CLI Reference

Install:

# No install needed — use npx directly:
npx @dotlabshq/orbseal <command>

# Or install globally:
npm install -g @dotlabshq/orbseal

Auth

`login`

orbseal login <token> [api_base]
orbseal login                       # interactive prompt

Saves the token to ~/.orbseal/config.json. Admin tokens (orb_admin_...) and app keys (orb_live_...) are saved to separate slots — logging in with an app key does not overwrite your saved admin token.

`switch`

orbseal switch admin    # restore saved admin token as active
orbseal switch app      # restore saved app key as active
orbseal switch          # show both saved slots

`logout`

orbseal logout          # remove active token

`whoami` · alias: `wh`

orbseal whoami

Shows active token prefix, mode (admin / app key), API base, context, saved slots, and public key.

Context

Set a default workspace/project/environment so you don't repeat them on every command.

`use`

orbseal use <org>/<workspace>/<project>/<env>
orbseal use acme/platform/taskflow/production

orbseal use --public-key orbpk-...    # save public key only
orbseal use acme/platform --public-key orbpk-...  # combine

orbseal use --clear                   # clear everything

Context is stored in ~/.orbseal/config.json under the context key. Each part is optional — you can set just org/workspace and supply project per-command.

`ls`

orbseal ls

Shows the full org → workspace → project → env tree. Active context items are highlighted with ◀.

Workspaces · alias: `ws`

orbseal workspaces list
orbseal workspaces create "My Workspace"
orbseal workspaces get <slug-or-id>
orbseal workspaces rename <slug-or-id> "New Name"
orbseal workspaces delete <slug-or-id>

Fields

Field	Description
`short_id`	6-char immutable ID
`slug`	URL-safe name, mutable
`name`	Display name
`project_count`	Number of projects

Projects · alias: `proj`

orbseal projects list [workspace]
orbseal projects create "My Project"          # workspace from context
orbseal projects get <slug-or-id>
orbseal projects rename <slug-or-id> "New Name"
orbseal projects delete <slug-or-id>

Environments · alias: `env`

orbseal envs list
orbseal envs create "production"
orbseal envs get <slug-or-id>
orbseal envs rename <slug-or-id> "New Name"
orbseal envs delete <slug-or-id>

Schema

orbseal sync [orb.yaml]           # sync schema from file (default: ./orb.yaml)
orbseal schema list               # list all definitions
orbseal schema get <plugin:key>   # show one definition

sync blocks breaking changes (type or scope change). Safe updates (new default, label change, new key) are applied and increment the definition version.

Values

orbseal values list
orbseal values set <plugin:key> <value> --scope <scope> --ref <scope_ref>
orbseal values delete <plugin:key> --scope <scope> --ref <scope_ref>

Scopes

Scope	`--ref` value
`workspace`	workspace slug or `default`
`project`	project slug
`environment`	environment slug
`user`	user ID

Examples

orbseal values set taskflow:max_seats 50 --scope workspace --ref default
orbseal values set taskflow:theme dark --scope user --ref user-abc123
orbseal values set taskflow:app_url https://app.io --scope environment --ref production

Secrets

# Save public key to context once
orbseal use --public-key orbpk-...

# Seal a secret (prompts for value, never logged)
orbseal seal <plugin:key> --scope <scope> --ref <scope_ref>
orbseal seal taskflow:database_url --scope environment --ref production

# Override --public-key for this command
orbseal seal taskflow:stripe_secret \
  --public-key orbpk-... \
  --scope environment --ref production

Releases

orbseal release                              # cut a release for env from context
orbseal releases list [ws] [proj] [env]
orbseal releases get [ws] [proj] [env] <version|latest>

A release is an immutable snapshot of resolved non-secret config. Secrets are NOT in the snapshot — they are resolved live at runtime.

App keys

orbseal keys list
orbseal keys create <name> --public-key <orbpk-...> [--env <slug>]
orbseal keys revoke <id>

App keys (orb_live_...) are shown once at creation time. Store them securely.

Tokens

orbseal tokens list
orbseal tokens create [name]
orbseal tokens revoke <id>

Admin tokens for programmatic management access.

Resolve (runtime)

# Must be logged in with an app key (orb_live_...)
orbseal switch app
orbseal resolve
orbseal resolve --user <user-id>    # include user overrides

Keygen

orbseal keygen                     # generate a new X25519 keypair
orbseal recover "<12 word phrase>" # recover keypair from BIP-39 phrase

Status

orbseal status    # full status: token, org tree, definitions, keys, latest release

Global flags

Flag	Description
`--json` / `-j`	Output raw JSON instead of formatted table

Aliases

Alias	Full command
`ws`	`workspaces`
`proj`	`projects`
`env`	`envs`
`wh`	`whoami`
`switch`	`switchToken` (internal)

Config file

~/.orbseal/config.json

{
  "token":       "orb_admin_...",
  "admin_token": "orb_admin_...",
  "app_token":   "orb_live_...",
  "apiBase":     "https://api.orbseal.com",
  "context": {
    "org":        "acme",
    "workspace":  "platform",
    "project":    "taskflow",
    "env":        "production",
    "public_key": "orbpk-..."
  }
}