@seekrit/cli 1.0.0 → 1.2.0

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
 import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
@@ -8,6 +8,7 @@ import { dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
 /** Default lifetime of a published bundle (7 days), in seconds. */
 const POLICY_DEFAULT_TTL_SECONDS = 10080 * 60;
 /** Bounds on a bundle's lifetime: an hour at the short end, 90 days at the long. */
@@ -1906,6 +1907,8 @@ const AUDIT_ACTIONS = [
 	"org.mfa_policy_changed",
 	"org.exported",
 	"user.keys_updated",
+	"user.passkey_enrolled",
+	"user.passkey_removed",
 	"user.notification_prefs_updated",
 	"app.created",
 	"app.updated",
@@ -2150,6 +2153,16 @@ z.object({
 	*/
 	encryptedPrivateKey: z.string().min(1)
 });
+z.object({
+	/** Base64url WebAuthn credential id — what `allowCredentials` is built from. */
+	credentialId: z.string().min(1).max(512),
+	/** Human label for the device, e.g. "MacBook Touch ID". Display only. */
+	label: z.string().min(1).max(64),
+	/** Base64url PRF evaluation input for this credential; not a secret. */
+	prfInput: z.string().min(1).max(256),
+	/** The private key wrapped to this passkey's PRF output. */
+	encryptedPrivateKey: z.string().min(1).max(8192).refine((v) => v.startsWith("pk2."), { message: "expected a pk2. passkey wrap" })
+});
 const grantEnvironmentKeySchema = z.object({
 	principalType: principalTypeSchema,
 	principalId: z.string().min(1),
@@ -2482,7 +2495,8 @@ const SYNC_PROVIDER_KINDS = [
 	"github-actions",
 	"gcp-secret-manager",
 	"langgraph-platform",
-	"azure-key-vault"
+	"azure-key-vault",
+	"huggingface-spaces"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -2871,6 +2885,21 @@ const azureKeyVaultConnectionConfigSchema = z.object({
 	/** Which Azure cloud the tenant and its vaults live in. */
 	cloud: z.enum(AZURE_CLOUDS).default("public")
 });
+/**
+* Hugging Face account scope — empty, as Render's and Fly's are.
+*
+* Neither half of "which account, which thing" needs stating. A Hub user access
+* token belongs to one user and carries their write access to every Space they
+* or their organizations own; a Space is addressed by `owner/name`, which is
+* globally unique. So the token plus the destination is the whole address.
+*
+* There is deliberately no `baseUrl` twin of the GitHub Enterprise Server
+* field. `HF_ENDPOINT` exists in the Python client for Hub *mirrors*, which
+* serve repository content — not the settings API this connector writes, and
+* not something a mirror is expected to accept a write on. Adding the field
+* would invite pointing a connection at a host that silently swallows secrets.
+*/
+const huggingfaceSpacesConnectionConfigSchema = z.object({ provider: z.literal("huggingface-spaces") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -2889,7 +2918,8 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	githubActionsConnectionConfigSchema,
 	gcpSecretManagerConnectionConfigSchema,
 	langgraphPlatformConnectionConfigSchema,
-	azureKeyVaultConnectionConfigSchema
+	azureKeyVaultConnectionConfigSchema,
+	huggingfaceSpacesConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -3680,6 +3710,40 @@ const azureKeyVaultDestinationSchema = z.object({
 	/** What to do with a name Key Vault cannot store — see {@link AZURE_KEY_VAULT_NAME_MODES}. */
 	nameMode: z.enum(AZURE_KEY_VAULT_NAME_MODES).default("dash")
 });
+/**
+* The Space whose secrets a binding owns, addressed the way the Hub addresses
+* every repository: `owner/name`, where `owner` is a user or an organization.
+*
+* A Space has **one** secret set, shared by every replica — there is no
+* per-target split to state, the way Vercel and Pages have one. The Hub's
+* convention is that staging and production are separate Spaces
+* (`acme/demo`, `acme/demo-staging`), so pointing at an environment means
+* naming that Space, exactly as a Fly environment means naming its own app.
+*
+* Validated by shape because the two habitual slips both fail *late*: pasting
+* the browser URL (`https://huggingface.co/spaces/acme/demo`) or the bare name
+* without its owner. Either one is a 404 from the Hub inside an alarm with
+* nobody watching, and a 404 says nothing about which half was wrong. The
+* leading character is held to alphanumeric, which is also what rejects the
+* `.` and `..` that no repository may be called.
+*/
+const huggingfaceRepoIdSchema = z.string().trim().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/, "must be a Space ID as owner/name, e.g. acme/support-demo — not a URL");
+/**
+* One Hugging Face **Space**, whose secrets arrive in the app's container as
+* environment variables.
+*
+* Only secrets. A Space also has *variables*, and they are not a second lane
+* seekrit could use: the Hub calls them "non-sensitive configuration values",
+* they are "publicly accessible and viewable", and they are copied into every
+* Space duplicated from this one. Writing a seekrit secret there would publish
+* it, so this connector has no variables mode — a binding that wants one is
+* asking for the wrong thing.
+*/
+const huggingfaceSpacesDestinationSchema = z.object({
+	provider: z.literal("huggingface-spaces"),
+	/** Space ID as `owner/name`, e.g. `acme/support-demo`. */
+	repoId: huggingfaceRepoIdSchema
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -3698,7 +3762,8 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	githubActionsDestinationSchema,
 	gcpSecretManagerDestinationSchema,
 	langgraphPlatformDestinationSchema,
-	azureKeyVaultDestinationSchema
+	azureKeyVaultDestinationSchema,
+	huggingfaceSpacesDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -4986,7 +5051,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.0.0";
+var version = "1.2.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -5059,6 +5124,22 @@ var SeekritClient = class {
 	revokeCliSession(sessionId) {
 		return this.request("DELETE", `/v1/me/cli-sessions/${sessionId}`);
 	}
+	/**
+	* The passkeys enrolled to unlock this user's keyring, each with the `pk2.`
+	* blob its PRF output decrypts. One call is everything the unlock ceremony
+	* needs; the blobs are opaque without the authenticator.
+	*/
+	listMyPasskeys() {
+		return this.request("GET", "/v1/me/passkeys");
+	}
+	/** File a private key already wrapped, client-side, to a passkey's PRF output. */
+	enrollMyPasskey(input) {
+		return this.request("POST", "/v1/me/passkeys", input);
+	}
+	/** Stop a passkey unlocking the keyring. The key itself is untouched. */
+	deleteMyPasskey(passkeyId) {
+		return this.request("DELETE", `/v1/me/passkeys/${passkeyId}`);
+	}
 	/** What a pending login request is asking for — for the approval screen. */
 	getCliLoginRequest(code) {
 		return this.request("GET", `/v1/cli-login/${encodeURIComponent(code)}`);
@@ -9584,6 +9665,224 @@ function registerGroupCommands(program) {
 	});
 }
 //#endregion
+//#region src/hermes.ts
+/**
+* `seekrit hermes` — wire seekrit into [Hermes Agent](https://hermes-agent.nousresearch.com)
+* as a **secret source**.
+*
+* Hermes reads credentials from `~/.hermes/.env` and the process environment, and
+* a *secret source* is the documented way to fill that environment from
+* somewhere else at startup. Implementing one is Python, and it lives in the
+* Python SDK (`seekrit.hermes`) rather than here — a `SecretSource` subclass and
+* the `register(ctx)` hook Hermes calls. This command exists for the two parts
+* that are not Python: the `config.yaml` block, and the plugin directory for a
+* Hermes install that cannot see the SDK's entry point.
+*
+* **`config.yaml` is printed, not written.** It is YAML that belongs to
+* somebody's agent, with comments and anchors this CLI carries no parser for;
+* a rewrite through a JSON round trip would delete them. The plugin directory
+* *is* written, because those two files are entirely ours.
+*
+* There are two sources, and which one to use is a real choice rather than a
+* default. `seekrit` is **bulk**: one environment, whole, nothing to enumerate.
+* `seekrit_refs` is **mapped**: explicit `VAR: skt://NAME` bindings, which is
+* what you need to rename a secret, read more than one environment, or win a
+* contested variable — Hermes lets a mapped claim beat a bulk one.
+*/
+/** The two source names `seekrit.hermes` registers. */
+const BULK_SOURCE = "seekrit";
+const MAPPED_SOURCE = "seekrit_refs";
+/** Hermes' home: `$HERMES_HOME`, else `~/.hermes`. */
+function hermesHome(env = process.env) {
+	const home = env.HERMES_HOME?.trim();
+	return home && home.length > 0 ? resolve(home) : join(homedir(), ".hermes");
+}
+const NAME_RE$1 = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* Build an `skt://` reference.
+*
+* A service token is bound to one environment, so a reference names a *token*
+* (by the alias its `tokens:` map gives it) and a secret in that token's
+* environment — not an arbitrary app and env, which nothing on the read path
+* could resolve.
+*/
+function reference(name, tokenAlias) {
+	return `skt://${tokenAlias ? `${tokenAlias}/` : ""}${name}`;
+}
+/**
+* The `secrets:` block for `~/.hermes/config.yaml`.
+*
+* Hand-rolled rather than serialized, because the shape is fixed and small and
+* the output is meant to be *read* — a generic emitter would quote keys and
+* flow-fold lists in ways that make a config someone has to paste look foreign.
+*/
+function configBlock(options = {}) {
+	const source = options.mapped ? MAPPED_SOURCE : BULK_SOURCE;
+	const lines = [
+		"secrets:",
+		`  sources: [${source}]`,
+		`  ${source}:`,
+		"    enabled: true"
+	];
+	if (options.tokenEnv && options.tokenEnv !== "SEEKRIT_TOKEN") lines.push(`    token_env: ${options.tokenEnv}`);
+	if (options.mapped) {
+		const tokens = Object.entries(options.tokens ?? {});
+		if (tokens.length > 0) {
+			lines.push("    tokens:");
+			for (const [alias, variable] of tokens) lines.push(`      ${alias}: ${variable}`);
+		}
+		lines.push("    env:");
+		const bindings = options.bindings ?? [];
+		if (bindings.length === 0) lines.push(`      OPENAI_API_KEY: ${reference("OPENAI_API_KEY")}`);
+		else for (const b of bindings) lines.push(`      ${b.variable}: ${reference(b.name, b.tokenAlias)}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+/** `plugin.yaml` for the directory-install path. */
+function pluginYaml() {
+	return [
+		"name: seekrit",
+		"description: >-",
+		"  Resolve Hermes provider credentials from seekrit — end-to-end encrypted",
+		"  secrets, decrypted in this process by your own service token.",
+		""
+	].join("\n");
+}
+/**
+* `__init__.py` for the directory-install path.
+*
+* Re-exporting `register` is the whole file: the implementation lives in the
+* published SDK, so a plugin scaffolded once keeps up with SDK releases instead
+* of pinning a copy of the resolver into somebody's home directory.
+*/
+function pluginInit() {
+	return [
+		"\"\"\"seekrit secret sources for Hermes Agent.",
+		"",
+		"Hermes calls `register(ctx)` from this module. The implementation lives in",
+		"the `seekrit` package (`pip install seekrit`), so this file stays a re-export",
+		"and never has to be regenerated.",
+		"\"\"\"",
+		"",
+		"from seekrit.hermes import register  # noqa: F401",
+		""
+	].join("\n");
+}
+/**
+* Parse a `VAR=NAME` or `VAR=alias/NAME` binding for `--bind`.
+*
+* The left side is the environment variable Hermes will set; the right side is
+* the seekrit secret it comes from. They differ often enough — that is most of
+* why the mapped source exists — that inferring one from the other would be
+* wrong more than it was convenient.
+*/
+function parseBinding(raw) {
+	const eq = raw.indexOf("=");
+	if (eq <= 0) return void 0;
+	const variable = raw.slice(0, eq).trim();
+	const target = raw.slice(eq + 1).trim();
+	if (!NAME_RE$1.test(variable) || target.length === 0) return void 0;
+	const slash = target.indexOf("/");
+	if (slash === -1) return NAME_RE$1.test(target) ? {
+		variable,
+		name: target
+	} : void 0;
+	const tokenAlias = target.slice(0, slash).trim();
+	const name = target.slice(slash + 1).trim();
+	if (tokenAlias.length === 0 || !NAME_RE$1.test(name)) return void 0;
+	return {
+		variable,
+		name,
+		tokenAlias
+	};
+}
+/** Parse a `--token alias=VAR` pair. */
+function parseTokenAlias(raw) {
+	const eq = raw.indexOf("=");
+	if (eq <= 0) return void 0;
+	const alias = raw.slice(0, eq).trim();
+	const variable = raw.slice(eq + 1).trim();
+	if (alias.length === 0 || !NAME_RE$1.test(variable)) return void 0;
+	return {
+		alias,
+		variable
+	};
+}
+function registerHermesCommands(program) {
+	const hermes = program.command("hermes").description("wire seekrit into a Hermes Agent as a secret source (`seekrit hermes --help`)");
+	hermes.command("init").description("print the Hermes config that resolves credentials from seekrit").option("--mapped", `use the ${MAPPED_SOURCE} source (explicit VAR -> secret bindings)`).option("--token-env <var>", "variable holding the service token", "SEEKRIT_TOKEN").option("--bind <VAR=NAME...>", "a mapped binding, e.g. OPENAI_API_KEY=OPENAI_KEY").option("--token <alias=VAR...>", "name a second token, e.g. billing=SEEKRIT_TOKEN_BILLING").option("--plugin-dir", "also scaffold $HERMES_HOME/plugins/seekrit (for a pip-less install)").option("--home <path>", "Hermes home (default: $HERMES_HOME or ~/.hermes)").option("--json", "machine-readable output").action((options) => {
+		const bindings = (options.bind ?? []).map((raw) => {
+			const parsed = parseBinding(raw);
+			if (!parsed) fail(`--bind must be VAR=NAME or VAR=alias/NAME (got "${raw}")`);
+			return parsed;
+		});
+		const tokens = {};
+		for (const raw of options.token ?? []) {
+			const parsed = parseTokenAlias(raw);
+			if (!parsed) fail(`--token must be alias=VARIABLE (got "${raw}")`);
+			tokens[parsed.alias] = parsed.variable;
+		}
+		for (const binding of bindings) if (binding.tokenAlias && !tokens[binding.tokenAlias]) fail(`--bind ${binding.variable} names token alias "${binding.tokenAlias}", so pass --token ${binding.tokenAlias}=<VARIABLE> too`);
+		if (!options.mapped && (bindings.length > 0 || Object.keys(tokens).length > 0)) fail("--bind and --token describe the mapped source: pass --mapped as well");
+		const source = options.mapped ? MAPPED_SOURCE : BULK_SOURCE;
+		const block = configBlock({
+			mapped: options.mapped,
+			tokenEnv: options.tokenEnv,
+			bindings,
+			tokens
+		});
+		const home = options.home ? resolve(options.home) : hermesHome();
+		const pluginDir = join(home, "plugins", "seekrit");
+		const written = [];
+		if (options.pluginDir) {
+			mkdirSync(pluginDir, { recursive: true });
+			const files = [["plugin.yaml", pluginYaml()], ["__init__.py", pluginInit()]];
+			for (const [name, contents] of files) {
+				const path = join(pluginDir, name);
+				writeFileSync(path, contents);
+				written.push(path);
+			}
+		}
+		emit(options, {
+			source,
+			configPath: join(home, "config.yaml"),
+			block,
+			written
+		}, () => {
+			section("hermes secret source");
+			printFields([
+				["source", source],
+				["shape", options.mapped ? "mapped (explicit bindings)" : "bulk (whole environment)"],
+				["config", join(home, "config.yaml")],
+				["plugin dir", options.pluginDir ? pluginDir : "not scaffolded"]
+			]);
+			console.log();
+			console.log("1. Install the SDK into the environment Hermes runs in:");
+			console.log("     pip install seekrit");
+			console.log();
+			console.log("2. Put the service token in ~/.hermes/.env (not config.yaml):");
+			console.log(`     ${options.tokenEnv ?? "SEEKRIT_TOKEN"}=skt_...`);
+			console.log();
+			console.log("3. Enable the plugin and merge this into ~/.hermes/config.yaml:");
+			console.log("     hermes plugins enable seekrit");
+			console.log();
+			console.log(block.trimEnd());
+			console.log();
+			if (written.length > 0) {
+				console.log("Scaffolded:");
+				for (const path of written) console.log(`  ${path}`);
+				console.log();
+			}
+			console.log("The source overrides values already in .env or your shell, so a rotation wins — list a variable under `preserve_existing` when a local override is the point.");
+		});
+	});
+	hermes.command("ref <name>").description("print the skt:// reference to bind a Hermes variable to").option("--token-alias <alias>", "resolve through a second token named in `tokens:`").option("--json", "machine-readable output").action((name, options) => {
+		if (!NAME_RE$1.test(name)) fail(`not a valid secret name: "${name}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
+		const ref = reference(name, options.tokenAlias);
+		emit(options, { reference: ref }, () => console.log(ref));
+	});
+}
+//#endregion
 //#region src/honey.ts
 /**
 * Honey tokens — decoy credentials that unlock nothing and alert when used.
@@ -10092,100 +10391,689 @@ function collect$3(value, acc) {
 	acc.push(value);
 	return acc;
 }
-//#endregion
-//#region src/orgs.ts
 /**
-* Counts for `org show`. Each list is admin-gated to a different degree, so a
-* member who can't read one still gets the rest: a failed call reports as
-* `null`, which `printFields` drops and JSON preserves as "not visible to you".
+* Fetch + decrypt every secret in a single environment.
+*
+* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
+* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
+* scope here — a reference to a secret inherited from a composed group is left
+* literal, because the group layers aren't fetched. `materializeEnv` is the
+* fully-layered view.
 */
-async function countOrNull(load) {
+async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
+	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
+}
+/**
+* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
+* the CLI's standard fatal exit — it is a config bug with no correct value to
+* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
+*/
+function interpolateValues(values, enabled = true) {
+	if (!enabled) return {
+		values,
+		interpolated: [],
+		unresolvedRefs: []
+	};
 	try {
-		return await load();
-	} catch {
-		return null;
+		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
+		return {
+			values: expandedValues,
+			interpolated: expanded,
+			unresolvedRefs: unresolved
+		};
+	} catch (err) {
+		return fail(err instanceof Error ? err.message : String(err));
 	}
 }
-async function orgOverview(ctx, orgId) {
-	const [apps, groups, members, tokens] = await Promise.all([
-		countOrNull(async () => (await ctx.client.listApps(orgId)).apps.length),
-		countOrNull(async () => (await ctx.client.listGroups(orgId)).groups.length),
-		countOrNull(async () => (await ctx.client.listMembers(orgId)).members.length),
-		countOrNull(async () => (await ctx.client.listTokens(orgId)).tokens.length)
-	]);
+/**
+* Decrypt one historical version of a secret. Ciphertext is bound to
+* `(envId, name)` as AAD and neither changes across versions, so an old blob
+* opens with the environment's current data key — no special handling needed.
+*/
+async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
+	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
+	const row = versions.find((v) => v.version === version);
+	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
+	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
+}
+async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
+	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
+	await ctx.client.setSecret(orgId, envId, name, ciphertext);
+}
+/**
+* Encrypt and store many secrets into one environment. The DEK is fetched once
+* (so user auth prompts for the passphrase a single time, not per variable),
+* then each value is encrypted locally and written. Existing names are
+* overwritten; the result splits them into created vs. updated for a summary.
+* Callers validate the names first — a rejected name aborts before any write.
+*/
+async function importSecrets(ctx, orgId, envId, entries) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const existing = new Set(secrets.map((s) => s.name));
+	const result = {
+		created: [],
+		updated: []
+	};
+	for (const [name, value] of Object.entries(entries)) {
+		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
+		await ctx.client.setSecret(orgId, envId, name, ciphertext);
+		(existing.has(name) ? result.updated : result.created).push(name);
+	}
+	return result;
+}
+/**
+* Resolve the full, layered environment for a running app: composed group
+* secrets (lowest precedence) → the app env's own secrets → `.env` files.
+* Each layer's DEK is unwrapped once with the principal's private key and its
+* ciphertext decrypted locally. `process.env` is NOT applied here — callers
+* that spawn a process layer it on top so the live shell always wins.
+*
+* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
+* reference always resolves to whichever layer won the name.
+*/
+async function materializeEnv(ctx, opts) {
+	const query = {};
+	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (opts.branch) query.branch = opts.branch;
+	if (!isTokenAuth(ctx)) {
+		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
+		query.env = opts.envId;
+	}
+	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
+	const privateKey = await getPrivateKey(ctx);
+	const values = {};
+	const provenance = {};
+	for (const layer of layers) {
+		const dek = await unwrapDek(layer.wrappedDek, privateKey);
+		let label;
+		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
+		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
+		else label = `app:${scope.appSlug}/${layer.slug}`;
+		for (const secret of layer.secrets) {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
+			provenance[secret.name] = label;
+		}
+	}
+	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
 	return {
-		apps,
-		groups,
-		members,
-		tokens
+		...interpolateValues(values, opts.interpolate !== false),
+		provenance,
+		scope,
+		loadedEnvFiles
 	};
 }
-function registerOrgCommands(program) {
-	const org = program.command("org").description("manage organizations");
-	org.command("list").alias("ls").description("list the organizations you can access").option("--json", "print the raw API response").action(async (options) => {
-		const { orgs } = await buildContext().client.listOrgs();
-		emit(options, { orgs }, () => printTable(orgs, [
-			col("slug", (o) => o.slug),
-			col("name", (o) => o.name),
-			col("role", (o) => o.role),
-			col("id", (o) => o.id)
-		], "no organizations — create one with `seekrit org create`"));
-	});
-	org.command("show [slug]").description("show an organization and what it contains").option("--org <slug>", "organization slug (or pass it as the argument)").option("--json", "print the raw API response").action(async (slug, options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, slug ?? options.org);
-		const { org: row } = await ctx.client.getOrg(ref.id);
-		const counts = await orgOverview(ctx, ref.id);
-		const shown = (n) => n === null ? "—" : n;
-		emit(options, {
-			org: row,
-			counts
-		}, () => {
-			printFields([
-				["slug", row.slug],
-				["name", row.name],
-				["id", row.id],
-				["your role", row.role],
-				["created", row.createdAt],
-				["applications", shown(counts.apps)],
-				["groups", shown(counts.groups)],
-				["members", shown(counts.members)],
-				["service tokens", shown(counts.tokens)]
-			]);
-		});
-	});
-	org.command("create").description("create an organization (you become its owner)").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
-		const created = await buildContext().client.createOrg({
-			name: options.name,
-			slug: options.slug
-		});
-		console.error(`created org ${created.org.slug} (${created.org.id})`);
-	});
-	org.command("rename").description("change an organization's display name (the slug is permanent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "new display name").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { org: row } = await ctx.client.updateOrg(ref.id, { name: options.name });
-		console.error(`renamed ${row.slug} to "${row.name}"`);
-	});
-	org.command("member").description("view organization members").command("list").alias("ls").description("list members, and whether each has finished key setup").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { members } = await ctx.client.listMembers(ref.id);
-		emit(options, { members }, () => printTable(members, [
-			col("email", (m) => m.email),
-			col("role", (m) => m.role),
-			col("name", (m) => m.name),
-			col("keys", (m) => m.publicKeyJwk ? "ready" : "pending"),
-			col("id", (m) => m.userId)
-		], "no members"));
-	});
-	const invite = org.command("invite").description("manage pending invitations");
-	invite.command("list").alias("ls").description("list outstanding invitations").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { invites } = await ctx.client.listInvites(ref.id);
-		emit(options, { invites }, () => printTable(invites, [
-			col("email", (i) => i.email),
+/**
+* Resolve, going through the last-known-good cache when one is configured.
+*
+* Always live first: the cache exists for when the call cannot land, not to
+* save a round trip, so a recovered network is picked up on the very next
+* invocation. A *refused* resolve (401/403/…) drops the entry rather than
+* falling back to it — otherwise revoking a token would keep working offline
+* until the entry aged out.
+*/
+async function resolveWithCache(ctx, query, cache) {
+	if (!cache) return ctx.client.resolve(query);
+	try {
+		const response = await ctx.client.resolve(query);
+		try {
+			cache.write(JSON.stringify(response));
+		} catch (err) {
+			warn(`could not update the cache: ${errorMessage(err)}`);
+		}
+		return response;
+	} catch (err) {
+		if (!mayFallBack(err)) {
+			cache.invalidate();
+			throw err;
+		}
+		const found = cache.read();
+		if (found.kind === "hit") {
+			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
+			return JSON.parse(found.body);
+		}
+		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
+		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
+		throw err;
+	}
+}
+function warn(text) {
+	process.stderr.write(`seekrit: ${text}\n`);
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* Overlay `.env` files onto an existing value/provenance set (later files win).
+* Missing files are skipped. Returns the files that were actually loaded. Used
+* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
+* managed secrets are unavailable but `.env` should still apply.
+*/
+function overlayEnvFiles(values, provenance, envFiles) {
+	const loaded = [];
+	for (const file of envFiles) {
+		if (!existsSync(file)) continue;
+		loaded.push(file);
+		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
+			values[name] = value;
+			provenance[name] = `dotenv:${file}`;
+		}
+	}
+	return loaded;
+}
+/**
+* Print a name → source table to stderr (never the secret values). Names whose
+* value had references expanded are marked, and dangling references are called
+* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
+* deliberately passed through as literal text.
+*/
+function printExplain(provenance, refs = {}) {
+	const interpolated = new Set(refs.interpolated ?? []);
+	const names = Object.keys(provenance).sort();
+	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
+	for (const name of names) {
+		const marker = interpolated.has(name) ? "  (interpolated)" : "";
+		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
+	}
+	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
+}
+/** Plugin id and integration id declared by `@seekrit/openclaw-plugin`. */
+const PLUGIN_ID = "seekrit";
+const PLUGIN_INTEGRATION_ID = "seekrit";
+/** The provider alias written into `secrets.providers`. */
+const PROVIDER_ALIAS = "seekrit";
+/**
+* Environment the resolver needs, and nothing else.
+*
+* OpenClaw hands an exec provider an empty environment apart from this
+* allowlist, which is a feature: it is the difference between "the resolver can
+* read the credential it needs" and "the resolver inherits the whole gateway
+* environment". `PATH` is here because Node's own startup needs it, `HOME` for
+* the CLI's login session, and the `SEEKRIT_*` set is how a machine credential
+* reaches a process nobody gets to pass flags to.
+*/
+const PASS_ENV = [
+	"PATH",
+	"HOME",
+	"USERPROFILE",
+	"APPDATA",
+	"LOCALAPPDATA",
+	"TEMP",
+	"TMP",
+	"SYSTEMROOT",
+	"WINDIR",
+	"XDG_CONFIG_HOME",
+	"XDG_CACHE_HOME",
+	"NODE_EXTRA_CA_CERTS",
+	"SEEKRIT_TOKEN",
+	"SEEKRIT_CLIENT_ID",
+	"SEEKRIT_CLIENT_SECRET",
+	"SEEKRIT_API_URL",
+	"SEEKRIT_ORG",
+	"SEEKRIT_APP",
+	"SEEKRIT_ENV",
+	"SEEKRIT_BRANCH"
+];
+/**
+* Generous, because the first resolve of a cold start does real work — an M2M
+* token mint, a resolve, and a key unwrap — and OpenClaw fails startup rather
+* than degrading when this expires. The 1Password integration picks 90s for the
+* same reason (its CLI may prompt for biometrics); 30s is enough here because
+* nothing in this path is interactive.
+*/
+const TIMEOUT_MS = 3e4;
+/** A seekrit secret name: what `seekrit secrets set` accepts. */
+const NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Slugs as the API spells them. */
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+/**
+* Parse an exec SecretRef id.
+*
+* Two shapes, mirroring 1Password's `op://vault/item/field` — a bare name for
+* the environment the credential already points at, and an explicit
+* `app/env/NAME` triple for a provider serving more than one environment:
+*
+*     OPENAI_API_KEY
+*     billing-api/production/STRIPE_SECRET_KEY
+*
+* A bare name is the common case and the one a service token wants, since the
+* token is already bound to an environment and there is nothing to disambiguate.
+*/
+function parseSecretId(id) {
+	const trimmed = id.trim();
+	if (trimmed.length === 0) return void 0;
+	const parts = trimmed.split("/");
+	if (parts.length === 1) {
+		const [name = ""] = parts;
+		return NAME_RE.test(name) ? { name } : void 0;
+	}
+	if (parts.length !== 3) return void 0;
+	const [app = "", env = "", name = ""] = parts;
+	if (!SLUG_RE.test(app) || !SLUG_RE.test(env) || !NAME_RE.test(name)) return void 0;
+	return {
+		app,
+		env,
+		name
+	};
+}
+/** The (app, env) pair an id resolves against — `""` for the credential's own. */
+function scopeKey(id) {
+	return id.app && id.env ? `${id.app}/${id.env}` : "";
+}
+/**
+* Parse a request, tolerantly in exactly one direction.
+*
+* Non-string and empty ids are dropped rather than rejected — a request whose
+* shape we do not recognize should still resolve the ids we do, because the
+* alternative fails OpenClaw's whole startup over one malformed entry. A body
+* that is not an object with an `ids` array is a different matter: there is
+* nothing to answer, so it throws.
+*/
+function parseExecRequest(input) {
+	const parsed = JSON.parse(input);
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("exec SecretRef request must be a JSON object");
+	const ids = parsed.ids;
+	if (!Array.isArray(ids)) throw new Error("exec SecretRef request must carry an `ids` array");
+	return { ids: ids.filter((id) => typeof id === "string" && id.trim().length > 0) };
+}
+/** Assemble a response, omitting `errors` entirely when everything resolved. */
+function buildExecResponse(values, errors) {
+	return {
+		protocolVersion: 1,
+		values,
+		...Object.keys(errors).length > 0 ? { errors } : {}
+	};
+}
+/**
+* Resolve every requested id, reading each distinct environment exactly once.
+*
+* A batch is normally one environment, but a provider may serve several, and
+* resolving per id would mean an unwrap per id. Grouping keeps a 40-variable
+* gateway to one round trip.
+*
+* `resolveScope` is injected so the protocol can be tested without a network,
+* an API, or a key.
+*/
+async function resolveIds(ids, resolveScope) {
+	const values = {};
+	const errors = {};
+	const byScope = /* @__PURE__ */ new Map();
+	for (const id of ids) {
+		const parsed = parseSecretId(id);
+		if (!parsed) {
+			errors[id] = { code: "INVALID_ID" };
+			continue;
+		}
+		const key = scopeKey(parsed);
+		const bucket = byScope.get(key) ?? {
+			scope: parsed,
+			ids: []
+		};
+		bucket.ids.push({
+			id,
+			name: parsed.name
+		});
+		byScope.set(key, bucket);
+	}
+	for (const { scope, ids: wanted } of byScope.values()) {
+		let resolved;
+		try {
+			resolved = await resolveScope(scope);
+		} catch (err) {
+			const code = classify(err);
+			for (const { id } of wanted) errors[id] = { code };
+			continue;
+		}
+		for (const { id, name } of wanted) {
+			const value = resolved[name];
+			if (value === void 0) errors[id] = { code: "NOT_FOUND" };
+			else values[id] = value;
+		}
+	}
+	return buildExecResponse(values, errors);
+}
+/**
+* Bucket a failure into a code an operator can act on.
+*
+* Deliberately coarse and deliberately message-free: it reads the error's own
+* text to pick a bucket and then throws that text away, because the text may
+* quote a token.
+*/
+function classify(err) {
+	const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
+	if (/unauthor|forbidden|token|credential|passphrase|decrypt|sign in|log in|login/.test(message)) return "UNAUTHORIZED";
+	return "UNAVAILABLE";
+}
+/** OpenClaw's config directory: `$OPENCLAW_HOME`, else `~/.openclaw`. */
+function openclawHome(env = process.env) {
+	const home = env.OPENCLAW_HOME?.trim();
+	return home && home.length > 0 ? resolve(home) : join(homedir(), ".openclaw");
+}
+/**
+* The provider block for an installed `@seekrit/openclaw-plugin`.
+*
+* Preferred over the exec shape below for one reason that matters on upgrade:
+* OpenClaw reads the command out of the plugin's manifest at every startup, so
+* a plugin release that moves its resolver keeps working. A copied command is a
+* path pinned in someone's config forever.
+*/
+function pluginProvider() {
+	return {
+		source: "exec",
+		pluginIntegration: {
+			pluginId: PLUGIN_ID,
+			integrationId: PLUGIN_INTEGRATION_ID
+		}
+	};
+}
+/**
+* The provider block for a plain CLI install, with no plugin.
+*
+* `realpathSync` on both paths is not tidiness. OpenClaw's guard rejects a
+* symlinked command outright, and a Node installed by a version manager is
+* almost always reached through one — so resolving here is the difference
+* between a provider that works and a startup failure whose message points at
+* the config rather than at the shim.
+*/
+function execProvider(cliEntry, nodeBinary = process.execPath) {
+	const command = realTo(nodeBinary);
+	const entry = realTo(cliEntry);
+	return {
+		source: "exec",
+		command,
+		args: [
+			entry,
+			"openclaw",
+			"resolve"
+		],
+		passEnv: [...PASS_ENV],
+		jsonOnly: true,
+		timeoutMs: TIMEOUT_MS,
+		noOutputTimeoutMs: TIMEOUT_MS,
+		trustedDirs: [.../* @__PURE__ */ new Set([dirname(command), dirname(entry)])]
+	};
+}
+function realTo(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+/** This CLI's own entry file — what `execProvider` hands to Node. */
+function cliEntryPath() {
+	return fileURLToPath(new URL("index.js", import.meta.url));
+}
+/**
+* Add the seekrit provider to a parsed config without disturbing anything else.
+*
+* An existing `seekrit` entry that differs is left alone unless forced, for the
+* same reason `seekrit paperclip init` leaves an existing MCP server alone:
+* someone who pinned a timeout or narrowed `passEnv` did it deliberately, and
+* silently reverting a security narrowing is the worst kind of helpful.
+*/
+function mergeProvider(existing, provider, force) {
+	const secrets = { ...existing.secrets ?? {} };
+	const providers = { ...secrets.providers ?? {} };
+	const current = providers[PROVIDER_ALIAS];
+	if (current && !force && JSON.stringify(current) !== JSON.stringify(provider)) return {
+		merged: existing,
+		changed: false
+	};
+	if (current && JSON.stringify(current) === JSON.stringify(provider)) return {
+		merged: existing,
+		changed: false
+	};
+	providers[PROVIDER_ALIAS] = provider;
+	return {
+		merged: {
+			...existing,
+			secrets: {
+				...secrets,
+				providers
+			}
+		},
+		changed: true
+	};
+}
+/** A SecretRef pointing at this provider — what replaces a plaintext key. */
+function secretRef(id) {
+	return {
+		source: "exec",
+		provider: PROVIDER_ALIAS,
+		id
+	};
+}
+/**
+* Read `openclaw.json`, or decline to.
+*
+* The file is JSON5: comments and trailing commas are legal, and a parse/write
+* round trip through `JSON` would delete every comment in someone's gateway
+* config. So a file that is not also valid strict JSON is not edited at all —
+* the caller prints the block to paste instead. Losing a config's comments to
+* be helpful is worse than asking for one paste.
+*/
+function readOpenclawConfig(path) {
+	if (!existsSync(path)) return { config: {} };
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (err) {
+		fail(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (raw.trim().length === 0) return { config: {} };
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { json5: true };
+		return { config: parsed };
+	} catch {
+		return { json5: true };
+	}
+}
+function registerOpenclawCommands(program) {
+	const openclaw = program.command("openclaw").description("wire seekrit into OpenClaw as a SecretRef provider (`seekrit openclaw --help`)");
+	openclaw.command("init").description("add the seekrit exec SecretRef provider to openclaw.json").option("--config <path>", "path to openclaw.json (default: $OPENCLAW_HOME/openclaw.json)").option("--plugin", "point at an installed @seekrit/openclaw-plugin (recommended)").option("--exec", "point directly at this CLI, with no plugin installed").option("--write", "write the file instead of printing the block to paste").option("--force", "replace a seekrit provider entry that already differs").option("--json", "machine-readable output").action((options) => {
+		if (options.plugin && options.exec) fail("--plugin and --exec are mutually exclusive");
+		const usePlugin = options.exec !== true;
+		let provider;
+		if (usePlugin) provider = pluginProvider();
+		else {
+			const entry = cliEntryPath();
+			if (!existsSync(entry)) fail(`cannot find this CLI's entry file at ${entry} — --exec needs an installed seekrit (npm i -g @seekrit/cli), or use --plugin`);
+			provider = execProvider(entry);
+		}
+		const path = options.config ? resolve(options.config) : join(openclawHome(), "openclaw.json");
+		const read = readOpenclawConfig(path);
+		const json5 = "json5" in read;
+		const merged = json5 ? void 0 : mergeProvider(read.config, provider, options.force === true);
+		const wrote = Boolean(options.write) && merged?.changed === true;
+		if (wrote && merged) writeFileSync(path, `${JSON.stringify(merged.merged, null, 2)}\n`, { mode: 384 });
+		emit(options, {
+			path,
+			provider,
+			wrote,
+			json5
+		}, () => {
+			section("openclaw secret provider");
+			printFields([
+				["config", path],
+				["provider", PROVIDER_ALIAS],
+				["shape", usePlugin ? "plugin integration" : "exec (this CLI)"],
+				["written", wrote ? "yes" : "no"]
+			]);
+			console.log();
+			if (json5) {
+				console.log(`${path} is JSON5 (comments or trailing commas), which a rewrite here would delete.`);
+				console.log("Merge this into it by hand:");
+			} else if (!options.write) console.log("Merge this into your config, or re-run with --write:");
+			else if (!wrote) console.log(`A different \`${PROVIDER_ALIAS}\` provider is already configured — left as it is. Re-run with --force to replace it.`);
+			else console.log("Written. The block now in your config:");
+			console.log();
+			console.log(JSON.stringify({ secrets: { providers: { [PROVIDER_ALIAS]: provider } } }, null, 2));
+			console.log();
+			if (usePlugin) {
+				console.log("Install the plugin, if you have not already:");
+				console.log("  openclaw plugins install npm:@seekrit/openclaw-plugin");
+				console.log("  openclaw plugins enable seekrit");
+				console.log();
+			}
+			console.log("Then replace a plaintext credential with a ref, e.g.:");
+			console.log(`  ${JSON.stringify(secretRef("OPENAI_API_KEY"))}`);
+			console.log();
+			console.log("And check your work:");
+			console.log("  openclaw secrets audit --check --allow-exec");
+			console.log();
+			console.log("Resolution is eager: OpenClaw reads every ref once at startup. After a rotation, run `openclaw secrets reload`.");
+		});
+	});
+	openclaw.command("ref <name>").description("print the SecretRef object to paste in place of a plaintext credential").option("--app <slug>", "address a specific application (with --env)").option("--env <slug>", "address a specific environment (with --app)").option("--json", "machine-readable output").action((name, options) => {
+		if (Boolean(options.app) !== Boolean(options.env)) fail("--app and --env go together (an id names both, or neither)");
+		const id = options.app && options.env ? `${options.app}/${options.env}/${name}` : name;
+		if (!parseSecretId(id)) fail(`not a valid SecretRef id: "${id}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
+		const ref = secretRef(id);
+		emit(options, ref, () => console.log(JSON.stringify(ref)));
+	});
+	openclaw.command("resolve").description("resolve exec SecretRef ids from stdin (OpenClaw calls this; not for humans)").action(async () => {
+		setFailThrows(true);
+		let request;
+		try {
+			request = parseExecRequest(await readStdin());
+		} catch (err) {
+			process.stderr.write(`seekrit: ${err instanceof Error ? err.message : String(err)}\n`);
+			process.exitCode = 2;
+			return;
+		}
+		const scopes = /* @__PURE__ */ new Map();
+		let ctx;
+		const response = await resolveIds(request.ids, (scope) => {
+			const key = scopeKey(scope);
+			const cached = scopes.get(key);
+			if (cached) return cached;
+			ctx ??= buildContext();
+			const pending = resolveEnvironment(ctx, scope);
+			scopes.set(key, pending);
+			return pending;
+		});
+		process.stdout.write(`${JSON.stringify(response)}\n`);
+	});
+}
+/**
+* Resolve one environment's full variable set.
+*
+* `.env` overlays are deliberately switched off (`envFiles: []`). Everywhere
+* else in this CLI they are a convenience for a developer's shell; here the
+* working directory belongs to the OpenClaw gateway, and letting a file in it
+* override a gateway credential would make a stray `.env` a privilege
+* escalation. Reference expansion stays on — a `${OTHER_SECRET}` reference is
+* stored data, not a local override.
+*/
+async function resolveEnvironment(ctx, scope) {
+	let envId;
+	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, {
+		app: scope.app,
+		env: scope.env
+	})).envId;
+	const { values } = await materializeEnv(ctx, {
+		envId,
+		envFiles: []
+	});
+	return values;
+}
+//#endregion
+//#region src/orgs.ts
+/**
+* Counts for `org show`. Each list is admin-gated to a different degree, so a
+* member who can't read one still gets the rest: a failed call reports as
+* `null`, which `printFields` drops and JSON preserves as "not visible to you".
+*/
+async function countOrNull(load) {
+	try {
+		return await load();
+	} catch {
+		return null;
+	}
+}
+async function orgOverview(ctx, orgId) {
+	const [apps, groups, members, tokens] = await Promise.all([
+		countOrNull(async () => (await ctx.client.listApps(orgId)).apps.length),
+		countOrNull(async () => (await ctx.client.listGroups(orgId)).groups.length),
+		countOrNull(async () => (await ctx.client.listMembers(orgId)).members.length),
+		countOrNull(async () => (await ctx.client.listTokens(orgId)).tokens.length)
+	]);
+	return {
+		apps,
+		groups,
+		members,
+		tokens
+	};
+}
+function registerOrgCommands(program) {
+	const org = program.command("org").description("manage organizations");
+	org.command("list").alias("ls").description("list the organizations you can access").option("--json", "print the raw API response").action(async (options) => {
+		const { orgs } = await buildContext().client.listOrgs();
+		emit(options, { orgs }, () => printTable(orgs, [
+			col("slug", (o) => o.slug),
+			col("name", (o) => o.name),
+			col("role", (o) => o.role),
+			col("id", (o) => o.id)
+		], "no organizations — create one with `seekrit org create`"));
+	});
+	org.command("show [slug]").description("show an organization and what it contains").option("--org <slug>", "organization slug (or pass it as the argument)").option("--json", "print the raw API response").action(async (slug, options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, slug ?? options.org);
+		const { org: row } = await ctx.client.getOrg(ref.id);
+		const counts = await orgOverview(ctx, ref.id);
+		const shown = (n) => n === null ? "—" : n;
+		emit(options, {
+			org: row,
+			counts
+		}, () => {
+			printFields([
+				["slug", row.slug],
+				["name", row.name],
+				["id", row.id],
+				["your role", row.role],
+				["created", row.createdAt],
+				["applications", shown(counts.apps)],
+				["groups", shown(counts.groups)],
+				["members", shown(counts.members)],
+				["service tokens", shown(counts.tokens)]
+			]);
+		});
+	});
+	org.command("create").description("create an organization (you become its owner)").requiredOption("--name <name>", "display name").requiredOption("--slug <slug>", "url-safe identifier (permanent)").action(async (options) => {
+		const created = await buildContext().client.createOrg({
+			name: options.name,
+			slug: options.slug
+		});
+		console.error(`created org ${created.org.slug} (${created.org.id})`);
+	});
+	org.command("rename").description("change an organization's display name (the slug is permanent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--name <name>", "new display name").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { org: row } = await ctx.client.updateOrg(ref.id, { name: options.name });
+		console.error(`renamed ${row.slug} to "${row.name}"`);
+	});
+	org.command("member").description("view organization members").command("list").alias("ls").description("list members, and whether each has finished key setup").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { members } = await ctx.client.listMembers(ref.id);
+		emit(options, { members }, () => printTable(members, [
+			col("email", (m) => m.email),
+			col("role", (m) => m.role),
+			col("name", (m) => m.name),
+			col("keys", (m) => m.publicKeyJwk ? "ready" : "pending"),
+			col("id", (m) => m.userId)
+		], "no members"));
+	});
+	const invite = org.command("invite").description("manage pending invitations");
+	invite.command("list").alias("ls").description("list outstanding invitations").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { invites } = await ctx.client.listInvites(ref.id);
+		emit(options, { invites }, () => printTable(invites, [
+			col("email", (i) => i.email),
 			col("role", (i) => i.role),
 			col("invited", (i) => i.createdAt),
 			col("id", (i) => i.id)
@@ -11968,193 +12856,6 @@ function registerRotationCommands(program) {
 		console.error(`disabled rotation of ${r.secretName}${rotatorRevoked ? " — rotator key access revoked for this environment" : ""}`);
 	});
 }
-/**
-* Fetch + decrypt every secret in a single environment.
-*
-* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
-* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
-* scope here — a reference to a secret inherited from a composed group is left
-* literal, because the group layers aren't fetched. `materializeEnv` is the
-* fully-layered view.
-*/
-async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
-	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
-}
-/**
-* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
-* the CLI's standard fatal exit — it is a config bug with no correct value to
-* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
-*/
-function interpolateValues(values, enabled = true) {
-	if (!enabled) return {
-		values,
-		interpolated: [],
-		unresolvedRefs: []
-	};
-	try {
-		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
-		return {
-			values: expandedValues,
-			interpolated: expanded,
-			unresolvedRefs: unresolved
-		};
-	} catch (err) {
-		return fail(err instanceof Error ? err.message : String(err));
-	}
-}
-/**
-* Decrypt one historical version of a secret. Ciphertext is bound to
-* `(envId, name)` as AAD and neither changes across versions, so an old blob
-* opens with the environment's current data key — no special handling needed.
-*/
-async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
-	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
-	const row = versions.find((v) => v.version === version);
-	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
-	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
-}
-async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
-	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
-	await ctx.client.setSecret(orgId, envId, name, ciphertext);
-}
-/**
-* Encrypt and store many secrets into one environment. The DEK is fetched once
-* (so user auth prompts for the passphrase a single time, not per variable),
-* then each value is encrypted locally and written. Existing names are
-* overwritten; the result splits them into created vs. updated for a summary.
-* Callers validate the names first — a rejected name aborts before any write.
-*/
-async function importSecrets(ctx, orgId, envId, entries) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const existing = new Set(secrets.map((s) => s.name));
-	const result = {
-		created: [],
-		updated: []
-	};
-	for (const [name, value] of Object.entries(entries)) {
-		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
-		await ctx.client.setSecret(orgId, envId, name, ciphertext);
-		(existing.has(name) ? result.updated : result.created).push(name);
-	}
-	return result;
-}
-/**
-* Resolve the full, layered environment for a running app: composed group
-* secrets (lowest precedence) → the app env's own secrets → `.env` files.
-* Each layer's DEK is unwrapped once with the principal's private key and its
-* ciphertext decrypted locally. `process.env` is NOT applied here — callers
-* that spawn a process layer it on top so the live shell always wins.
-*
-* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
-* reference always resolves to whichever layer won the name.
-*/
-async function materializeEnv(ctx, opts) {
-	const query = {};
-	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
-	if (opts.branch) query.branch = opts.branch;
-	if (!isTokenAuth(ctx)) {
-		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
-		query.env = opts.envId;
-	}
-	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
-	const privateKey = await getPrivateKey(ctx);
-	const values = {};
-	const provenance = {};
-	for (const layer of layers) {
-		const dek = await unwrapDek(layer.wrappedDek, privateKey);
-		let label;
-		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
-		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
-		else label = `app:${scope.appSlug}/${layer.slug}`;
-		for (const secret of layer.secrets) {
-			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
-			provenance[secret.name] = label;
-		}
-	}
-	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
-	return {
-		...interpolateValues(values, opts.interpolate !== false),
-		provenance,
-		scope,
-		loadedEnvFiles
-	};
-}
-/**
-* Resolve, going through the last-known-good cache when one is configured.
-*
-* Always live first: the cache exists for when the call cannot land, not to
-* save a round trip, so a recovered network is picked up on the very next
-* invocation. A *refused* resolve (401/403/…) drops the entry rather than
-* falling back to it — otherwise revoking a token would keep working offline
-* until the entry aged out.
-*/
-async function resolveWithCache(ctx, query, cache) {
-	if (!cache) return ctx.client.resolve(query);
-	try {
-		const response = await ctx.client.resolve(query);
-		try {
-			cache.write(JSON.stringify(response));
-		} catch (err) {
-			warn(`could not update the cache: ${errorMessage(err)}`);
-		}
-		return response;
-	} catch (err) {
-		if (!mayFallBack(err)) {
-			cache.invalidate();
-			throw err;
-		}
-		const found = cache.read();
-		if (found.kind === "hit") {
-			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
-			return JSON.parse(found.body);
-		}
-		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
-		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
-		throw err;
-	}
-}
-function warn(text) {
-	process.stderr.write(`seekrit: ${text}\n`);
-}
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-/**
-* Overlay `.env` files onto an existing value/provenance set (later files win).
-* Missing files are skipped. Returns the files that were actually loaded. Used
-* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
-* managed secrets are unavailable but `.env` should still apply.
-*/
-function overlayEnvFiles(values, provenance, envFiles) {
-	const loaded = [];
-	for (const file of envFiles) {
-		if (!existsSync(file)) continue;
-		loaded.push(file);
-		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
-			values[name] = value;
-			provenance[name] = `dotenv:${file}`;
-		}
-	}
-	return loaded;
-}
-/**
-* Print a name → source table to stderr (never the secret values). Names whose
-* value had references expanded are marked, and dangling references are called
-* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
-* deliberately passed through as literal text.
-*/
-function printExplain(provenance, refs = {}) {
-	const interpolated = new Set(refs.interpolated ?? []);
-	const names = Object.keys(provenance).sort();
-	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
-	for (const name of names) {
-		const marker = interpolated.has(name) ? "  (interpolated)" : "";
-		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
-	}
-	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
-}
 //#endregion
 //#region src/ssh.ts
 /**
@@ -12328,6 +13029,18 @@ function assertLanggraphDeploymentId(value) {
 	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`--langgraph-deployment should be the deployment UUID from its dashboard URL, not "${id}"`);
 	return id;
 }
+/**
+* A Hugging Face Space is addressed as `owner/name`. The two habitual slips are
+* pasting the browser URL and giving the bare name without its owner; the first
+* is recovered rather than refused, since a Space URL has exactly one shape.
+*/
+function assertHuggingfaceSpace(value) {
+	if (!value) fail("--hf-space is required for huggingface-spaces (owner/name)");
+	const raw = value.trim();
+	const id = raw.match(/^https?:\/\/(?:[^/]*\.)?huggingface\.co\/spaces\/([^/?#]+\/[^/?#]+)(?:[/?#]|$)/i)?.[1] ?? raw.replace(/^\/+|\/+$/g, "");
+	if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/.test(id)) fail(`--hf-space should be the Space ID as owner/name, e.g. acme/support-demo, not "${raw}"`);
+	return id;
+}
 /** Reject a single value outside a known set, naming the choices. */
 function assertMember(value, allowed, flag, fallback) {
 	if (value === void 0) return fallback;
@@ -12454,6 +13167,7 @@ function credentialNoun(provider) {
 	if (provider === "gcp-secret-manager") return "service-account key JSON";
 	if (provider === "langgraph-platform") return "LangSmith API key";
 	if (provider === "azure-key-vault") return "client secret";
+	if (provider === "huggingface-spaces") return "user access token";
 	return "API token";
 }
 /**
@@ -12542,6 +13256,7 @@ function buildConfig(provider, options) {
 				cloud: cloud ?? "public"
 			};
 		}
+		case "huggingface-spaces": return { provider: "huggingface-spaces" };
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -12755,6 +13470,10 @@ function buildDestination(provider, options) {
 				nameMode: nameMode ?? "dash"
 			};
 		}
+		case "huggingface-spaces": return {
+			provider: "huggingface-spaces",
+			repoId: assertHuggingfaceSpace(options.hfSpace)
+		};
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -12777,6 +13496,7 @@ function describeDestination(destination) {
 		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
 		case "langgraph-platform": return `deployment ${destination.deploymentId}`;
 		case "azure-key-vault": return `${destination.vault}${destination.prefix ? ` (${destination.prefix}*)` : ""}`;
+		case "huggingface-spaces": return `space ${destination.repoId}`;
 		case "github-actions": switch (destination.kind) {
 			case "repo": return `${destination.owner}/${destination.repo}`;
 			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
@@ -12792,7 +13512,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager, azure-key-vault: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version").option("--vault <name>", "azure-key-vault: vault name, e.g. acme-prod").option("--name-mode <mode>", `azure-key-vault: ${AZURE_KEY_VAULT_NAME_MODES.join(" | ")} — Key Vault stores no underscores, so DATABASE_URL becomes DATABASE-URL unless you reject instead`);
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager, azure-key-vault: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version").option("--vault <name>", "azure-key-vault: vault name, e.g. acme-prod").option("--hf-space <owner/name>", "huggingface-spaces: Space ID, e.g. acme/support-demo (its owner and name, not a URL)").option("--name-mode <mode>", `azure-key-vault: ${AZURE_KEY_VAULT_NAME_MODES.join(" | ")} — Key Vault stores no underscores, so DATABASE_URL becomes DATABASE-URL unless you reject instead`);
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -13689,6 +14409,8 @@ registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
 registerPaperclipCommands(program);
+registerOpenclawCommands(program);
+registerHermesCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);