@seekrit/cli 1.4.0 → 1.6.0

package/dist/index.js

@@ -8,6 +8,7 @@ import { dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
+import { connect } from "node:net";
 import { fileURLToPath } from "node:url";
 import { request } from "node:http";
 /** Default lifetime of a published bundle (7 days), in seconds. */
@@ -5052,7 +5053,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.4.0";
+var version = "1.6.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -7058,185 +7059,647 @@ function registerPolicyCommands(policy) {
 		});
 	});
 }
-//#endregion
-//#region src/kms.ts
-/** Collect a repeatable option into a list. */
-function collect$7(value, acc = []) {
-	acc.push(value);
-	return acc;
-}
-/** The calling principal's identity + public key (for a self-grant). */
-async function kmsCallerIdentity(ctx) {
-	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
-		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
-		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
-		return {
-			principalType: "service_token",
-			principalId: tokenId,
-			publicKeyJwk: JSON.stringify(pub)
-		};
-	}
-	const { user } = await ctx.client.me();
-	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+/** Domain separators — must match `crates/seekrit-cache`. */
+const KEY_DOMAIN = "seekrit-lkg-cache-v1";
+const TOKEN_DOMAIN = "seekrit-token-fp-v1";
+/** 24h: long enough to ride out an outage, short enough to bound the tail. */
+const DEFAULT_MAX_AGE_MS = 1440 * 60 * 1e3;
+/**
+* Derive the key for one resolve request. Overrides are sorted, so flag order
+* never splits the cache. Byte-for-byte identical to `CacheKey::new` in
+* `crates/seekrit-cache`.
+*/
+function cacheKey(apiUrl, token, branch, overrides = {}) {
+	const pairs = Object.entries(overrides).map(([group, env]) => `${group}:${env}`).sort();
 	return {
-		principalType: "user",
-		principalId: user.id,
-		publicKeyJwk: user.publicKeyJwk
+		key: createHash("sha256").update([
+			KEY_DOMAIN,
+			apiUrl.replace(/\/+$/, ""),
+			token,
+			branch ?? "",
+			pairs.join(",")
+		].join("\n")).digest("hex"),
+		tokenFingerprint: tokenFingerprint(token)
 	};
 }
-/** Look up an org member (by email) or service token (by id) as a grant recipient. */
-async function kmsResolveRecipient(ctx, orgId, who) {
-	if (who.user) {
-		const { members } = await ctx.client.listMembers(orgId);
-		const m = members.find((x) => x.email === who.user);
-		if (!m) fail(`no member ${who.user}`);
-		if (!m.publicKeyJwk) fail(`${who.user} has not completed key setup`);
+/** The hex SHA-256 identifying a token without storing it. */
+function tokenFingerprint(token) {
+	return createHash("sha256").update(`${TOKEN_DOMAIN}\n${token}`).digest("hex");
+}
+/**
+* `$XDG_CACHE_HOME/seekrit`, else `~/.cache/seekrit` — beside the config
+* directory holding the credential, never a shared temp directory.
+*/
+function defaultCacheDir() {
+	return join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "seekrit");
+}
+/** Render an age for a log line, rounded to its largest whole unit. */
+function humanize(ms) {
+	const secs = Math.floor(ms / 1e3);
+	if (secs < 60) return `${secs}s`;
+	if (secs < 3600) return `${Math.floor(secs / 60)}m`;
+	if (secs < 86400) return `${Math.floor(secs / 3600)}h`;
+	return `${Math.floor(secs / 86400)}d`;
+}
+/**
+* Whether a failed resolve means the API was *unreachable* (the cache may stand
+* in) rather than *refusing us* (it must not). A refusal is an answer, and
+* revocation is supposed to take effect the moment it arrives.
+*/
+function mayFallBack(err) {
+	if (err instanceof SeekritApiError) return err.status >= 500 || err.status === 429;
+	return true;
+}
+/** An opened cache, bound to one resolve request. */
+var LkgCache = class {
+	dir;
+	maxAgeMs;
+	id;
+	constructor(id, options = {}) {
+		this.id = id;
+		this.dir = options.dir ?? defaultCacheDir();
+		this.maxAgeMs = options.maxAgeMs ?? 864e5;
+	}
+	path() {
+		return join(this.dir, `${this.id.key}.json`);
+	}
+	read() {
+		const path = this.path();
+		if (!existsSync(path)) return { kind: "missing" };
+		let envelope;
+		try {
+			envelope = JSON.parse(readFileSync(path, "utf8"));
+		} catch (err) {
+			return {
+				kind: "unusable",
+				reason: `corrupt cache entry: ${message(err)}`
+			};
+		}
+		if (envelope.version !== 1) return {
+			kind: "unusable",
+			reason: `cache entry is format v${envelope.version}, this build reads v1`
+		};
+		if (envelope.tokenFingerprint !== this.id.tokenFingerprint) return {
+			kind: "unusable",
+			reason: "cache entry belongs to a different token"
+		};
+		if (typeof envelope.body !== "string") return {
+			kind: "unusable",
+			reason: "cache entry has no body"
+		};
+		const ageMs = Math.max(0, Date.now() - envelope.fetchedAt * 1e3);
+		if (ageMs >= this.maxAgeMs) return {
+			kind: "expired",
+			ageMs
+		};
 		return {
-			principalType: "user",
-			principalId: m.userId,
-			publicKeyJwk: m.publicKeyJwk
+			kind: "hit",
+			body: envelope.body,
+			ageMs
 		};
 	}
-	if (who.token) {
-		const { tokens } = await ctx.client.listTokens(orgId);
-		const t = tokens.find((x) => x.id === who.token);
-		if (!t) fail(`no service token ${who.token}`);
-		return {
-			principalType: "service_token",
-			principalId: t.id,
-			publicKeyJwk: t.publicKeyJwk
+	/**
+	* Record a freshly-fetched response. Written to a temporary file and renamed,
+	* so a concurrent reader sees either the old entry or the new one — never a
+	* half-written file. Throws only on genuinely unexpected I/O; callers treat a
+	* failed write as a warning, never as a failed resolve.
+	*/
+	write(body) {
+		mkdirSync(this.dir, {
+			recursive: true,
+			mode: 448
+		});
+		const envelope = {
+			version: 1,
+			fetchedAt: Math.floor(Date.now() / 1e3),
+			tokenFingerprint: this.id.tokenFingerprint,
+			body
 		};
+		const tmp = join(this.dir, `${this.id.key}.${process.pid}.tmp`);
+		try {
+			writeFileSync(tmp, JSON.stringify(envelope), { mode: 384 });
+			renameSync(tmp, this.path());
+		} catch (err) {
+			rmSync(tmp, { force: true });
+			throw err;
+		}
+		this.pruneExpired();
 	}
-	fail("specify --user <email> or --token <id>");
+	/** Drop this entry — used when the API refuses the token. */
+	invalidate() {
+		rmSync(this.path(), { force: true });
+	}
+	/**
+	* Delete entries past their usefulness (a rotated token or a changed
+	* `--with` leaves one nothing will read again). Best-effort and silent, and
+	* it only ever touches files this cache named: `<64 hex>.json`.
+	*/
+	pruneExpired() {
+		let names;
+		try {
+			names = readdirSync(this.dir);
+		} catch {
+			return;
+		}
+		for (const name of names) {
+			if (!/^[0-9a-f]{64}\.json$/.test(name)) continue;
+			const path = join(this.dir, name);
+			let expired = true;
+			try {
+				const envelope = JSON.parse(readFileSync(path, "utf8"));
+				expired = Math.max(0, Date.now() - envelope.fetchedAt * 1e3) >= this.maxAgeMs;
+			} catch {}
+			if (expired) rmSync(path, { force: true });
+		}
+	}
+};
+function message(err) {
+	return err instanceof Error ? err.message : String(err);
 }
-async function kmsResolveKey(ctx, orgId, ref) {
-	const { keys } = await ctx.client.listKmsKeys(orgId);
-	const key = keys.find((k) => k.id === ref || k.name === ref);
-	if (!key) fail(`no KMS key "${ref}"`);
-	return key;
+/**
+* Fetch + decrypt every secret in a single environment.
+*
+* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
+* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
+* scope here — a reference to a secret inherited from a composed group is left
+* literal, because the group layers aren't fetched. `materializeEnv` is the
+* fully-layered view.
+*/
+async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
+	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
 }
-/** Recover a key's material for one version (default: current), for the caller. */
-async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
-	const mat = await ctx.client.getMyKmsKey(orgId, keyId);
-	const v = version ?? mat.currentVersion;
-	const grant = mat.grants.find((g) => g.version === v);
-	if (!grant) fail(`no grant for version ${v} of this key`);
-	return {
-		material: await unwrapDek(grant.wrappedKey, await getPrivateKey(ctx)),
-		version: v,
-		currentVersion: mat.currentVersion
+/**
+* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
+* the CLI's standard fatal exit — it is a config bug with no correct value to
+* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
+*/
+function interpolateValues(values, enabled = true) {
+	if (!enabled) return {
+		values,
+		interpolated: [],
+		unresolvedRefs: []
 	};
+	try {
+		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
+		return {
+			values: expandedValues,
+			interpolated: expanded,
+			unresolvedRefs: unresolved
+		};
+	} catch (err) {
+		return fail(err instanceof Error ? err.message : String(err));
+	}
 }
-function registerKmsCommands(program) {
-	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
-		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
-		if (options.app && options.group) fail("pass at most one of --app or --group");
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		let toWrap;
-		let publicKeyJwk;
-		if (options.purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
-		else {
-			const km = await generateSigningKeyMaterial();
-			toWrap = km.privateKeyPkcs8;
-			publicKeyJwk = km.publicKeyJwk;
-		}
-		let applicationId;
-		let groupId;
-		if (options.app) {
-			const { apps } = await ctx.client.listApps(org.id);
-			const app = apps.find((a) => a.slug === options.app || a.id === options.app);
-			if (!app) fail(`no app "${options.app}" in ${org.slug}`);
-			applicationId = app.id;
-		} else if (options.group) {
-			const { groups } = await ctx.client.listGroups(org.id);
-			const group = groups.find((g) => g.slug === options.group || g.id === options.group);
-			if (!group) fail(`no group "${options.group}" in ${org.slug}`);
-			groupId = group.id;
+/**
+* Decrypt one historical version of a secret. Ciphertext is bound to
+* `(envId, name)` as AAD and neither changes across versions, so an old blob
+* opens with the environment's current data key — no special handling needed.
+*/
+async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
+	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
+	const row = versions.find((v) => v.version === version);
+	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
+	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
+}
+async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
+	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
+	await ctx.client.setSecret(orgId, envId, name, ciphertext);
+}
+/**
+* Encrypt and store many secrets into one environment. The DEK is fetched once
+* (so user auth prompts for the passphrase a single time, not per variable),
+* then each value is encrypted locally and written. Existing names are
+* overwritten; the result splits them into created vs. updated for a summary.
+* Callers validate the names first — a rejected name aborts before any write.
+*/
+async function importSecrets(ctx, orgId, envId, entries) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const existing = new Set(secrets.map((s) => s.name));
+	const result = {
+		created: [],
+		updated: []
+	};
+	for (const [name, value] of Object.entries(entries)) {
+		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
+		await ctx.client.setSecret(orgId, envId, name, ciphertext);
+		(existing.has(name) ? result.updated : result.created).push(name);
+	}
+	return result;
+}
+/**
+* Resolve the full, layered environment for a running app: composed group
+* secrets (lowest precedence) → the app env's own secrets → `.env` files.
+* Each layer's DEK is unwrapped once with the principal's private key and its
+* ciphertext decrypted locally. `process.env` is NOT applied here — callers
+* that spawn a process layer it on top so the live shell always wins.
+*
+* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
+* reference always resolves to whichever layer won the name.
+*/
+async function materializeEnv(ctx, opts) {
+	const query = {};
+	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (opts.branch) query.branch = opts.branch;
+	if (!isTokenAuth(ctx)) {
+		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
+		query.env = opts.envId;
+	}
+	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
+	const privateKey = await getPrivateKey(ctx);
+	const values = {};
+	const provenance = {};
+	for (const layer of layers) {
+		const dek = await unwrapDek(layer.wrappedDek, privateKey);
+		let label;
+		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
+		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
+		else label = `app:${scope.appSlug}/${layer.slug}`;
+		for (const secret of layer.secrets) {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
+			provenance[secret.name] = label;
 		}
-		const recipients = [await kmsCallerIdentity(ctx)];
-		for (const email of options.grantUser) recipients.push(await kmsResolveRecipient(ctx, org.id, { user: email }));
-		for (const tokenId of options.grantToken) recipients.push(await kmsResolveRecipient(ctx, org.id, { token: tokenId }));
-		const seen = /* @__PURE__ */ new Set();
-		const grants = [];
-		for (const r of recipients) {
-			const dedupeKey = `${r.principalType}:${r.principalId}`;
-			if (seen.has(dedupeKey)) continue;
-			seen.add(dedupeKey);
-			grants.push({
-				principalType: r.principalType,
-				principalId: r.principalId,
-				wrappedKey: await wrapDek(toWrap, r.publicKeyJwk)
-			});
+	}
+	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
+	return {
+		...interpolateValues(values, opts.interpolate !== false),
+		provenance,
+		scope,
+		loadedEnvFiles
+	};
+}
+/**
+* Resolve, going through the last-known-good cache when one is configured.
+*
+* Always live first: the cache exists for when the call cannot land, not to
+* save a round trip, so a recovered network is picked up on the very next
+* invocation. A *refused* resolve (401/403/…) drops the entry rather than
+* falling back to it — otherwise revoking a token would keep working offline
+* until the entry aged out.
+*/
+async function resolveWithCache(ctx, query, cache) {
+	if (!cache) return ctx.client.resolve(query);
+	try {
+		const response = await ctx.client.resolve(query);
+		try {
+			cache.write(JSON.stringify(response));
+		} catch (err) {
+			warn(`could not update the cache: ${errorMessage(err)}`);
 		}
-		const input = {
-			name: options.name,
-			purpose: options.purpose,
-			spec: options.purpose === "sign" ? "ecdsa-p256" : "aes-256-gcm",
-			...applicationId ? { applicationId } : {},
-			...groupId ? { groupId } : {},
-			...publicKeyJwk ? { publicKeyJwk } : {},
-			grants
-		};
-		const { key } = await ctx.client.createKmsKey(org.id, input);
-		console.error(`created ${key.purpose} key ${key.name} (${key.id}), ${grants.length} grant(s)`);
-	});
-	kms.command("ls").description("list keys you can see").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { keys } = await ctx.client.listKmsKeys(org.id);
-		if (keys.length === 0) {
-			console.error("(no keys)");
-			return;
+		return response;
+	} catch (err) {
+		if (!mayFallBack(err)) {
+			cache.invalidate();
+			throw err;
 		}
-		for (const k of keys) {
-			const scope = k.applicationId ? `app:${k.applicationId}` : k.groupId ? `group:${k.groupId}` : "org";
-			const state = k.disabledAt ? " [disabled]" : "";
-			console.log(`${k.name}\t${k.purpose}\tv${k.currentVersion}\t${scope}\t${k.id}${state}`);
+		const found = cache.read();
+		if (found.kind === "hit") {
+			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
+			return JSON.parse(found.body);
 		}
+		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
+		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
+		throw err;
+	}
+}
+function warn(text) {
+	process.stderr.write(`seekrit: ${text}\n`);
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* Overlay `.env` files onto an existing value/provenance set (later files win).
+* Missing files are skipped. Returns the files that were actually loaded. Used
+* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
+* managed secrets are unavailable but `.env` should still apply.
+*/
+function overlayEnvFiles(values, provenance, envFiles) {
+	const loaded = [];
+	for (const file of envFiles) {
+		if (!existsSync(file)) continue;
+		loaded.push(file);
+		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
+			values[name] = value;
+			provenance[name] = `dotenv:${file}`;
+		}
+	}
+	return loaded;
+}
+/**
+* Print a name → source table to stderr (never the secret values). Names whose
+* value had references expanded are marked, and dangling references are called
+* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
+* deliberately passed through as literal text.
+*/
+function printExplain(provenance, refs = {}) {
+	const interpolated = new Set(refs.interpolated ?? []);
+	const names = Object.keys(provenance).sort();
+	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
+	for (const name of names) {
+		const marker = interpolated.has(name) ? "  (interpolated)" : "";
+		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
+	}
+	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
+}
+//#endregion
+//#region src/env-diff.ts
+/**
+* The comparison itself, kept pure so it can be tested without a network or a
+* key. Rows come back sorted by name: a diff people read top-to-bottom should
+* not reorder itself because the API returned rows in a different order.
+*/
+function diffSecrets(from, to, values) {
+	const byName = (rows) => new Map(rows.map((r) => [r.name, r]));
+	const left = byName(from);
+	const right = byName(to);
+	return [.../* @__PURE__ */ new Set([...left.keys(), ...right.keys()])].sort().map((name) => {
+		const a = left.get(name) ?? null;
+		const b = right.get(name) ?? null;
+		let value = "unknown";
+		if (values && a && b) value = values.from[name] === values.to[name] ? "identical" : "differs";
+		return {
+			name,
+			from: a,
+			to: b,
+			value
+		};
 	});
-	kms.command("grant").description("grant a principal use of a key's current version").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <email>", "grant an org member").option("--token <tokenId>", "grant a service token").action(async (options) => {
-		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const key = await kmsResolveKey(ctx, org.id, options.key);
-		const recipient = await kmsResolveRecipient(ctx, org.id, options);
-		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id);
-		await ctx.client.grantKmsKey(org.id, key.id, {
-			principalType: recipient.principalType,
-			principalId: recipient.principalId,
-			wrappedKey: await wrapDek(material, recipient.publicKeyJwk)
-		});
-		console.error(`granted ${key.name} to ${recipient.principalId}`);
-	});
-	kms.command("revoke").description("revoke a principal from a key (all versions)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <email>", "revoke this user's grant").option("--token <tokenId>", "revoke this service token's grant").option("-y, --yes", "skip the confirmation").action(async (options) => {
-		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+}
+/**
+* Resolve `--from` / `--to`, which accept an environment *or* a branch.
+*
+* Branch slugs share the application's environment namespace but are excluded
+* from the environment listing, so naming one would otherwise land on "no
+* environment …" — and diffing a branch against its parent is the main thing
+* this command is for.
+*/
+async function resolveSide(ctx, app, ref) {
+	const { environments } = await ctx.client.listEnvs(app.orgId, app.id);
+	const env = environments.find((e) => e.slug === ref || e.id === ref);
+	if (env) return {
+		id: env.id,
+		slug: env.slug,
+		isBranch: false,
+		parentSlug: null
+	};
+	const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+	const branch = branches.find((b) => b.slug === ref || b.id === ref);
+	if (!branch) fail(`no environment or branch "${ref}" in ${app.slug}`);
+	const parent = environments.find((e) => e.id === branch.parentEnvironmentId);
+	return {
+		id: branch.id,
+		slug: branch.slug,
+		isBranch: true,
+		parentSlug: parent?.slug ?? null
+	};
+}
+/** `v3 → v5`, or the one side that exists. */
+function versions(row) {
+	if (row.from && row.to) return `v${row.from.version} → v${row.to.version}`;
+	const only = row.from ?? row.to;
+	return only ? `v${only.version}` : "";
+}
+function registerEnvDiff(env) {
+	env.command("diff").description("compare the secrets declared on two environments (or a branch and its parent)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <slug>", "environment or branch to compare from").requiredOption("--to <slug>", "environment or branch to compare to").option("--values", "also decrypt both sides to report identical/differs (values are never printed)").option("--json", "print the comparison as JSON (metadata only — never values)").action(async (options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const key = await kmsResolveKey(ctx, org.id, options.key);
-		const recipient = await kmsResolveRecipient(ctx, org.id, options);
-		await confirmDestructive(options.yes, `Revoke ${recipient.principalId} from ${key.name}? Anything already decrypted stays decrypted.`);
-		await ctx.client.revokeKmsKey(org.id, key.id, {
-			principalType: recipient.principalType,
-			principalId: recipient.principalId
+		const app = await resolveApp(ctx, options);
+		const [from, to] = await Promise.all([resolveSide(ctx, app, options.from), resolveSide(ctx, app, options.to)]);
+		if (from.id === to.id) fail(`--from and --to are the same environment (${from.slug})`);
+		const [fromRows, toRows] = await Promise.all([ctx.client.listSecrets(app.orgId, from.id), ctx.client.listSecrets(app.orgId, to.id)]);
+		const facts = (rows) => rows.secrets.map(({ name, version, updatedAt }) => ({
+			name,
+			version,
+			updatedAt
+		}));
+		const values = options.values ? {
+			from: await fetchDecryptedSecrets(ctx, app.orgId, from.id, { raw: true }),
+			to: await fetchDecryptedSecrets(ctx, app.orgId, to.id, { raw: true })
+		} : void 0;
+		const rows = diffSecrets(facts(fromRows), facts(toRows), values);
+		const onlyFrom = rows.filter((r) => r.from && !r.to);
+		const onlyTo = rows.filter((r) => !r.from && r.to);
+		const both = rows.filter((r) => r.from && r.to);
+		const differs = both.filter((r) => r.value === "differs");
+		const identical = both.filter((r) => r.value === "identical");
+		emit(options, {
+			from: {
+				slug: from.slug,
+				isBranch: from.isBranch,
+				parentSlug: from.parentSlug
+			},
+			to: {
+				slug: to.slug,
+				isBranch: to.isBranch,
+				parentSlug: to.parentSlug
+			},
+			comparedValues: Boolean(options.values),
+			secrets: rows
+		}, () => {
+			for (const side of [from, to]) if (side.isBranch) console.log(`note: ${side.slug} is a branch — it declares only its own overrides; everything else it reads comes from ${side.parentSlug ?? "its parent"}`);
+			section(`only in ${from.slug}`);
+			printTable(onlyFrom, [col("name", (r) => r.name), col("version", versions)], `nothing declared only in ${from.slug}`);
+			section(`only in ${to.slug}`);
+			printTable(onlyTo, [col("name", (r) => r.name), col("version", versions)], `nothing declared only in ${to.slug}`);
+			if (options.values) {
+				section("different values");
+				printTable(differs, [col("name", (r) => r.name), col("version", versions)], "no shared name holds a different value");
+				section("identical values");
+				printTable(identical, [col("name", (r) => r.name), col("version", versions)], "no shared name holds the same value");
+				if (identical.length > 0) console.log(`\nnote: ${identical.length} name(s) hold the same value in both — a credential shared across two environments is one revocation that hits both.`);
+			} else {
+				section("declared in both");
+				printTable(both, [
+					col("name", (r) => r.name),
+					col("version", versions),
+					col("updated", (r) => r.to?.updatedAt ?? "")
+				], "no name is declared on both");
+				console.log("\nnote: values were not compared — pass --values to decrypt both sides and report identical/differs.");
+			}
+			console.log("note: this compares secrets declared on each environment, not the composed view — a secret contributed by a group is not listed here.");
 		});
-		console.error(`revoked ${recipient.principalId} from ${key.name}`);
 	});
-	kms.command("rotate").description("add a new key version and re-wrap it for every current grantee").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const key = await kmsResolveKey(ctx, org.id, options.key);
-		let toWrap;
-		let publicKeyJwk;
-		if (key.purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
-		else {
-			const km = await generateSigningKeyMaterial();
-			toWrap = km.privateKeyPkcs8;
-			publicKeyJwk = km.publicKeyJwk;
-		}
-		const { grants: current } = await ctx.client.listKmsGrants(org.id, key.id);
-		const [{ members }, { tokens }] = await Promise.all([ctx.client.listMembers(org.id), ctx.client.listTokens(org.id)]);
+}
+//#endregion
+//#region src/kms.ts
+/** Collect a repeatable option into a list. */
+function collect$8(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** The calling principal's identity + public key (for a self-grant). */
+async function kmsCallerIdentity(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return {
+			principalType: "service_token",
+			principalId: tokenId,
+			publicKeyJwk: JSON.stringify(pub)
+		};
+	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+	return {
+		principalType: "user",
+		principalId: user.id,
+		publicKeyJwk: user.publicKeyJwk
+	};
+}
+/** Look up an org member (by email) or service token (by id) as a grant recipient. */
+async function kmsResolveRecipient(ctx, orgId, who) {
+	if (who.user) {
+		const { members } = await ctx.client.listMembers(orgId);
+		const m = members.find((x) => x.email === who.user);
+		if (!m) fail(`no member ${who.user}`);
+		if (!m.publicKeyJwk) fail(`${who.user} has not completed key setup`);
+		return {
+			principalType: "user",
+			principalId: m.userId,
+			publicKeyJwk: m.publicKeyJwk
+		};
+	}
+	if (who.token) {
+		const { tokens } = await ctx.client.listTokens(orgId);
+		const t = tokens.find((x) => x.id === who.token);
+		if (!t) fail(`no service token ${who.token}`);
+		return {
+			principalType: "service_token",
+			principalId: t.id,
+			publicKeyJwk: t.publicKeyJwk
+		};
+	}
+	fail("specify --user <email> or --token <id>");
+}
+async function kmsResolveKey(ctx, orgId, ref) {
+	const { keys } = await ctx.client.listKmsKeys(orgId);
+	const key = keys.find((k) => k.id === ref || k.name === ref);
+	if (!key) fail(`no KMS key "${ref}"`);
+	return key;
+}
+/** Recover a key's material for one version (default: current), for the caller. */
+async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
+	const mat = await ctx.client.getMyKmsKey(orgId, keyId);
+	const v = version ?? mat.currentVersion;
+	const grant = mat.grants.find((g) => g.version === v);
+	if (!grant) fail(`no grant for version ${v} of this key`);
+	return {
+		material: await unwrapDek(grant.wrappedKey, await getPrivateKey(ctx)),
+		version: v,
+		currentVersion: mat.currentVersion
+	};
+}
+function registerKmsCommands(program) {
+	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$8, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$8, []).action(async (options) => {
+		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
+		if (options.app && options.group) fail("pass at most one of --app or --group");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		let toWrap;
+		let publicKeyJwk;
+		if (options.purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		let applicationId;
+		let groupId;
+		if (options.app) {
+			const { apps } = await ctx.client.listApps(org.id);
+			const app = apps.find((a) => a.slug === options.app || a.id === options.app);
+			if (!app) fail(`no app "${options.app}" in ${org.slug}`);
+			applicationId = app.id;
+		} else if (options.group) {
+			const { groups } = await ctx.client.listGroups(org.id);
+			const group = groups.find((g) => g.slug === options.group || g.id === options.group);
+			if (!group) fail(`no group "${options.group}" in ${org.slug}`);
+			groupId = group.id;
+		}
+		const recipients = [await kmsCallerIdentity(ctx)];
+		for (const email of options.grantUser) recipients.push(await kmsResolveRecipient(ctx, org.id, { user: email }));
+		for (const tokenId of options.grantToken) recipients.push(await kmsResolveRecipient(ctx, org.id, { token: tokenId }));
+		const seen = /* @__PURE__ */ new Set();
+		const grants = [];
+		for (const r of recipients) {
+			const dedupeKey = `${r.principalType}:${r.principalId}`;
+			if (seen.has(dedupeKey)) continue;
+			seen.add(dedupeKey);
+			grants.push({
+				principalType: r.principalType,
+				principalId: r.principalId,
+				wrappedKey: await wrapDek(toWrap, r.publicKeyJwk)
+			});
+		}
+		const input = {
+			name: options.name,
+			purpose: options.purpose,
+			spec: options.purpose === "sign" ? "ecdsa-p256" : "aes-256-gcm",
+			...applicationId ? { applicationId } : {},
+			...groupId ? { groupId } : {},
+			...publicKeyJwk ? { publicKeyJwk } : {},
+			grants
+		};
+		const { key } = await ctx.client.createKmsKey(org.id, input);
+		console.error(`created ${key.purpose} key ${key.name} (${key.id}), ${grants.length} grant(s)`);
+	});
+	kms.command("ls").description("list keys you can see").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { keys } = await ctx.client.listKmsKeys(org.id);
+		if (keys.length === 0) {
+			console.error("(no keys)");
+			return;
+		}
+		for (const k of keys) {
+			const scope = k.applicationId ? `app:${k.applicationId}` : k.groupId ? `group:${k.groupId}` : "org";
+			const state = k.disabledAt ? " [disabled]" : "";
+			console.log(`${k.name}\t${k.purpose}\tv${k.currentVersion}\t${scope}\t${k.id}${state}`);
+		}
+	});
+	kms.command("grant").description("grant a principal use of a key's current version").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <email>", "grant an org member").option("--token <tokenId>", "grant a service token").action(async (options) => {
+		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const recipient = await kmsResolveRecipient(ctx, org.id, options);
+		const { material } = await kmsRecoverMaterial(ctx, org.id, key.id);
+		await ctx.client.grantKmsKey(org.id, key.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId,
+			wrappedKey: await wrapDek(material, recipient.publicKeyJwk)
+		});
+		console.error(`granted ${key.name} to ${recipient.principalId}`);
+	});
+	kms.command("revoke").description("revoke a principal from a key (all versions)").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <email>", "revoke this user's grant").option("--token <tokenId>", "revoke this service token's grant").option("-y, --yes", "skip the confirmation").action(async (options) => {
+		if (!options.user === !options.token) fail("pass exactly one of --user or --token");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		const recipient = await kmsResolveRecipient(ctx, org.id, options);
+		await confirmDestructive(options.yes, `Revoke ${recipient.principalId} from ${key.name}? Anything already decrypted stays decrypted.`);
+		await ctx.client.revokeKmsKey(org.id, key.id, {
+			principalType: recipient.principalType,
+			principalId: recipient.principalId
+		});
+		console.error(`revoked ${recipient.principalId} from ${key.name}`);
+	});
+	kms.command("rotate").description("add a new key version and re-wrap it for every current grantee").requiredOption("--key <name>", "key name or id").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const key = await kmsResolveKey(ctx, org.id, options.key);
+		let toWrap;
+		let publicKeyJwk;
+		if (key.purpose === "encrypt") toWrap = generateEncryptKeyMaterial();
+		else {
+			const km = await generateSigningKeyMaterial();
+			toWrap = km.privateKeyPkcs8;
+			publicKeyJwk = km.publicKeyJwk;
+		}
+		const { grants: current } = await ctx.client.listKmsGrants(org.id, key.id);
+		const [{ members }, { tokens }] = await Promise.all([ctx.client.listMembers(org.id), ctx.client.listTokens(org.id)]);
 		const grants = [];
 		for (const g of current) {
 			const pub = g.principalType === "user" ? members.find((m) => m.userId === g.principalId)?.publicKeyJwk : tokens.find((t) => t.id === g.principalId)?.publicKeyJwk;
@@ -7351,7 +7814,7 @@ function registerKmsCommands(program) {
 //#endregion
 //#region src/recovery.ts
 /** Collect a repeatable option into a list. */
-function collect$6(value, acc = []) {
+function collect$7(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -7448,7 +7911,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$7, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7466,7 +7929,7 @@ function registerRecoveryCommands(program) {
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$7, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7634,6 +8097,7 @@ function registerAppCommands(program) {
 		console.error(`deleted app ${ref.slug}`);
 	});
 	const env = program.command("env").description("manage environments");
+	registerEnvDiff(env);
 	env.command("list").alias("ls").description("list an application's environments").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveApp(ctx, options);
@@ -8606,7 +9070,7 @@ function formatSecrets(values, format) {
 * `buildContext()` in any of them silently breaks the promise the feature makes.
 */
 /** Collect a repeatable option into a list. */
-function collect$5(value, acc = []) {
+function collect$6(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -8879,7 +9343,7 @@ function registerArchiveCommands(program) {
 		} catch {}
 		fail("none of the recovery shares in this archive unwrap with that key");
 	});
-	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$6).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
 		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
 		if (![
 			"dotenv",
@@ -8930,525 +9394,1191 @@ function parseLimit(raw) {
 	if (!Number.isInteger(n) || n < 1) fail(`--limit must be a positive whole number, got "${raw}"`);
 	return Math.min(n, MAX_PAGE);
 }
-/**
-* The org audit trail. Append-only and admin-only, so this is the record of
-* who did what — the CLI needs the same filters the dashboard has, plus
-* pagination, or "find the grant that shouldn't be there" means scrolling.
-*/
-function registerAuditCommands(program) {
-	const audit = program.command("audit").description("read the org audit trail");
-	audit.command("list", { isDefault: true }).alias("ls").description("show the org audit trail").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--limit <n>", `entries per page (max ${MAX_PAGE})`, "50").option("--action <action>", "only this action, e.g. env.key_granted").option("--resource-type <type>", "only this resource type, e.g. environment").option("--cursor <cursor>", "continue from a previous page's cursor").option("--all", "page through the whole trail, not just the first page").option("--metadata", "include each entry's metadata as JSON").option("--json", "print the raw API response").action(async (options) => {
-		if (options.action && !AUDIT_ACTIONS.includes(options.action)) fail(`unknown action "${options.action}" — see \`seekrit audit actions\``);
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const limit = parseLimit(options.limit);
-		const entries = [];
-		let cursor = options.cursor;
-		let nextCursor = null;
-		do {
-			const page = await ctx.client.listAudit(ref.id, {
-				limit,
-				cursor,
-				action: options.action,
-				resourceType: options.resourceType
-			});
-			entries.push(...page.entries);
-			nextCursor = page.nextCursor;
-			cursor = page.nextCursor ?? void 0;
-		} while (options.all && cursor);
-		emit(options, {
-			entries,
-			nextCursor
-		}, () => {
-			printTable(entries, [
-				col("when", (e) => e.createdAt),
-				col("action", (e) => e.action),
-				col("actor", (e) => `${e.actorType}:${e.actorId}`),
-				col("resource", (e) => `${e.resourceType}${e.resourceId ? `:${e.resourceId}` : ""}`),
-				...options.metadata ? [col("metadata", (e) => e.metadata ? JSON.stringify(e.metadata) : "-")] : []
-			], "no audit entries match");
-			if (nextCursor && !options.all) console.error(`more entries — continue with --cursor ${nextCursor} (or pass --all)`);
-		});
-	});
-	audit.command("actions").description("list every action the audit trail can record (for `audit --action`)").option("--json", "print the raw API response").action((options) => {
-		emit(options, { actions: AUDIT_ACTIONS }, () => {
-			for (const action of AUDIT_ACTIONS) console.log(action);
-		});
-	});
+/**
+* The org audit trail. Append-only and admin-only, so this is the record of
+* who did what — the CLI needs the same filters the dashboard has, plus
+* pagination, or "find the grant that shouldn't be there" means scrolling.
+*/
+function registerAuditCommands(program) {
+	const audit = program.command("audit").description("read the org audit trail");
+	audit.command("list", { isDefault: true }).alias("ls").description("show the org audit trail").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--limit <n>", `entries per page (max ${MAX_PAGE})`, "50").option("--action <action>", "only this action, e.g. env.key_granted").option("--resource-type <type>", "only this resource type, e.g. environment").option("--cursor <cursor>", "continue from a previous page's cursor").option("--all", "page through the whole trail, not just the first page").option("--metadata", "include each entry's metadata as JSON").option("--json", "print the raw API response").action(async (options) => {
+		if (options.action && !AUDIT_ACTIONS.includes(options.action)) fail(`unknown action "${options.action}" — see \`seekrit audit actions\``);
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const limit = parseLimit(options.limit);
+		const entries = [];
+		let cursor = options.cursor;
+		let nextCursor = null;
+		do {
+			const page = await ctx.client.listAudit(ref.id, {
+				limit,
+				cursor,
+				action: options.action,
+				resourceType: options.resourceType
+			});
+			entries.push(...page.entries);
+			nextCursor = page.nextCursor;
+			cursor = page.nextCursor ?? void 0;
+		} while (options.all && cursor);
+		emit(options, {
+			entries,
+			nextCursor
+		}, () => {
+			printTable(entries, [
+				col("when", (e) => e.createdAt),
+				col("action", (e) => e.action),
+				col("actor", (e) => `${e.actorType}:${e.actorId}`),
+				col("resource", (e) => `${e.resourceType}${e.resourceId ? `:${e.resourceId}` : ""}`),
+				...options.metadata ? [col("metadata", (e) => e.metadata ? JSON.stringify(e.metadata) : "-")] : []
+			], "no audit entries match");
+			if (nextCursor && !options.all) console.error(`more entries — continue with --cursor ${nextCursor} (or pass --all)`);
+		});
+	});
+	audit.command("actions").description("list every action the audit trail can record (for `audit --action`)").option("--json", "print the raw API response").action((options) => {
+		emit(options, { actions: AUDIT_ACTIONS }, () => {
+			for (const action of AUDIT_ACTIONS) console.log(action);
+		});
+	});
+}
+//#endregion
+//#region src/aws.ts
+/**
+* `seekrit aws` — temporary AWS credentials via STS AssumeRole (Vault-style
+* dynamic secrets, the tier-2 sibling of `seekrit pg`).
+*
+* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
+* keypair on THIS machine and sends only the public key; STS mints the
+* credential and the broker returns it wrapped to that key, so the control plane
+* only ever relays ciphertext and only this machine can unwrap it. Registering a
+* target wraps the base IAM credential to the broker's public key locally, so
+* the control plane never sees it either — its only needed permission is
+* `sts:AssumeRole` on the target role.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$6(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/**
+* The base IAM credential the broker assumes the role with. From flags or the
+* standard AWS env vars; JSON-serialized so the executor can parse it. Never the
+* plaintext leaves this machine unwrapped — it is wrapped to the broker key.
+*/
+function resolveBaseCredential(opts) {
+	const accessKeyId = opts.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = opts.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY;
+	const sessionToken = process.env.AWS_SESSION_TOKEN;
+	if (!accessKeyId || !secretAccessKey) fail("provide the base IAM credential via --access-key-id/--secret-access-key or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (it needs only sts:AssumeRole on the role)");
+	return JSON.stringify({
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	});
+}
+function registerAwsCommands(program) {
+	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
+	const target = aws.command("target").description("manage AWS role targets");
+	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
+		const config = {
+			provider: "aws",
+			executor: "in_do",
+			roleArn: options.roleArn,
+			region: options.region,
+			...options.externalId ? { externalId: options.externalId } : {},
+			...sessionPolicy ? { sessionPolicy } : {},
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$6(options.maxTtl) } : {}
+		};
+		const baseCredential = resolveBaseCredential(options);
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(baseCredential), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered AWS target ${created.name} (${created.id})`);
+		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
+		console.log(awsTrustPolicyInstructions(config));
+	});
+	target.command("list").description("list AWS role targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "aws") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
+		}
+	});
+	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
+		console.log(awsTrustPolicyInstructions(cfg));
+	});
+	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
+		const ttlSeconds = parseTtlSeconds$6(options.ttl);
+		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
+		const recipient = await generateAwsRecipientKeyPair();
+		const { aws: leased } = await ctx.client.mintLease(org.id, {
+			provider: "aws",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds
+		});
+		const cred = await unwrapAwsCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cfg.roleArn} in ${cred.region} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify({
+			...cred,
+			roleArn: cfg.roleArn
+		}, null, 2));
+		else {
+			console.log(`export AWS_ACCESS_KEY_ID=${cred.accessKeyId}`);
+			console.log(`export AWS_SECRET_ACCESS_KEY=${cred.secretAccessKey}`);
+			console.log(`export AWS_SESSION_TOKEN=${cred.sessionToken}`);
+			console.log(`export AWS_REGION=${cred.region}`);
+		}
+	});
+	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "aws") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId}? Credentials already issued stay valid until they expire.`);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
+	});
+}
+//#endregion
+//#region src/billing.ts
+/** `included: null` means unlimited; an unavailable meter is unknown, not zero. */
+function usageLine(usage) {
+	if (!usage.available) return "unknown";
+	return `${usage.quantity} of ${usage.included ?? "unlimited"}`;
+}
+/**
+* Plan, usage, and self-serve billing.
+*
+* Checkout and the billing portal are browser flows the biller hosts, so those
+* commands print a URL rather than pretending to complete a payment in the
+* terminal.
+*/
+function registerBillingCommands(program) {
+	const billing = program.command("billing").description("plan, usage, and subscription");
+	billing.command("show", { isDefault: true }).description("show the org's plan, what it includes, and current usage").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const info = await ctx.client.getBilling(ref.id);
+		emit(options, info, () => {
+			printFields([
+				["plan", `${info.plan.name} (${info.plan.id})`],
+				["status", info.subscription?.status ?? "no subscription (default plan)"],
+				["renews", info.subscription?.currentPeriodEnd ?? null],
+				["cancels", info.subscription?.cancelAt ?? null],
+				["trial ends", info.subscription?.trialEndsAt ?? null],
+				["limits enforced", info.enforced ? "yes" : "no (informational only)"],
+				["self-serve", [info.manage.checkout ? `checkout (${info.manage.checkoutFamilies.join(", ")})` : null, info.manage.portal ? "portal" : null].filter(Boolean).join(", ") || "unavailable"]
+			]);
+			section("usage");
+			printTable(info.usage, [col("metric", (u) => u.label), col("used", (u) => usageLine(u))], "nothing metered yet");
+			if (info.overrides.length > 0) {
+				section("overrides");
+				printTable(info.overrides, [
+					col("key", (o) => o.key),
+					col("value", (o) => String(o.value)),
+					col("note", (o) => o.note),
+					col("expires", (o) => o.expiresAt)
+				]);
+			}
+		});
+	});
+	billing.command("entitlements").description("list every entitlement this org resolves to").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const info = await ctx.client.getBilling(ref.id);
+		emit(options, { entitlements: info.entitlements }, () => printTable(info.entitlements, [
+			col("key", (e) => e.key),
+			col("value", (e) => e.value === null ? "unlimited" : String(e.value)),
+			col("source", (e) => e.source)
+		]));
+	});
+	billing.command("checkout <family>").description(`start a self-serve upgrade (${VISIBLE_PLAN_FAMILY_IDS.join(" | ")}) — prints a URL`).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (family, options) => {
+		if (!PLAN_FAMILY_IDS.includes(family)) fail(`unknown plan "${family}" — one of: ${PLAN_FAMILY_IDS.join(", ")}`);
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { url } = await ctx.client.startCheckout(ref.id, { family });
+		console.error("open this to complete checkout:");
+		console.log(url);
+	});
+	billing.command("portal").description("open the billing portal (prints a URL) to manage payment and invoices").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		const { url } = await ctx.client.openBillingPortal(ref.id);
+		console.error("open this to manage billing:");
+		console.log(url);
+	});
+	billing.command("cancel").description("cancel the subscription and drop back to the Free plan").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
+		const ctx = buildContext();
+		const ref = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Cancel ${ref.slug}'s subscription and move it to the Free plan?`);
+		await ctx.client.cancelSubscription(ref.id);
+		console.error(`${ref.slug} moved to the Free plan`);
+	});
+}
+//#endregion
+//#region src/branches.ts
+/**
+* Resolve `--from` to the environment being branched.
+*
+* Not just `resolveAppEnv`: branch slugs live in the same namespace but are
+* excluded from the environment list, so naming one lands on "no environment
+* …". Branching a branch is a real thing people will try (depth is capped at
+* one), and it deserves an error that says so.
+*/
+async function resolveBranchParent(ctx, opts) {
+	const app = await resolveApp(ctx, opts);
+	const { environments } = await ctx.client.listEnvs(app.orgId, app.id);
+	const env = environments.find((e) => e.slug === opts.from || e.id === opts.from);
+	if (env) return {
+		orgId: app.orgId,
+		appId: app.id,
+		appSlug: app.slug,
+		envId: env.id,
+		envSlug: env.slug
+	};
+	const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
+	if (branches.some((b) => b.slug === opts.from || b.id === opts.from)) fail(`"${opts.from}" is itself a branch — branches are one level deep, so branch from the environment it overlays`);
+	fail(`no environment "${opts.from}" in ${app.slug}`);
+}
+/**
+* Branch (ephemeral) configs: `seekrit branch create pr-142 --from dev`.
+*
+* A branch overlays its parent instead of copying it, so creating one encrypts
+* nothing — it mints a data key for the branch's own overrides and wraps that
+* key to whoever should read them. Everything the branch inherits stays where
+* it is, and stays live.
+*/
+function registerBranchCommands(program) {
+	const branch = program.command("branch").description("ephemeral per-PR / preview configs layered on an environment");
+	branch.command("create <slug>").description("fork an environment into an ephemeral branch (inherits its secrets)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <env>", "the environment to branch").option("--name <name>", "display name (defaults to the slug)").option("--ttl <duration>", "lifetime: 12h, 7d, 2w, … or `never`", "7d").option("--no-share", "don't give the parent's other readers access to this branch").action(async (slug, options) => {
+		const ctx = buildContext();
+		const parent = await resolveBranchParent(ctx, {
+			org: options.org,
+			app: options.app,
+			from: options.from
+		});
+		const parsedTtl = parseBranchTtl(options.ttl);
+		if (parsedTtl === null) fail(`invalid --ttl "${options.ttl}" (try 12h, 7d, 2w, or never)`);
+		const ttlSeconds = Number.isFinite(parsedTtl) ? parsedTtl : null;
+		const me = await kmsCallerIdentity(ctx);
+		const dek = generateDek();
+		const wrappedDek = await wrapDek(dek, me.publicKeyJwk);
+		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, parent.orgId, dek);
+		const grants = [];
+		if (options.share !== false) {
+			const { grantees } = await ctx.client.listGrantees(parent.orgId, parent.envId);
+			for (const grantee of grantees) {
+				if (grantee.principalType === me.principalType && grantee.principalId === me.principalId) continue;
+				grants.push({
+					principalType: grantee.principalType,
+					principalId: grantee.principalId,
+					wrappedDek: await wrapDek(dek, grantee.publicKeyJwk)
+				});
+			}
+		}
+		const created = await ctx.client.createBranch(parent.orgId, parent.envId, {
+			slug,
+			name: options.name,
+			ttlSeconds,
+			wrappedDek,
+			recoveryWrappedDek,
+			grants
+		});
+		console.error(`created branch ${parent.appSlug}/${parent.envSlug}#${created.branch.slug} (${created.branch.id})`);
+		console.error(created.branch.expiresAt ? `expires ${created.branch.expiresAt}` : "no expiry — delete it explicitly when the PR closes");
+		if (grants.length > 0) console.error(`shared with ${grants.length} other reader(s)`);
+	});
+	branch.command("list").alias("ls").description("list branches in an application (or of one environment)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const branches = options.env ? await (async () => {
+			const parent = await resolveAppEnv(ctx, options);
+			return (await ctx.client.listBranches(parent.orgId, parent.envId)).branches;
+		})() : await (async () => {
+			const app = await resolveApp(ctx, options);
+			return (await ctx.client.listAppBranches(app.orgId, app.id)).branches;
+		})();
+		emit(options, { branches }, () => printTable(branches, [
+			col("slug", (b) => b.slug),
+			col("expires", (b) => b.expiresAt ?? "never"),
+			col("created", (b) => b.createdAt),
+			col("id", (b) => b.id)
+		], "no branches — create one with `seekrit branch create`"));
+	});
+	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("-y, --yes", "skip the confirmation").action(async (slug, options) => {
+		const ctx = buildContext();
+		const app = await resolveApp(ctx, options);
+		const target = await resolveBranch(ctx, app, slug);
+		await confirmDestructive(options.yes, `Tear down branch ${app.slug}#${target.slug} and every override in it?`);
+		await ctx.client.deleteBranch(app.orgId, target.id);
+		console.error(`deleted branch ${app.slug}#${target.slug}`);
+	});
+}
+/** Plugin id and integration id declared by `@seekrit/openclaw-plugin`. */
+const PLUGIN_ID = "seekrit";
+const PLUGIN_INTEGRATION_ID = "seekrit";
+/** The provider alias written into `secrets.providers`. */
+const PROVIDER_ALIAS = "seekrit";
+/**
+* Environment the resolver needs, and nothing else.
+*
+* OpenClaw hands an exec provider an empty environment apart from this
+* allowlist, which is a feature: it is the difference between "the resolver can
+* read the credential it needs" and "the resolver inherits the whole gateway
+* environment". `PATH` is here because Node's own startup needs it, `HOME` for
+* the CLI's login session, and the `SEEKRIT_*` set is how a machine credential
+* reaches a process nobody gets to pass flags to.
+*/
+const PASS_ENV = [
+	"PATH",
+	"HOME",
+	"USERPROFILE",
+	"APPDATA",
+	"LOCALAPPDATA",
+	"TEMP",
+	"TMP",
+	"SYSTEMROOT",
+	"WINDIR",
+	"XDG_CONFIG_HOME",
+	"XDG_CACHE_HOME",
+	"NODE_EXTRA_CA_CERTS",
+	"SEEKRIT_TOKEN",
+	"SEEKRIT_CLIENT_ID",
+	"SEEKRIT_CLIENT_SECRET",
+	"SEEKRIT_API_URL",
+	"SEEKRIT_ORG",
+	"SEEKRIT_APP",
+	"SEEKRIT_ENV",
+	"SEEKRIT_BRANCH"
+];
+/**
+* Generous, because the first resolve of a cold start does real work — an M2M
+* token mint, a resolve, and a key unwrap — and OpenClaw fails startup rather
+* than degrading when this expires. The 1Password integration picks 90s for the
+* same reason (its CLI may prompt for biometrics); 30s is enough here because
+* nothing in this path is interactive.
+*/
+const TIMEOUT_MS = 3e4;
+/** A seekrit secret name: what `seekrit secrets set` accepts. */
+const NAME_RE$1 = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Slugs as the API spells them. */
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+/**
+* Parse an exec SecretRef id.
+*
+* Two shapes, mirroring 1Password's `op://vault/item/field` — a bare name for
+* the environment the credential already points at, and an explicit
+* `app/env/NAME` triple for a provider serving more than one environment:
+*
+*     OPENAI_API_KEY
+*     billing-api/production/STRIPE_SECRET_KEY
+*
+* A bare name is the common case and the one a service token wants, since the
+* token is already bound to an environment and there is nothing to disambiguate.
+*/
+function parseSecretId(id) {
+	const trimmed = id.trim();
+	if (trimmed.length === 0) return void 0;
+	const parts = trimmed.split("/");
+	if (parts.length === 1) {
+		const [name = ""] = parts;
+		return NAME_RE$1.test(name) ? { name } : void 0;
+	}
+	if (parts.length !== 3) return void 0;
+	const [app = "", env = "", name = ""] = parts;
+	if (!SLUG_RE.test(app) || !SLUG_RE.test(env) || !NAME_RE$1.test(name)) return void 0;
+	return {
+		app,
+		env,
+		name
+	};
+}
+/** The (app, env) pair an id resolves against — `""` for the credential's own. */
+function scopeKey(id) {
+	return id.app && id.env ? `${id.app}/${id.env}` : "";
 }
-//#endregion
-//#region src/aws.ts
 /**
-* `seekrit aws` — temporary AWS credentials via STS AssumeRole (Vault-style
-* dynamic secrets, the tier-2 sibling of `seekrit pg`).
+* Parse a request, tolerantly in exactly one direction.
 *
-* Zero-knowledge for the leased credential: minting generates an ephemeral P-256
-* keypair on THIS machine and sends only the public key; STS mints the
-* credential and the broker returns it wrapped to that key, so the control plane
-* only ever relays ciphertext and only this machine can unwrap it. Registering a
-* target wraps the base IAM credential to the broker's public key locally, so
-* the control plane never sees it either — its only needed permission is
-* `sts:AssumeRole` on the target role.
+* Non-string and empty ids are dropped rather than rejected — a request whose
+* shape we do not recognize should still resolve the ids we do, because the
+* alternative fails OpenClaw's whole startup over one malformed entry. A body
+* that is not an object with an `ids` array is a different matter: there is
+* nothing to answer, so it throws.
 */
-/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$6(input) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
+function parseExecRequest(input) {
+	const parsed = JSON.parse(input);
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("exec SecretRef request must be a JSON object");
+	const ids = parsed.ids;
+	if (!Array.isArray(ids)) throw new Error("exec SecretRef request must carry an `ids` array");
+	return { ids: ids.filter((id) => typeof id === "string" && id.trim().length > 0) };
+}
+/** Assemble a response, omitting `errors` entirely when everything resolved. */
+function buildExecResponse(values, errors) {
+	return {
+		protocolVersion: 1,
+		values,
+		...Object.keys(errors).length > 0 ? { errors } : {}
+	};
 }
 /**
-* The base IAM credential the broker assumes the role with. From flags or the
-* standard AWS env vars; JSON-serialized so the executor can parse it. Never the
-* plaintext leaves this machine unwrapped — it is wrapped to the broker key.
+* Resolve every requested id, reading each distinct environment exactly once.
+*
+* A batch is normally one environment, but a provider may serve several, and
+* resolving per id would mean an unwrap per id. Grouping keeps a 40-variable
+* gateway to one round trip.
+*
+* `resolveScope` is injected so the protocol can be tested without a network,
+* an API, or a key.
 */
-function resolveBaseCredential(opts) {
-	const accessKeyId = opts.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID;
-	const secretAccessKey = opts.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY;
-	const sessionToken = process.env.AWS_SESSION_TOKEN;
-	if (!accessKeyId || !secretAccessKey) fail("provide the base IAM credential via --access-key-id/--secret-access-key or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (it needs only sts:AssumeRole on the role)");
-	return JSON.stringify({
-		accessKeyId,
-		secretAccessKey,
-		...sessionToken ? { sessionToken } : {}
-	});
-}
-function registerAwsCommands(program) {
-	const aws = program.command("aws").description("temporary AWS credentials (STS AssumeRole, zero-knowledge)");
-	const target = aws.command("target").description("manage AWS role targets");
-	target.command("add").description("register an assumable IAM role to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-deploy").requiredOption("--role-arn <arn>", "the IAM role to assume, arn:aws:iam::<acct>:role/<name>").requiredOption("--region <region>", "region whose STS endpoint to call, e.g. us-east-1").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--external-id <id>", "STS ExternalId the role's trust policy requires").option("--session-policy <file>", "path to an inline session policy JSON (further restricts)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--access-key-id <id>", "base IAM access key id (else AWS_ACCESS_KEY_ID)").option("--secret-access-key <secret>", "base IAM secret (else AWS_SECRET_ACCESS_KEY)").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const sessionPolicy = options.sessionPolicy ? readFileSync(options.sessionPolicy, "utf8").trim() : void 0;
-		const config = {
-			provider: "aws",
-			executor: "in_do",
-			roleArn: options.roleArn,
-			region: options.region,
-			...options.externalId ? { externalId: options.externalId } : {},
-			...sessionPolicy ? { sessionPolicy } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$6(options.maxTtl) } : {}
-		};
-		const baseCredential = resolveBaseCredential(options);
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(baseCredential), publicKeyJwk);
-		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
-			name: options.name,
-			config,
-			wrappedAdminSecret
-		});
-		console.error(`registered AWS target ${created.name} (${created.id})`);
-		console.error("\nEnsure the role trusts the admin principal, then `seekrit aws lease`:\n");
-		console.log(awsTrustPolicyInstructions(config));
-	});
-	target.command("list").description("list AWS role targets").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		for (const t of targets) {
-			const cfg = t.config;
-			if (cfg.provider !== "aws") continue;
-			console.log(`${t.id}\t${t.name}\t${cfg.region}\t${cfg.roleArn}`);
+async function resolveIds(ids, resolveScope) {
+	const values = {};
+	const errors = {};
+	const byScope = /* @__PURE__ */ new Map();
+	for (const id of ids) {
+		const parsed = parseSecretId(id);
+		if (!parsed) {
+			errors[id] = { code: "INVALID_ID" };
+			continue;
 		}
-	});
-	target.command("trust <targetId>").description("reprint the IAM trust-policy setup for an AWS target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetId || x.name === targetId);
-		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "aws") fail("not an aws target (see `seekrit pg`/`seekrit ssh`)");
-		console.log(awsTrustPolicyInstructions(cfg));
-	});
-	target.command("rm <targetId>").description("delete an AWS role target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`deleted ${targetId}`);
-	});
-	aws.command("lease <target>").description("mint short-lived AWS credentials; prints ready-to-source export lines").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--ttl <duration>", "credential lifetime, e.g. 15m, 1h, 12h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
-		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
-		const ttlSeconds = parseTtlSeconds$6(options.ttl);
-		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
-		const recipient = await generateAwsRecipientKeyPair();
-		const { aws: leased } = await ctx.client.mintLease(org.id, {
-			provider: "aws",
-			targetId: t.id,
-			recipientPublicKey: recipient.publicKeyJwk,
-			ttlSeconds
+		const key = scopeKey(parsed);
+		const bucket = byScope.get(key) ?? {
+			scope: parsed,
+			ids: []
+		};
+		bucket.ids.push({
+			id,
+			name: parsed.name
 		});
-		const cred = await unwrapAwsCredential(leased.wrappedCredential, recipient.privateKeyJwk);
-		console.error(`leased ${cfg.roleArn} in ${cred.region} — expires ${cred.expiration}`);
-		if (options.json) console.log(JSON.stringify({
-			...cred,
-			roleArn: cfg.roleArn
-		}, null, 2));
-		else {
-			console.log(`export AWS_ACCESS_KEY_ID=${cred.accessKeyId}`);
-			console.log(`export AWS_SECRET_ACCESS_KEY=${cred.secretAccessKey}`);
-			console.log(`export AWS_SESSION_TOKEN=${cred.sessionToken}`);
-			console.log(`export AWS_REGION=${cred.region}`);
+		byScope.set(key, bucket);
+	}
+	for (const { scope, ids: wanted } of byScope.values()) {
+		let resolved;
+		try {
+			resolved = await resolveScope(scope);
+		} catch (err) {
+			const code = classify(err);
+			for (const { id } of wanted) errors[id] = { code };
+			continue;
 		}
-	});
-	aws.command("leases").description("list AWS leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) {
-			if (l.provider !== "aws") continue;
-			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		for (const { id, name } of wanted) {
+			const value = resolved[name];
+			if (value === void 0) errors[id] = { code: "NOT_FOUND" };
+			else values[id] = value;
 		}
-	});
-	aws.command("revoke <leaseId>").description("mark a lease revoked in the ledger (STS credentials stay valid until they expire)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await confirmDestructive(options.yes, `Revoke lease ${leaseId}? Credentials already issued stay valid until they expire.`);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId} (issued credentials remain valid until they expire)`);
-	});
+	}
+	return buildExecResponse(values, errors);
+}
+/**
+* Bucket a failure into a code an operator can act on.
+*
+* Deliberately coarse and deliberately message-free: it reads the error's own
+* text to pick a bucket and then throws that text away, because the text may
+* quote a token.
+*/
+function classify(err) {
+	const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
+	if (/unauthor|forbidden|token|credential|passphrase|decrypt|sign in|log in|login/.test(message)) return "UNAUTHORIZED";
+	return "UNAVAILABLE";
+}
+/** OpenClaw's config directory: `$OPENCLAW_HOME`, else `~/.openclaw`. */
+function openclawHome(env = process.env) {
+	const home = env.OPENCLAW_HOME?.trim();
+	return home && home.length > 0 ? resolve(home) : join(homedir(), ".openclaw");
 }
-//#endregion
-//#region src/billing.ts
-/** `included: null` means unlimited; an unavailable meter is unknown, not zero. */
-function usageLine(usage) {
-	if (!usage.available) return "unknown";
-	return `${usage.quantity} of ${usage.included ?? "unlimited"}`;
+/**
+* The provider block for an installed `@seekrit/openclaw-plugin`.
+*
+* Preferred over the exec shape below for one reason that matters on upgrade:
+* OpenClaw reads the command out of the plugin's manifest at every startup, so
+* a plugin release that moves its resolver keeps working. A copied command is a
+* path pinned in someone's config forever.
+*/
+function pluginProvider() {
+	return {
+		source: "exec",
+		pluginIntegration: {
+			pluginId: PLUGIN_ID,
+			integrationId: PLUGIN_INTEGRATION_ID
+		}
+	};
 }
 /**
-* Plan, usage, and self-serve billing.
+* The provider block for a plain CLI install, with no plugin.
 *
-* Checkout and the billing portal are browser flows the biller hosts, so those
-* commands print a URL rather than pretending to complete a payment in the
-* terminal.
+* `realpathSync` on both paths is not tidiness. OpenClaw's guard rejects a
+* symlinked command outright, and a Node installed by a version manager is
+* almost always reached through one — so resolving here is the difference
+* between a provider that works and a startup failure whose message points at
+* the config rather than at the shim.
 */
-function registerBillingCommands(program) {
-	const billing = program.command("billing").description("plan, usage, and subscription");
-	billing.command("show", { isDefault: true }).description("show the org's plan, what it includes, and current usage").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const info = await ctx.client.getBilling(ref.id);
-		emit(options, info, () => {
-			printFields([
-				["plan", `${info.plan.name} (${info.plan.id})`],
-				["status", info.subscription?.status ?? "no subscription (default plan)"],
-				["renews", info.subscription?.currentPeriodEnd ?? null],
-				["cancels", info.subscription?.cancelAt ?? null],
-				["trial ends", info.subscription?.trialEndsAt ?? null],
-				["limits enforced", info.enforced ? "yes" : "no (informational only)"],
-				["self-serve", [info.manage.checkout ? `checkout (${info.manage.checkoutFamilies.join(", ")})` : null, info.manage.portal ? "portal" : null].filter(Boolean).join(", ") || "unavailable"]
-			]);
-			section("usage");
-			printTable(info.usage, [col("metric", (u) => u.label), col("used", (u) => usageLine(u))], "nothing metered yet");
-			if (info.overrides.length > 0) {
-				section("overrides");
-				printTable(info.overrides, [
-					col("key", (o) => o.key),
-					col("value", (o) => String(o.value)),
-					col("note", (o) => o.note),
-					col("expires", (o) => o.expiresAt)
-				]);
-			}
-		});
-	});
-	billing.command("entitlements").description("list every entitlement this org resolves to").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const info = await ctx.client.getBilling(ref.id);
-		emit(options, { entitlements: info.entitlements }, () => printTable(info.entitlements, [
-			col("key", (e) => e.key),
-			col("value", (e) => e.value === null ? "unlimited" : String(e.value)),
-			col("source", (e) => e.source)
-		]));
-	});
-	billing.command("checkout <family>").description(`start a self-serve upgrade (${VISIBLE_PLAN_FAMILY_IDS.join(" | ")}) — prints a URL`).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (family, options) => {
-		if (!PLAN_FAMILY_IDS.includes(family)) fail(`unknown plan "${family}" — one of: ${PLAN_FAMILY_IDS.join(", ")}`);
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { url } = await ctx.client.startCheckout(ref.id, { family });
-		console.error("open this to complete checkout:");
-		console.log(url);
-	});
-	billing.command("portal").description("open the billing portal (prints a URL) to manage payment and invoices").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { url } = await ctx.client.openBillingPortal(ref.id);
-		console.error("open this to manage billing:");
-		console.log(url);
-	});
-	billing.command("cancel").description("cancel the subscription and drop back to the Free plan").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation prompt").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		await confirmDestructive(options.yes, `Cancel ${ref.slug}'s subscription and move it to the Free plan?`);
-		await ctx.client.cancelSubscription(ref.id);
-		console.error(`${ref.slug} moved to the Free plan`);
-	});
+function execProvider(cliEntry, nodeBinary = process.execPath) {
+	const command = realTo(nodeBinary);
+	const entry = realTo(cliEntry);
+	return {
+		source: "exec",
+		command,
+		args: [
+			entry,
+			"openclaw",
+			"resolve"
+		],
+		passEnv: [...PASS_ENV],
+		jsonOnly: true,
+		timeoutMs: TIMEOUT_MS,
+		noOutputTimeoutMs: TIMEOUT_MS,
+		trustedDirs: [.../* @__PURE__ */ new Set([dirname(command), dirname(entry)])]
+	};
+}
+function realTo(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+/** This CLI's own entry file — what `execProvider` hands to Node. */
+function cliEntryPath() {
+	return fileURLToPath(new URL("index.js", import.meta.url));
 }
-//#endregion
-//#region src/branches.ts
 /**
-* Resolve `--from` to the environment being branched.
+* Add the seekrit provider to a parsed config without disturbing anything else.
 *
-* Not just `resolveAppEnv`: branch slugs live in the same namespace but are
-* excluded from the environment list, so naming one lands on "no environment
-* …". Branching a branch is a real thing people will try (depth is capped at
-* one), and it deserves an error that says so.
+* An existing `seekrit` entry that differs is left alone unless forced, for the
+* same reason `seekrit paperclip init` leaves an existing MCP server alone:
+* someone who pinned a timeout or narrowed `passEnv` did it deliberately, and
+* silently reverting a security narrowing is the worst kind of helpful.
 */
-async function resolveBranchParent(ctx, opts) {
-	const app = await resolveApp(ctx, opts);
-	const { environments } = await ctx.client.listEnvs(app.orgId, app.id);
-	const env = environments.find((e) => e.slug === opts.from || e.id === opts.from);
-	if (env) return {
-		orgId: app.orgId,
-		appId: app.id,
-		appSlug: app.slug,
-		envId: env.id,
-		envSlug: env.slug
+function mergeProvider(existing, provider, force) {
+	const secrets = { ...existing.secrets ?? {} };
+	const providers = { ...secrets.providers ?? {} };
+	const current = providers[PROVIDER_ALIAS];
+	if (current && !force && JSON.stringify(current) !== JSON.stringify(provider)) return {
+		merged: existing,
+		changed: false
+	};
+	if (current && JSON.stringify(current) === JSON.stringify(provider)) return {
+		merged: existing,
+		changed: false
+	};
+	providers[PROVIDER_ALIAS] = provider;
+	return {
+		merged: {
+			...existing,
+			secrets: {
+				...secrets,
+				providers
+			}
+		},
+		changed: true
+	};
+}
+/** A SecretRef pointing at this provider — what replaces a plaintext key. */
+function secretRef(id) {
+	return {
+		source: "exec",
+		provider: PROVIDER_ALIAS,
+		id
 	};
-	const { branches } = await ctx.client.listAppBranches(app.orgId, app.id);
-	if (branches.some((b) => b.slug === opts.from || b.id === opts.from)) fail(`"${opts.from}" is itself a branch — branches are one level deep, so branch from the environment it overlays`);
-	fail(`no environment "${opts.from}" in ${app.slug}`);
 }
 /**
-* Branch (ephemeral) configs: `seekrit branch create pr-142 --from dev`.
+* Read `openclaw.json`, or decline to.
 *
-* A branch overlays its parent instead of copying it, so creating one encrypts
-* nothing — it mints a data key for the branch's own overrides and wraps that
-* key to whoever should read them. Everything the branch inherits stays where
-* it is, and stays live.
+* The file is JSON5: comments and trailing commas are legal, and a parse/write
+* round trip through `JSON` would delete every comment in someone's gateway
+* config. So a file that is not also valid strict JSON is not edited at all —
+* the caller prints the block to paste instead. Losing a config's comments to
+* be helpful is worse than asking for one paste.
 */
-function registerBranchCommands(program) {
-	const branch = program.command("branch").description("ephemeral per-PR / preview configs layered on an environment");
-	branch.command("create <slug>").description("fork an environment into an ephemeral branch (inherits its secrets)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--from <env>", "the environment to branch").option("--name <name>", "display name (defaults to the slug)").option("--ttl <duration>", "lifetime: 12h, 7d, 2w, … or `never`", "7d").option("--no-share", "don't give the parent's other readers access to this branch").action(async (slug, options) => {
-		const ctx = buildContext();
-		const parent = await resolveBranchParent(ctx, {
-			org: options.org,
-			app: options.app,
-			from: options.from
-		});
-		const parsedTtl = parseBranchTtl(options.ttl);
-		if (parsedTtl === null) fail(`invalid --ttl "${options.ttl}" (try 12h, 7d, 2w, or never)`);
-		const ttlSeconds = Number.isFinite(parsedTtl) ? parsedTtl : null;
-		const me = await kmsCallerIdentity(ctx);
-		const dek = generateDek();
-		const wrappedDek = await wrapDek(dek, me.publicKeyJwk);
-		const recoveryWrappedDek = await recoveryWrapForNewEnv(ctx, parent.orgId, dek);
-		const grants = [];
-		if (options.share !== false) {
-			const { grantees } = await ctx.client.listGrantees(parent.orgId, parent.envId);
-			for (const grantee of grantees) {
-				if (grantee.principalType === me.principalType && grantee.principalId === me.principalId) continue;
-				grants.push({
-					principalType: grantee.principalType,
-					principalId: grantee.principalId,
-					wrappedDek: await wrapDek(dek, grantee.publicKeyJwk)
-				});
+function readOpenclawConfig(path) {
+	if (!existsSync(path)) return { config: {} };
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (err) {
+		fail(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (raw.trim().length === 0) return { config: {} };
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { json5: true };
+		return { config: parsed };
+	} catch {
+		return { json5: true };
+	}
+}
+function registerOpenclawCommands(program) {
+	const openclaw = program.command("openclaw").description("wire seekrit into OpenClaw as a SecretRef provider (`seekrit openclaw --help`)");
+	openclaw.command("init").description("add the seekrit exec SecretRef provider to openclaw.json").option("--config <path>", "path to openclaw.json (default: $OPENCLAW_HOME/openclaw.json)").option("--plugin", "point at an installed @seekrit/openclaw-plugin (recommended)").option("--exec", "point directly at this CLI, with no plugin installed").option("--write", "write the file instead of printing the block to paste").option("--force", "replace a seekrit provider entry that already differs").option("--json", "machine-readable output").action((options) => {
+		if (options.plugin && options.exec) fail("--plugin and --exec are mutually exclusive");
+		const usePlugin = options.exec !== true;
+		let provider;
+		if (usePlugin) provider = pluginProvider();
+		else {
+			const entry = cliEntryPath();
+			if (!existsSync(entry)) fail(`cannot find this CLI's entry file at ${entry} — --exec needs an installed seekrit (npm i -g @seekrit/cli), or use --plugin`);
+			provider = execProvider(entry);
+		}
+		const path = options.config ? resolve(options.config) : join(openclawHome(), "openclaw.json");
+		const read = readOpenclawConfig(path);
+		const json5 = "json5" in read;
+		const merged = json5 ? void 0 : mergeProvider(read.config, provider, options.force === true);
+		const wrote = Boolean(options.write) && merged?.changed === true;
+		if (wrote && merged) writeFileSync(path, `${JSON.stringify(merged.merged, null, 2)}\n`, { mode: 384 });
+		emit(options, {
+			path,
+			provider,
+			wrote,
+			json5
+		}, () => {
+			section("openclaw secret provider");
+			printFields([
+				["config", path],
+				["provider", PROVIDER_ALIAS],
+				["shape", usePlugin ? "plugin integration" : "exec (this CLI)"],
+				["written", wrote ? "yes" : "no"]
+			]);
+			console.log();
+			if (json5) {
+				console.log(`${path} is JSON5 (comments or trailing commas), which a rewrite here would delete.`);
+				console.log("Merge this into it by hand:");
+			} else if (!options.write) console.log("Merge this into your config, or re-run with --write:");
+			else if (!wrote) console.log(`A different \`${PROVIDER_ALIAS}\` provider is already configured — left as it is. Re-run with --force to replace it.`);
+			else console.log("Written. The block now in your config:");
+			console.log();
+			console.log(JSON.stringify({ secrets: { providers: { [PROVIDER_ALIAS]: provider } } }, null, 2));
+			console.log();
+			if (usePlugin) {
+				console.log("Install the plugin, if you have not already:");
+				console.log("  openclaw plugins install npm:@seekrit/openclaw-plugin");
+				console.log("  openclaw plugins enable seekrit");
+				console.log();
 			}
-		}
-		const created = await ctx.client.createBranch(parent.orgId, parent.envId, {
-			slug,
-			name: options.name,
-			ttlSeconds,
-			wrappedDek,
-			recoveryWrappedDek,
-			grants
+			console.log("Then replace a plaintext credential with a ref, e.g.:");
+			console.log(`  ${JSON.stringify(secretRef("OPENAI_API_KEY"))}`);
+			console.log();
+			console.log("And check your work:");
+			console.log("  openclaw secrets audit --check --allow-exec");
+			console.log();
+			console.log("Resolution is eager: OpenClaw reads every ref once at startup. After a rotation, run `openclaw secrets reload`.");
 		});
-		console.error(`created branch ${parent.appSlug}/${parent.envSlug}#${created.branch.slug} (${created.branch.id})`);
-		console.error(created.branch.expiresAt ? `expires ${created.branch.expiresAt}` : "no expiry — delete it explicitly when the PR closes");
-		if (grants.length > 0) console.error(`shared with ${grants.length} other reader(s)`);
 	});
-	branch.command("list").alias("ls").description("list branches in an application (or of one environment)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--env <slug>", "only branches of this environment").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const branches = options.env ? await (async () => {
-			const parent = await resolveAppEnv(ctx, options);
-			return (await ctx.client.listBranches(parent.orgId, parent.envId)).branches;
-		})() : await (async () => {
-			const app = await resolveApp(ctx, options);
-			return (await ctx.client.listAppBranches(app.orgId, app.id)).branches;
-		})();
-		emit(options, { branches }, () => printTable(branches, [
-			col("slug", (b) => b.slug),
-			col("expires", (b) => b.expiresAt ?? "never"),
-			col("created", (b) => b.createdAt),
-			col("id", (b) => b.id)
-		], "no branches — create one with `seekrit branch create`"));
+	openclaw.command("ref <name>").description("print the SecretRef object to paste in place of a plaintext credential").option("--app <slug>", "address a specific application (with --env)").option("--env <slug>", "address a specific environment (with --app)").option("--json", "machine-readable output").action((name, options) => {
+		if (Boolean(options.app) !== Boolean(options.env)) fail("--app and --env go together (an id names both, or neither)");
+		const id = options.app && options.env ? `${options.app}/${options.env}/${name}` : name;
+		if (!parseSecretId(id)) fail(`not a valid SecretRef id: "${id}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
+		const ref = secretRef(id);
+		emit(options, ref, () => console.log(JSON.stringify(ref)));
 	});
-	branch.command("delete <slug>").alias("rm").description("tear down a branch and everything it overrode").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (defaults to seekrit.json)").option("-y, --yes", "skip the confirmation").action(async (slug, options) => {
-		const ctx = buildContext();
-		const app = await resolveApp(ctx, options);
-		const target = await resolveBranch(ctx, app, slug);
-		await confirmDestructive(options.yes, `Tear down branch ${app.slug}#${target.slug} and every override in it?`);
-		await ctx.client.deleteBranch(app.orgId, target.id);
-		console.error(`deleted branch ${app.slug}#${target.slug}`);
+	openclaw.command("resolve").description("resolve exec SecretRef ids from stdin (OpenClaw calls this; not for humans)").action(async () => {
+		setFailThrows(true);
+		let request;
+		try {
+			request = parseExecRequest(await readStdin());
+		} catch (err) {
+			process.stderr.write(`seekrit: ${err instanceof Error ? err.message : String(err)}\n`);
+			process.exitCode = 2;
+			return;
+		}
+		const scopes = /* @__PURE__ */ new Map();
+		let ctx;
+		const response = await resolveIds(request.ids, (scope) => {
+			const key = scopeKey(scope);
+			const cached = scopes.get(key);
+			if (cached) return cached;
+			ctx ??= buildContext();
+			const pending = resolveEnvironment(ctx, scope);
+			scopes.set(key, pending);
+			return pending;
+		});
+		process.stdout.write(`${JSON.stringify(response)}\n`);
 	});
 }
-/** Domain separators — must match `crates/seekrit-cache`. */
-const KEY_DOMAIN = "seekrit-lkg-cache-v1";
-const TOKEN_DOMAIN = "seekrit-token-fp-v1";
-/** 24h: long enough to ride out an outage, short enough to bound the tail. */
-const DEFAULT_MAX_AGE_MS = 1440 * 60 * 1e3;
 /**
-* Derive the key for one resolve request. Overrides are sorted, so flag order
-* never splits the cache. Byte-for-byte identical to `CacheKey::new` in
-* `crates/seekrit-cache`.
+* Resolve one environment's full variable set.
+*
+* `.env` overlays are deliberately switched off (`envFiles: []`). Everywhere
+* else in this CLI they are a convenience for a developer's shell; here the
+* working directory belongs to the OpenClaw gateway, and letting a file in it
+* override a gateway credential would make a stray `.env` a privilege
+* escalation. Reference expansion stays on — a `${OTHER_SECRET}` reference is
+* stored data, not a local override.
 */
-function cacheKey(apiUrl, token, branch, overrides = {}) {
-	const pairs = Object.entries(overrides).map(([group, env]) => `${group}:${env}`).sort();
-	return {
-		key: createHash("sha256").update([
-			KEY_DOMAIN,
-			apiUrl.replace(/\/+$/, ""),
-			token,
-			branch ?? "",
-			pairs.join(",")
-		].join("\n")).digest("hex"),
-		tokenFingerprint: tokenFingerprint(token)
-	};
-}
-/** The hex SHA-256 identifying a token without storing it. */
-function tokenFingerprint(token) {
-	return createHash("sha256").update(`${TOKEN_DOMAIN}\n${token}`).digest("hex");
+async function resolveEnvironment(ctx, scope) {
+	let envId;
+	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, {
+		app: scope.app,
+		env: scope.env
+	})).envId;
+	const { values } = await materializeEnv(ctx, {
+		envId,
+		envFiles: []
+	});
+	return values;
 }
+//#endregion
+//#region src/doctor.ts
+/** Every `SEEKRIT_*` variable the CLI reads, for the set-but-blank check. */
+const READ_VARS = [
+	"SEEKRIT_TOKEN",
+	"SEEKRIT_API_URL",
+	"SEEKRIT_CLIENT_ID",
+	"SEEKRIT_CLIENT_SECRET",
+	"SEEKRIT_DEV_USER",
+	"SEEKRIT_ORG",
+	"SEEKRIT_APP",
+	"SEEKRIT_ENV"
+];
 /**
-* `$XDG_CACHE_HOME/seekrit`, else `~/.cache/seekrit` — beside the config
-* directory holding the credential, never a shared temp directory.
+* A variable that is *set to nothing* is the trap this checks for.
+*
+* `present()` in context.ts treats blank as absent, which is the right
+* behaviour — an unset CI secret, a `${VAR}` that expanded to nothing, a bare
+* `export SEEKRIT_TOKEN=` all arrive as `""`. But it means someone who believes
+* they exported a token gets "no credentials found" and goes looking at their
+* login instead of at the empty variable in front of them.
 */
-function defaultCacheDir() {
-	return join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "seekrit");
-}
-/** Render an age for a log line, rounded to its largest whole unit. */
-function humanize(ms) {
-	const secs = Math.floor(ms / 1e3);
-	if (secs < 60) return `${secs}s`;
-	if (secs < 3600) return `${Math.floor(secs / 60)}m`;
-	if (secs < 86400) return `${Math.floor(secs / 3600)}h`;
-	return `${Math.floor(secs / 86400)}d`;
+function blankVars(env) {
+	return READ_VARS.filter((key) => env[key] !== void 0 && env[key]?.trim() === "");
 }
 /**
-* Whether a failed resolve means the API was *unreachable* (the cache may stand
-* in) rather than *refusing us* (it must not). A refusal is an answer, and
-* revocation is supposed to take effect the moment it arrives.
+* Every credential currently configured, highest precedence first.
+*
+* The list matters more than the winner. Six things can authenticate this CLI
+* and the order is not something anyone recites from memory, so the failure
+* mode is invisible rather than confusing: you run `seekrit login`, it succeeds,
+* and every command afterwards keeps using the `SEEKRIT_TOKEN` still exported
+* in that shell from last week. Nothing is wrong, nothing says anything, and
+* you are operating on the wrong org.
 */
-function mayFallBack(err) {
-	if (err instanceof SeekritApiError) return err.status >= 500 || err.status === 429;
-	return true;
+function credentialSources(env, config) {
+	const set = (v) => Boolean(v?.trim());
+	const found = [];
+	if (set(env.SEEKRIT_TOKEN)) found.push({
+		origin: "SEEKRIT_TOKEN (environment)",
+		kind: "bearer token"
+	});
+	if (set(config.token)) found.push({
+		origin: "saved config: token",
+		kind: "service token (`seekrit login --token`)"
+	});
+	if (set(config.sessionToken)) found.push({
+		origin: "saved config: sessionToken",
+		kind: "CLI session (`seekrit login`, revocable)"
+	});
+	if (set(env.SEEKRIT_DEV_USER)) found.push({
+		origin: "SEEKRIT_DEV_USER (environment)",
+		kind: "dev-mode identity"
+	});
+	if (set(config.devUser)) found.push({
+		origin: "saved config: devUser",
+		kind: "dev-mode identity"
+	});
+	if (set(env.SEEKRIT_CLIENT_ID) || set(config.clientId)) found.push({
+		origin: set(env.SEEKRIT_CLIENT_ID) ? "SEEKRIT_CLIENT_ID (environment)" : "saved config: clientId",
+		kind: "M2M client credentials (mint an admin token on use)"
+	});
+	return found;
 }
-/** An opened cache, bound to one resolve request. */
-var LkgCache = class {
-	dir;
-	maxAgeMs;
-	id;
-	constructor(id, options = {}) {
-		this.id = id;
-		this.dir = options.dir ?? defaultCacheDir();
-		this.maxAgeMs = options.maxAgeMs ?? 864e5;
-	}
-	path() {
-		return join(this.dir, `${this.id.key}.json`);
-	}
-	read() {
-		const path = this.path();
-		if (!existsSync(path)) return { kind: "missing" };
-		let envelope;
-		try {
-			envelope = JSON.parse(readFileSync(path, "utf8"));
-		} catch (err) {
-			return {
-				kind: "unusable",
-				reason: `corrupt cache entry: ${message(err)}`
-			};
-		}
-		if (envelope.version !== 1) return {
-			kind: "unusable",
-			reason: `cache entry is format v${envelope.version}, this build reads v1`
-		};
-		if (envelope.tokenFingerprint !== this.id.tokenFingerprint) return {
-			kind: "unusable",
-			reason: "cache entry belongs to a different token"
-		};
-		if (typeof envelope.body !== "string") return {
-			kind: "unusable",
-			reason: "cache entry has no body"
-		};
-		const ageMs = Math.max(0, Date.now() - envelope.fetchedAt * 1e3);
-		if (ageMs >= this.maxAgeMs) return {
-			kind: "expired",
-			ageMs
-		};
-		return {
-			kind: "hit",
-			body: envelope.body,
-			ageMs
-		};
-	}
-	/**
-	* Record a freshly-fetched response. Written to a temporary file and renamed,
-	* so a concurrent reader sees either the old entry or the new one — never a
-	* half-written file. Throws only on genuinely unexpected I/O; callers treat a
-	* failed write as a warning, never as a failed resolve.
-	*/
-	write(body) {
-		mkdirSync(this.dir, {
-			recursive: true,
-			mode: 448
+/** Findings about a resolved credential set. */
+function credentialChecks(env, config) {
+	const group = "credentials";
+	const checks = [];
+	const blank = blankVars(env);
+	if (blank.length > 0) checks.push({
+		group,
+		name: "blank variables",
+		status: "warn",
+		detail: `set but empty, so treated as unset: ${blank.join(", ")}`,
+		fix: "unset them, or give them a value — the CLI treats blank as absent, so the symptom is a missing setting rather than an error"
+	});
+	const sources = credentialSources(env, config);
+	if (sources.length === 0) {
+		checks.push({
+			group,
+			name: "credential",
+			status: "fail",
+			detail: "none configured",
+			fix: "run `seekrit login`"
 		});
-		const envelope = {
-			version: 1,
-			fetchedAt: Math.floor(Date.now() / 1e3),
-			tokenFingerprint: this.id.tokenFingerprint,
-			body
-		};
-		const tmp = join(this.dir, `${this.id.key}.${process.pid}.tmp`);
-		try {
-			writeFileSync(tmp, JSON.stringify(envelope), { mode: 384 });
-			renameSync(tmp, this.path());
-		} catch (err) {
-			rmSync(tmp, { force: true });
-			throw err;
-		}
-		this.pruneExpired();
-	}
-	/** Drop this entry — used when the API refuses the token. */
-	invalidate() {
-		rmSync(this.path(), { force: true });
-	}
-	/**
-	* Delete entries past their usefulness (a rotated token or a changed
-	* `--with` leaves one nothing will read again). Best-effort and silent, and
-	* it only ever touches files this cache named: `<64 hex>.json`.
-	*/
-	pruneExpired() {
-		let names;
+		return checks;
+	}
+	const winner = sources[0];
+	const shadowed = sources.slice(1);
+	if (!winner) return checks;
+	checks.push({
+		group,
+		name: "credential in use",
+		status: "ok",
+		detail: `${winner.kind} from ${winner.origin}`
+	});
+	if (shadowed.length > 0) checks.push({
+		group,
+		name: "shadowed credentials",
+		status: "warn",
+		detail: `${shadowed.length} other credential(s) configured and outranked: ${shadowed.map((s) => s.origin).join(", ")}`,
+		fix: `commands authenticate as ${winner.origin} — unset it to fall through to the next one`
+	});
+	return checks;
+}
+/**
+* Does the CLI's own precedence agree with the model above?
+*
+* `credentialSources` is a second reading of `tryBuildContext`'s rules, and a
+* second reading can drift from the first. Rather than let it drift quietly and
+* report a confident wrong answer, compare the two and say so when they differ.
+*/
+function precedenceAgrees(env, config) {
+	const predicted = credentialSources(env, config)[0];
+	const actual = tryBuildContext();
+	if (!predicted && !actual) return null;
+	if (!predicted || !actual) return {
+		group: "credentials",
+		name: "precedence model",
+		status: "fail",
+		detail: `doctor and the CLI disagree about whether a credential is configured (doctor: ${predicted ? "yes" : "no"}, CLI: ${actual ? "yes" : "no"}) — this is a bug in doctor, not in your setup`
+	};
+	if (predicted.kind === "dev-mode identity" !== (actual.auth.type === "dev")) return {
+		group: "credentials",
+		name: "precedence model",
+		status: "fail",
+		detail: `doctor expected ${predicted.origin} to win, but the CLI authenticated as ${actual.auth.type} — this is a bug in doctor, not in your setup`
+	};
+	return null;
+}
+function skewCheck(serverDate, localNow) {
+	const group = "api";
+	if (!serverDate) return {
+		group,
+		name: "clock",
+		status: "skip",
+		detail: "server sent no Date header"
+	};
+	const server = Date.parse(serverDate);
+	if (Number.isNaN(server)) return {
+		group,
+		name: "clock",
+		status: "skip",
+		detail: `unparseable Date: ${serverDate}`
+	};
+	const skew = server - localNow;
+	const seconds = Math.round(Math.abs(skew) / 1e3);
+	if (Math.abs(skew) < 6e4) return {
+		group,
+		name: "clock",
+		status: "ok",
+		detail: `within ${seconds}s of the API`
+	};
+	return {
+		group,
+		name: "clock",
+		status: "warn",
+		detail: `this machine is ${seconds}s ${skew > 0 ? "behind" : "ahead of"} the API`,
+		fix: "sync this machine's clock — skew expires tokens and leases early, and the error names the credential instead"
+	};
+}
+/**
+* The seekrit provider inside someone's `openclaw.json`.
+*
+* OpenClaw's exec-provider rules fail *silently*: a command that resolves
+* through a symlink is rejected outright, and an `args[0]` that no longer
+* exists resolves nothing. Neither produces a diagnostic naming seekrit, so a
+* gateway that stopped resolving credentials looks like a seekrit outage.
+*/
+function openclawChecks(config, env) {
+	const group = "openclaw";
+	const provider = config.secrets?.providers?.seekrit;
+	if (provider === void 0) return [{
+		group,
+		name: "provider",
+		status: "warn",
+		detail: "openclaw.json has no `seekrit` secret provider",
+		fix: "run `seekrit openclaw init`"
+	}];
+	if (provider === null || typeof provider !== "object") return [{
+		group,
+		name: "provider",
+		status: "fail",
+		detail: "the `seekrit` entry is not an object"
+	}];
+	const entry = provider;
+	const checks = [];
+	if (entry.pluginIntegration) {
+		checks.push({
+			group,
+			name: "provider",
+			status: "ok",
+			detail: "resolved through the seekrit OpenClaw plugin"
+		});
+		return checks;
+	}
+	const command = typeof entry.command === "string" ? entry.command : null;
+	if (!command) checks.push({
+		group,
+		name: "command",
+		status: "fail",
+		detail: "no `command` on the provider"
+	});
+	else if (!existsSync(command)) checks.push({
+		group,
+		name: "command",
+		status: "fail",
+		detail: `\`command\` does not exist: ${command}`,
+		fix: "re-run `seekrit openclaw init --force` (a Node version manager upgrade moves this path)"
+	});
+	else {
+		let real = null;
 		try {
-			names = readdirSync(this.dir);
+			real = realpathSync(command);
 		} catch {
-			return;
-		}
-		for (const name of names) {
-			if (!/^[0-9a-f]{64}\.json$/.test(name)) continue;
-			const path = join(this.dir, name);
-			let expired = true;
-			try {
-				const envelope = JSON.parse(readFileSync(path, "utf8"));
-				expired = Math.max(0, Date.now() - envelope.fetchedAt * 1e3) >= this.maxAgeMs;
-			} catch {}
-			if (expired) rmSync(path, { force: true });
+			real = null;
 		}
+		if (real && real !== command) checks.push({
+			group,
+			name: "command",
+			status: "fail",
+			detail: `\`command\` is a symlink to ${real} — OpenClaw rejects a symlinked command`,
+			fix: "re-run `seekrit openclaw init --force`, which resolves the real path"
+		});
+		else checks.push({
+			group,
+			name: "command",
+			status: "ok",
+			detail: command
+		});
+	}
+	const args = Array.isArray(entry.args) ? entry.args : [];
+	const entryPath = typeof args[0] === "string" ? args[0] : null;
+	if (!entryPath) checks.push({
+		group,
+		name: "resolver",
+		status: "fail",
+		detail: "no resolver path in `args`"
+	});
+	else if (!existsSync(entryPath)) checks.push({
+		group,
+		name: "resolver",
+		status: "fail",
+		detail: `the CLI it points at is gone: ${entryPath}`,
+		fix: "re-run `seekrit openclaw init --force`"
+	});
+	else checks.push({
+		group,
+		name: "resolver",
+		status: "ok",
+		detail: entryPath
+	});
+	const passEnv = Array.isArray(entry.passEnv) ? entry.passEnv.filter((v) => typeof v === "string") : [];
+	const missing = PASS_ENV.filter((v) => !passEnv.includes(v));
+	const stranded = missing.filter((v) => Boolean(env[v]?.trim()));
+	if (stranded.length > 0) checks.push({
+		group,
+		name: "passEnv",
+		status: "fail",
+		detail: `set here but not passed to the resolver: ${stranded.join(", ")}`,
+		fix: "re-run `seekrit openclaw init --force`, or add them to `passEnv` by hand"
+	});
+	else if (missing.length > 0) checks.push({
+		group,
+		name: "passEnv",
+		status: "warn",
+		detail: `written by an older CLI — missing ${missing.join(", ")}`,
+		fix: "re-run `seekrit openclaw init --force` before relying on those variables"
+	});
+	else checks.push({
+		group,
+		name: "passEnv",
+		status: "ok",
+		detail: `${passEnv.length} variables`
+	});
+	return checks;
+}
+/** Is something listening on a local `HTTPS_PROXY`? */
+async function localPortOpen(host, port) {
+	return new Promise((resolve) => {
+		const socket = connect({
+			host,
+			port
+		});
+		const done = (open) => {
+			socket.destroy();
+			resolve(open);
+		};
+		socket.setTimeout(1500);
+		socket.once("connect", () => done(true));
+		socket.once("timeout", () => done(false));
+		socket.once("error", () => done(false));
+	});
+}
+/**
+* An `HTTPS_PROXY` pointing at a local port with nothing behind it.
+*
+* This is the agent-proxy setup failure with no symptom of its own: every
+* outbound request from the workload fails at the transport, and the error it
+* raises names the upstream it never reached.
+*/
+async function proxyChecks(env) {
+	const group = "proxy";
+	const raw = env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy;
+	if (!raw?.trim()) return [];
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return [{
+			group,
+			name: "HTTPS_PROXY",
+			status: "fail",
+			detail: `not a URL: ${raw}`
+		}];
+	}
+	const host = url.hostname;
+	if (![
+		"127.0.0.1",
+		"localhost",
+		"::1",
+		"0.0.0.0"
+	].includes(host)) return [{
+		group,
+		name: "HTTPS_PROXY",
+		status: "skip",
+		detail: `${url.origin} (not local)`
+	}];
+	const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+	return [await localPortOpen(host === "localhost" ? "127.0.0.1" : host, port) ? {
+		group,
+		name: "HTTPS_PROXY",
+		status: "ok",
+		detail: `${url.origin} is accepting connections`
+	} : {
+		group,
+		name: "HTTPS_PROXY",
+		status: "fail",
+		detail: `${url.origin} is set but nothing is listening`,
+		fix: "start it with `seekrit proxy run`, or unset HTTPS_PROXY — every outbound request fails at the transport until one of those"
+	}];
+}
+/** Run every check. Exported for tests that drive the whole sweep. */
+async function runChecks() {
+	const env = process.env;
+	const config = readGlobalConfig();
+	const checks = [...credentialChecks(env, config)];
+	const drift = precedenceAgrees(env, config);
+	if (drift) checks.push(drift);
+	const project = findProjectConfig();
+	checks.push(project ? {
+		group: "project",
+		name: "seekrit.json",
+		status: "ok",
+		detail: `org=${project.org ?? "unset"} app=${project.app ?? "unset"}`
+	} : {
+		group: "project",
+		name: "seekrit.json",
+		status: "skip",
+		detail: "none found above the working directory",
+		fix: "run `seekrit init` to stop passing --org/--app"
+	});
+	const apiUrl = env.SEEKRIT_API_URL?.trim() || config.apiUrl || "https://api.seekrit.dev";
+	try {
+		const response = await fetch(new URL("/health", apiUrl));
+		checks.push({
+			group: "api",
+			name: "reachable",
+			status: response.ok ? "ok" : "warn",
+			detail: `${apiUrl} → ${response.status}`
+		});
+		checks.push(skewCheck(response.headers.get("date"), Date.now()));
+	} catch (err) {
+		checks.push({
+			group: "api",
+			name: "reachable",
+			status: "fail",
+			detail: describeError(err),
+			fix: "check SEEKRIT_API_URL, your network, and any VPN"
+		});
+	}
+	const openclawConfig = join(openclawHome(env), "openclaw.json");
+	if (existsSync(openclawConfig)) {
+		const read = readOpenclawConfig(openclawConfig);
+		if ("json5" in read) checks.push({
+			group: "openclaw",
+			name: "openclaw.json",
+			status: "warn",
+			detail: `${openclawConfig} is JSON5 (comments or trailing commas), so it cannot be checked or edited automatically`
+		});
+		else checks.push(...openclawChecks(read.config, env));
 	}
+	checks.push(...await proxyChecks(env));
+	return checks;
+}
+const GLYPH = {
+	ok: "ok  ",
+	warn: "warn",
+	fail: "FAIL",
+	skip: "--  "
 };
-function message(err) {
-	return err instanceof Error ? err.message : String(err);
+function registerDoctorCommand(program) {
+	program.command("doctor").description("check the setup failures that would otherwise be silent").option("--json", "print the findings as JSON").action(async (options) => {
+		const checks = await runChecks();
+		emit(options, { checks }, () => {
+			let group = "";
+			for (const check of checks) {
+				if (check.group !== group) {
+					group = check.group;
+					console.log(`\n${group}`);
+				}
+				console.log(`  ${GLYPH[check.status]}  ${check.name}: ${check.detail}`);
+				if (check.fix) console.log(`        → ${check.fix}`);
+			}
+			const failed = checks.filter((c) => c.status === "fail").length;
+			const warned = checks.filter((c) => c.status === "warn").length;
+			console.log(failed === 0 && warned === 0 ? "\nnothing to report." : `\n${failed} failure(s), ${warned} warning(s).`);
+		});
+		if (checks.some((c) => c.status === "fail")) process.exitCode = 1;
+	});
 }
 //#endregion
 //#region src/gcp.ts
@@ -9733,7 +10863,7 @@ function hermesHome(env = process.env) {
 	const home = env.HERMES_HOME?.trim();
 	return home && home.length > 0 ? resolve(home) : join(homedir(), ".hermes");
 }
-const NAME_RE$1 = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
 * Build an `skt://` reference.
 *
@@ -9817,15 +10947,15 @@ function parseBinding(raw) {
 	if (eq <= 0) return void 0;
 	const variable = raw.slice(0, eq).trim();
 	const target = raw.slice(eq + 1).trim();
-	if (!NAME_RE$1.test(variable) || target.length === 0) return void 0;
+	if (!NAME_RE.test(variable) || target.length === 0) return void 0;
 	const slash = target.indexOf("/");
-	if (slash === -1) return NAME_RE$1.test(target) ? {
+	if (slash === -1) return NAME_RE.test(target) ? {
 		variable,
 		name: target
 	} : void 0;
 	const tokenAlias = target.slice(0, slash).trim();
 	const name = target.slice(slash + 1).trim();
-	if (tokenAlias.length === 0 || !NAME_RE$1.test(name)) return void 0;
+	if (tokenAlias.length === 0 || !NAME_RE.test(name)) return void 0;
 	return {
 		variable,
 		name,
@@ -9838,7 +10968,7 @@ function parseTokenAlias(raw) {
 	if (eq <= 0) return void 0;
 	const alias = raw.slice(0, eq).trim();
 	const variable = raw.slice(eq + 1).trim();
-	if (alias.length === 0 || !NAME_RE$1.test(variable)) return void 0;
+	if (alias.length === 0 || !NAME_RE.test(variable)) return void 0;
 	return {
 		alias,
 		variable
@@ -9913,7 +11043,7 @@ function registerHermesCommands(program) {
 		});
 	});
 	hermes.command("ref <name>").description("print the skt:// reference to bind a Hermes variable to").option("--token-alias <alias>", "resolve through a second token named in `tokens:`").option("--json", "machine-readable output").action((name, options) => {
-		if (!NAME_RE$1.test(name)) fail(`not a valid secret name: "${name}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
+		if (!NAME_RE.test(name)) fail(`not a valid secret name: "${name}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
 		const ref = reference(name, options.tokenAlias);
 		emit(options, { reference: ref }, () => console.log(ref));
 	});
@@ -10133,7 +11263,7 @@ function parseTtlSeconds$4(input) {
 	}[m[2] || "s"] ?? 1);
 }
 /** Collect a repeatable option into an array. */
-function collect$4(value, previous) {
+function collect$5(value, previous) {
 	return [...previous, value];
 }
 /** Parse `readWrite@app` → { role, db } for a custom target. */
@@ -10158,7 +11288,7 @@ function resolveAdminUri(uri) {
 function registerMongoCommands(program) {
 	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
 	const target = mongo.command("target").description("manage MongoDB targets");
-	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$5, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const adminUri = resolveAdminUri(options.uri);
@@ -10320,7 +11450,7 @@ function generateUserName$1(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$4, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$4, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -10412,609 +11542,586 @@ function registerMysqlCommands(program) {
 		for (const l of leases) {
 			if (l.provider !== "mysql") continue;
 			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
-		}
-	});
-	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its MySQL user is dropped immediately.`);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId}`);
-	});
-}
-/** Collect a repeatable option into an array. */
-function collect$3(value, acc) {
-	acc.push(value);
-	return acc;
-}
-/**
-* Fetch + decrypt every secret in a single environment.
-*
-* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
-* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
-* scope here — a reference to a secret inherited from a composed group is left
-* literal, because the group layers aren't fetched. `materializeEnv` is the
-* fully-layered view.
-*/
-async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
-	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
-}
-/**
-* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
-* the CLI's standard fatal exit — it is a config bug with no correct value to
-* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
-*/
-function interpolateValues(values, enabled = true) {
-	if (!enabled) return {
-		values,
-		interpolated: [],
-		unresolvedRefs: []
-	};
-	try {
-		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
-		return {
-			values: expandedValues,
-			interpolated: expanded,
-			unresolvedRefs: unresolved
-		};
-	} catch (err) {
-		return fail(err instanceof Error ? err.message : String(err));
-	}
-}
-/**
-* Decrypt one historical version of a secret. Ciphertext is bound to
-* `(envId, name)` as AAD and neither changes across versions, so an old blob
-* opens with the environment's current data key — no special handling needed.
-*/
-async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
-	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
-	const row = versions.find((v) => v.version === version);
-	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
-	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
-}
-async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
-	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
-	await ctx.client.setSecret(orgId, envId, name, ciphertext);
-}
-/**
-* Encrypt and store many secrets into one environment. The DEK is fetched once
-* (so user auth prompts for the passphrase a single time, not per variable),
-* then each value is encrypted locally and written. Existing names are
-* overwritten; the result splits them into created vs. updated for a summary.
-* Callers validate the names first — a rejected name aborts before any write.
-*/
-async function importSecrets(ctx, orgId, envId, entries) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const existing = new Set(secrets.map((s) => s.name));
-	const result = {
-		created: [],
-		updated: []
-	};
-	for (const [name, value] of Object.entries(entries)) {
-		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
-		await ctx.client.setSecret(orgId, envId, name, ciphertext);
-		(existing.has(name) ? result.updated : result.created).push(name);
-	}
-	return result;
-}
-/**
-* Resolve the full, layered environment for a running app: composed group
-* secrets (lowest precedence) → the app env's own secrets → `.env` files.
-* Each layer's DEK is unwrapped once with the principal's private key and its
-* ciphertext decrypted locally. `process.env` is NOT applied here — callers
-* that spawn a process layer it on top so the live shell always wins.
-*
-* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
-* reference always resolves to whichever layer won the name.
-*/
-async function materializeEnv(ctx, opts) {
-	const query = {};
-	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
-	if (opts.branch) query.branch = opts.branch;
-	if (!isTokenAuth(ctx)) {
-		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
-		query.env = opts.envId;
-	}
-	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
-	const privateKey = await getPrivateKey(ctx);
-	const values = {};
-	const provenance = {};
-	for (const layer of layers) {
-		const dek = await unwrapDek(layer.wrappedDek, privateKey);
-		let label;
-		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
-		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
-		else label = `app:${scope.appSlug}/${layer.slug}`;
-		for (const secret of layer.secrets) {
-			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
-			provenance[secret.name] = label;
-		}
-	}
-	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
-	return {
-		...interpolateValues(values, opts.interpolate !== false),
-		provenance,
-		scope,
-		loadedEnvFiles
-	};
-}
-/**
-* Resolve, going through the last-known-good cache when one is configured.
-*
-* Always live first: the cache exists for when the call cannot land, not to
-* save a round trip, so a recovered network is picked up on the very next
-* invocation. A *refused* resolve (401/403/…) drops the entry rather than
-* falling back to it — otherwise revoking a token would keep working offline
-* until the entry aged out.
-*/
-async function resolveWithCache(ctx, query, cache) {
-	if (!cache) return ctx.client.resolve(query);
-	try {
-		const response = await ctx.client.resolve(query);
-		try {
-			cache.write(JSON.stringify(response));
-		} catch (err) {
-			warn(`could not update the cache: ${errorMessage(err)}`);
-		}
-		return response;
-	} catch (err) {
-		if (!mayFallBack(err)) {
-			cache.invalidate();
-			throw err;
-		}
-		const found = cache.read();
-		if (found.kind === "hit") {
-			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
-			return JSON.parse(found.body);
-		}
-		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
-		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
-		throw err;
-	}
-}
-function warn(text) {
-	process.stderr.write(`seekrit: ${text}\n`);
-}
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-/**
-* Overlay `.env` files onto an existing value/provenance set (later files win).
-* Missing files are skipped. Returns the files that were actually loaded. Used
-* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
-* managed secrets are unavailable but `.env` should still apply.
-*/
-function overlayEnvFiles(values, provenance, envFiles) {
-	const loaded = [];
-	for (const file of envFiles) {
-		if (!existsSync(file)) continue;
-		loaded.push(file);
-		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
-			values[name] = value;
-			provenance[name] = `dotenv:${file}`;
-		}
-	}
-	return loaded;
-}
-/**
-* Print a name → source table to stderr (never the secret values). Names whose
-* value had references expanded are marked, and dangling references are called
-* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
-* deliberately passed through as literal text.
-*/
-function printExplain(provenance, refs = {}) {
-	const interpolated = new Set(refs.interpolated ?? []);
-	const names = Object.keys(provenance).sort();
-	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
-	for (const name of names) {
-		const marker = interpolated.has(name) ? "  (interpolated)" : "";
-		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
-	}
-	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
+		}
+	});
+	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its MySQL user is dropped immediately.`);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
 }
-/** Plugin id and integration id declared by `@seekrit/openclaw-plugin`. */
-const PLUGIN_ID = "seekrit";
-const PLUGIN_INTEGRATION_ID = "seekrit";
-/** The provider alias written into `secrets.providers`. */
-const PROVIDER_ALIAS = "seekrit";
+/** Collect a repeatable option into an array. */
+function collect$4(value, acc) {
+	acc.push(value);
+	return acc;
+}
+//#endregion
+//#region src/proxy-binary.ts
 /**
-* Environment the resolver needs, and nothing else.
+* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
 *
-* OpenClaw hands an exec provider an empty environment apart from this
-* allowlist, which is a feature: it is the difference between "the resolver can
-* read the credential it needs" and "the resolver inherits the whole gateway
-* environment". `PATH` is here because Node's own startup needs it, `HOME` for
-* the CLI's login session, and the `SEEKRIT_*` set is how a machine credential
-* reaches a process nobody gets to pass flags to.
+* The proxy is the strongest answer seekrit has for an untrusted workload — the
+* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
+* thing here to *try*, because trying it meant `cargo` and a TOML file. This
+* module removes the first half: it resolves a prebuilt, checksum-verified
+* binary for the host platform and execs it, so `npx @seekrit/proxy` and
+* `seekrit proxy run` behave like the proxy was already installed.
+*
+* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
+* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
+* entrypoint over it, and the two must not drift.
+*
+* Three properties worth stating, since this downloads and executes code:
+*
+* - **The checksum is verified before anything is executed**, against a
+*   `.sha256` fetched from the same release. That is integrity, not provenance —
+*   it proves the bytes match what the release published, which is exactly the
+*   guarantee `install.sh` gives and no more.
+* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
+*   short-circuits entirely, and a cached download for the same version+target is
+*   reused, so this is a one-time cost per version.
+* - **Version is pinned, not floating.** A default of `latest` would make two
+*   machines run different proxies from the same command; the pinned constant is
+*   what this CLI was built against, overridable when you want otherwise.
 */
-const PASS_ENV = [
-	"PATH",
-	"HOME",
-	"USERPROFILE",
-	"APPDATA",
-	"LOCALAPPDATA",
-	"TEMP",
-	"TMP",
-	"SYSTEMROOT",
-	"WINDIR",
-	"XDG_CONFIG_HOME",
-	"XDG_CACHE_HOME",
-	"NODE_EXTRA_CA_CERTS",
-	"SEEKRIT_TOKEN",
-	"SEEKRIT_CLIENT_ID",
-	"SEEKRIT_CLIENT_SECRET",
-	"SEEKRIT_API_URL",
-	"SEEKRIT_ORG",
-	"SEEKRIT_APP",
-	"SEEKRIT_ENV",
-	"SEEKRIT_BRANCH"
-];
 /**
-* Generous, because the first resolve of a cold start does real work — an M2M
-* token mint, a resolve, and a key unwrap — and OpenClaw fails startup rather
-* than degrading when this expires. The 1Password integration picks 90s for the
-* same reason (its CLI may prompt for biometrics); 30s is enough here because
-* nothing in this path is interactive.
+* The proxy version this CLI was built against.
+*
+* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
+* release-please-config.json), so the pin follows the crate without anyone
+* remembering to move it.
 */
-const TIMEOUT_MS = 3e4;
-/** A seekrit secret name: what `seekrit secrets set` accepts. */
-const NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Slugs as the API spells them. */
-const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+const PROXY_VERSION = "0.12.0";
+const BIN = "seekrit-proxy";
 /**
-* Parse an exec SecretRef id.
-*
-* Two shapes, mirroring 1Password's `op://vault/item/field` — a bare name for
-* the environment the credential already points at, and an explicit
-* `app/env/NAME` triple for a provider serving more than one environment:
-*
-*     OPENAI_API_KEY
-*     billing-api/production/STRIPE_SECRET_KEY
+* Host → Rust target triple.
 *
-* A bare name is the common case and the one a service token wants, since the
-* token is already bound to an environment and there is nothing to disambiguate.
+* Linux always resolves to **musl**: that build is statically linked, so one
+* artifact covers glibc, musl, alpine, and distroless, and there is no libc
+* detection to get wrong on a machine where `ldd` says something unexpected.
 */
-function parseSecretId(id) {
-	const trimmed = id.trim();
-	if (trimmed.length === 0) return void 0;
-	const parts = trimmed.split("/");
-	if (parts.length === 1) {
-		const [name = ""] = parts;
-		return NAME_RE.test(name) ? { name } : void 0;
+function detectTarget(os = platform(), cpu = arch()) {
+	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
+	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	switch (os) {
+		case "linux": return {
+			target: `${machine}-unknown-linux-musl`,
+			exe: ""
+		};
+		case "darwin": return {
+			target: `${machine}-apple-darwin`,
+			exe: ""
+		};
+		case "win32":
+			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
+			return {
+				target: "x86_64-pc-windows-msvc",
+				exe: ".exe"
+			};
+		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
 	}
-	if (parts.length !== 3) return void 0;
-	const [app = "", env = "", name = ""] = parts;
-	if (!SLUG_RE.test(app) || !SLUG_RE.test(env) || !NAME_RE.test(name)) return void 0;
-	return {
-		app,
-		env,
-		name
-	};
 }
-/** The (app, env) pair an id resolves against — `""` for the credential's own. */
-function scopeKey(id) {
-	return id.app && id.env ? `${id.app}/${id.env}` : "";
+/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
+function versionPrefix(version) {
+	if (version === "latest") return "latest";
+	return version.startsWith("v") ? version : `v${version}`;
 }
-/**
-* Parse a request, tolerantly in exactly one direction.
-*
-* Non-string and empty ids are dropped rather than rejected — a request whose
-* shape we do not recognize should still resolve the ids we do, because the
-* alternative fails OpenClaw's whole startup over one malformed entry. A body
-* that is not an object with an `ids` array is a different matter: there is
-* nothing to answer, so it throws.
-*/
-function parseExecRequest(input) {
-	const parsed = JSON.parse(input);
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("exec SecretRef request must be a JSON object");
-	const ids = parsed.ids;
-	if (!Array.isArray(ids)) throw new Error("exec SecretRef request must carry an `ids` array");
-	return { ids: ids.filter((id) => typeof id === "string" && id.trim().length > 0) };
+function resolveVersion(explicit) {
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.0";
 }
-/** Assemble a response, omitting `errors` entirely when everything resolved. */
-function buildExecResponse(values, errors) {
-	return {
-		protocolVersion: 1,
-		values,
-		...Object.keys(errors).length > 0 ? { errors } : {}
-	};
+function resolveBaseUrl(explicit) {
+	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
+}
+/** Where a resolved binary is kept, keyed so versions and targets never collide. */
+function proxyBinaryPath(version, target, exe) {
+	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
+}
+async function fetchBytes$1(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
 }
 /**
-* Resolve every requested id, reading each distinct environment exactly once.
-*
-* A batch is normally one environment, but a provider may serve several, and
-* resolving per id would mean an unwrap per id. Grouping keeps a 40-variable
-* gateway to one round trip.
+* Ensure a `seekrit-proxy` binary exists locally and return its path.
 *
-* `resolveScope` is injected so the protocol can be tested without a network,
-* an API, or a key.
+* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
+* version+target, then a fresh download. A binary already on `PATH` is
+* deliberately *not* used — silently running a different version than the one
+* this CLI pins is the kind of surprise that costs an afternoon.
 */
-async function resolveIds(ids, resolveScope) {
-	const values = {};
-	const errors = {};
-	const byScope = /* @__PURE__ */ new Map();
-	for (const id of ids) {
-		const parsed = parseSecretId(id);
-		if (!parsed) {
-			errors[id] = { code: "INVALID_ID" };
-			continue;
-		}
-		const key = scopeKey(parsed);
-		const bucket = byScope.get(key) ?? {
-			scope: parsed,
-			ids: []
-		};
-		bucket.ids.push({
-			id,
-			name: parsed.name
-		});
-		byScope.set(key, bucket);
+async function resolveProxyBinary(options = {}) {
+	const override = process.env.SEEKRIT_PROXY_BIN;
+	if (override) {
+		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
+		return override;
 	}
-	for (const { scope, ids: wanted } of byScope.values()) {
-		let resolved;
-		try {
-			resolved = await resolveScope(scope);
-		} catch (err) {
-			const code = classify(err);
-			for (const { id } of wanted) errors[id] = { code };
-			continue;
-		}
-		for (const { id, name } of wanted) {
-			const value = resolved[name];
-			if (value === void 0) errors[id] = { code: "NOT_FOUND" };
-			else values[id] = value;
-		}
+	const version = resolveVersion(options.version);
+	const { target, exe } = detectTarget();
+	const dest = proxyBinaryPath(version, target, exe);
+	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
+	const baseUrl = resolveBaseUrl(options.baseUrl);
+	const prefix = versionPrefix(version);
+	const name = `${BIN}-${target}${exe}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	const sumUrl = `${binUrl}.sha256`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
+	try {
+		[bytes, expected] = await Promise.all([fetchBytes$1(binUrl), fetchBytes$1(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
+	}
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
+	const dir = dirname(dest);
+	mkdirSync(dir, { recursive: true });
+	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		throw err;
 	}
-	return buildExecResponse(values, errors);
+	chmodSync(dest, 493);
+	return dest;
 }
 /**
-* Bucket a failure into a code an operator can act on.
+* Run the proxy, forwarding stdio, signals, and its exit status.
 *
-* Deliberately coarse and deliberately message-free: it reads the error's own
-* text to pick a bucket and then throws that text away, because the text may
-* quote a token.
+* The proxy is a long-lived foreground process, so this wrapper has to be
+* transparent: Node cannot exec-replace itself, and without relaying signals
+* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
+* the proxy running, holding decrypted secrets, with the shell prompt back.
 */
-function classify(err) {
-	const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
-	if (/unauthor|forbidden|token|credential|passphrase|decrypt|sign in|log in|login/.test(message)) return "UNAUTHORIZED";
-	return "UNAVAILABLE";
+async function runProxyBinary(argv, options = {}) {
+	const bin = await resolveProxyBinary(options);
+	const child = spawn(bin, argv, {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...options.env
+		}
+	});
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	const forward = (signal) => {
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		child.kill(signal);
+	};
+	for (const signal of signals) process.on(signal, forward);
+	return new Promise((resolve, reject) => {
+		child.on("error", (err) => {
+			for (const s of signals) process.off(s, forward);
+			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
+		});
+		child.on("exit", (code, signal) => {
+			for (const s of signals) process.off(s, forward);
+			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
+		});
+	});
 }
-/** OpenClaw's config directory: `$OPENCLAW_HOME`, else `~/.openclaw`. */
-function openclawHome(env = process.env) {
-	const home = env.OPENCLAW_HOME?.trim();
-	return home && home.length > 0 ? resolve(home) : join(homedir(), ".openclaw");
+/** Signal name → number, for the 128+n exit convention. */
+function signalNumber(signal) {
+	return {
+		SIGHUP: 1,
+		SIGINT: 2,
+		SIGQUIT: 3,
+		SIGKILL: 9,
+		SIGTERM: 15
+	}[signal] ?? 0;
 }
+//#endregion
+//#region src/nomad.ts
 /**
-* The provider block for an installed `@seekrit/openclaw-plugin`.
+* `seekrit nomad` — wire seekrit into [HashiCorp Nomad](https://developer.hashicorp.com/nomad)
+* as a **secret provider plugin**.
 *
-* Preferred over the exec shape below for one reason that matters on upgrade:
-* OpenClaw reads the command out of the plugin's manifest at every startup, so
-* a plugin release that moves its resolver keeps working. A copied command is a
-* path pinned in someone's config forever.
+* Nomad 1.11 grew a `secret` block in the job specification plus an external
+* plugin framework: drop an executable in `client.common_plugin_dir/secrets/`,
+* answer `fingerprint` and `fetch` with JSON on stdout, and jobs name
+* credentials instead of holding them. Two built-in providers ship (Nomad
+* Variables and Vault); everything else is a community binary.
+*
+* The plugin itself is Rust (`apps/nomad-plugin`), not this CLI, because it runs
+* as the Nomad agent's user on every client node — bare Linux hosts where
+* requiring a Node runtime would be a real adoption tax. This command covers the
+* three things around it that are not the protocol: putting the binary in the
+* right place, printing the configuration, and proving the install works.
+*
+* Three facts about Nomad shaped this file, and **all three fail silently**:
+*
+* **The `provider` value is the executable's filename.** Nomad looks for an
+* executable named exactly what the job's `provider` says. So the binary is
+* installed as `secrets/seekrit`, not as its artifact name — get it wrong and
+* the plugin is not registered, with no error and no log line pointing here.
+*
+* **Plugins are fingerprinted once, at client startup.** Installing a plugin
+* into a running agent does nothing until it restarts. So every path here says
+* so, rather than letting someone conclude the plugin is broken.
+*
+* **`common_plugin_dir` is opt-in.** An agent with no `common_plugin_dir` set
+* scans nothing. `init` prints the stanza because the most likely reason a
+* correct install does not work is that the agent was never told where to look.
 */
-function pluginProvider() {
-	return {
-		source: "exec",
-		pluginIntegration: {
-			pluginId: PLUGIN_ID,
-			integrationId: PLUGIN_INTEGRATION_ID
-		}
-	};
-}
 /**
-* The provider block for a plain CLI install, with no plugin.
+* The name a job's `secret` block puts in `provider`, **and** the filename the
+* binary must have on disk. Nomad ties the two together; they are one constant
+* here so they cannot drift.
+*/
+const PROVIDER_NAME = "seekrit";
+/** The artifact's own name — what the release publishes and install.sh fetches. */
+const PLUGIN_BIN = "seekrit-nomad-secrets";
+/**
+* The plugin version this CLI installs by default.
 *
-* `realpathSync` on both paths is not tidiness. OpenClaw's guard rejects a
-* symlinked command outright, and a Node installed by a version manager is
-* almost always reached through one — so resolving here is the difference
-* between a provider that works and a startup failure whose message points at
-* the config rather than at the shim.
+* Bumped by release-please when `apps/nomad-plugin` releases (an `extra-files`
+* entry in release-please-config.json), so the pin follows the crate without
+* anyone remembering to move it — the same arrangement `PROXY_VERSION` has.
 */
-function execProvider(cliEntry, nodeBinary = process.execPath) {
-	const command = realTo(nodeBinary);
-	const entry = realTo(cliEntry);
-	return {
-		source: "exec",
-		command,
-		args: [
-			entry,
-			"openclaw",
-			"resolve"
-		],
-		passEnv: [...PASS_ENV],
-		jsonOnly: true,
-		timeoutMs: TIMEOUT_MS,
-		noOutputTimeoutMs: TIMEOUT_MS,
-		trustedDirs: [.../* @__PURE__ */ new Set([dirname(command), dirname(entry)])]
-	};
+const NOMAD_PLUGIN_VERSION = "0.2.0";
+/** Public artifact host. Mirrors GitHub Releases; public, no egress fees. */
+const DEFAULT_BASE_URL = "https://nomad.seekrit.dev";
+/** Where the plugin reads its node config, matching `config::DEFAULT_CONFIG_PATH`. */
+const DEFAULT_CONFIG_PATH = "/etc/seekrit/nomad.json";
+/**
+* Plugin directories to look in when `--plugin-dir` is not given.
+*
+* Deliberately a short list of conventional paths rather than a guess: an agent
+* can put `common_plugin_dir` anywhere, and installing into the wrong directory
+* produces a plugin that does not exist as far as Nomad is concerned.
+*/
+const PLUGIN_DIR_CANDIDATES = ["/opt/nomad/plugins", "/var/lib/nomad/plugins"];
+/** The first candidate that exists, or undefined — never a blind default. */
+function detectPluginDir(candidates = PLUGIN_DIR_CANDIDATES) {
+	return candidates.find((dir) => existsSync(dir));
 }
-function realTo(path) {
-	try {
-		return realpathSync(path);
-	} catch {
-		return resolve(path);
-	}
+/** Where the executable has to end up for `provider = "seekrit"` to find it. */
+function pluginPath(pluginDir) {
+	return join(pluginDir, "secrets", PROVIDER_NAME);
 }
-/** This CLI's own entry file — what `execProvider` hands to Node. */
-function cliEntryPath() {
-	return fileURLToPath(new URL("index.js", import.meta.url));
+/** The agent stanza that makes Nomad scan for plugins at all. */
+function agentStanza(pluginDir) {
+	return [
+		"client {",
+		"  enabled           = true",
+		`  common_plugin_dir = ${JSON.stringify(pluginDir)}`,
+		"}"
+	].join("\n");
+}
+/** The node-side config file: which credential, and who may use it. */
+function pluginConfig(opts) {
+	const profile = { token_file: opts.tokenFile };
+	if (opts.namespaces?.length) profile.namespaces = opts.namespaces;
+	if (opts.jobs?.length) profile.jobs = opts.jobs;
+	return `${JSON.stringify({ profiles: { [opts.profile]: profile } }, null, 2)}\n`;
 }
 /**
-* Add the seekrit provider to a parsed config without disturbing anything else.
+* A job snippet.
 *
-* An existing `seekrit` entry that differs is left alone unless forced, for the
-* same reason `seekrit paperclip init` leaves an existing MCP server alone:
-* someone who pinned a timeout or narrowed `passEnv` did it deliberately, and
-* silently reverting a security narrowing is the worst kind of helpful.
+* `path` is the profile name, because the first segment of a path is always a
+* profile — never a secret name. seekrit names and slugs overlap (`api_key` is
+* a legal spelling of both), so a single-segment path that could mean either
+* would resolve differently depending on what a node happened to have
+* configured, which is the worst possible failure mode for an access decision.
 */
-function mergeProvider(existing, provider, force) {
-	const secrets = { ...existing.secrets ?? {} };
-	const providers = { ...secrets.providers ?? {} };
-	const current = providers[PROVIDER_ALIAS];
-	if (current && !force && JSON.stringify(current) !== JSON.stringify(provider)) return {
-		merged: existing,
-		changed: false
-	};
-	if (current && JSON.stringify(current) === JSON.stringify(provider)) return {
-		merged: existing,
-		changed: false
-	};
-	providers[PROVIDER_ALIAS] = provider;
-	return {
-		merged: {
-			...existing,
-			secrets: {
-				...secrets,
-				providers
-			}
-		},
-		changed: true
-	};
+function jobSnippet(profile, names) {
+	const vars = names.length > 0 ? names : ["DATABASE_URL", "STRIPE_SECRET_KEY"];
+	const width = Math.max(...vars.map((n) => n.length));
+	const INTERP = "${secret.seekrit.";
+	const env = vars.map((n) => `        ${n.padEnd(width)} = "${INTERP}${n}}"`).join("\n");
+	return [
+		"job \"example\" {",
+		"  secret \"seekrit\" {",
+		`    provider = ${JSON.stringify(PROVIDER_NAME)}`,
+		`    path     = ${JSON.stringify(profile)}`,
+		"  }",
+		"",
+		"  group \"app\" {",
+		"    task \"server\" {",
+		"      driver = \"docker\"",
+		"      env {",
+		env,
+		"      }",
+		"    }",
+		"  }",
+		"}"
+	].join("\n");
 }
-/** A SecretRef pointing at this provider — what replaces a plaintext key. */
-function secretRef(id) {
-	return {
-		source: "exec",
-		provider: PROVIDER_ALIAS,
-		id
-	};
+async function fetchBytes(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
 }
 /**
-* Read `openclaw.json`, or decline to.
+* Download, verify, and place the plugin.
 *
-* The file is JSON5: comments and trailing commas are legal, and a parse/write
-* round trip through `JSON` would delete every comment in someone's gateway
-* config. So a file that is not also valid strict JSON is not edited at all —
-* the caller prints the block to paste instead. Losing a config's comments to
-* be helpful is worse than asking for one paste.
+* Same integrity story as the proxy launcher: the SHA-256 is checked against a
+* `.sha256` published beside the binary *before* anything is written to the
+* plugin directory. That proves the bytes match what the release published —
+* integrity, not provenance.
+*
+* The staging file lives in the destination directory rather than `TMPDIR` so
+* the rename is atomic: a cross-device rename degrades to a copy, which would
+* let Nomad fingerprint a half-written executable.
 */
-function readOpenclawConfig(path) {
-	if (!existsSync(path)) return { config: {} };
-	let raw;
+async function installPlugin(pluginDir, options = {}) {
+	const version = options.version ?? "0.2.0";
+	const baseUrl = (options.baseUrl ?? "https://nomad.seekrit.dev").replace(/\/+$/, "");
+	const { target, exe } = detectTarget();
+	if (exe !== "") fail("Nomad secret provider plugins are not supported on Windows clients");
+	const prefix = versionPrefix(version);
+	const name = `${PLUGIN_BIN}-${target}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${PLUGIN_BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
 	try {
-		raw = readFileSync(path, "utf8");
+		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(`${binUrl}.sha256`).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
 	} catch (err) {
-		fail(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+		const message = err instanceof Error ? err.message : String(err);
+		fail(`could not download ${PLUGIN_BIN} ${prefix} for ${target}: ${message}\n  Build it from apps/nomad-plugin, or use https://nomad.seekrit.dev/install.sh`);
 	}
-	if (raw.trim().length === 0) return { config: {} };
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) fail(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to install it.`);
+	const dest = pluginPath(pluginDir);
+	const dir = dirname(dest);
 	try {
-		const parsed = JSON.parse(raw);
-		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { json5: true };
-		return { config: parsed };
+		mkdirSync(dir, { recursive: true });
+	} catch (err) {
+		fail(`could not create ${dir}: ${err instanceof Error ? err.message : String(err)}\n  The plugin directory usually belongs to root — try again with sudo.`);
+	}
+	const staging = join(dir, `.${PROVIDER_NAME}-${process.pid}-${actual.slice(0, 12)}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		fail(`could not install to ${dest}: ${err instanceof Error ? err.message : String(err)}\n  The plugin directory usually belongs to root — try again with sudo.`);
+	}
+	chmodSync(dest, 493);
+	return {
+		path: dest,
+		version: prefix,
+		target,
+		sha256: actual
+	};
+}
+/**
+* Exercise an installed plugin exactly the way Nomad will.
+*
+* This exists because every way to get a Nomad plugin wrong fails *silently* —
+* a misnamed file, an unset `common_plugin_dir`, a plugin installed but never
+* fingerprinted because the agent was not restarted. None of those produce a
+* diagnostic, so the only reliable check is to run the thing yourself.
+*/
+function checkPlugin(pluginDir, opts = {}) {
+	const steps = [];
+	const bin = pluginPath(pluginDir);
+	if (!existsSync(bin)) {
+		steps.push({
+			name: "installed",
+			ok: false,
+			detail: `${bin} is missing — run \`seekrit nomad install\``
+		});
+		return steps;
+	}
+	steps.push({
+		name: "installed",
+		ok: true,
+		detail: bin
+	});
+	const fingerprint = spawnSync(bin, ["fingerprint"], {
+		encoding: "utf8",
+		timeout: 6e4
+	});
+	const fingerprintBody = safeJson(fingerprint.stdout);
+	const fingerprintOk = fingerprint.status === 0 && fingerprintBody?.type === "secrets";
+	steps.push({
+		name: "fingerprint",
+		ok: fingerprintOk,
+		detail: fingerprintOk ? String(fingerprintBody?.version ?? "") : (fingerprint.stderr || fingerprint.stdout || "no output").trim()
+	});
+	if (!fingerprintOk) return steps;
+	const fetch = spawnSync(bin, [...opts.config ? [
+		"--config",
+		opts.config,
+		"fetch"
+	] : ["fetch"], opts.path ?? ""], {
+		encoding: "utf8",
+		timeout: 6e4,
+		env: {
+			...process.env,
+			...opts.namespace ? { NOMAD_NAMESPACE: opts.namespace } : {},
+			...opts.job ? { NOMAD_JOB_ID: opts.job } : {}
+		}
+	});
+	const body = safeJson(fetch.stdout);
+	if (!body) {
+		steps.push({
+			name: "fetch",
+			ok: false,
+			detail: (fetch.stderr || "no JSON on stdout").trim()
+		});
+		return steps;
+	}
+	if (typeof body.error === "string") {
+		steps.push({
+			name: "fetch",
+			ok: false,
+			detail: body.error
+		});
+		return steps;
+	}
+	const count = Object.keys(body.result ?? {}).length;
+	steps.push({
+		name: "fetch",
+		ok: true,
+		detail: `${count} ${count === 1 ? "secret" : "secrets"}`
+	});
+	return steps;
+}
+function safeJson(text) {
+	if (!text) return void 0;
+	try {
+		const parsed = JSON.parse(text.trim());
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
 	} catch {
-		return { json5: true };
+		return;
 	}
 }
-function registerOpenclawCommands(program) {
-	const openclaw = program.command("openclaw").description("wire seekrit into OpenClaw as a SecretRef provider (`seekrit openclaw --help`)");
-	openclaw.command("init").description("add the seekrit exec SecretRef provider to openclaw.json").option("--config <path>", "path to openclaw.json (default: $OPENCLAW_HOME/openclaw.json)").option("--plugin", "point at an installed @seekrit/openclaw-plugin (recommended)").option("--exec", "point directly at this CLI, with no plugin installed").option("--write", "write the file instead of printing the block to paste").option("--force", "replace a seekrit provider entry that already differs").option("--json", "machine-readable output").action((options) => {
-		if (options.plugin && options.exec) fail("--plugin and --exec are mutually exclusive");
-		const usePlugin = options.exec !== true;
-		let provider;
-		if (usePlugin) provider = pluginProvider();
-		else {
-			const entry = cliEntryPath();
-			if (!existsSync(entry)) fail(`cannot find this CLI's entry file at ${entry} — --exec needs an installed seekrit (npm i -g @seekrit/cli), or use --plugin`);
-			provider = execProvider(entry);
+function requirePluginDir(explicit) {
+	if (explicit) return resolve(explicit);
+	const found = detectPluginDir();
+	if (found) return found;
+	fail("could not find the Nomad plugin directory — pass --plugin-dir <path> matching your agent's client.common_plugin_dir");
+}
+function collect$3(value, previous = []) {
+	return [...previous, value];
+}
+function registerNomadCommands(program) {
+	const nomad = program.command("nomad").description("wire seekrit into Nomad as a secret provider (`seekrit nomad --help`)");
+	nomad.command("init").description("print the agent stanza, plugin config, and job snippet for this client").option("--plugin-dir <path>", "the agent's client.common_plugin_dir").option("--profile <name>", "profile name jobs will reference in `path`", "default").option("--token-file <path>", "where the profile's service token lives").option("--namespace <ns>", "restrict the profile to a Nomad namespace (repeatable)", collect$3).option("--job <id>", "restrict the profile to a Nomad job id (repeatable)", collect$3).option("--config <path>", "plugin config path", DEFAULT_CONFIG_PATH).option("--write", "write the plugin config file instead of printing it").option("--json", "machine-readable output").action((options) => {
+		const pluginDir = options.pluginDir ? resolve(options.pluginDir) : detectPluginDir() ?? PLUGIN_DIR_CANDIDATES[0];
+		const profile = options.profile ?? "default";
+		const tokenFile = options.tokenFile ?? `/etc/seekrit/tokens/${profile}`;
+		const configPath = resolve(options.config ?? "/etc/seekrit/nomad.json");
+		const config = pluginConfig({
+			profile,
+			tokenFile,
+			namespaces: options.namespace,
+			jobs: options.job
+		});
+		let wrote = false;
+		if (options.write) try {
+			mkdirSync(dirname(configPath), { recursive: true });
+			writeFileSync(configPath, config, { mode: 384 });
+			wrote = true;
+		} catch (err) {
+			fail(`could not write ${configPath}: ${err instanceof Error ? err.message : String(err)}\n  This path usually belongs to root — try again with sudo.`);
 		}
-		const path = options.config ? resolve(options.config) : join(openclawHome(), "openclaw.json");
-		const read = readOpenclawConfig(path);
-		const json5 = "json5" in read;
-		const merged = json5 ? void 0 : mergeProvider(read.config, provider, options.force === true);
-		const wrote = Boolean(options.write) && merged?.changed === true;
-		if (wrote && merged) writeFileSync(path, `${JSON.stringify(merged.merged, null, 2)}\n`, { mode: 384 });
 		emit(options, {
-			path,
-			provider,
-			wrote,
-			json5
+			pluginDir,
+			pluginPath: pluginPath(pluginDir),
+			configPath,
+			profile,
+			wrote
 		}, () => {
-			section("openclaw secret provider");
+			section("nomad secret provider");
 			printFields([
-				["config", path],
-				["provider", PROVIDER_ALIAS],
-				["shape", usePlugin ? "plugin integration" : "exec (this CLI)"],
-				["written", wrote ? "yes" : "no"]
+				["plugin dir", pluginDir],
+				["plugin path", pluginPath(pluginDir)],
+				["provider", PROVIDER_NAME],
+				["config", configPath],
+				["profile", profile],
+				["config written", wrote ? "yes" : "no"]
 			]);
 			console.log();
-			if (json5) {
-				console.log(`${path} is JSON5 (comments or trailing commas), which a rewrite here would delete.`);
-				console.log("Merge this into it by hand:");
-			} else if (!options.write) console.log("Merge this into your config, or re-run with --write:");
-			else if (!wrote) console.log(`A different \`${PROVIDER_ALIAS}\` provider is already configured — left as it is. Re-run with --force to replace it.`);
-			else console.log("Written. The block now in your config:");
+			console.log("1. Install the plugin on every Nomad client:");
+			console.log("     seekrit nomad install");
+			console.log();
+			console.log("   The file must be named `seekrit` — Nomad matches a job's `provider`");
+			console.log("   against the executable's filename, and a mismatch registers nothing.");
+			console.log();
+			console.log("2. Point the agent at the plugin directory (/etc/nomad.d/client.hcl):");
+			console.log();
+			console.log(indent(agentStanza(pluginDir)));
 			console.log();
-			console.log(JSON.stringify({ secrets: { providers: { [PROVIDER_ALIAS]: provider } } }, null, 2));
+			console.log(`3. ${wrote ? `Written to ${configPath}:` : `Put this in ${configPath} (mode 0600):`}`);
 			console.log();
-			if (usePlugin) {
-				console.log("Install the plugin, if you have not already:");
-				console.log("  openclaw plugins install npm:@seekrit/openclaw-plugin");
-				console.log("  openclaw plugins enable seekrit");
-				console.log();
-			}
-			console.log("Then replace a plaintext credential with a ref, e.g.:");
-			console.log(`  ${JSON.stringify(secretRef("OPENAI_API_KEY"))}`);
+			console.log(indent(config.trimEnd()));
 			console.log();
-			console.log("And check your work:");
-			console.log("  openclaw secrets audit --check --allow-exec");
+			console.log(`   Then write the token itself to ${tokenFile} (mode 0600):`);
+			console.log(`     seekrit token create --name nomad-${profile} --app <app> --env <env>`);
+			console.log(`     # then: echo "skt_…" | sudo tee ${tokenFile} && sudo chmod 600 ${tokenFile}`);
 			console.log();
-			console.log("Resolution is eager: OpenClaw reads every ref once at startup. After a rotation, run `openclaw secrets reload`.");
+			console.log("4. Restart the agent — plugins are fingerprinted at client startup:");
+			console.log("     sudo systemctl restart nomad");
+			console.log();
+			console.log("5. Reference it from a job:");
+			console.log();
+			console.log(indent(jobSnippet(profile, [])));
+			console.log();
+			console.log("Check your work with:  seekrit nomad check");
 		});
 	});
-	openclaw.command("ref <name>").description("print the SecretRef object to paste in place of a plaintext credential").option("--app <slug>", "address a specific application (with --env)").option("--env <slug>", "address a specific environment (with --app)").option("--json", "machine-readable output").action((name, options) => {
-		if (Boolean(options.app) !== Boolean(options.env)) fail("--app and --env go together (an id names both, or neither)");
-		const id = options.app && options.env ? `${options.app}/${options.env}/${name}` : name;
-		if (!parseSecretId(id)) fail(`not a valid SecretRef id: "${id}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
-		const ref = secretRef(id);
-		emit(options, ref, () => console.log(JSON.stringify(ref)));
+	nomad.command("install").description("download the secret provider plugin onto this Nomad client").option("--plugin-dir <path>", "the agent's client.common_plugin_dir").option("--version <version>", "plugin version to install", NOMAD_PLUGIN_VERSION).option("--base-url <url>", "artifact host", DEFAULT_BASE_URL).option("--json", "machine-readable output").action(async (options) => {
+		const result = await installPlugin(requirePluginDir(options.pluginDir), {
+			version: options.version,
+			baseUrl: options.baseUrl,
+			quiet: options.json === true
+		});
+		emit(options, result, () => {
+			section("nomad plugin installed");
+			printFields([
+				["path", result.path],
+				["version", result.version],
+				["target", result.target],
+				["sha256", result.sha256],
+				["provider", PROVIDER_NAME]
+			]);
+			console.log();
+			console.log("Nomad fingerprints plugins at client startup — restart the agent:");
+			console.log("  sudo systemctl restart nomad");
+			console.log();
+			console.log("Then:  seekrit nomad check");
+		});
 	});
-	openclaw.command("resolve").description("resolve exec SecretRef ids from stdin (OpenClaw calls this; not for humans)").action(async () => {
-		setFailThrows(true);
-		let request;
-		try {
-			request = parseExecRequest(await readStdin());
-		} catch (err) {
-			process.stderr.write(`seekrit: ${err instanceof Error ? err.message : String(err)}\n`);
-			process.exitCode = 2;
-			return;
-		}
-		const scopes = /* @__PURE__ */ new Map();
-		let ctx;
-		const response = await resolveIds(request.ids, (scope) => {
-			const key = scopeKey(scope);
-			const cached = scopes.get(key);
-			if (cached) return cached;
-			ctx ??= buildContext();
-			const pending = resolveEnvironment(ctx, scope);
-			scopes.set(key, pending);
-			return pending;
+	nomad.command("check").description("run the installed plugin the way Nomad does, and report what happened").option("--plugin-dir <path>", "the agent's client.common_plugin_dir").option("--path <path>", "the `path` a job would use (profile, or profile/NAME)", "").option("--namespace <ns>", "pretend to be a job in this Nomad namespace").option("--job <id>", "pretend to be this Nomad job id").option("--config <path>", "check against this plugin config instead of the installed one").option("--json", "machine-readable output").action((options) => {
+		const pluginDir = requirePluginDir(options.pluginDir);
+		const steps = checkPlugin(pluginDir, {
+			path: options.path,
+			namespace: options.namespace,
+			job: options.job,
+			config: options.config
 		});
-		process.stdout.write(`${JSON.stringify(response)}\n`);
+		const ok = steps.every((s) => s.ok);
+		emit(options, {
+			pluginDir,
+			ok,
+			steps
+		}, () => {
+			section("nomad plugin check");
+			printFields(steps.map((s) => [s.name, `${s.ok ? "ok" : "FAILED"} — ${s.detail}`]));
+			console.log();
+			if (ok) {
+				console.log("The plugin resolves. If a job still cannot, the agent has not been");
+				console.log("restarted since the install, or client.common_plugin_dir is unset.");
+			} else console.log("See `seekrit nomad init` for the configuration this expects.");
+		});
+		if (!ok) process.exitCode = 1;
 	});
 }
-/**
-* Resolve one environment's full variable set.
-*
-* `.env` overlays are deliberately switched off (`envFiles: []`). Everywhere
-* else in this CLI they are a convenience for a developer's shell; here the
-* working directory belongs to the OpenClaw gateway, and letting a file in it
-* override a gateway credential would make a stray `.env` a privilege
-* escalation. Reference expansion stays on — a `${OTHER_SECRET}` reference is
-* stored data, not a local override.
-*/
-async function resolveEnvironment(ctx, scope) {
-	let envId;
-	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, {
-		app: scope.app,
-		env: scope.env
-	})).envId;
-	const { values } = await materializeEnv(ctx, {
-		envId,
-		envFiles: []
-	});
-	return values;
+function indent(text) {
+	return text.split("\n").map((line) => line.length > 0 ? `     ${line}` : line).join("\n");
 }
 //#endregion
 //#region src/orgs.ts
@@ -12142,188 +13249,6 @@ function collect$2(value, acc) {
 	return acc;
 }
 //#endregion
-//#region src/proxy-binary.ts
-/**
-* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
-*
-* The proxy is the strongest answer seekrit has for an untrusted workload — the
-* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
-* thing here to *try*, because trying it meant `cargo` and a TOML file. This
-* module removes the first half: it resolves a prebuilt, checksum-verified
-* binary for the host platform and execs it, so `npx @seekrit/proxy` and
-* `seekrit proxy run` behave like the proxy was already installed.
-*
-* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
-* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
-* entrypoint over it, and the two must not drift.
-*
-* Three properties worth stating, since this downloads and executes code:
-*
-* - **The checksum is verified before anything is executed**, against a
-*   `.sha256` fetched from the same release. That is integrity, not provenance —
-*   it proves the bytes match what the release published, which is exactly the
-*   guarantee `install.sh` gives and no more.
-* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
-*   short-circuits entirely, and a cached download for the same version+target is
-*   reused, so this is a one-time cost per version.
-* - **Version is pinned, not floating.** A default of `latest` would make two
-*   machines run different proxies from the same command; the pinned constant is
-*   what this CLI was built against, overridable when you want otherwise.
-*/
-/**
-* The proxy version this CLI was built against.
-*
-* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
-* release-please-config.json), so the pin follows the crate without anyone
-* remembering to move it.
-*/
-const PROXY_VERSION = "0.12.0";
-const BIN = "seekrit-proxy";
-/**
-* Host → Rust target triple.
-*
-* Linux always resolves to **musl**: that build is statically linked, so one
-* artifact covers glibc, musl, alpine, and distroless, and there is no libc
-* detection to get wrong on a machine where `ldd` says something unexpected.
-*/
-function detectTarget(os = platform(), cpu = arch()) {
-	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
-	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	switch (os) {
-		case "linux": return {
-			target: `${machine}-unknown-linux-musl`,
-			exe: ""
-		};
-		case "darwin": return {
-			target: `${machine}-apple-darwin`,
-			exe: ""
-		};
-		case "win32":
-			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
-			return {
-				target: "x86_64-pc-windows-msvc",
-				exe: ".exe"
-			};
-		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	}
-}
-/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
-function versionPrefix(version) {
-	if (version === "latest") return "latest";
-	return version.startsWith("v") ? version : `v${version}`;
-}
-function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.0";
-}
-function resolveBaseUrl(explicit) {
-	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
-}
-/** Where a resolved binary is kept, keyed so versions and targets never collide. */
-function proxyBinaryPath(version, target, exe) {
-	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
-}
-async function fetchBytes(url) {
-	const res = await fetch(url);
-	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
-	return new Uint8Array(await res.arrayBuffer());
-}
-/**
-* Ensure a `seekrit-proxy` binary exists locally and return its path.
-*
-* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
-* version+target, then a fresh download. A binary already on `PATH` is
-* deliberately *not* used — silently running a different version than the one
-* this CLI pins is the kind of surprise that costs an afternoon.
-*/
-async function resolveProxyBinary(options = {}) {
-	const override = process.env.SEEKRIT_PROXY_BIN;
-	if (override) {
-		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
-		return override;
-	}
-	const version = resolveVersion(options.version);
-	const { target, exe } = detectTarget();
-	const dest = proxyBinaryPath(version, target, exe);
-	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
-	const baseUrl = resolveBaseUrl(options.baseUrl);
-	const prefix = versionPrefix(version);
-	const name = `${BIN}-${target}${exe}`;
-	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
-	const sumUrl = `${binUrl}.sha256`;
-	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
-	let bytes;
-	let expected;
-	try {
-		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
-	}
-	const actual = createHash("sha256").update(bytes).digest("hex");
-	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
-	const dir = dirname(dest);
-	mkdirSync(dir, { recursive: true });
-	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
-	try {
-		writeFileSync(staging, bytes, { mode: 493 });
-		renameSync(staging, dest);
-	} catch (err) {
-		rmSync(staging, { force: true });
-		throw err;
-	}
-	chmodSync(dest, 493);
-	return dest;
-}
-/**
-* Run the proxy, forwarding stdio, signals, and its exit status.
-*
-* The proxy is a long-lived foreground process, so this wrapper has to be
-* transparent: Node cannot exec-replace itself, and without relaying signals
-* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
-* the proxy running, holding decrypted secrets, with the shell prompt back.
-*/
-async function runProxyBinary(argv, options = {}) {
-	const bin = await resolveProxyBinary(options);
-	const child = spawn(bin, argv, {
-		stdio: "inherit",
-		env: {
-			...process.env,
-			...options.env
-		}
-	});
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	const forward = (signal) => {
-		if (child.exitCode !== null || child.signalCode !== null) return;
-		child.kill(signal);
-	};
-	for (const signal of signals) process.on(signal, forward);
-	return new Promise((resolve, reject) => {
-		child.on("error", (err) => {
-			for (const s of signals) process.off(s, forward);
-			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
-		});
-		child.on("exit", (code, signal) => {
-			for (const s of signals) process.off(s, forward);
-			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
-		});
-	});
-}
-/** Signal name → number, for the 128+n exit convention. */
-function signalNumber(signal) {
-	return {
-		SIGHUP: 1,
-		SIGINT: 2,
-		SIGQUIT: 3,
-		SIGKILL: 9,
-		SIGTERM: 15
-	}[signal] ?? 0;
-}
-//#endregion
 //#region src/proxy.ts
 /**
 * `seekrit proxy` — get `seekrit-proxy` running without a Rust toolchain or a
@@ -14589,6 +15514,7 @@ registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
 registerPaperclipCommands(program);
+registerNomadCommands(program);
 registerOpenclawCommands(program);
 registerHermesCommands(program);
 registerSshCommands(program);
@@ -14599,7 +15525,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-BOawfW_U.js");
+	const { runMcpServer } = await import("./mcp-CjHg4P-V.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);
@@ -14608,9 +15534,10 @@ registerArchiveCommands(program);
 registerLogSinkCommands(program);
 registerSyncCommands(program);
 registerBillingCommands(program);
+registerDoctorCommand(program);
 const argv = process.argv.map((arg) => arg === "-v" ? "--version" : arg);
 program.parseAsync(argv).catch((err) => {
 	fail(describeError(err));
 });
 //#endregion
-export { verifyMessage as A, toBase64 as B, isServiceToken as C, importVerifyingKey as D, importSigningKey as E, kmsBlobKeyRef as F, kmsDecrypt as I, kmsEncrypt as L, generateMysqlCredential as M, generateDataKey as N, signMessage as O, generateEncryptKeyMaterial as P, wrapDek as R, createServiceToken as S, generateSigningKeyMaterial as T, parseBranchTtl as V, isTokenAuth as _, ensureM2mAdminToken as a, writeProjectConfig as b, kmsResolveKey as c, resolveAppEnv as d, resolveBranch as f, getDek as g, resolveOrg as h, materializeEnv as i, generatePostgresCredential as j, signatureKeyRef as k, kmsResolveRecipient as l, resolveGroup as m, fetchDecryptedSecrets as n, kmsCallerIdentity as o, resolveEnvTarget as p, fetchDecryptedVersion as r, kmsRecoverMaterial as s, encryptAndSetSecret as t, resolveApp as u, tryBuildContext as v, parseServiceToken as w, version as x, setFailThrows as y, generateDek as z };
+export { verifyMessage as A, toBase64 as B, isServiceToken as C, importVerifyingKey as D, importSigningKey as E, kmsBlobKeyRef as F, kmsDecrypt as I, kmsEncrypt as L, generateMysqlCredential as M, generateDataKey as N, signMessage as O, generateEncryptKeyMaterial as P, wrapDek as R, createServiceToken as S, generateSigningKeyMaterial as T, parseBranchTtl as V, isTokenAuth as _, kmsResolveRecipient as a, writeProjectConfig as b, fetchDecryptedVersion as c, resolveAppEnv as d, resolveBranch as f, getDek as g, resolveOrg as h, kmsResolveKey as i, generatePostgresCredential as j, signatureKeyRef as k, materializeEnv as l, resolveGroup as m, kmsCallerIdentity as n, encryptAndSetSecret as o, resolveEnvTarget as p, kmsRecoverMaterial as r, fetchDecryptedSecrets as s, ensureM2mAdminToken as t, resolveApp as u, tryBuildContext as v, parseServiceToken as w, version as x, setFailThrows as y, generateDek as z };