);
@@ -13038,6 +13731,7 @@ async function runLogout() {
 		console.error("not signed in");
 		return;
 	}
+	if (!sessionToken) console.error(config.token ? "signed out — the stored service token was removed from this machine" : "signed out");
 	if (sessionToken) {
 		const api = new SeekritClient({
 			baseUrl: process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "https://api.seekrit.dev",
@@ -13255,9 +13949,10 @@ withTarget(secrets.command("restore <name> <version>").description("roll a secre
 	const { secret, restoredFrom } = await ctx.client.restoreSecret(orgId, envId, name, parseVersion(version));
 	console.error(`${name} restored from v${restoredFrom} — now v${secret.version}`);
 });
-withTarget(secrets.command("rm <name>").description("delete a secret")).action(async (name, options) => {
+withTarget(secrets.command("rm <name>").description("delete a secret and its whole version history").option("-y, --yes", "skip the confirmation")).action(async (name, options) => {
 	const ctx = buildContext();
-	const { orgId, envId } = await resolveEnvTarget(ctx, options);
+	const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+	await confirmDestructive(options.yes, `Delete ${name} from ${label}, including every earlier version? This cannot be undone.`);
 	await ctx.client.deleteSecret(orgId, envId, name);
 	console.error(`${name} deleted`);
 });
@@ -13342,8 +14037,7 @@ async function materializeForRun(options) {
 			branch
 		}, dotenvVars);
 	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		console.error(`seekrit: continuing without seekrit-managed secrets: ${message}`);
+		console.error(`seekrit: continuing without seekrit-managed secrets: ${describeError(err)}`);
 		const values = {};
 		const provenance = {};
 		overlayEnvFiles(values, provenance, envFiles);
@@ -13463,7 +14157,7 @@ async function reapStragglers(pids, signal) {
 		process.kill(pid, "SIGKILL");
 	} catch {}
 }
-program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
 	const { values, provenance, interpolated, unresolvedRefs } = await materializeForRun(options);
@@ -13515,7 +14209,7 @@ program.command("run").description("run a command with decrypted secrets injecte
 	});
 	child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
 });
-program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
+program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
 	if (![
 		"dotenv",
 		"json",
@@ -13531,7 +14225,7 @@ program.command("export").description("print decrypted secrets (dotenv, json, or
 registerAccessCommands(program);
 registerHoneyTokenCommands(program);
 const token = program.command("token").description("manage service tokens (CI, docker, agents)");
-token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
+token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
 	const ctx = buildContext();
 	const role = options.admin ? "admin" : "member";
 	const boundToEnv = Boolean(options.app || options.env);
@@ -13580,7 +14274,7 @@ token.command("create").description("create a service token (runtime, or --admin
 	console.error(`${role} token created${granted ? " and granted" : ""} for ${scope} — save it now, it is not stored:`);
 	console.log(created.token);
 });
-token.command("list").alias("ls").description("list service tokens").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+token.command("list").alias("ls").description("list service tokens").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
 	const ctx = buildContext();
 	const orgRef = await resolveOrg(ctx, options.org);
 	const { tokens } = await ctx.client.listTokens(orgRef.id);
@@ -13594,15 +14288,17 @@ token.command("list").alias("ls").description("list service tokens").option("--o
 		col("id", (t) => t.id)
 	], "no service tokens — create one with `seekrit token create`"));
 });
-token.command("revoke <tokenId>").description("revoke a service token").option("--org <slug>").action(async (tokenId, options) => {
+token.command("revoke <tokenId>").description("revoke a service token").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (tokenId, options) => {
 	const ctx = buildContext();
 	const orgRef = await resolveOrg(ctx, options.org);
+	await confirmDestructive(options.yes, `Revoke ${tokenId}? Anything still presenting it stops resolving immediately.`);
 	await ctx.client.revokeToken(orgRef.id, tokenId);
 	console.error(`${tokenId} revoked`);
 });
-token.command("delete <tokenId>").description("permanently delete a revoked service token (revoke it first)").option("--org <slug>").action(async (tokenId, options) => {
+token.command("delete <tokenId>").description("permanently delete a revoked service token (revoke it first)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (tokenId, options) => {
 	const ctx = buildContext();
 	const orgRef = await resolveOrg(ctx, options.org);
+	await confirmDestructive(options.yes, `Permanently delete ${tokenId}? Its audit history keeps the id, but the token row is gone.`);
 	await ctx.client.deleteToken(orgRef.id, tokenId);
 	console.error(`${tokenId} deleted`);
 });
@@ -13614,6 +14310,8 @@ registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
 registerPaperclipCommands(program);
+registerOpenclawCommands(program);
+registerHermesCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);
@@ -13633,7 +14331,7 @@ registerSyncCommands(program);
 registerBillingCommands(program);
 const argv = process.argv.map((arg) => arg === "-v" ? "--version" : arg);
 program.parseAsync(argv).catch((err) => {
-	fail(err instanceof Error ? err.message : String(err));
+	fail(describeError(err));
 });
 //#endregion
 export { verifyMessage as A, toBase64 as B, isServiceToken as C, importVerifyingKey as D, importSigningKey as E, kmsBlobKeyRef as F, kmsDecrypt as I, kmsEncrypt as L, generateMysqlCredential as M, generateDataKey as N, signMessage as O, generateEncryptKeyMaterial as P, wrapDek as R, createServiceToken as S, generateSigningKeyMaterial as T, parseBranchTtl as V, isTokenAuth as _, ensureM2mAdminToken as a, writeProjectConfig as b, kmsResolveKey as c, resolveAppEnv as d, resolveBranch as f, getDek as g, resolveOrg as h, materializeEnv as i, generatePostgresCredential as j, signatureKeyRef as k, kmsResolveRecipient as l, resolveGroup as m, fetchDecryptedSecrets as n, kmsCallerIdentity as o, resolveEnvTarget as p, fetchDecryptedVersion as r, kmsRecoverMaterial as s, encryptAndSetSecret as t, resolveApp as u, tryBuildContext as v, parseServiceToken as w, version as x, setFailThrows as y, generateDek as z };