Merge pull request 'Certificate metadata reconciliation and a cert-manager seeding script' (#22) from dev into main

Reviewed-on: #22

.gitea/workflows/publish-psgallery.yml

@@ -319,9 +319,65 @@ jobs:
         run: |
           $ErrorActionPreference = 'Stop'
           $moduleDir = Join-Path $PWD 'Module/PSInfisicalAPI'
-          Write-Host "Publishing module from: $moduleDir"
-          Publish-PSResource `
-              -Path $moduleDir `
-              -Repository PSGallery `
-              -ApiKey $env:PSGALLERY_API_KEY `
-              -Verbose
+          $manifest  = Test-ModuleManifest -Path (Join-Path $moduleDir 'PSInfisicalAPI.psd1')
+          $version   = $manifest.Version.ToString()
+
+          # NuGet strips leading zeros from each segment, so the manifest's 2026.07.30.2309 is listed on the
+          # gallery as 2026.7.30.2309. Compare on the normalized form or every lookup misses.
+          function Get-NormalizedVersion {
+              param([string]$Value)
+              $parts = $Value -split '\.'
+              $normalized = foreach ($part in $parts) {
+                  $number = 0
+                  if ([int]::TryParse($part, [ref]$number)) { $number.ToString([System.Globalization.CultureInfo]::InvariantCulture) } else { $part }
+              }
+              return ($normalized -join '.')
+          }
+
+          function Test-PublishedVersion {
+              param([string]$Normalized)
+              $uri = "https://www.powershellgallery.com/api/v2/FindPackagesById()?id='PSInfisicalAPI'&`$select=Version"
+              try {
+                  $feed = Invoke-RestMethod -Uri $uri -TimeoutSec 120
+              } catch {
+                  Write-Host "==> Could not query the gallery for existing versions: $($_.Exception.Message)"
+                  return $false
+              }
+
+              foreach ($entry in @($feed)) {
+                  $candidate = $entry.properties.Version
+                  if ([string]::IsNullOrWhiteSpace($candidate)) { continue }
+                  if ((Get-NormalizedVersion -Value $candidate) -eq $Normalized) { return $true }
+              }
+
+              return $false
+          }
+
+          $normalizedVersion = Get-NormalizedVersion -Value $version
+          Write-Host "==> Module version : $version (gallery form: $normalizedVersion)"
+          Write-Host "==> Publishing from: $moduleDir"
+
+          if (Test-PublishedVersion -Normalized $normalizedVersion) {
+              Write-Host "==> Version $normalizedVersion is already on the PowerShell Gallery; nothing to publish."
+              exit 0
+          }
+
+          try {
+              Publish-PSResource `
+                  -Path $moduleDir `
+                  -Repository PSGallery `
+                  -ApiKey $env:PSGALLERY_API_KEY `
+                  -Verbose
+              Write-Host "==> Published $normalizedVersion to the PowerShell Gallery."
+          } catch {
+              # A push can be accepted by the gallery and still surface as an error here; when that happens the
+              # retry comes back as 409. Re-check before failing the run over an upload that actually landed.
+              Write-Host "==> Publish-PSResource reported: $($_.Exception.Message)"
+              Start-Sleep -Seconds 15
+              if (Test-PublishedVersion -Normalized $normalizedVersion) {
+                  Write-Host "==> Version $normalizedVersion is present on the gallery; treating the publish as successful."
+                  exit 0
+              }
+
+              throw
+          }

.github/workflows/publish-psgallery.yml

@@ -0,0 +1,384 @@
+name: Publish to PowerShell Gallery
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+jobs:
+  build:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify host prerequisites (pwsh, dotnet)
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $missing = @()
+          if (-not (Get-Command pwsh   -ErrorAction SilentlyContinue)) { $missing += 'pwsh'   }
+          if (-not (Get-Command dotnet -ErrorAction SilentlyContinue)) { $missing += 'dotnet' }
+          if ($missing.Count -gt 0) {
+              throw "Host runner is missing required tool(s): $($missing -join ', '). Provision them on the runner host."
+          }
+          Write-Host ("pwsh:   " + (pwsh -NoProfile -Command '$PSVersionTable.PSVersion.ToString()'))
+          Write-Host ("dotnet: " + (dotnet --version))
+          Write-Host '--- dotnet --info ---'
+          dotnet --info
+          Write-Host '--- disk free ---'
+          df -h .
+          Write-Host '--- memory ---'
+          free -m
+
+      - name: Restore NuGet packages
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Write-Host '==> dotnet restore src/PSInfisicalAPI/PSInfisicalAPI.csproj'
+          dotnet restore src/PSInfisicalAPI/PSInfisicalAPI.csproj --verbosity normal
+          if ($LASTEXITCODE -ne 0) { throw "Restore of PSInfisicalAPI.csproj failed with exit code $LASTEXITCODE" }
+          Write-Host '==> dotnet restore src/PSInfisicalAPI.Tests/PSInfisicalAPI.Tests.csproj'
+          dotnet restore src/PSInfisicalAPI.Tests/PSInfisicalAPI.Tests.csproj --verbosity normal
+          if ($LASTEXITCODE -ne 0) { throw "Restore of PSInfisicalAPI.Tests.csproj failed with exit code $LASTEXITCODE" }
+
+      - name: Build module
+        shell: pwsh
+        run: ./build.ps1
+
+      - name: Validate module manifest
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $manifestPath = Join-Path $PWD 'Module/PSInfisicalAPI/PSInfisicalAPI.psd1'
+          $manifest = Test-ModuleManifest -Path $manifestPath
+          Write-Host "Manifest OK: $($manifest.Name) $($manifest.Version)"
+
+      - name: Upload module artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: PSInfisicalAPI-module
+          path: Module/PSInfisicalAPI
+          if-no-files-found: error
+          retention-days: 7
+
+  release:
+    needs: build
+    if: ${{ success() && github.event.pull_request.merged == true }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.meta.outputs.version }}
+      tag: ${{ steps.meta.outputs.tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify host prerequisites (pwsh)
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if (-not (Get-Command pwsh -ErrorAction SilentlyContinue)) {
+              throw "Host runner is missing required tool: pwsh. Provision it on the runner host."
+          }
+          Write-Host ("pwsh: " + (pwsh -NoProfile -Command '$PSVersionTable.PSVersion.ToString()'))
+
+      - name: Download module artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: PSInfisicalAPI-module
+          path: Module/PSInfisicalAPI
+
+      - name: Resolve module version and tag
+        id: meta
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $manifestPath = Join-Path $PWD 'Module/PSInfisicalAPI/PSInfisicalAPI.psd1'
+          $manifest = Test-ModuleManifest -Path $manifestPath
+          $version = $manifest.Version.ToString()
+          $tag = $version
+          Write-Host "Module version: $version"
+          Write-Host "Release tag:    $tag"
+          "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+          "tag=$tag"         | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+
+      - name: Package module as release asset
+        shell: pwsh
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $zipPath = Join-Path $PWD "PSInfisicalAPI-$($env:VERSION).zip"
+          if (Test-Path $zipPath) { Remove-Item $zipPath -Force }
+          Compress-Archive -Path 'Module/PSInfisicalAPI/*' -DestinationPath $zipPath -Force
+          Write-Host "Created: $zipPath ($([math]::Round((Get-Item $zipPath).Length / 1KB, 1)) KB)"
+
+      - name: Create GitHub release
+        shell: pwsh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          API_URL: ${{ github.api_url }}
+          REPO: ${{ github.repository }}
+          TAG: ${{ steps.meta.outputs.tag }}
+          VERSION: ${{ steps.meta.outputs.version }}
+          COMMIT_SHA: ${{ github.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          SERVER_URL: ${{ github.server_url }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Set-StrictMode -Version Latest
+          trap { Write-Host "==> RELEASE STEP FAILED: $($_ | Out-String)"; Write-Host ($_.ScriptStackTrace); exit 1 }
+
+          Write-Host "==> [1/8] Validating inputs"
+          Write-Host "       TAG=$($env:TAG)"
+          Write-Host "       VERSION=$($env:VERSION)"
+          Write-Host "       REPO=$($env:REPO)"
+          Write-Host "       API_URL=$($env:API_URL)"
+          Write-Host "       SERVER_URL=$($env:SERVER_URL)"
+          Write-Host "       PR_NUMBER=$($env:PR_NUMBER)"
+          Write-Host "       RUN_ID=$($env:RUN_ID)"
+          if ([string]::IsNullOrWhiteSpace($env:GITHUB_TOKEN)) { throw "github.token is empty." }
+          if ([string]::IsNullOrWhiteSpace($env:TAG))          { throw "TAG is empty." }
+          if ([string]::IsNullOrWhiteSpace($env:VERSION))      { throw "VERSION is empty." }
+          if ([string]::IsNullOrWhiteSpace($env:API_URL))      { throw "API_URL is empty." }
+          if ([string]::IsNullOrWhiteSpace($env:REPO))         { throw "REPO is empty." }
+          if ([string]::IsNullOrWhiteSpace($env:COMMIT_SHA))   { throw "COMMIT_SHA is empty." }
+
+          Write-Host "==> [2/8] Deriving metadata"
+          $shortSha = $env:COMMIT_SHA.Substring(0, [Math]::Min(12, $env:COMMIT_SHA.Length))
+          $buildUtc = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+          $runUrl   = "$($env:SERVER_URL)/$($env:REPO)/actions/runs/$($env:RUN_ID)"
+          $prUrl    = "$($env:SERVER_URL)/$($env:REPO)/pull/$($env:PR_NUMBER)"
+          Write-Host "       shortSha=$shortSha"
+
+          Write-Host "==> [3/8] Extracting CHANGELOG section"
+          $changelogSection = ''
+          if (Test-Path 'CHANGELOG.md') {
+              $lines = [System.IO.File]::ReadAllLines('CHANGELOG.md')
+              $start = -1; $end = $lines.Length
+              for ($i = 0; $i -lt $lines.Length; $i++) {
+                  if ($lines[$i] -match "^##\s+$([regex]::Escape($env:VERSION))\s*$") { $start = $i + 1; continue }
+                  if ($start -ge 0 -and $lines[$i] -match '^##\s+') { $end = $i; break }
+              }
+              if ($start -ge 0) {
+                  $changelogSection = ($lines[$start..($end - 1)] -join "`n").Trim()
+              }
+          }
+          Write-Host "       CHANGELOG section length: $($changelogSection.Length) chars"
+
+          Write-Host "==> [4/8] Building release body"
+          $changelogText = if ($changelogSection) { $changelogSection } else { '_No CHANGELOG section found for this version._' }
+          $sb = New-Object System.Text.StringBuilder
+          [void]$sb.AppendLine("**PSInfisicalAPI $($env:VERSION)**")
+          [void]$sb.AppendLine('')
+          [void]$sb.AppendLine('| Field | Value |')
+          [void]$sb.AppendLine('| --- | --- |')
+          [void]$sb.AppendLine("| Version | ``$($env:VERSION)`` |")
+          [void]$sb.AppendLine("| Tag | ``$($env:TAG)`` |")
+          [void]$sb.AppendLine("| Commit | [``$shortSha``]($($env:SERVER_URL)/$($env:REPO)/commit/$($env:COMMIT_SHA)) |")
+          [void]$sb.AppendLine("| Built (UTC) | $buildUtc |")
+          [void]$sb.AppendLine("| Merged PR | [#$($env:PR_NUMBER) $($env:PR_TITLE)]($prUrl) by @$($env:PR_AUTHOR) |")
+          [void]$sb.AppendLine("| Workflow run | [$($env:RUN_ID)]($runUrl) |")
+          [void]$sb.AppendLine('')
+          [void]$sb.AppendLine('## Changes')
+          [void]$sb.AppendLine($changelogText)
+          [void]$sb.AppendLine('')
+          [void]$sb.AppendLine('## Install')
+          [void]$sb.AppendLine('```powershell')
+          [void]$sb.AppendLine("Install-Module -Name PSInfisicalAPI -RequiredVersion $($env:VERSION) -Scope CurrentUser")
+          [void]$sb.AppendLine('```')
+          $body = $sb.ToString()
+          Write-Host "       body length: $($body.Length) chars"
+
+          $headers = @{
+              Authorization          = "Bearer $($env:GITHUB_TOKEN)"
+              Accept                 = 'application/vnd.github+json'
+              'X-GitHub-Api-Version' = '2022-11-28'
+          }
+          $createUri = "$($env:API_URL)/repos/$($env:REPO)/releases"
+
+          Write-Host "==> [5/8] Checking for existing release tag: $createUri/tags/$($env:TAG)"
+          $existing = $null
+          try {
+              $existing = Invoke-RestMethod -Method Get -Headers $headers `
+                  -Uri "$createUri/tags/$($env:TAG)" -ErrorAction Stop
+          } catch {
+              $status = $null
+              try { $status = $_.Exception.Response.StatusCode.value__ } catch { }
+              if ($status -ne 404) {
+                  Write-Host "       Lookup failed (status=$status): $($_.Exception.Message)"
+                  throw
+              }
+              Write-Host "       No existing release (404)."
+          }
+          if ($existing) {
+              Write-Host "       Release tag '$($env:TAG)' already exists (id=$($existing.id)); skipping creation."
+              return
+          }
+
+          Write-Host "==> [6/8] Creating release"
+          $payload = @{
+              tag_name         = $env:TAG
+              target_commitish = $env:COMMIT_SHA
+              name             = "PSInfisicalAPI $($env:VERSION)"
+              body             = $body
+              draft            = $false
+              prerelease       = $false
+          } | ConvertTo-Json -Depth 4
+          Write-Host "       payload bytes: $([System.Text.Encoding]::UTF8.GetByteCount($payload))"
+
+          $release = Invoke-RestMethod -Method Post -Uri $createUri -Headers $headers `
+              -ContentType 'application/json' -Body $payload
+          Write-Host "       Created release id=$($release.id) at $($release.html_url)"
+
+          Write-Host "==> [7/8] Locating release asset"
+          $assetPath = Join-Path $PWD "PSInfisicalAPI-$($env:VERSION).zip"
+          if (-not (Test-Path $assetPath)) { throw "Release asset not found at: $assetPath" }
+          $fileBytes = [System.IO.File]::ReadAllBytes($assetPath)
+          Write-Host "       Asset: $assetPath ($([math]::Round($fileBytes.Length / 1KB, 1)) KB)"
+
+          Write-Host "==> [8/8] Uploading asset"
+          # GitHub returns a URI Template in upload_url (e.g. "https://uploads.github.com/.../assets{?name,label}").
+          # Strip the template suffix and append the asset name query.
+          $uploadBase = ($release.upload_url -replace '\{.*\}$', '')
+          $uploadUri  = "$uploadBase`?name=PSInfisicalAPI-$($env:VERSION).zip"
+          Invoke-RestMethod -Method Post -Uri $uploadUri -Headers $headers `
+              -ContentType 'application/zip' -Body $fileBytes | Out-Null
+          Write-Host "==> Done: uploaded PSInfisicalAPI-$($env:VERSION).zip"
+
+  publish:
+    needs: release
+    if: ${{ success() && github.event.pull_request.merged == true }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify host prerequisites (pwsh)
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if (-not (Get-Command pwsh -ErrorAction SilentlyContinue)) {
+              throw "Host runner is missing required tool: pwsh. Provision it on the runner host."
+          }
+          Write-Host ("pwsh: " + (pwsh -NoProfile -Command '$PSVersionTable.PSVersion.ToString()'))
+
+      - name: Download module artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: PSInfisicalAPI-module
+          path: Module/PSInfisicalAPI
+
+      - name: Bootstrap Microsoft.PowerShell.PSResourceGet
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if (-not (Get-Module -ListAvailable -Name Microsoft.PowerShell.PSResourceGet)) {
+              Write-Host "==> Installing Microsoft.PowerShell.PSResourceGet for CurrentUser"
+              Install-Module -Name Microsoft.PowerShell.PSResourceGet -Scope CurrentUser -Force -AllowClobber -ErrorAction Stop
+          }
+          Import-Module Microsoft.PowerShell.PSResourceGet -ErrorAction Stop
+
+          $existing = Get-PSResourceRepository -Name PSGallery -ErrorAction SilentlyContinue
+          if (-not $existing) {
+              Write-Host "==> Registering PSGallery repository"
+              Register-PSResourceRepository -PSGallery -Trusted -ErrorAction Stop
+          } else {
+              Write-Host "==> PSGallery already registered; ensuring Trusted + ApiVersion v2"
+              Set-PSResourceRepository -Name PSGallery -Trusted -ApiVersion v2 -ErrorAction Stop
+          }
+          Get-PSResourceRepository -Name PSGallery | Format-Table Name,Uri,Trusted,ApiVersion
+
+      - name: Verify PowerShell Gallery API key is configured
+        shell: pwsh
+        env:
+          PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:PSGALLERY_API_KEY)) {
+              throw "Repository secret 'PSGALLERY_API_KEY' is not configured."
+          }
+
+      - name: Re-validate downloaded module manifest
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $manifestPath = Join-Path $PWD 'Module/PSInfisicalAPI/PSInfisicalAPI.psd1'
+          $manifest = Test-ModuleManifest -Path $manifestPath
+          Write-Host "Manifest OK: $($manifest.Name) $($manifest.Version)"
+
+      - name: Publish to PowerShell Gallery
+        shell: pwsh
+        env:
+          PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $moduleDir = Join-Path $PWD 'Module/PSInfisicalAPI'
+          $manifest  = Test-ModuleManifest -Path (Join-Path $moduleDir 'PSInfisicalAPI.psd1')
+          $version   = $manifest.Version.ToString()
+
+          # NuGet strips leading zeros from each segment, so the manifest's 2026.07.30.2309 is listed on the
+          # gallery as 2026.7.30.2309. Compare on the normalized form or every lookup misses.
+          function Get-NormalizedVersion {
+              param([string]$Value)
+              $parts = $Value -split '\.'
+              $normalized = foreach ($part in $parts) {
+                  $number = 0
+                  if ([int]::TryParse($part, [ref]$number)) { $number.ToString([System.Globalization.CultureInfo]::InvariantCulture) } else { $part }
+              }
+              return ($normalized -join '.')
+          }
+
+          function Test-PublishedVersion {
+              param([string]$Normalized)
+              $uri = "https://www.powershellgallery.com/api/v2/FindPackagesById()?id='PSInfisicalAPI'&`$select=Version"
+              try {
+                  $feed = Invoke-RestMethod -Uri $uri -TimeoutSec 120
+              } catch {
+                  Write-Host "==> Could not query the gallery for existing versions: $($_.Exception.Message)"
+                  return $false
+              }
+
+              foreach ($entry in @($feed)) {
+                  $candidate = $entry.properties.Version
+                  if ([string]::IsNullOrWhiteSpace($candidate)) { continue }
+                  if ((Get-NormalizedVersion -Value $candidate) -eq $Normalized) { return $true }
+              }
+
+              return $false
+          }
+
+          $normalizedVersion = Get-NormalizedVersion -Value $version
+          Write-Host "==> Module version : $version (gallery form: $normalizedVersion)"
+          Write-Host "==> Publishing from: $moduleDir"
+
+          if (Test-PublishedVersion -Normalized $normalizedVersion) {
+              Write-Host "==> Version $normalizedVersion is already on the PowerShell Gallery; nothing to publish."
+              exit 0
+          }
+
+          try {
+              Publish-PSResource `
+                  -Path $moduleDir `
+                  -Repository PSGallery `
+                  -ApiKey $env:PSGALLERY_API_KEY `
+                  -Verbose
+              Write-Host "==> Published $normalizedVersion to the PowerShell Gallery."
+          } catch {
+              # A push can be accepted by the gallery and still surface as an error here; when that happens the
+              # retry comes back as 409. Re-check before failing the run over an upload that actually landed.
+              Write-Host "==> Publish-PSResource reported: $($_.Exception.Message)"
+              Start-Sleep -Seconds 15
+              if (Test-PublishedVersion -Normalized $normalizedVersion) {
+                  Write-Host "==> Version $normalizedVersion is present on the gallery; treating the publish as successful."
+                  exit 0
+              }
+
+              throw
+          }

Module/PSInfisicalAPI/PSInfisicalAPI.Format.ps1xml

@@ -38,11 +38,12 @@
       </ViewSelectedBy>
       <TableControl>
         <TableHeaders>
-          <TableColumnHeader><Label>Name</Label><Width>28</Width></TableColumnHeader>
-          <TableColumnHeader><Label>CommonName</Label><Width>32</Width></TableColumnHeader>
-          <TableColumnHeader><Label>Type</Label><Width>10</Width></TableColumnHeader>
-          <TableColumnHeader><Label>Status</Label><Width>10</Width></TableColumnHeader>
-          <TableColumnHeader><Label>KeyAlgorithm</Label><Width>14</Width></TableColumnHeader>
+          <TableColumnHeader><Label>Name</Label><Width>24</Width></TableColumnHeader>
+          <TableColumnHeader><Label>CommonName</Label><Width>28</Width></TableColumnHeader>
+          <TableColumnHeader><Label>Type</Label><Width>9</Width></TableColumnHeader>
+          <TableColumnHeader><Label>Status</Label><Width>8</Width></TableColumnHeader>
+          <TableColumnHeader><Label>DirectIssue</Label><Width>11</Width></TableColumnHeader>
+          <TableColumnHeader><Label>KeyAlgorithm</Label><Width>13</Width></TableColumnHeader>
           <TableColumnHeader><Label>NotAfter</Label><Width>22</Width></TableColumnHeader>
         </TableHeaders>
         <TableRowEntries>
@@ -52,6 +53,7 @@
               <TableColumnItem><PropertyName>CommonName</PropertyName></TableColumnItem>
               <TableColumnItem><PropertyName>Type</PropertyName></TableColumnItem>
               <TableColumnItem><PropertyName>Status</PropertyName></TableColumnItem>
+              <TableColumnItem><PropertyName>EnableDirectIssuance</PropertyName></TableColumnItem>
               <TableColumnItem><PropertyName>KeyAlgorithm</PropertyName></TableColumnItem>
               <TableColumnItem><PropertyName>NotAfter</PropertyName></TableColumnItem>
             </TableColumnItems>

Module/PSInfisicalAPI/PSInfisicalAPI.psd1

@@ -1,6 +1,6 @@
 @{
     RootModule           = 'PSInfisicalAPI.psm1'
-    ModuleVersion        = '2026.06.05.2040'
+    ModuleVersion        = '2026.07.31.0045'
     GUID                 = 'b8a2f3d4-7c51-4d2f-9e6a-1f0c8b3d4e51'
     Author               = 'Grace Solutions'
     CompanyName          = 'Grace Solutions'
@@ -19,6 +19,7 @@
         'Copy-InfisicalSecret',
         'ConvertTo-InfisicalSecretDictionary',
         'Export-InfisicalSecrets',
+        'Import-InfisicalSecret',
         'Get-InfisicalProject',
         'New-InfisicalProject',
         'Update-InfisicalProject',
@@ -35,6 +36,14 @@
         'New-InfisicalTag',
         'Update-InfisicalTag',
         'Remove-InfisicalTag',
+        'Get-InfisicalOrganization',
+        'New-InfisicalOrganization',
+        'Update-InfisicalOrganization',
+        'Remove-InfisicalOrganization',
+        'Get-InfisicalSubOrganization',
+        'New-InfisicalSubOrganization',
+        'Update-InfisicalSubOrganization',
+        'Remove-InfisicalSubOrganization',
         'Get-InfisicalCertificateAuthority',
         'Get-InfisicalPkiSubscriber',
         'Get-InfisicalCertificateProfile',
@@ -50,7 +59,10 @@
         'New-InfisicalScepDynamicChallenge',
         'Get-InfisicalScepMdmProfile',
         'Export-InfisicalScepMdmProfile',
-        'Write-InfisicalScepMdmProfileToWmi'
+        'Write-InfisicalScepMdmProfileToWmi',
+        'Start-InfisicalProcess',
+        'Get-InfisicalEnvironmentVariable',
+        'Get-InfisicalSANList'
     )
     AliasesToExport      = @()
     VariablesToExport    = @()
@@ -62,7 +74,7 @@
             LicenseUri   = 'https://www.gnu.org/licenses/agpl-3.0.html'
             ProjectUri   = 'https://prod.git.gracesolution.info/gsadmin/PSInfisicalAPI'
             ReleaseNotes = 'See CHANGELOG.md in the project repository for release history.'
-            CommitHash   = '1270c9099cae'
+            CommitHash   = 'd47a5af6b3a6'
         }
     }
 }

Module/PSInfisicalAPI/bin/en-US/PSInfisicalAPI.dll-Help.xml

@@ -295,7 +295,7 @@ $CopyInfisicalSecretResult = Copy-InfisicalSecret @CopyInfisicalSecretParameters
       <command:noun>InfisicalSecretDictionary</command:noun>
     </command:details>
     <maml:description>
-      <maml:para>Aggregates an incoming pipeline of InfisicalSecret objects into a case-insensitive Dictionary keyed by SecretName. By default values are SecureString; pass -AsPlainText to materialize string values. Duplicate keys are handled via the -DuplicateKeyBehavior parameter (Error, FirstWins, LastWins).</maml:para>
+      <maml:para>Aggregates an incoming pipeline of InfisicalSecret objects into a case-insensitive Dictionary keyed by SecretName. By default values are SecureString; pass -AsPlainText to materialize string values. Duplicate keys are handled via the -DuplicateKeyBehavior parameter (Error, FirstWins, LastWins). -Prefix prepends a string to every dictionary key (e.g. SecretName 'API_KEY' with -Prefix 'MYAPP_' becomes key 'MYAPP_API_KEY'); the underlying InfisicalSecret objects are not mutated. A SecretName that already starts with -Prefix (case-insensitive) is left as-is to avoid double-prefixing; pass -ForcePrefix to always prepend.</maml:para>
     </maml:description>
     <maml:alertSet>
       <maml:title>Notes</maml:title>
@@ -322,6 +322,11 @@ $ConvertToInfisicalSecretDictionaryParameters.Verbose              = $True
 $ConvertToInfisicalSecretDictionaryResult = ConvertTo-InfisicalSecretDictionary @ConvertToInfisicalSecretDictionaryParameters</dev:code>
         <dev:remarks><maml:para>Aggregates recursive secret results into a plain-text dictionary, with the last value winning on key collisions.</maml:para></dev:remarks>
       </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>Get-InfisicalSecret -ProjectId $ProjectId -Environment 'dev' | ConvertTo-InfisicalSecretDictionary -Prefix 'MYAPP_' -AsPlainText</dev:code>
+        <dev:remarks><maml:para>Builds a plain-text dictionary whose keys are namespaced with 'MYAPP_' (e.g. API_KEY becomes MYAPP_API_KEY); the source InfisicalSecret objects are unchanged.</maml:para></dev:remarks>
+      </command:example>
     </command:examples>
   </command:command>
 
@@ -333,7 +338,7 @@ $ConvertToInfisicalSecretDictionaryResult = ConvertTo-InfisicalSecretDictionary
       <command:noun>InfisicalSecrets</command:noun>
     </command:details>
     <maml:description>
-      <maml:para>Buffers an incoming pipeline of InfisicalSecret objects and writes them to a file in the requested format (DotEnv, Json, Yaml, EnvironmentVariables, etc.) or sets them as environment variables on the chosen scope (Process, User, Machine). -Encoding controls text encoding for file outputs.</maml:para>
+      <maml:para>Buffers an incoming pipeline of InfisicalSecret objects and writes them to a file in the requested format (DotEnv, Json, Yaml, EnvironmentVariables, etc.) or sets them as environment variables on the chosen scope (Process, User, Machine). -Encoding controls text encoding for file outputs. -Prefix prepends a string to every emitted variable name regardless of format; names that already start with -Prefix (case-insensitive) are left as-is to avoid double-prefixing. Pass -ForcePrefix to always prepend.</maml:para>
     </maml:description>
     <maml:alertSet>
       <maml:title>Notes</maml:title>
@@ -361,9 +366,52 @@ $ExportInfisicalSecretsParameters.Verbose     = $True
 $ExportInfisicalSecretsResult = Export-InfisicalSecrets @ExportInfisicalSecretsParameters</dev:code>
         <dev:remarks><maml:para>Projects the recursive secret result into Process-scope environment variables for the current PowerShell session.</maml:para></dev:remarks>
       </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>Get-InfisicalSecret -ProjectId $ProjectId -Environment 'dev' | Export-InfisicalSecrets -Format EnvironmentVariables -Scope Process -Prefix 'MYAPP_'</dev:code>
+        <dev:remarks><maml:para>Imports secrets into the process environment with every variable name prefixed by 'MYAPP_' (e.g. API_KEY becomes MYAPP_API_KEY).</maml:para></dev:remarks>
+      </command:example>
     </command:examples>
   </command:command>
 
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Import-InfisicalSecret</command:name>
+      <maml:description><maml:para>Reads a previously exported secrets file (Json, Yaml, Env, or Xml) back into a name-keyed Dictionary.</maml:para></maml:description>
+      <command:verb>Import</command:verb>
+      <command:noun>InfisicalSecret</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Loads the file at -Path (which must exist) using the parser matching -Format and returns a case-insensitive Dictionary keyed by SecretName. By default values are SecureString; pass -AsPlainText for a plain string dictionary. -Prefix prepends to every emitted key; keys already starting with -Prefix (case-insensitive) are left as-is to avoid double-prefixing, and -ForcePrefix overrides that gate. -DuplicateKeyBehavior controls collision handling (Error, FirstWins, LastWins). The EnvironmentVariables format is intentionally not supported here; use [Environment]::GetEnvironmentVariable or Get-InfisicalEnvironmentVariable for environment-backed values.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Importers expect the same schema that Export-InfisicalSecrets produces (Json/Yaml = array or 'Secrets' root list of {SecretName, SecretValue}; Xml = &lt;Secrets&gt;&lt;Secret&gt;&lt;SecretName/&gt;&lt;SecretValue/&gt;; Env = KEY=VALUE per line, '#' comments allowed). JSON and YAML additionally accept a flat key/value object as a convenience.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>$Secrets = Import-InfisicalSecret -Path '.\secrets.json' -Format Json</dev:code>
+        <dev:remarks><maml:para>Reads a JSON export back into a Dictionary&lt;string, SecureString&gt; keyed by the original SecretName values.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$ImportInfisicalSecretParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$ImportInfisicalSecretParameters.Path                 = [System.IO.FileInfo]'.\secrets.env'
+$ImportInfisicalSecretParameters.Format               = 'Env'
+$ImportInfisicalSecretParameters.Prefix               = 'MYAPP_'
+$ImportInfisicalSecretParameters.DuplicateKeyBehavior = 'LastWins'
+$ImportInfisicalSecretParameters.AsPlainText          = $True
+
+$ImportInfisicalSecretResult = Import-InfisicalSecret @ImportInfisicalSecretParameters</dev:code>
+        <dev:remarks><maml:para>Loads a .env file into a plain-text dictionary, namespacing every key with 'MYAPP_' and letting the last occurrence win on duplicates.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+
   <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
     <command:details>
       <command:name>Get-InfisicalProject</command:name>
@@ -1018,7 +1066,7 @@ $RemoveInfisicalTagResult = Remove-InfisicalTag @RemoveInfisicalTagParameters</d
     <maml:alertSet>
       <maml:title>Notes</maml:title>
       <maml:alert>
-        <maml:para>ByID retrieval currently always resolves against the internal CA endpoint. CA Ids returned here are the values to pass on -CertificateAuthorityId to Request-InfisicalCertificate. The Type property distinguishes 'internal' from 'acme' when -Kind Any is used.</maml:para>
+        <maml:para>ByID retrieval currently always resolves against the internal CA endpoint. CA Ids returned here are the values to pass on -CertificateAuthorityId to Request-InfisicalCertificate. The Type property distinguishes 'internal' from 'acme' when -Kind Any is used. Only CAs whose EnableDirectIssuance property is True can sign a CSR through -CertificateAuthorityId; the others must issue through Request-InfisicalCertificate -CertificateProfileId, which bypasses that check. EnableDirectIssuance is fixed at CA creation and appears in no Infisical update schema, so it cannot be toggled afterwards; a CA migrated from the older requireTemplateForIssuance column reads False permanently.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -1233,6 +1281,16 @@ $GetInfisicalCertificatePolicyResult = Get-InfisicalCertificatePolicy @GetInfisi
       <maml:title>Notes</maml:title>
       <maml:alert>
         <maml:para>Default -PrivateKeyProtection is 'LocalOnly': the leaf is loaded into memory without persisting the private key and PrivateKeyPem is scrubbed from the emitted result unless -PrivateKeyPath or an explicit -KeyStorageFlags binding overrides it. The reuse path completes its chain from the Infisical bundle when local stores are incomplete; pass -LocalChainOnly to suppress that fetch entirely.</maml:para>
+        <maml:para>Choose the parameter set by whether the common name varies per request. -CertificateProfileId and -CertificateAuthorityId both accept a per-request common name and suit fleet enrollment; -PkiSubscriberSlug does not, because Infisical rejects any CSR whose CN differs from the subscriber's ('Common name (CN) in the CSR does not match the subscriber's common name') and allowlists the subscriber's subjectAlternativeNames. A subscriber is a single named identity, so enrolling many machines through subscribers requires one subscriber per machine.</maml:para>
+        <maml:para>-CertificateAuthorityId only works against a CA that permits direct issuance (Get-InfisicalCertificateAuthority reports this as EnableDirectIssuance). The cmdlet resolves the issuer and validates this before generating a keypair, naming the subscriber, CA, or profile it will use on the verbose stream and in the -WhatIf target. Profile issuance is the only path that ignores that flag, so -CertificateProfileId works against a CA whose EnableDirectIssuance is False. Note that enableDirectIssuance appears in no Infisical create or update schema, so it cannot be changed through the API or UI after the CA exists.</maml:para>
+        <maml:para>There is no -CertificateTemplateId parameter because Infisical's REST API exposes no template-based issuance route; when the API asks for 'a certificate template or subscriber', supply -CertificateProfileId or -PkiSubscriberSlug, or use a CA that allows direct issuance.</maml:para>
+        <maml:para>-CommonName takes the bare value ('web01.contoso.com'), not an RDN; a leading 'CN=' is stripped because the CSR builder adds the prefix itself. -DnsName accepts the mixed output of Get-InfisicalSANList: IP literals in that list are emitted as iPAddress SAN entries rather than dNSName entries.</maml:para>
+        <maml:para>When -StoreLocation is not supplied it is chosen from the process elevation: an elevated session installs to LocalMachine, otherwise CurrentUser. The choice is reported on the verbose stream. Chain members are routed by type regardless of location - self-signed certificates to the Root store, others to CertificateAuthority. When the resolved location is LocalMachine and -KeyStorageFlags was not supplied, the private key is placed in the machine key store so the installed certificate has a usable key outside the calling user's profile.</maml:para>
+        <maml:para>Installing a root into CurrentUser\Root makes Windows display a modal trust confirmation dialog, and the call blocks until it is answered; in a non-interactive session this looks like a hang. The cmdlet emits a warning before blocking. Run elevated or pass -StoreLocation LocalMachine to install machine-wide without a prompt.</maml:para>
+        <maml:para>Only the leaf honours -StoreName (default My). Chain members are routed by what they are: a self-signed certificate is a root and goes to the trusted-root store, anything with an issuer above it is a subordinate CA and goes to the intermediate store, for a chain of any depth. Issuers are installed before the leaf, and the chain is then validated against the machine's stores; an incomplete chain is reported as a warning naming the missing issuer, which is the condition Windows shows as "The issuer of this certificate could not be found".</maml:para>
+        <maml:para>The installed certificate's Windows friendly name defaults to the common name in upper case. -FriendlyName overrides it and is accepted on every parameter set; on the -CertificateAuthorityId path the same value is additionally sent to Infisical as the issued certificate's friendlyName.</maml:para>
+        <maml:para>-Metadata attaches key/value pairs to the certificate in Infisical and accepts any IDictionary, such as a hashtable or an [Ordered] dictionary. Only the supplied keys are reconciled; keys already on the certificate that the call does not mention are left alone, so several callers can each own their own keys. This is performed client-side because Infisical's PATCH replaces a certificate's metadata wholesale, so the module reads the current set, merges the supplied keys over it, and writes back the union; when nothing would change no request is sent. Reconciliation also runs on the reuse path, so a metadata change lands without forcing reissuance. Values are flattened to strings, keys are trimmed and compared case-insensitively, and blank keys are dropped. The resulting metadata is returned on the result's Metadata property. A metadata failure is reported as a warning and does not fail an issuance that otherwise succeeded.</maml:para>
+        <maml:para>The reuse check is scoped to the issuer being requested: the search is filtered by -CertificateProfileId or -CertificateAuthorityId, so a certificate issued by a different profile is not reused. This matters when two profiles over one CA differ in key usage, such as server authentication versus client authentication, where a common-name match alone would return a certificate with the wrong extended key usages. Reuse additionally requires the existing certificate to carry every requested subject alternative name, so adding an entry to -DnsName or -IpAddress issues a new certificate instead of returning one that would fail validation for the new name. The rule is coverage rather than equality: a certificate carrying more names than requested still qualifies, DNS names compare case-insensitively, and IP addresses are normalized so ::1 matches 0:0:0:0:0:0:0:1. Use -Force when the SAN set needs trimming rather than extending. When Infisical cannot be reached the check falls back to matching on the common name alone and says so with a warning.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -1649,4 +1707,400 @@ $WriteInfisicalScepMdmProfileToWmiResult = Write-InfisicalScepMdmProfileToWmi @W
     </command:examples>
   </command:command>
 
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Start-InfisicalProcess</command:name>
+      <maml:description><maml:para>Starts a child process with Infisical secrets injected directly into its environment block.</maml:para></maml:description>
+      <command:verb>Start</command:verb>
+      <command:noun>InfisicalProcess</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Launches the executable specified by -FilePath, captures stdout/stderr, validates the exit code against -AcceptableExitCodeList, and optionally parses output with -ParsingExpression. InfisicalSecret objects supplied via -Secret (pipeline or by name) are decrypted into the ProcessStartInfo.Environment dictionary only, never written to the user or machine scope; -Prefix prepends a string to each injected variable name, skipping names that already start with -Prefix (case-insensitive) unless -ForcePrefix is supplied. -EnvironmentVariables adds additional non-secret values. -ExecutionTimeout, -NoWait, -CreateNoWindow, -WindowStyle, -Priority, -StandardInputObjectList, -SecureArgumentList, -LogOutput, and -ContinueOnError mirror the semantics of the upstream Start-ProcessWithOutput helper. Honors -WhatIf and -Confirm.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Secret values exist as plain strings only within the child process environment block; they are never persisted to the calling shell, the user scope, or the machine scope. Use -SecureArgumentList to mask sensitive command-line arguments in verbose output.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Get-InfisicalSecret -SecretPath '/build' | Start-InfisicalProcess -FilePath 'dotnet.exe' -ArgumentList @('publish','-c','Release') -AcceptableExitCodeList @('0') -CreateNoWindow</dev:code>
+        <dev:remarks><maml:para>Decrypts every secret at /build, exposes each one as a process environment variable, and runs dotnet publish with no visible window.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$Secrets = Get-InfisicalSecret -SecretPath '/runtime'
+Start-InfisicalProcess -FilePath 'node.exe' -ArgumentList @('app.js') -Secret $Secrets -Prefix 'APP_' -ExecutionTimeout ([TimeSpan]::FromMinutes(5)) -LogOutput</dev:code>
+        <dev:remarks><maml:para>Injects the /runtime secrets as APP_-prefixed environment variables, runs node app.js, and forcibly terminates the process after five minutes if it has not exited.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>$StartInfisicalProcessParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$StartInfisicalProcessParameters.FilePath               = 'pwsh.exe'
+$StartInfisicalProcessParameters.ArgumentList           = @('-NoProfile','-Command','Write-Host $env:DEPLOY_TOKEN.Length')
+$StartInfisicalProcessParameters.Secret                 = Get-InfisicalSecret -SecretPath '/deploy'
+$StartInfisicalProcessParameters.Prefix                 = 'DEPLOY_'
+$StartInfisicalProcessParameters.AcceptableExitCodeList = @('0')
+$StartInfisicalProcessParameters.CreateNoWindow         = $True
+$StartInfisicalProcessParameters.SecureArgumentList     = $True
+$StartInfisicalProcessParameters.LogOutput              = $True
+$StartInfisicalProcessParameters.Verbose                = $True
+
+$StartInfisicalProcessResult = Start-InfisicalProcess @StartInfisicalProcessParameters</dev:code>
+        <dev:remarks><maml:para>Splatted invocation that runs pwsh with DEPLOY_-prefixed secrets in scope, masks the command line in verbose output, and echoes both stdout and stderr to the verbose stream after exit.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Get-InfisicalEnvironmentVariable</command:name>
+      <maml:description><maml:para>Reads an environment variable from the first scope that has a non-empty value (Process > User > Machine).</maml:para></maml:description>
+      <command:verb>Get</command:verb>
+      <command:noun>InfisicalEnvironmentVariable</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Returns the value of -Name from the first scope that contains a non-empty value, checking Process, then User, then Machine in that order. Emits nothing when the variable is missing or blank in every scope, so an assignment yields $null without writing errors or warnings. Platform-unsupported scopes (User and Machine on non-Windows) are silently skipped.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Designed for the same discovery semantics the rest of PSInfisicalAPI uses when resolving connection inputs from the environment. Pipe-friendly: accepts -Name from the pipeline by value and by property name.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>$Value = Get-InfisicalEnvironmentVariable -Name 'INFISICAL_CLIENT_ID'</dev:code>
+        <dev:remarks><maml:para>Returns the first non-empty value of INFISICAL_CLIENT_ID across Process, User, and Machine scopes; assigns $null when the variable is unset everywhere.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>@('INFISICAL_BASE_URI','INFISICAL_PROJECT_ID') | Get-InfisicalEnvironmentVariable</dev:code>
+        <dev:remarks><maml:para>Pipes a list of variable names through the cmdlet and emits one value per name that is set in any scope.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Get-InfisicalOrganization</command:name>
+      <maml:description><maml:para>Lists or retrieves Infisical organizations accessible to the current identity.</maml:para></maml:description>
+      <command:verb>Get</command:verb>
+      <command:noun>InfisicalOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Default (List parameter set) returns every organization the active session can see; visibility is governed by Infisical's role assignments. When -OrganizationId is supplied (Single parameter set) the cmdlet returns one organization. Does not require a project context.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>The List-mode result is an array of InfisicalOrganization objects; pipe into Where-Object or Select-Object to filter by Slug, Name, or Id. The cmdlet accepts pipeline input by property name on -OrganizationId.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Get-InfisicalOrganization</dev:code>
+        <dev:remarks><maml:para>Lists every organization the current session can see.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>Get-InfisicalOrganization -OrganizationId $OrganizationId</dev:code>
+        <dev:remarks><maml:para>Retrieves the canonical record for a single organization by id.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>New-InfisicalOrganization</command:name>
+      <maml:description><maml:para>Creates a new Infisical organization.</maml:para></maml:description>
+      <command:verb>New</command:verb>
+      <command:noun>InfisicalOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Creates a new organization with the supplied name and optional slug. Honors -WhatIf and -Confirm. Requires server-side permission to create organizations.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Slug must be unique server-side; if omitted, the server derives one from the name.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>New-InfisicalOrganization -Name 'Acme Corporation'</dev:code>
+        <dev:remarks><maml:para>Creates a new organization named 'Acme Corporation' with a server-derived slug.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$NewInfisicalOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$NewInfisicalOrganizationParameters.Name    = 'Acme Corporation'
+$NewInfisicalOrganizationParameters.Slug    = 'acme-corp'
+$NewInfisicalOrganizationParameters.Verbose = $True
+
+$NewInfisicalOrganizationResult = New-InfisicalOrganization @NewInfisicalOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Creates an organization with an explicit slug.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Update-InfisicalOrganization</command:name>
+      <maml:description><maml:para>Updates mutable attributes on an existing Infisical organization.</maml:para></maml:description>
+      <command:verb>Update</command:verb>
+      <command:noun>InfisicalOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Updates the name or slug of an organization. -OrganizationId is required. Only bound parameters are transmitted. Honors -WhatIf and -Confirm.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Renaming or re-slugging an organization may affect billing exports and identity URLs; coordinate with downstream consumers.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Update-InfisicalOrganization -OrganizationId $OrganizationId -Name 'Acme Corp.'</dev:code>
+        <dev:remarks><maml:para>Renames the supplied organization.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$UpdateInfisicalOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$UpdateInfisicalOrganizationParameters.OrganizationId = $OrganizationId
+$UpdateInfisicalOrganizationParameters.Name           = 'Acme Corp.'
+$UpdateInfisicalOrganizationParameters.Slug           = 'acme-corp'
+$UpdateInfisicalOrganizationParameters.Verbose        = $True
+
+$UpdateInfisicalOrganizationResult = Update-InfisicalOrganization @UpdateInfisicalOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Renames the organization and updates its slug.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Remove-InfisicalOrganization</command:name>
+      <maml:description><maml:para>Deletes an Infisical organization.</maml:para></maml:description>
+      <command:verb>Remove</command:verb>
+      <command:noun>InfisicalOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Deletes an organization by id. -OrganizationId is required. High ConfirmImpact prompts unless -Confirm:$False is supplied. -PassThru emits the removed organization id.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>This is irreversible and removes all projects, sub-organizations, secrets, and identities owned by the organization. Honors -WhatIf and -Confirm.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Remove-InfisicalOrganization -OrganizationId $OrganizationId -Confirm:$False</dev:code>
+        <dev:remarks><maml:para>Deletes the supplied organization without prompting.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$RemoveInfisicalOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$RemoveInfisicalOrganizationParameters.OrganizationId = $OrganizationId
+$RemoveInfisicalOrganizationParameters.PassThru       = $True
+$RemoveInfisicalOrganizationParameters.Confirm        = $False
+$RemoveInfisicalOrganizationParameters.Verbose        = $True
+
+$RemoveInfisicalOrganizationResult = Remove-InfisicalOrganization @RemoveInfisicalOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Removes the organization without confirmation and emits the removed organization id for logging.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Get-InfisicalSubOrganization</command:name>
+      <maml:description><maml:para>Lists or retrieves Infisical sub-organizations accessible to the current identity.</maml:para></maml:description>
+      <command:verb>Get</command:verb>
+      <command:noun>InfisicalSubOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Default (List parameter set) returns every sub-organization the active session can see. Optional -Limit, -Offset, -Search, -OrderBy, -OrderDirection, and -IsAccessible are forwarded to the server as query parameters. When -SubOrganizationId is supplied (Single parameter set) the cmdlet returns one sub-organization. Does not require a project context.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Sub-organizations are a beta Infisical feature. The List result is an array of InfisicalSubOrganization objects; pipe into Where-Object or Select-Object to filter further. The cmdlet accepts pipeline input by property name on -SubOrganizationId.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Get-InfisicalSubOrganization</dev:code>
+        <dev:remarks><maml:para>Lists every sub-organization the current session can see.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>Get-InfisicalSubOrganization -SubOrganizationId $SubOrganizationId</dev:code>
+        <dev:remarks><maml:para>Retrieves the canonical record for a single sub-organization by id.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>Get-InfisicalSubOrganization -Search 'platform' -OrderBy 'name' -OrderDirection 'asc' -Limit 25 -IsAccessible</dev:code>
+        <dev:remarks><maml:para>Lists up to 25 sub-organizations matching 'platform', sorted ascending by name, restricted to those the current identity has access to.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>New-InfisicalSubOrganization</command:name>
+      <maml:description><maml:para>Creates a new Infisical sub-organization.</maml:para></maml:description>
+      <command:verb>New</command:verb>
+      <command:noun>InfisicalSubOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Creates a sub-organization with the supplied name and slug. Both are required by the server. Honors -WhatIf and -Confirm.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Slug must be unique within the parent organization. Sub-organizations are a beta Infisical feature.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>New-InfisicalSubOrganization -Name 'Platform Engineering' -Slug 'platform-eng'</dev:code>
+        <dev:remarks><maml:para>Creates a new sub-organization named 'Platform Engineering' with slug 'platform-eng'.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$NewInfisicalSubOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$NewInfisicalSubOrganizationParameters.Name    = 'Platform Engineering'
+$NewInfisicalSubOrganizationParameters.Slug    = 'platform-eng'
+$NewInfisicalSubOrganizationParameters.Verbose = $True
+
+$NewInfisicalSubOrganizationResult = New-InfisicalSubOrganization @NewInfisicalSubOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Splatted invocation that creates a sub-organization and logs the request via the verbose stream.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Update-InfisicalSubOrganization</command:name>
+      <maml:description><maml:para>Updates mutable attributes on an existing Infisical sub-organization.</maml:para></maml:description>
+      <command:verb>Update</command:verb>
+      <command:noun>InfisicalSubOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Updates the name or slug of a sub-organization. -SubOrganizationId is required. Only bound parameters are transmitted. Honors -WhatIf and -Confirm.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Sub-organizations are a beta Infisical feature; coordinate slug changes with downstream consumers that pin the slug in scripts or configuration files.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Update-InfisicalSubOrganization -SubOrganizationId $SubOrganizationId -Name 'Platform (v2)'</dev:code>
+        <dev:remarks><maml:para>Renames the supplied sub-organization.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$UpdateInfisicalSubOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$UpdateInfisicalSubOrganizationParameters.SubOrganizationId = $SubOrganizationId
+$UpdateInfisicalSubOrganizationParameters.Name              = 'Platform (v2)'
+$UpdateInfisicalSubOrganizationParameters.Slug              = 'platform-v2'
+$UpdateInfisicalSubOrganizationParameters.Verbose           = $True
+
+$UpdateInfisicalSubOrganizationResult = Update-InfisicalSubOrganization @UpdateInfisicalSubOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Renames the sub-organization and updates its slug in a single call.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Remove-InfisicalSubOrganization</command:name>
+      <maml:description><maml:para>Deletes an Infisical sub-organization.</maml:para></maml:description>
+      <command:verb>Remove</command:verb>
+      <command:noun>InfisicalSubOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Deletes a sub-organization by id. -SubOrganizationId is required. High ConfirmImpact prompts unless -Confirm:$False is supplied. -PassThru emits the removed sub-organization id.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>This is destructive and removes all projects, secrets, and identities scoped to the sub-organization. Honors -WhatIf and -Confirm.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Remove-InfisicalSubOrganization -SubOrganizationId $SubOrganizationId -Confirm:$False</dev:code>
+        <dev:remarks><maml:para>Deletes the supplied sub-organization without prompting.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$RemoveInfisicalSubOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$RemoveInfisicalSubOrganizationParameters.SubOrganizationId = $SubOrganizationId
+$RemoveInfisicalSubOrganizationParameters.PassThru          = $True
+$RemoveInfisicalSubOrganizationParameters.Confirm           = $False
+$RemoveInfisicalSubOrganizationParameters.Verbose           = $True
+
+$RemoveInfisicalSubOrganizationResult = Remove-InfisicalSubOrganization @RemoveInfisicalSubOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Removes the sub-organization without confirmation and emits the removed id for logging.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Get-InfisicalSANList</command:name>
+      <maml:description><maml:para>Builds a deduplicated list of Subject Alternative Name candidates for the local device.</maml:para></maml:description>
+      <command:verb>Get</command:verb>
+      <command:noun>InfisicalSANList</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Returns, in order: the local device name; the device name suffixed with each non-empty DNS suffix found on any operational (non-loopback) network adapter and the system primary domain; every IPv4 unicast address whose first octets fall within RFC 1918 (10/8, 172.16/12, 192.168/16) or CGNAT (100.64/10); and the IPv4 and IPv6 loopback addresses (127.0.0.1, ::1). Optional -InclusionExpression and -ExclusionExpression regex filters are applied in that order after collection, before output. Suitable as a one-shot SAN provider for Request-InfisicalCertificate -DnsName.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Output is a single strongly-typed System.String[] array (emitted non-enumerated) so it round-trips into [System.Collections.Generic.List[string]]::AddRange() and binds directly to string[] parameters such as Request-InfisicalCertificate -DnsName. The device name comes first so it can be reused as a CommonName. Routable public IPv4 addresses, link-local addresses, and IPv6 unicast addresses other than loopback are intentionally excluded. -InclusionExpression and -ExclusionExpression are case-insensitive .NET regular expressions; inclusion is applied first, then exclusion.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Get-InfisicalSANList</dev:code>
+        <dev:remarks><maml:para>Returns the SAN candidate list for the current device.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$Sans = Get-InfisicalSANList
+Request-InfisicalCertificate -ProjectId $ProjectId -CertificateAuthorityId $CaId -CommonName $Sans[0] -DnsName $Sans -Ttl '90d'</dev:code>
+        <dev:remarks><maml:para>Captures the SAN list, then uses the device name as the CommonName and the full list as DnsName when requesting a certificate.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>$GetInfisicalSANListParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$GetInfisicalSANListParameters.InclusionExpression = '\.gracesolution\.prv$|^10\.|^172\.'
+$GetInfisicalSANListParameters.ExclusionExpression = '^127\.|^::1$'
+$Sans = Get-InfisicalSANList @GetInfisicalSANListParameters</dev:code>
+        <dev:remarks><maml:para>Keeps only entries ending in the corporate DNS suffix or sitting in the 10/8 or 172/12 ranges, then drops loopback. Filters are case-insensitive and applied in fetch -> include -> exclude -> output order.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
 </helpItems>

Module/PSInfisicalAPI/en-US/PSInfisicalAPI.dll-Help.xml

@@ -295,7 +295,7 @@ $CopyInfisicalSecretResult = Copy-InfisicalSecret @CopyInfisicalSecretParameters
       <command:noun>InfisicalSecretDictionary</command:noun>
     </command:details>
     <maml:description>
-      <maml:para>Aggregates an incoming pipeline of InfisicalSecret objects into a case-insensitive Dictionary keyed by SecretName. By default values are SecureString; pass -AsPlainText to materialize string values. Duplicate keys are handled via the -DuplicateKeyBehavior parameter (Error, FirstWins, LastWins).</maml:para>
+      <maml:para>Aggregates an incoming pipeline of InfisicalSecret objects into a case-insensitive Dictionary keyed by SecretName. By default values are SecureString; pass -AsPlainText to materialize string values. Duplicate keys are handled via the -DuplicateKeyBehavior parameter (Error, FirstWins, LastWins). -Prefix prepends a string to every dictionary key (e.g. SecretName 'API_KEY' with -Prefix 'MYAPP_' becomes key 'MYAPP_API_KEY'); the underlying InfisicalSecret objects are not mutated. A SecretName that already starts with -Prefix (case-insensitive) is left as-is to avoid double-prefixing; pass -ForcePrefix to always prepend.</maml:para>
     </maml:description>
     <maml:alertSet>
       <maml:title>Notes</maml:title>
@@ -322,6 +322,11 @@ $ConvertToInfisicalSecretDictionaryParameters.Verbose              = $True
 $ConvertToInfisicalSecretDictionaryResult = ConvertTo-InfisicalSecretDictionary @ConvertToInfisicalSecretDictionaryParameters</dev:code>
         <dev:remarks><maml:para>Aggregates recursive secret results into a plain-text dictionary, with the last value winning on key collisions.</maml:para></dev:remarks>
       </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>Get-InfisicalSecret -ProjectId $ProjectId -Environment 'dev' | ConvertTo-InfisicalSecretDictionary -Prefix 'MYAPP_' -AsPlainText</dev:code>
+        <dev:remarks><maml:para>Builds a plain-text dictionary whose keys are namespaced with 'MYAPP_' (e.g. API_KEY becomes MYAPP_API_KEY); the source InfisicalSecret objects are unchanged.</maml:para></dev:remarks>
+      </command:example>
     </command:examples>
   </command:command>
 
@@ -333,7 +338,7 @@ $ConvertToInfisicalSecretDictionaryResult = ConvertTo-InfisicalSecretDictionary
       <command:noun>InfisicalSecrets</command:noun>
     </command:details>
     <maml:description>
-      <maml:para>Buffers an incoming pipeline of InfisicalSecret objects and writes them to a file in the requested format (DotEnv, Json, Yaml, EnvironmentVariables, etc.) or sets them as environment variables on the chosen scope (Process, User, Machine). -Encoding controls text encoding for file outputs.</maml:para>
+      <maml:para>Buffers an incoming pipeline of InfisicalSecret objects and writes them to a file in the requested format (DotEnv, Json, Yaml, EnvironmentVariables, etc.) or sets them as environment variables on the chosen scope (Process, User, Machine). -Encoding controls text encoding for file outputs. -Prefix prepends a string to every emitted variable name regardless of format; names that already start with -Prefix (case-insensitive) are left as-is to avoid double-prefixing. Pass -ForcePrefix to always prepend.</maml:para>
     </maml:description>
     <maml:alertSet>
       <maml:title>Notes</maml:title>
@@ -361,9 +366,52 @@ $ExportInfisicalSecretsParameters.Verbose     = $True
 $ExportInfisicalSecretsResult = Export-InfisicalSecrets @ExportInfisicalSecretsParameters</dev:code>
         <dev:remarks><maml:para>Projects the recursive secret result into Process-scope environment variables for the current PowerShell session.</maml:para></dev:remarks>
       </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>Get-InfisicalSecret -ProjectId $ProjectId -Environment 'dev' | Export-InfisicalSecrets -Format EnvironmentVariables -Scope Process -Prefix 'MYAPP_'</dev:code>
+        <dev:remarks><maml:para>Imports secrets into the process environment with every variable name prefixed by 'MYAPP_' (e.g. API_KEY becomes MYAPP_API_KEY).</maml:para></dev:remarks>
+      </command:example>
     </command:examples>
   </command:command>
 
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Import-InfisicalSecret</command:name>
+      <maml:description><maml:para>Reads a previously exported secrets file (Json, Yaml, Env, or Xml) back into a name-keyed Dictionary.</maml:para></maml:description>
+      <command:verb>Import</command:verb>
+      <command:noun>InfisicalSecret</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Loads the file at -Path (which must exist) using the parser matching -Format and returns a case-insensitive Dictionary keyed by SecretName. By default values are SecureString; pass -AsPlainText for a plain string dictionary. -Prefix prepends to every emitted key; keys already starting with -Prefix (case-insensitive) are left as-is to avoid double-prefixing, and -ForcePrefix overrides that gate. -DuplicateKeyBehavior controls collision handling (Error, FirstWins, LastWins). The EnvironmentVariables format is intentionally not supported here; use [Environment]::GetEnvironmentVariable or Get-InfisicalEnvironmentVariable for environment-backed values.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Importers expect the same schema that Export-InfisicalSecrets produces (Json/Yaml = array or 'Secrets' root list of {SecretName, SecretValue}; Xml = &lt;Secrets&gt;&lt;Secret&gt;&lt;SecretName/&gt;&lt;SecretValue/&gt;; Env = KEY=VALUE per line, '#' comments allowed). JSON and YAML additionally accept a flat key/value object as a convenience.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>$Secrets = Import-InfisicalSecret -Path '.\secrets.json' -Format Json</dev:code>
+        <dev:remarks><maml:para>Reads a JSON export back into a Dictionary&lt;string, SecureString&gt; keyed by the original SecretName values.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$ImportInfisicalSecretParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$ImportInfisicalSecretParameters.Path                 = [System.IO.FileInfo]'.\secrets.env'
+$ImportInfisicalSecretParameters.Format               = 'Env'
+$ImportInfisicalSecretParameters.Prefix               = 'MYAPP_'
+$ImportInfisicalSecretParameters.DuplicateKeyBehavior = 'LastWins'
+$ImportInfisicalSecretParameters.AsPlainText          = $True
+
+$ImportInfisicalSecretResult = Import-InfisicalSecret @ImportInfisicalSecretParameters</dev:code>
+        <dev:remarks><maml:para>Loads a .env file into a plain-text dictionary, namespacing every key with 'MYAPP_' and letting the last occurrence win on duplicates.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+
   <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
     <command:details>
       <command:name>Get-InfisicalProject</command:name>
@@ -1018,7 +1066,7 @@ $RemoveInfisicalTagResult = Remove-InfisicalTag @RemoveInfisicalTagParameters</d
     <maml:alertSet>
       <maml:title>Notes</maml:title>
       <maml:alert>
-        <maml:para>ByID retrieval currently always resolves against the internal CA endpoint. CA Ids returned here are the values to pass on -CertificateAuthorityId to Request-InfisicalCertificate. The Type property distinguishes 'internal' from 'acme' when -Kind Any is used.</maml:para>
+        <maml:para>ByID retrieval currently always resolves against the internal CA endpoint. CA Ids returned here are the values to pass on -CertificateAuthorityId to Request-InfisicalCertificate. The Type property distinguishes 'internal' from 'acme' when -Kind Any is used. Only CAs whose EnableDirectIssuance property is True can sign a CSR through -CertificateAuthorityId; the others must issue through Request-InfisicalCertificate -CertificateProfileId, which bypasses that check. EnableDirectIssuance is fixed at CA creation and appears in no Infisical update schema, so it cannot be toggled afterwards; a CA migrated from the older requireTemplateForIssuance column reads False permanently.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -1233,6 +1281,16 @@ $GetInfisicalCertificatePolicyResult = Get-InfisicalCertificatePolicy @GetInfisi
       <maml:title>Notes</maml:title>
       <maml:alert>
         <maml:para>Default -PrivateKeyProtection is 'LocalOnly': the leaf is loaded into memory without persisting the private key and PrivateKeyPem is scrubbed from the emitted result unless -PrivateKeyPath or an explicit -KeyStorageFlags binding overrides it. The reuse path completes its chain from the Infisical bundle when local stores are incomplete; pass -LocalChainOnly to suppress that fetch entirely.</maml:para>
+        <maml:para>Choose the parameter set by whether the common name varies per request. -CertificateProfileId and -CertificateAuthorityId both accept a per-request common name and suit fleet enrollment; -PkiSubscriberSlug does not, because Infisical rejects any CSR whose CN differs from the subscriber's ('Common name (CN) in the CSR does not match the subscriber's common name') and allowlists the subscriber's subjectAlternativeNames. A subscriber is a single named identity, so enrolling many machines through subscribers requires one subscriber per machine.</maml:para>
+        <maml:para>-CertificateAuthorityId only works against a CA that permits direct issuance (Get-InfisicalCertificateAuthority reports this as EnableDirectIssuance). The cmdlet resolves the issuer and validates this before generating a keypair, naming the subscriber, CA, or profile it will use on the verbose stream and in the -WhatIf target. Profile issuance is the only path that ignores that flag, so -CertificateProfileId works against a CA whose EnableDirectIssuance is False. Note that enableDirectIssuance appears in no Infisical create or update schema, so it cannot be changed through the API or UI after the CA exists.</maml:para>
+        <maml:para>There is no -CertificateTemplateId parameter because Infisical's REST API exposes no template-based issuance route; when the API asks for 'a certificate template or subscriber', supply -CertificateProfileId or -PkiSubscriberSlug, or use a CA that allows direct issuance.</maml:para>
+        <maml:para>-CommonName takes the bare value ('web01.contoso.com'), not an RDN; a leading 'CN=' is stripped because the CSR builder adds the prefix itself. -DnsName accepts the mixed output of Get-InfisicalSANList: IP literals in that list are emitted as iPAddress SAN entries rather than dNSName entries.</maml:para>
+        <maml:para>When -StoreLocation is not supplied it is chosen from the process elevation: an elevated session installs to LocalMachine, otherwise CurrentUser. The choice is reported on the verbose stream. Chain members are routed by type regardless of location - self-signed certificates to the Root store, others to CertificateAuthority. When the resolved location is LocalMachine and -KeyStorageFlags was not supplied, the private key is placed in the machine key store so the installed certificate has a usable key outside the calling user's profile.</maml:para>
+        <maml:para>Installing a root into CurrentUser\Root makes Windows display a modal trust confirmation dialog, and the call blocks until it is answered; in a non-interactive session this looks like a hang. The cmdlet emits a warning before blocking. Run elevated or pass -StoreLocation LocalMachine to install machine-wide without a prompt.</maml:para>
+        <maml:para>Only the leaf honours -StoreName (default My). Chain members are routed by what they are: a self-signed certificate is a root and goes to the trusted-root store, anything with an issuer above it is a subordinate CA and goes to the intermediate store, for a chain of any depth. Issuers are installed before the leaf, and the chain is then validated against the machine's stores; an incomplete chain is reported as a warning naming the missing issuer, which is the condition Windows shows as "The issuer of this certificate could not be found".</maml:para>
+        <maml:para>The installed certificate's Windows friendly name defaults to the common name in upper case. -FriendlyName overrides it and is accepted on every parameter set; on the -CertificateAuthorityId path the same value is additionally sent to Infisical as the issued certificate's friendlyName.</maml:para>
+        <maml:para>-Metadata attaches key/value pairs to the certificate in Infisical and accepts any IDictionary, such as a hashtable or an [Ordered] dictionary. Only the supplied keys are reconciled; keys already on the certificate that the call does not mention are left alone, so several callers can each own their own keys. This is performed client-side because Infisical's PATCH replaces a certificate's metadata wholesale, so the module reads the current set, merges the supplied keys over it, and writes back the union; when nothing would change no request is sent. Reconciliation also runs on the reuse path, so a metadata change lands without forcing reissuance. Values are flattened to strings, keys are trimmed and compared case-insensitively, and blank keys are dropped. The resulting metadata is returned on the result's Metadata property. A metadata failure is reported as a warning and does not fail an issuance that otherwise succeeded.</maml:para>
+        <maml:para>The reuse check is scoped to the issuer being requested: the search is filtered by -CertificateProfileId or -CertificateAuthorityId, so a certificate issued by a different profile is not reused. This matters when two profiles over one CA differ in key usage, such as server authentication versus client authentication, where a common-name match alone would return a certificate with the wrong extended key usages. Reuse additionally requires the existing certificate to carry every requested subject alternative name, so adding an entry to -DnsName or -IpAddress issues a new certificate instead of returning one that would fail validation for the new name. The rule is coverage rather than equality: a certificate carrying more names than requested still qualifies, DNS names compare case-insensitively, and IP addresses are normalized so ::1 matches 0:0:0:0:0:0:0:1. Use -Force when the SAN set needs trimming rather than extending. When Infisical cannot be reached the check falls back to matching on the common name alone and says so with a warning.</maml:para>
       </maml:alert>
     </maml:alertSet>
     <command:examples>
@@ -1649,4 +1707,400 @@ $WriteInfisicalScepMdmProfileToWmiResult = Write-InfisicalScepMdmProfileToWmi @W
     </command:examples>
   </command:command>
 
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Start-InfisicalProcess</command:name>
+      <maml:description><maml:para>Starts a child process with Infisical secrets injected directly into its environment block.</maml:para></maml:description>
+      <command:verb>Start</command:verb>
+      <command:noun>InfisicalProcess</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Launches the executable specified by -FilePath, captures stdout/stderr, validates the exit code against -AcceptableExitCodeList, and optionally parses output with -ParsingExpression. InfisicalSecret objects supplied via -Secret (pipeline or by name) are decrypted into the ProcessStartInfo.Environment dictionary only, never written to the user or machine scope; -Prefix prepends a string to each injected variable name, skipping names that already start with -Prefix (case-insensitive) unless -ForcePrefix is supplied. -EnvironmentVariables adds additional non-secret values. -ExecutionTimeout, -NoWait, -CreateNoWindow, -WindowStyle, -Priority, -StandardInputObjectList, -SecureArgumentList, -LogOutput, and -ContinueOnError mirror the semantics of the upstream Start-ProcessWithOutput helper. Honors -WhatIf and -Confirm.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Secret values exist as plain strings only within the child process environment block; they are never persisted to the calling shell, the user scope, or the machine scope. Use -SecureArgumentList to mask sensitive command-line arguments in verbose output.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Get-InfisicalSecret -SecretPath '/build' | Start-InfisicalProcess -FilePath 'dotnet.exe' -ArgumentList @('publish','-c','Release') -AcceptableExitCodeList @('0') -CreateNoWindow</dev:code>
+        <dev:remarks><maml:para>Decrypts every secret at /build, exposes each one as a process environment variable, and runs dotnet publish with no visible window.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$Secrets = Get-InfisicalSecret -SecretPath '/runtime'
+Start-InfisicalProcess -FilePath 'node.exe' -ArgumentList @('app.js') -Secret $Secrets -Prefix 'APP_' -ExecutionTimeout ([TimeSpan]::FromMinutes(5)) -LogOutput</dev:code>
+        <dev:remarks><maml:para>Injects the /runtime secrets as APP_-prefixed environment variables, runs node app.js, and forcibly terminates the process after five minutes if it has not exited.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>$StartInfisicalProcessParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$StartInfisicalProcessParameters.FilePath               = 'pwsh.exe'
+$StartInfisicalProcessParameters.ArgumentList           = @('-NoProfile','-Command','Write-Host $env:DEPLOY_TOKEN.Length')
+$StartInfisicalProcessParameters.Secret                 = Get-InfisicalSecret -SecretPath '/deploy'
+$StartInfisicalProcessParameters.Prefix                 = 'DEPLOY_'
+$StartInfisicalProcessParameters.AcceptableExitCodeList = @('0')
+$StartInfisicalProcessParameters.CreateNoWindow         = $True
+$StartInfisicalProcessParameters.SecureArgumentList     = $True
+$StartInfisicalProcessParameters.LogOutput              = $True
+$StartInfisicalProcessParameters.Verbose                = $True
+
+$StartInfisicalProcessResult = Start-InfisicalProcess @StartInfisicalProcessParameters</dev:code>
+        <dev:remarks><maml:para>Splatted invocation that runs pwsh with DEPLOY_-prefixed secrets in scope, masks the command line in verbose output, and echoes both stdout and stderr to the verbose stream after exit.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Get-InfisicalEnvironmentVariable</command:name>
+      <maml:description><maml:para>Reads an environment variable from the first scope that has a non-empty value (Process > User > Machine).</maml:para></maml:description>
+      <command:verb>Get</command:verb>
+      <command:noun>InfisicalEnvironmentVariable</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Returns the value of -Name from the first scope that contains a non-empty value, checking Process, then User, then Machine in that order. Emits nothing when the variable is missing or blank in every scope, so an assignment yields $null without writing errors or warnings. Platform-unsupported scopes (User and Machine on non-Windows) are silently skipped.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Designed for the same discovery semantics the rest of PSInfisicalAPI uses when resolving connection inputs from the environment. Pipe-friendly: accepts -Name from the pipeline by value and by property name.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>$Value = Get-InfisicalEnvironmentVariable -Name 'INFISICAL_CLIENT_ID'</dev:code>
+        <dev:remarks><maml:para>Returns the first non-empty value of INFISICAL_CLIENT_ID across Process, User, and Machine scopes; assigns $null when the variable is unset everywhere.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>@('INFISICAL_BASE_URI','INFISICAL_PROJECT_ID') | Get-InfisicalEnvironmentVariable</dev:code>
+        <dev:remarks><maml:para>Pipes a list of variable names through the cmdlet and emits one value per name that is set in any scope.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Get-InfisicalOrganization</command:name>
+      <maml:description><maml:para>Lists or retrieves Infisical organizations accessible to the current identity.</maml:para></maml:description>
+      <command:verb>Get</command:verb>
+      <command:noun>InfisicalOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Default (List parameter set) returns every organization the active session can see; visibility is governed by Infisical's role assignments. When -OrganizationId is supplied (Single parameter set) the cmdlet returns one organization. Does not require a project context.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>The List-mode result is an array of InfisicalOrganization objects; pipe into Where-Object or Select-Object to filter by Slug, Name, or Id. The cmdlet accepts pipeline input by property name on -OrganizationId.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Get-InfisicalOrganization</dev:code>
+        <dev:remarks><maml:para>Lists every organization the current session can see.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>Get-InfisicalOrganization -OrganizationId $OrganizationId</dev:code>
+        <dev:remarks><maml:para>Retrieves the canonical record for a single organization by id.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>New-InfisicalOrganization</command:name>
+      <maml:description><maml:para>Creates a new Infisical organization.</maml:para></maml:description>
+      <command:verb>New</command:verb>
+      <command:noun>InfisicalOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Creates a new organization with the supplied name and optional slug. Honors -WhatIf and -Confirm. Requires server-side permission to create organizations.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Slug must be unique server-side; if omitted, the server derives one from the name.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>New-InfisicalOrganization -Name 'Acme Corporation'</dev:code>
+        <dev:remarks><maml:para>Creates a new organization named 'Acme Corporation' with a server-derived slug.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$NewInfisicalOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$NewInfisicalOrganizationParameters.Name    = 'Acme Corporation'
+$NewInfisicalOrganizationParameters.Slug    = 'acme-corp'
+$NewInfisicalOrganizationParameters.Verbose = $True
+
+$NewInfisicalOrganizationResult = New-InfisicalOrganization @NewInfisicalOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Creates an organization with an explicit slug.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Update-InfisicalOrganization</command:name>
+      <maml:description><maml:para>Updates mutable attributes on an existing Infisical organization.</maml:para></maml:description>
+      <command:verb>Update</command:verb>
+      <command:noun>InfisicalOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Updates the name or slug of an organization. -OrganizationId is required. Only bound parameters are transmitted. Honors -WhatIf and -Confirm.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Renaming or re-slugging an organization may affect billing exports and identity URLs; coordinate with downstream consumers.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Update-InfisicalOrganization -OrganizationId $OrganizationId -Name 'Acme Corp.'</dev:code>
+        <dev:remarks><maml:para>Renames the supplied organization.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$UpdateInfisicalOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$UpdateInfisicalOrganizationParameters.OrganizationId = $OrganizationId
+$UpdateInfisicalOrganizationParameters.Name           = 'Acme Corp.'
+$UpdateInfisicalOrganizationParameters.Slug           = 'acme-corp'
+$UpdateInfisicalOrganizationParameters.Verbose        = $True
+
+$UpdateInfisicalOrganizationResult = Update-InfisicalOrganization @UpdateInfisicalOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Renames the organization and updates its slug.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Remove-InfisicalOrganization</command:name>
+      <maml:description><maml:para>Deletes an Infisical organization.</maml:para></maml:description>
+      <command:verb>Remove</command:verb>
+      <command:noun>InfisicalOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Deletes an organization by id. -OrganizationId is required. High ConfirmImpact prompts unless -Confirm:$False is supplied. -PassThru emits the removed organization id.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>This is irreversible and removes all projects, sub-organizations, secrets, and identities owned by the organization. Honors -WhatIf and -Confirm.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Remove-InfisicalOrganization -OrganizationId $OrganizationId -Confirm:$False</dev:code>
+        <dev:remarks><maml:para>Deletes the supplied organization without prompting.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$RemoveInfisicalOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$RemoveInfisicalOrganizationParameters.OrganizationId = $OrganizationId
+$RemoveInfisicalOrganizationParameters.PassThru       = $True
+$RemoveInfisicalOrganizationParameters.Confirm        = $False
+$RemoveInfisicalOrganizationParameters.Verbose        = $True
+
+$RemoveInfisicalOrganizationResult = Remove-InfisicalOrganization @RemoveInfisicalOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Removes the organization without confirmation and emits the removed organization id for logging.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Get-InfisicalSubOrganization</command:name>
+      <maml:description><maml:para>Lists or retrieves Infisical sub-organizations accessible to the current identity.</maml:para></maml:description>
+      <command:verb>Get</command:verb>
+      <command:noun>InfisicalSubOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Default (List parameter set) returns every sub-organization the active session can see. Optional -Limit, -Offset, -Search, -OrderBy, -OrderDirection, and -IsAccessible are forwarded to the server as query parameters. When -SubOrganizationId is supplied (Single parameter set) the cmdlet returns one sub-organization. Does not require a project context.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Sub-organizations are a beta Infisical feature. The List result is an array of InfisicalSubOrganization objects; pipe into Where-Object or Select-Object to filter further. The cmdlet accepts pipeline input by property name on -SubOrganizationId.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Get-InfisicalSubOrganization</dev:code>
+        <dev:remarks><maml:para>Lists every sub-organization the current session can see.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>Get-InfisicalSubOrganization -SubOrganizationId $SubOrganizationId</dev:code>
+        <dev:remarks><maml:para>Retrieves the canonical record for a single sub-organization by id.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>Get-InfisicalSubOrganization -Search 'platform' -OrderBy 'name' -OrderDirection 'asc' -Limit 25 -IsAccessible</dev:code>
+        <dev:remarks><maml:para>Lists up to 25 sub-organizations matching 'platform', sorted ascending by name, restricted to those the current identity has access to.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>New-InfisicalSubOrganization</command:name>
+      <maml:description><maml:para>Creates a new Infisical sub-organization.</maml:para></maml:description>
+      <command:verb>New</command:verb>
+      <command:noun>InfisicalSubOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Creates a sub-organization with the supplied name and slug. Both are required by the server. Honors -WhatIf and -Confirm.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Slug must be unique within the parent organization. Sub-organizations are a beta Infisical feature.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>New-InfisicalSubOrganization -Name 'Platform Engineering' -Slug 'platform-eng'</dev:code>
+        <dev:remarks><maml:para>Creates a new sub-organization named 'Platform Engineering' with slug 'platform-eng'.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$NewInfisicalSubOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$NewInfisicalSubOrganizationParameters.Name    = 'Platform Engineering'
+$NewInfisicalSubOrganizationParameters.Slug    = 'platform-eng'
+$NewInfisicalSubOrganizationParameters.Verbose = $True
+
+$NewInfisicalSubOrganizationResult = New-InfisicalSubOrganization @NewInfisicalSubOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Splatted invocation that creates a sub-organization and logs the request via the verbose stream.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Update-InfisicalSubOrganization</command:name>
+      <maml:description><maml:para>Updates mutable attributes on an existing Infisical sub-organization.</maml:para></maml:description>
+      <command:verb>Update</command:verb>
+      <command:noun>InfisicalSubOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Updates the name or slug of a sub-organization. -SubOrganizationId is required. Only bound parameters are transmitted. Honors -WhatIf and -Confirm.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Sub-organizations are a beta Infisical feature; coordinate slug changes with downstream consumers that pin the slug in scripts or configuration files.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Update-InfisicalSubOrganization -SubOrganizationId $SubOrganizationId -Name 'Platform (v2)'</dev:code>
+        <dev:remarks><maml:para>Renames the supplied sub-organization.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$UpdateInfisicalSubOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$UpdateInfisicalSubOrganizationParameters.SubOrganizationId = $SubOrganizationId
+$UpdateInfisicalSubOrganizationParameters.Name              = 'Platform (v2)'
+$UpdateInfisicalSubOrganizationParameters.Slug              = 'platform-v2'
+$UpdateInfisicalSubOrganizationParameters.Verbose           = $True
+
+$UpdateInfisicalSubOrganizationResult = Update-InfisicalSubOrganization @UpdateInfisicalSubOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Renames the sub-organization and updates its slug in a single call.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Remove-InfisicalSubOrganization</command:name>
+      <maml:description><maml:para>Deletes an Infisical sub-organization.</maml:para></maml:description>
+      <command:verb>Remove</command:verb>
+      <command:noun>InfisicalSubOrganization</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Deletes a sub-organization by id. -SubOrganizationId is required. High ConfirmImpact prompts unless -Confirm:$False is supplied. -PassThru emits the removed sub-organization id.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>This is destructive and removes all projects, secrets, and identities scoped to the sub-organization. Honors -WhatIf and -Confirm.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Remove-InfisicalSubOrganization -SubOrganizationId $SubOrganizationId -Confirm:$False</dev:code>
+        <dev:remarks><maml:para>Deletes the supplied sub-organization without prompting.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$RemoveInfisicalSubOrganizationParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$RemoveInfisicalSubOrganizationParameters.SubOrganizationId = $SubOrganizationId
+$RemoveInfisicalSubOrganizationParameters.PassThru          = $True
+$RemoveInfisicalSubOrganizationParameters.Confirm           = $False
+$RemoveInfisicalSubOrganizationParameters.Verbose           = $True
+
+$RemoveInfisicalSubOrganizationResult = Remove-InfisicalSubOrganization @RemoveInfisicalSubOrganizationParameters</dev:code>
+        <dev:remarks><maml:para>Removes the sub-organization without confirmation and emits the removed id for logging.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
+  <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
+    <command:details>
+      <command:name>Get-InfisicalSANList</command:name>
+      <maml:description><maml:para>Builds a deduplicated list of Subject Alternative Name candidates for the local device.</maml:para></maml:description>
+      <command:verb>Get</command:verb>
+      <command:noun>InfisicalSANList</command:noun>
+    </command:details>
+    <maml:description>
+      <maml:para>Returns, in order: the local device name; the device name suffixed with each non-empty DNS suffix found on any operational (non-loopback) network adapter and the system primary domain; every IPv4 unicast address whose first octets fall within RFC 1918 (10/8, 172.16/12, 192.168/16) or CGNAT (100.64/10); and the IPv4 and IPv6 loopback addresses (127.0.0.1, ::1). Optional -InclusionExpression and -ExclusionExpression regex filters are applied in that order after collection, before output. Suitable as a one-shot SAN provider for Request-InfisicalCertificate -DnsName.</maml:para>
+    </maml:description>
+    <maml:alertSet>
+      <maml:title>Notes</maml:title>
+      <maml:alert>
+        <maml:para>Output is a single strongly-typed System.String[] array (emitted non-enumerated) so it round-trips into [System.Collections.Generic.List[string]]::AddRange() and binds directly to string[] parameters such as Request-InfisicalCertificate -DnsName. The device name comes first so it can be reused as a CommonName. Routable public IPv4 addresses, link-local addresses, and IPv6 unicast addresses other than loopback are intentionally excluded. -InclusionExpression and -ExclusionExpression are case-insensitive .NET regular expressions; inclusion is applied first, then exclusion.</maml:para>
+      </maml:alert>
+    </maml:alertSet>
+    <command:examples>
+      <command:example>
+        <maml:title>EXAMPLE 1</maml:title>
+        <dev:code>Get-InfisicalSANList</dev:code>
+        <dev:remarks><maml:para>Returns the SAN candidate list for the current device.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 2</maml:title>
+        <dev:code>$Sans = Get-InfisicalSANList
+Request-InfisicalCertificate -ProjectId $ProjectId -CertificateAuthorityId $CaId -CommonName $Sans[0] -DnsName $Sans -Ttl '90d'</dev:code>
+        <dev:remarks><maml:para>Captures the SAN list, then uses the device name as the CommonName and the full list as DnsName when requesting a certificate.</maml:para></dev:remarks>
+      </command:example>
+      <command:example>
+        <maml:title>EXAMPLE 3</maml:title>
+        <dev:code>$GetInfisicalSANListParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+$GetInfisicalSANListParameters.InclusionExpression = '\.gracesolution\.prv$|^10\.|^172\.'
+$GetInfisicalSANListParameters.ExclusionExpression = '^127\.|^::1$'
+$Sans = Get-InfisicalSANList @GetInfisicalSANListParameters</dev:code>
+        <dev:remarks><maml:para>Keeps only entries ending in the corporate DNS suffix or sitting in the 10/8 or 172/12 ranges, then drops loopback. Filters are case-insensitive and applied in fetch -> include -> exclude -> output order.</maml:para></dev:remarks>
+      </command:example>
+    </command:examples>
+  </command:command>
+
 </helpItems>

Module/PSInfisicalAPI/en-US/about_PSInfisicalAPI.help.txt

@@ -84,6 +84,39 @@ EXAMPLES
         Get-InfisicalSecrets |
             Export-InfisicalSecrets -Path .\secrets.env -Format Env
 
+ERROR HANDLING AND STREAMS
+    Every cmdlet derives from PSCmdlet, so the common parameters are bound:
+    -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction,
+    -WarningVariable, -InformationAction, -InformationVariable, -OutVariable,
+    and -PipelineVariable, plus -WhatIf/-Confirm where ShouldProcess applies.
+
+    Output is separated by stream so those parameters mean what they say:
+
+        Error     The failure itself, once, as a non-terminating ErrorRecord.
+        Warning   Advisories that are not failures.
+        Verbose   Request/response trace and the trail leading up to a failure.
+        Debug     Low-level detail.
+
+    Operation failures are NON-TERMINATING, so -ErrorAction decides the
+    outcome:
+
+        Continue (default)  Error is written; a pipeline keeps processing.
+        SilentlyContinue    Nothing printed; still in $Error/-ErrorVariable.
+        Ignore              Nothing printed and nothing recorded.
+        Stop                Promoted to terminating; try/catch catches it.
+
+    To catch a failure you must ask for it:
+
+        try {
+            Request-InfisicalCertificate @Parameters -ErrorAction Stop
+        } catch [PSInfisicalAPI.Errors.InfisicalApiException] {
+            "HTTP $($_.Exception.StatusCode): $($_.Exception.ApiErrorMessage)"
+        }
+
+    The ErrorRecord carries the API detail, so log scraping is unnecessary:
+    $Error[0].Exception exposes StatusCode, ApiErrorCode, ApiErrorMessage, and
+    ApiRequestId on InfisicalApiException.
+
 SECURITY NOTES
     - SecureString is used for ClientSecret, AccessToken, and any secret
       payloads returned by the API.

README.md

@@ -26,7 +26,7 @@ Import-Module -Name .\Module\PSInfisicalAPI
 
 ## Cmdlets
 
-The module exports 37 cmdlets. Discovery cmdlets (`Get-Infisical*`) use a `List` (default) / single-record parameter-set pair: invoking without the identity parameter returns the collection, supplying the identity parameter returns one record.
+The module exports 51 cmdlets. Discovery cmdlets (`Get-Infisical*`) use a `List` (default) / single-record parameter-set pair: invoking without the identity parameter returns the collection, supplying the identity parameter returns one record.
 
 ### Session
 
@@ -47,6 +47,24 @@ The module exports 37 cmdlets. Discovery cmdlets (`Get-Infisical*`) use a `List`
 | `ConvertTo-InfisicalSecretDictionary` | Converts a stream of InfisicalSecret objects into a name-keyed Dictionary of SecureString or plain text values. |
 | `Export-InfisicalSecrets`             | Exports InfisicalSecret objects to disk or environment variables in a chosen file format.          |
 
+### Organizations
+
+| Cmdlet                         | Purpose                                                                                            |
+| ------------------------------ | -------------------------------------------------------------------------------------------------- |
+| `Get-InfisicalOrganization`    | Lists or retrieves Infisical organizations accessible to the current identity.                     |
+| `New-InfisicalOrganization`    | Creates a new Infisical organization.                                                              |
+| `Update-InfisicalOrganization` | Updates the name or slug of an existing Infisical organization.                                    |
+| `Remove-InfisicalOrganization` | Deletes an Infisical organization.                                                                 |
+
+### Sub-Organizations
+
+| Cmdlet                            | Purpose                                                                                            |
+| --------------------------------- | -------------------------------------------------------------------------------------------------- |
+| `Get-InfisicalSubOrganization`    | Lists or retrieves Infisical sub-organizations, with optional search, paging, and ordering filters. |
+| `New-InfisicalSubOrganization`    | Creates a new Infisical sub-organization.                                                          |
+| `Update-InfisicalSubOrganization` | Updates the name or slug of an existing Infisical sub-organization.                                |
+| `Remove-InfisicalSubOrganization` | Deletes an Infisical sub-organization.                                                             |
+
 ### Projects
 
 | Cmdlet                    | Purpose                                                                                            |
@@ -98,6 +116,13 @@ The module exports 37 cmdlets. Discovery cmdlets (`Get-Infisical*`) use a `List`
 | `Get-InfisicalScepMdmProfile`       | Projects an Infisical certificate profile into a Windows SCEP MDM profile model.                   |
 | `Export-InfisicalScepMdmProfile`    | Writes a SCEP MDM profile to disk as a SyncML payload suitable for MDM delivery.                   |
 | `Write-InfisicalScepMdmProfileToWmi`| Submits a SCEP MDM profile to the local MDM Bridge WMI provider to trigger enrollment.             |
+| `Get-InfisicalSANList`              | Builds a SAN candidate list (device name, `<device>.<suffix>` per adapter DNS suffix, RFC 1918 + CGNAT IPv4 addresses, IPv4/IPv6 loopback) for `Request-InfisicalCertificate -DnsName`. |
+
+### Process
+
+| Cmdlet                   | Purpose                                                                                            |
+| ------------------------ | -------------------------------------------------------------------------------------------------- |
+| `Start-InfisicalProcess` | Launches a child process with Infisical secrets injected directly into its environment block, capturing stdout/stderr and validating the exit code. |
 
 Use `Get-Help <Cmdlet> -Full` for parameter details and `Get-Help about_PSInfisicalAPI` for the module overview.
 
@@ -119,6 +144,399 @@ Get-InfisicalSecret -SecretPath '/'
 Disconnect-Infisical
 ```
 
+## End-to-end: request and install a chained certificate
+
+Connects, selects a `cert-manager` project, sources SANs from `Get-InfisicalSANList`, requests a certificate through a certificate profile, installs it (and its chain) into the current-user store, and disconnects. Each call uses a splatted `OrderedDictionary` constructed with `OrdinalIgnoreCase` so parameter names round-trip case-insensitively.
+
+This is the shape to use for **fleet enrollment**, where each machine needs its own common name. See [Choosing an issuance path](#choosing-an-issuance-path) — a PKI subscriber is *not* the right tool for this, because it pins one fixed common name.
+
+```powershell
+$ConnectInfisicalParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+    $ConnectInfisicalParameters.BaseUri        = 'https://app.infisical.com'
+    $ConnectInfisicalParameters.OrganizationId = '00000000-0000-0000-0000-000000000000'
+    $ConnectInfisicalParameters.ClientId       = 'machine-identity-client-id'
+    $ConnectInfisicalParameters.ClientSecret   = ConvertTo-SecureString -String 'ClientSecret' -AsPlainText -Force
+    $ConnectInfisicalParameters.PassThru       = $True
+    $ConnectInfisicalParameters.Verbose        = $True
+
+$Connection = Connect-Infisical @ConnectInfisicalParameters
+
+$Project = Get-InfisicalProject -Type cert-manager | Select-Object -First 1
+
+$Project
+
+#region Certificate authorities. Not required for profile issuance - the profile already binds its CA - but
+#       useful for confirming the chain you expect to be installed.
+    $CAList = Get-InfisicalCertificateAuthority -ProjectId ($Project.Id) -Kind Internal
+
+    $RootCA = $CAList | Where-Object {([String]::IsNullOrEmpty($_.ParentCaId) -eq $True)} | Select-Object -First 1
+
+    $RootCA
+
+    $IntermediateCA = $CAList | Where-Object {([String]::IsNullOrEmpty($_.ParentCaId) -eq $False)}
+
+    $IntermediateCA
+#endregion
+
+$CertificateProfile = Get-InfisicalCertificateProfile -ProjectId ($Project.Id) -IncludeConfigs |
+    Where-Object {($_.EnrollmentType -iin @('API')) -and ($_.Slug -imatch '.*Server.*')} |
+    Select-Object -First 1
+
+$CertificateProfile
+
+$SanList = Get-InfisicalSANList
+
+$SanList
+
+$RequestInfisicalCertificateParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
+    $RequestInfisicalCertificateParameters.ProjectId            = $Project.Id
+    $RequestInfisicalCertificateParameters.CertificateProfileId = $CertificateProfile.Id
+    $RequestInfisicalCertificateParameters.CommonName           = $Env:ComputerName.ToUpper()
+    $RequestInfisicalCertificateParameters.DnsName              = New-Object -TypeName 'System.Collections.Generic.List[System.String]'
+        $RequestInfisicalCertificateParameters.DnsName.AddRange($SanList)
+        $RequestInfisicalCertificateParameters.DnsName.Add('app.contoso.com')
+        $RequestInfisicalCertificateParameters.DnsName.Add('api.contoso.com')
+        $RequestInfisicalCertificateParameters.DnsName.Add('boot.contoso.com')
+    $RequestInfisicalCertificateParameters.Ttl                  = '90d'
+    $RequestInfisicalCertificateParameters.Install              = $True
+    $RequestInfisicalCertificateParameters.InstallChain         = $True
+    $RequestInfisicalCertificateParameters.Verbose              = $True
+
+$Certificate = Request-InfisicalCertificate @RequestInfisicalCertificateParameters
+
+$Null = Disconnect-Infisical -Verbose
+```
+
+Note `$CertificateProfile` rather than `$Profile`: `$Profile` is an automatic variable in PowerShell (the path to the current profile script), and assigning to it works but shadows something the host relies on.
+
+`-StoreName`/`-StoreLocation` are omitted deliberately — see [Where certificates get installed](#where-certificates-get-installed).
+
+### Example output
+
+```text
+Id                 : 00000000-0000-0000-0000-000000000000
+Name               : Microsoft Endpoint Configuration Manager
+Slug               : mecm
+Description        :
+OrganizationId     : 11111111-1111-1111-1111-111111111111
+Type               : cert-manager
+AutoCapitalization : False
+EnvironmentSlugs   : {dev, staging, prod}
+CreatedAtUtc       : 3/12/2026 8:32:52 PM +00:00
+UpdatedAtUtc       : 6/21/2026 7:00:28 PM +00:00
+
+Name         : root-ca
+CommonName   : Contoso Root Certificate Authority
+Type         : internal
+Status       : active
+KeyAlgorithm : RSA_2048
+NotAfter     : 03/25/2036 00:00:00
+Id           : 22222222-2222-2222-2222-222222222222
+
+Name         : intermediate-ca
+CommonName   : Contoso Intermediate Certificate Authority
+Type         : internal
+Status       : active
+KeyAlgorithm : RSA_2048
+NotAfter     : 03/25/2031 00:00:00
+Id           : 33333333-3333-3333-3333-333333333333
+
+Id                   : 44444444-4444-4444-4444-444444444444
+ProjectId            : 00000000-0000-0000-0000-000000000000
+CaId                 : 33333333-3333-3333-3333-333333333333
+CertificatePolicyId  : 55555555-5555-5555-5555-555555555555
+Slug                 : serverauthentication
+Description          :
+EnrollmentType       : api
+IssuerType           : ca
+EstConfigId          :
+ApiConfigId          : 66666666-6666-6666-6666-666666666666
+AcmeConfigId         :
+ScepConfigId         :
+CreatedAtUtc         : 3/25/2026 4:53:53 PM +00:00
+UpdatedAtUtc         : 3/25/2026 4:53:53 PM +00:00
+Defaults             : PSInfisicalAPI.Models.InfisicalCertificateProfileDefaults
+CertificateAuthority : PSInfisicalAPI.Models.InfisicalCertificateAuthoritySummary
+CertificatePolicy    :
+ApiConfig            : PSInfisicalAPI.Models.InfisicalCertificateProfileApiConfig
+
+WEB01
+10.20.30.40
+WEB01.contoso.com
+127.0.0.1
+::1
+
+VERBOSE: [...] - [Information] - [PkiClient] - Attempting to search Infisical certificates. Please Wait...
+VERBOSE: [...] - [Verbose] - [HttpClient] - Attempting HTTP POST to https://infisical.contoso.com/api/v1/projects/00000000-0000-0000-0000-000000000000/certificates/search. Please Wait...
+VERBOSE: [...] - [Verbose] - [HttpClient] - HTTP POST completed with status 200.
+VERBOSE: [...] - [Information] - [PkiClient] - Infisical certificate search was successful.
+VERBOSE: [...] - [Information] - [RequestInfisicalCertificateCmdlet] - Process is elevated; defaulting -StoreLocation to LocalMachine. Pass -StoreLocation explicitly to override.
+VERBOSE: [...] - [Information] - [RequestInfisicalCertificateCmdlet] - Issuing via certificate profile '44444444-4444-4444-4444-444444444444' in project '00000000-0000-0000-0000-000000000000'.
+VERBOSE: Performing the operation "Request new certificate" on target "certificate profile '44444444-4444-4444-4444-444444444444' for CN=WEB01".
+VERBOSE: [...] - [Information] - [PkiClient] - Attempting to issue certificate via profile '44444444-4444-4444-4444-444444444444'. Please Wait...
+VERBOSE: [...] - [Verbose] - [HttpClient] - Attempting HTTP POST to https://infisical.contoso.com/api/v1/cert-manager/certificates. Please Wait...
+VERBOSE: [...] - [Verbose] - [HttpClient] - HTTP POST completed with status 200.
+VERBOSE: [...] - [Information] - [PkiClient] - Infisical certificate issuance (profile) was successful.
+VERBOSE: [...] - [Information] - [RequestInfisicalCertificateCmdlet] - Installed certificate to LocalMachine\My [F480A920DFB41EA8EE3E9178C1BC6A5EC7055B96].
+VERBOSE: [...] - [Information] - [RequestInfisicalCertificateCmdlet] - Installed certificate to LocalMachine\CertificateAuthority [89A486A532D94EFE4391BEF2EA7F5E7E2B654AB0].
+VERBOSE: [...] - [Information] - [RequestInfisicalCertificateCmdlet] - Installed certificate to LocalMachine\Root [1F3A77B0C2D45E6819AB3C7D0E5F2A9B4C81D6E7].
+```
+
+### Where certificates get installed
+
+When `-StoreLocation` is not supplied, the cmdlet picks it from the process's elevation, and says which it chose on the verbose stream:
+
+| Session       | Leaf                       | Intermediates                                | Roots                        |
+| ------------- | -------------------------- | -------------------------------------------- | ---------------------------- |
+| Elevated      | `LocalMachine\My`          | `LocalMachine\CertificateAuthority`           | `LocalMachine\Root`          |
+| Not elevated  | `CurrentUser\My`           | `CurrentUser\CertificateAuthority`            | `CurrentUser\Root`           |
+
+The routing split is deliberate:
+
+- **The leaf** honours `-StoreName` (default `My`) and lands in the resolved location.
+- **Chain members** ignore `-StoreName` and are routed by what they are — a self-signed certificate is a root and goes to the trusted-root store; anything with an issuer above it is a subordinate CA and goes to the intermediate store. A chain of any depth is walked, so an issuing subordinate installs alongside every CA above it up to the root.
+
+`-StoreLocation` still applies to all of them, so an elevated run puts the whole chain machine-wide and a non-elevated run puts it all under the user.
+
+Issuers are installed **before** the leaf, so the certificate is chainable the moment it appears in the store. Afterwards the chain is validated against the machine's own stores, and an incomplete result is called out by name rather than left to be discovered in `certmgr`:
+
+```text
+WARNING: [...] Certificate chain is incomplete (PartialChain). The highest certificate installed is
+'CN=Contoso Intermediate Certificate Authority, OU=IT, O=Contoso, C=US', whose issuer
+'CN=Contoso Root Certificate Authority, OU=IT, O=Contoso, C=US' is not present in the trusted stores.
+Windows will report "The issuer of this certificate could not be found" until that issuer is installed.
+```
+
+The installed certificate's Windows friendly name defaults to the common name in upper case (`WEB01`), which is what shows in `certmgr`. Pass `-FriendlyName` on any parameter set to override it; on the `-CertificateAuthorityId` path the same value is also forwarded to Infisical as the issued certificate's `friendlyName`.
+
+### Metadata
+
+`-Metadata` attaches key/value pairs to the certificate in Infisical, and accepts any `IDictionary` — a hashtable, an `[Ordered]` dictionary, or a generic `Dictionary[String,String]`:
+
+```powershell
+$RequestInfisicalCertificateParameters.Metadata = [Ordered]@{
+    Environment = 'Production'
+    Owner       = 'Platform Engineering'
+    ManagedBy   = 'Invoke-SecretStaging'
+    Site        = 'HQ'
+}
+```
+
+**Only the supplied keys are reconciled.** Keys already on the certificate that this call does not mention are left alone, so several callers can each own their own keys without clobbering each other:
+
+```powershell
+Request-InfisicalCertificate @Parameters -Metadata @{ Owner = 'Platform' }   # certificate now has Owner
+Request-InfisicalCertificate @Parameters -Metadata @{ Site  = 'HQ' }         # Owner survives; Site added
+Request-InfisicalCertificate @Parameters -Metadata @{ Owner = 'Security' }   # Owner updated; Site survives
+```
+
+This is done client-side. Infisical's `PATCH /certificates/{id}` replaces a certificate's metadata wholesale — the service deletes every row before inserting what it was sent — so the module reads the current set, merges the supplied keys over it, and writes back the union. When nothing would change, no request is sent at all.
+
+Reconciliation runs on the reuse path too, so a metadata change lands without forcing reissuance. Values are flattened to strings (`443` becomes `"443"`, `$True` becomes `"True"`, `$Null` becomes `""`), keys are trimmed and compared case-insensitively, and blank keys are dropped.
+
+The result carries the certificate's metadata after reconciliation:
+
+```powershell
+$Certificate = Request-InfisicalCertificate @RequestInfisicalCertificateParameters
+$Certificate.Metadata['Environment']    # Production
+```
+
+Metadata never fails an issuance that otherwise succeeded. By the time it is applied the certificate exists and may already be installed, so a failure is reported as a warning and the certificate is still returned.
+
+Metadata is also a search filter — `Get-InfisicalCertificate` accepts `-Metadata` to find certificates by the keys you stamped on them.
+
+### Reuse and renewal
+
+A second run does not issue a new certificate if a still-valid one is already installed. That check is **scoped to the issuer you asked for**, not just the common name: the reuse search is filtered by `-CertificateProfileId` or `-CertificateAuthorityId`, so switching profiles issues a new certificate rather than handing back the old one.
+
+This matters when two profiles over the same CA differ in key usage. Requesting from a client-authentication profile on a host that already holds a server-authentication certificate for the same name issues a new certificate, because a name match alone would return one with the wrong EKUs:
+
+```text
+VERBOSE: Reuse search for CN=WEB01 scoped to certificate profile 'a42f8446-...' returned 0 active certificate(s).
+```
+
+Reuse also requires the existing certificate to carry **every** name being requested. Adding an entry to `-DnsName` and re-running issues a new certificate rather than returning one that would fail validation for the name you just added:
+
+```text
+VERBOSE: An existing certificate for CN=WEB01 does not carry the requested name DNS:api.contoso.com;
+         requesting a new certificate rather than reusing one that would fail validation for it.
+```
+
+The rule is coverage, not equality — a certificate carrying more names than requested still satisfies the request. DNS names compare case-insensitively and IP addresses are normalized, so `::1` matches `0:0:0:0:0:0:0:1`. Removing a name from the request therefore reuses the existing certificate; use `-Force` when you need the SAN set trimmed rather than extended.
+
+`-Force` issues unconditionally, and `-AllowRenewal` with `-RenewalThresholdDays` rotates a certificate that is inside its renewal window.
+
+If Infisical cannot be reached, the reuse check cannot confirm which certificates belong to which issuer and falls back to matching on the common name alone. That is announced as a warning, since it can return a certificate from a different profile.
+
+When the resolved location is `LocalMachine` and `-KeyStorageFlags` was not supplied, the private key is written to the machine key store. Without that the key lands in the calling user's profile while the certificate sits in `LocalMachine\My`, which is the usual cause of an installed certificate that reports no usable private key to a service.
+
+> **Non-elevated root installs prompt.** Adding a root to `CurrentUser\Root` makes Windows raise a modal trust dialog, and the call blocks until it is answered — if the dialog is hidden or the session is non-interactive (a scheduled task, an MECM task sequence), the cmdlet appears to hang indefinitely. It warns before blocking. Run elevated, or pass `-StoreLocation LocalMachine`, to install machine-wide with no prompt.
+
+### Choosing an issuance path
+
+`Request-InfisicalCertificate` has three mutually exclusive issuance parameter sets. The deciding question is **whether the common name varies per request**:
+
+| Parameter                  | Common name                          | Use when                                                                 |
+| -------------------------- | ------------------------------------ | ------------------------------------------------------------------------ |
+| `-CertificateProfileId`    | **Per request**, constrained by policy | Fleet enrollment — many machines, each with its own CN. Works on any CA.  |
+| `-CertificateAuthorityId`  | **Per request**, unconstrained         | Rarely usable — needs direct issuance, which cannot be enabled (see below).  |
+| `-PkiSubscriberSlug`       | **Fixed** by the subscriber record     | One named identity — a specific service or host, provisioned in advance.  |
+
+**A PKI subscriber is a per-identity object, not a fleet template.** `signSubscriberCert` rejects any CSR whose CN differs from the subscriber's:
+
+```text
+Common name (CN) in the CSR does not match the subscriber's common name
+```
+
+It also allowlists SANs — every `dNSName`/`email` SAN in the CSR must appear in the subscriber's `subjectAlternativeNames` — and requires CSR key usages to be a subset of the subscriber's. (IP SANs are not covered by that check.) Enrolling *N* machines through subscribers therefore means creating *N* subscribers. Prefer a profile.
+
+There is no `-CertificateTemplateId` parameter. Infisical's REST API exposes no template-based issuance route — templates are consumed internally by EST and subscribers — so when the API says *"Certificate template or subscriber is required for issuance"*, the reachable answers are a profile, a subscriber, or direct issuance.
+
+The cmdlet resolves and reports the issuer before generating a keypair, so `-Verbose` tells you exactly what will sign the request:
+
+```text
+VERBOSE: [...] - [Information] - [RequestInfisicalCertificateCmdlet] - Issuing via certificate profile 'a1b2c3d4-...' in project '2122628e-...'.
+VERBOSE: [...] - [Information] - [RequestInfisicalCertificateCmdlet] - Issuing directly via certificate authority 'intermediate-ca' (bf661d78-...); direct issuance is enabled.
+```
+
+`-WhatIf` names the same issuer without issuing anything:
+
+```powershell
+Request-InfisicalCertificate @RequestInfisicalCertificateParameters -WhatIf
+# What if: Performing the operation "Request new certificate" on target
+#          "certificate profile 'a1b2c3d4-...' for CN=WEB01".
+```
+
+#### Discovering profiles (recommended)
+
+A certificate profile binds a CA to a certificate policy. The policy constrains the subject, key usages, and extended key usages with `allowed`/`required`/`denied` lists, so the common name still varies per request while staying inside guardrails.
+
+```powershell
+Get-InfisicalCertificateProfile -ProjectId ($Project.Id) | Format-Table Id, Name, CaId
+Get-InfisicalCertificatePolicy  -ProjectId ($Project.Id) | Format-Table Id, Name
+```
+
+Profile issuance is the only path that does **not** consult the CA's direct-issuance flag — the service short-circuits it:
+
+```ts
+if (!isFromProfile && !ca.enableDirectIssuance && !certificateTemplate) { throw ... }
+```
+
+So a profile issues successfully against a CA whose `EnableDirectIssuance` is `False`. If a project has no profiles, create a policy then a profile under **Certificate Management** in the Infisical UI.
+
+#### Discovering subscribers
+
+```powershell
+Get-InfisicalPkiSubscriber -ProjectId ($Project.Id) |
+    Format-Table Name, CommonName, Status, Ttl, CaId
+```
+
+Pass the subscriber's `Name` to `-PkiSubscriberSlug`, and set `-CommonName` to exactly that subscriber's `CommonName`. Because the subscriber owns the lifetime and usage policy, `-Ttl`, `-KeyUsage`, and `-ExtendedKeyUsage` are not accepted on this parameter set — set them on the subscriber in Infisical instead.
+
+An empty result means the project has no subscribers; create one under **Certificate Management > Subscribers**. This module is read-only for subscribers, so creation is UI or raw API (`POST /api/v1/pki/subscribers`).
+
+#### Direct issuance on a CA
+
+Direct issuance lets a CA sign a bare CSR with no profile, subscriber, or template in front of it. When it is off, Infisical rejects the request with `400 Certificate template or subscriber is required for issuance`; this module catches that before building a CSR.
+
+> **There is no UI toggle or API field for this.** `enableDirectIssuance` appears in no create or update schema — the generic CA schemas accept only `name` and `status`. It is set at CA creation (the column defaults to `true`) and is not editable afterwards through the public API.
+
+A CA can therefore read `False` for a reason that is not obvious. Migration `20250521110635_add-external-ca-pki.ts` renamed the older `requireTemplateForIssuance` column to `enableDirectIssuance` and **inverted** every existing value:
+
+```ts
+t.renameColumn("requireTemplateForIssuance", "enableDirectIssuance");
+...
+.update({ name: slugifiedName, enableDirectIssuance: !ca.enableDirectIssuance });
+```
+
+Any CA created before that migration with "require template for issuance" enabled now reads `EnableDirectIssuance = False` permanently.
+
+Creating a new CA does not help either. Although the database column defaults to `true`, the creation service passes `false` explicitly:
+
+```ts
+const ca = await certificateAuthorityDAL.create({ projectId, name: resolvedCaName, status, enableDirectIssuance: false }, tx);
+```
+
+So **every CA created through the API or UI has direct issuance disabled**, and nothing can turn it on afterwards. Use a certificate profile, which ignores the flag entirely.
+
+```powershell
+Get-InfisicalCertificateAuthority -ProjectId ($Project.Id) -Kind Internal |
+    Format-Table Name, CommonName, Status, EnableDirectIssuance
+
+$Ca = Get-InfisicalCertificateAuthority -ProjectId ($Project.Id) -Kind Internal |
+    Where-Object {($_.EnableDirectIssuance -eq $True)} |
+    Select-Object -First 1
+
+$RequestInfisicalCertificateParameters.CertificateAuthorityId = $Ca.Id
+$RequestInfisicalCertificateParameters.Ttl                    = '90d'   # required by the CA path
+```
+
+### Subject and SAN handling
+
+- `-CommonName` takes the bare value (`WEB01.contoso.com`), not an RDN. `CN=WEB01` is accepted and normalized, since the CSR builder adds the `CN=` prefix itself.
+- `Get-InfisicalSANList` returns DNS names *and* IP addresses in one list. Passing the whole list to `-DnsName` is fine: IP literals are detected and emitted as `iPAddress` SAN entries rather than malformed `dNSName` entries.
+- `-Ttl` (or `-NotAfter`) applies to the `-CertificateAuthorityId` and `-CertificateProfileId` paths. Subscriber-issued certificates take their lifetime from the subscriber definition.
+
+## Diagnostics and error handling
+
+Every cmdlet derives from `PSCmdlet`, so the full set of common parameters is bound: `-Verbose`, `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-WarningAction`, `-WarningVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-PipelineVariable`, and `-WhatIf`/`-Confirm` on the cmdlets that declare `SupportsShouldProcess`.
+
+Output is routed by stream so those parameters mean what they say:
+
+| Stream      | Carries                                                                 | Controlled by                        |
+| ----------- | ----------------------------------------------------------------------- | ------------------------------------ |
+| Error       | The failure itself, once, as a non-terminating `ErrorRecord`            | `-ErrorAction`, `-ErrorVariable`, `2>` |
+| Warning     | Genuine advisories that are not failures (e.g. issuance returned no certificate) | `-WarningAction`, `-WarningVariable` |
+| Verbose     | Request/response trace and the diagnostic trail leading up to a failure  | `-Verbose`                           |
+| Debug       | Low-level detail                                                        | `-Debug`                             |
+
+A failed call surfaces exactly one error. The `[Error]`-tagged diagnostic lines that precede it are on the verbose stream, so they appear only under `-Verbose` and never compete with the `ErrorRecord`:
+
+```powershell
+# One error, no warning noise.
+Request-InfisicalCertificate @Parameters -ErrorVariable Failure -ErrorAction SilentlyContinue
+
+# The ErrorRecord carries the API detail; no log scraping required.
+$Failure[0].Exception.StatusCode      # 400
+$Failure[0].Exception.ApiErrorCode    # BadRequest
+$Failure[0].Exception.ApiErrorMessage # Certificate template or subscriber is required for issuance
+$Failure[0].Exception.ApiRequestId    # req-SSPFN1gc2zHvkV
+```
+
+### `-ErrorAction` decides the outcome
+
+Operation failures are reported as **non-terminating** errors, so `-ErrorAction` (or `$ErrorActionPreference`) governs what happens, exactly as it does for built-in cmdlets:
+
+| `-ErrorAction`     | Behavior                                                                  |
+| ------------------ | ------------------------------------------------------------------------- |
+| `Continue` (default) | Error is written; a pipeline keeps processing its remaining input        |
+| `SilentlyContinue` | Nothing is printed; the error is still in `$Error` and `-ErrorVariable`    |
+| `Ignore`           | Nothing is printed and nothing is recorded in `$Error`                    |
+| `Stop`             | Promoted to a terminating error that `try`/`catch` catches                |
+| `Inquire`          | Prompts                                                                   |
+
+A failing item does not abort the batch:
+
+```powershell
+'web01', 'does-not-exist', 'web02' |
+    ForEach-Object { Get-InfisicalPkiSubscriber -ProjectId $ProjectId -Name $_ -ErrorAction SilentlyContinue }
+# emits web01 and web02; the failure is available in $Error
+```
+
+**To catch failures you must ask for it** with `-ErrorAction Stop` or `$ErrorActionPreference = 'Stop'`:
+
+```powershell
+try {
+    $Certificate = Request-InfisicalCertificate @Parameters -ErrorAction Stop
+} catch [PSInfisicalAPI.Errors.InfisicalApiException] {
+    Write-Warning "Issuance failed with HTTP $($_.Exception.StatusCode): $($_.Exception.ApiErrorMessage)"
+}
+```
+
+> **Breaking change.** Failures were previously terminating, so `try`/`catch` caught them without `-ErrorAction Stop`. Existing `try`/`catch` blocks need `-ErrorAction Stop` added (or `$ErrorActionPreference = 'Stop'` set) to keep catching.
+
+Exception types are `InfisicalApiException`, `InfisicalAuthenticationException`, `InfisicalHttpException`, `InfisicalSerializationException`, `InfisicalConfigurationException`, `InfisicalExportException`, and `InfisicalImportException`, all deriving from `InfisicalException`.
+
 ## Automatic environment-variable discovery
 
 When `Connect-Infisical` is invoked with one or more parameters missing (or set to whitespace/empty), the cmdlet searches environment variables and uses the first value it finds. This makes invocation as simple as `Connect-Infisical` when variables are set up in advance.

build.ps1

@@ -113,6 +113,7 @@ function Write-Manifest {
         'Copy-InfisicalSecret',
         'ConvertTo-InfisicalSecretDictionary',
         'Export-InfisicalSecrets',
+        'Import-InfisicalSecret',
         'Get-InfisicalProject',
         'New-InfisicalProject',
         'Update-InfisicalProject',
@@ -129,6 +130,14 @@ function Write-Manifest {
         'New-InfisicalTag',
         'Update-InfisicalTag',
         'Remove-InfisicalTag',
+        'Get-InfisicalOrganization',
+        'New-InfisicalOrganization',
+        'Update-InfisicalOrganization',
+        'Remove-InfisicalOrganization',
+        'Get-InfisicalSubOrganization',
+        'New-InfisicalSubOrganization',
+        'Update-InfisicalSubOrganization',
+        'Remove-InfisicalSubOrganization',
         'Get-InfisicalCertificateAuthority',
         'Get-InfisicalPkiSubscriber',
         'Get-InfisicalCertificateProfile',
@@ -144,7 +153,10 @@ function Write-Manifest {
         'New-InfisicalScepDynamicChallenge',
         'Get-InfisicalScepMdmProfile',
         'Export-InfisicalScepMdmProfile',
-        'Write-InfisicalScepMdmProfileToWmi'
+        'Write-InfisicalScepMdmProfileToWmi',
+        'Start-InfisicalProcess',
+        'Get-InfisicalEnvironmentVariable',
+        'Get-InfisicalSANList'
     )
     AliasesToExport      = @()
     VariablesToExport    = @()
@@ -209,7 +221,7 @@ if (`$cmds.Count -eq 0) {
     throw "No cmdlets were exported by the PSInfisicalAPI module."
 }
 
-`$expectedCmds = @('Connect-Infisical','Disconnect-Infisical','Get-InfisicalSecret','New-InfisicalSecret','Update-InfisicalSecret','Remove-InfisicalSecret','Copy-InfisicalSecret','ConvertTo-InfisicalSecretDictionary','Export-InfisicalSecrets','Get-InfisicalProject','New-InfisicalProject','Update-InfisicalProject','Remove-InfisicalProject','Get-InfisicalEnvironment','New-InfisicalEnvironment','Update-InfisicalEnvironment','Remove-InfisicalEnvironment','Get-InfisicalFolder','New-InfisicalFolder','Update-InfisicalFolder','Remove-InfisicalFolder','Get-InfisicalTag','New-InfisicalTag','Update-InfisicalTag','Remove-InfisicalTag','Get-InfisicalCertificateAuthority','Get-InfisicalPkiSubscriber','Get-InfisicalCertificateProfile','Get-InfisicalCertificatePolicy','Get-InfisicalCertificate','Request-InfisicalCertificate','ConvertTo-InfisicalCertificate','Install-InfisicalCertificate','Uninstall-InfisicalCertificate','Export-InfisicalCertificate','Get-InfisicalCertificateApplication','Get-InfisicalCertificateApplicationEnrollment','New-InfisicalScepDynamicChallenge','Get-InfisicalScepMdmProfile','Export-InfisicalScepMdmProfile','Write-InfisicalScepMdmProfileToWmi')
+`$expectedCmds = @('Connect-Infisical','Disconnect-Infisical','Get-InfisicalSecret','New-InfisicalSecret','Update-InfisicalSecret','Remove-InfisicalSecret','Copy-InfisicalSecret','ConvertTo-InfisicalSecretDictionary','Export-InfisicalSecrets','Import-InfisicalSecret','Get-InfisicalProject','New-InfisicalProject','Update-InfisicalProject','Remove-InfisicalProject','Get-InfisicalEnvironment','New-InfisicalEnvironment','Update-InfisicalEnvironment','Remove-InfisicalEnvironment','Get-InfisicalFolder','New-InfisicalFolder','Update-InfisicalFolder','Remove-InfisicalFolder','Get-InfisicalTag','New-InfisicalTag','Update-InfisicalTag','Remove-InfisicalTag','Get-InfisicalOrganization','New-InfisicalOrganization','Update-InfisicalOrganization','Remove-InfisicalOrganization','Get-InfisicalSubOrganization','New-InfisicalSubOrganization','Update-InfisicalSubOrganization','Remove-InfisicalSubOrganization','Get-InfisicalCertificateAuthority','Get-InfisicalPkiSubscriber','Get-InfisicalCertificateProfile','Get-InfisicalCertificatePolicy','Get-InfisicalCertificate','Request-InfisicalCertificate','ConvertTo-InfisicalCertificate','Install-InfisicalCertificate','Uninstall-InfisicalCertificate','Export-InfisicalCertificate','Get-InfisicalCertificateApplication','Get-InfisicalCertificateApplicationEnrollment','New-InfisicalScepDynamicChallenge','Get-InfisicalScepMdmProfile','Export-InfisicalScepMdmProfile','Write-InfisicalScepMdmProfileToWmi','Start-InfisicalProcess','Get-InfisicalEnvironmentVariable','Get-InfisicalSANList')
 foreach (`$expected in `$expectedCmds) {
     if (-not (Get-Command -Name `$expected -Module PSInfisicalAPI -ErrorAction SilentlyContinue)) {
         throw "Cmdlet not found: `$expected"

docs/DesignSpec_PSInfisicalAPI.md

@@ -39,6 +39,14 @@ Get-InfisicalTag
 New-InfisicalTag
 Update-InfisicalTag
 Remove-InfisicalTag
+Get-InfisicalOrganization
+New-InfisicalOrganization
+Update-InfisicalOrganization
+Remove-InfisicalOrganization
+Get-InfisicalSubOrganization
+New-InfisicalSubOrganization
+Update-InfisicalSubOrganization
+Remove-InfisicalSubOrganization
 ```
 
 Infisical’s public API is REST-based and provides programmatic access for managing secrets and related resources. Current Infisical documentation shows the list-secrets endpoint under `/api/v4/secrets`, the single-secret retrieval endpoint under `/api/v4/secrets/{secretName}`, and Universal Auth login under `/api/v1/auth/universal-auth/login`. The implementation must centralize API endpoint definitions because Infisical uses different API versions across resource families. ([Infisical Blog][1])
@@ -1213,7 +1221,9 @@ Export-InfisicalSecrets `
     [-Path <FileInfo>] `
     [-Scope <Process|User|Machine>] `
     [-Force] `
-    [-Encoding <UTF8|UTF8Bom|Unicode>]
+    [-Encoding <UTF8|UTF8Bom|Unicode>] `
+    [-SecretsPrefix <string>] `
+    [-ForceSecretsPrefix]
 ```
 
 ## Parameter Rules
@@ -1490,6 +1500,121 @@ No warnings should be emitted.
 
 ---
 
+# 16.6 Start-InfisicalProcess
+
+Signature:
+
+```text
+Start-InfisicalProcess
+    -FilePath <string>
+    [-WorkingDirectory <DirectoryInfo>]
+    [-ArgumentList <string[]>]
+    [-AcceptableExitCodeList <string[]>]
+    [-WindowStyle <Normal|Hidden|Minimized|Maximized>]
+    [-CreateNoWindow]
+    [-NoWait]
+    [-Priority <AboveNormal|BelowNormal|High|Idle|Normal|RealTime>]
+    [-ExecutionTimeout <TimeSpan>]
+    [-ExecutionTimeoutInterval <TimeSpan>]
+    [-StandardInputObjectList <object[]>]
+    [-EnvironmentVariables <IDictionary>]
+    [-ParsingExpression <Regex>]
+    [-SecureArgumentList]
+    [-LogOutput]
+    [-ContinueOnError]
+    [-Secrets <InfisicalSecret[]>]
+    [-SecretsPrefix <string>]
+    [-ForceSecretsPrefix]
+```
+
+Behavior:
+
+```text
+Buffer pipeline InfisicalSecret objects in ProcessRecord.
+Decrypt secrets only into ProcessStartInfo.Environment.
+Apply -SecretsPrefix to each secret name before injection.
+Never write secret plaintext to user or machine environment scope.
+Honor -WhatIf / -Confirm.
+Default -AcceptableExitCodeList = @('0','3010').
+Throw a terminating error on unacceptable exit code unless -ContinueOnError is set.
+```
+
+Output: `InfisicalProcessResult` with `ExitCode`, `ExitCodeAsHex`, `ExitCodeAsInteger`, `ExitCodeAsDecimal`, `StandardOutput`, `StandardError`, `StandardOutputObject`, `StandardErrorObject`, `StartTime`, `ExitTime`, `Duration`, `DurationFriendly`, `ProcessId`, `TimedOut`, `Succeeded`, `SecretCount`.
+
+---
+
+# 16.7 Organization Cmdlets
+
+Organizations are the top-level tenancy boundary in Infisical. They are not scoped under a project; the active connection's `OrganizationId` is used as the default identifier when an explicit one is not supplied.
+
+Cmdlet signatures:
+
+```powershell
+Get-InfisicalOrganization [[-OrganizationId] <string>]                          # default = List
+New-InfisicalOrganization [-Name] <string> [-Slug <string>] [-WhatIf] [-Confirm]
+Update-InfisicalOrganization [-OrganizationId] <string> [-Name <string>] [-Slug <string>] [-WhatIf] [-Confirm]
+Remove-InfisicalOrganization [-OrganizationId] <string> [-PassThru] [-WhatIf] [-Confirm]
+```
+
+Parameter sets:
+
+| Cmdlet | Default set | Single set | Notes |
+|---|---|---|---|
+| `Get-InfisicalOrganization` | `List` (no `-Id`) | `Single` (`-OrganizationId`/`-Id`) | No `-ProjectId`. |
+| `New-InfisicalOrganization` | n/a | `-Name` mandatory, `-Slug` optional | ShouldProcess. |
+| `Update-InfisicalOrganization` | n/a | `-OrganizationId` mandatory | ShouldProcess; only bound parameters are sent. |
+| `Remove-InfisicalOrganization` | n/a | `-OrganizationId` mandatory | `ConfirmImpact.High`; `-PassThru` emits removed id. |
+
+Endpoints:
+
+| Operation | Method | Template | Version |
+|---|---|---|---|
+| List | `GET` | `/api/v2/organizations` | v2 |
+| Retrieve | `GET` | `/api/v1/organization/{organizationId}` | v1 |
+| Create | `POST` | `/api/v2/organizations` | v2 |
+| Update | `PATCH` | `/api/v1/organization/{organizationId}` | v1 |
+| Delete | `DELETE` | `/api/v1/organization/{organizationId}` | v1 |
+
+Output: `InfisicalOrganization` with `Id`, `Name`, `Slug`, `CustomerId`, `AuthEnforced`, `ScimEnabled`, `CreatedAtUtc`, `UpdatedAtUtc`.
+
+---
+
+# 16.8 Sub-Organization Cmdlets
+
+Sub-organizations partition an organization into isolated child tenants. They are not scoped under a project; the active connection is used for the parent organization context.
+
+Cmdlet signatures:
+
+```powershell
+Get-InfisicalSubOrganization [[-SubOrganizationId] <string>] [-Limit <int>] [-Offset <int>] [-Search <string>] [-OrderBy <string>] [-OrderDirection <string>] [-IsAccessible]
+New-InfisicalSubOrganization [-Name] <string> [-Slug] <string> [-WhatIf] [-Confirm]
+Update-InfisicalSubOrganization [-SubOrganizationId] <string> [-Name <string>] [-Slug <string>] [-WhatIf] [-Confirm]
+Remove-InfisicalSubOrganization [-SubOrganizationId] <string> [-PassThru] [-WhatIf] [-Confirm]
+```
+
+Parameter sets:
+
+| Cmdlet | Default set | Single set | Notes |
+|---|---|---|---|
+| `Get-InfisicalSubOrganization` | `List` (no `-Id`) | `Single` (`-SubOrganizationId`/`-Id`) | List supports server-side `-Limit`, `-Offset`, `-Search`, `-OrderBy`, `-OrderDirection`, `-IsAccessible`. |
+| `New-InfisicalSubOrganization` | n/a | `-Name` + `-Slug` mandatory | ShouldProcess. |
+| `Update-InfisicalSubOrganization` | n/a | `-SubOrganizationId` mandatory | ShouldProcess; only bound parameters are sent. |
+| `Remove-InfisicalSubOrganization` | n/a | `-SubOrganizationId` mandatory | `ConfirmImpact.High`; `-PassThru` emits removed id. |
+
+Endpoints (beta):
+
+| Operation | Method | Template | Version |
+|---|---|---|---|
+| List | `GET` | `/api/v1/sub-organizations` | v1 |
+| Retrieve | `GET` | `/api/v1/sub-organizations/{subOrgId}` | v1 |
+| Create | `POST` | `/api/v1/sub-organizations` | v1 |
+| Update | `PATCH` | `/api/v1/sub-organizations/{subOrgId}` | v1 |
+| Delete | `DELETE` | `/api/v1/sub-organizations/{subOrgId}` | v1 |
+
+Output: `InfisicalSubOrganization` with `Id`, `Name`, `Slug`, `OrganizationId`, `IsAccessible`, `CreatedAtUtc`, `UpdatedAtUtc`.
+
+---
+
 # 17. SecureString Utility
 
 Required utility:

src/PSInfisicalAPI.Tests/CertificateMetadataTests.cs

@@ -0,0 +1,244 @@
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Collections.Specialized;
+using System.Reflection;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace PSInfisicalAPI.Tests
+{
+    /// <summary>
+    /// PATCH /certificates/{id} replaces a certificate's metadata wholesale, so "reconcile only the supplied
+    /// keys" has to be produced client-side by merging over the current set. These pin that merge.
+    /// </summary>
+    public class CertificateMetadataTests
+    {
+        private static readonly Assembly ModuleAssembly = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly;
+
+        private static Dictionary<string, string> NormalizeMetadata(IDictionary source)
+        {
+            Type cmdletType = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet", true);
+            MethodInfo method = cmdletType.GetMethod("NormalizeMetadata", BindingFlags.NonPublic | BindingFlags.Static);
+            Assert.NotNull(method);
+            return (Dictionary<string, string>)method.Invoke(null, new object[] { source });
+        }
+
+        [Fact]
+        public void Metadata_Parameter_Accepts_Any_IDictionary_On_Every_Parameter_Set()
+        {
+            Type cmdletType = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet", true);
+            PropertyInfo metadata = cmdletType.GetProperty("Metadata");
+            Assert.NotNull(metadata);
+            Assert.Equal(typeof(IDictionary), metadata.PropertyType);
+
+            foreach (CustomAttributeData attribute in metadata.GetCustomAttributesData())
+            {
+                if (attribute.AttributeType != typeof(System.Management.Automation.ParameterAttribute)) { continue; }
+                foreach (CustomAttributeNamedArgument named in attribute.NamedArguments)
+                {
+                    Assert.NotEqual("ParameterSetName", named.MemberName);
+                }
+            }
+        }
+
+        [Fact]
+        public void Hashtable_And_OrderedDictionary_Both_Normalize()
+        {
+            Hashtable hashtable = new Hashtable { { "Environment", "Production" }, { "Owner", "Platform" } };
+            Dictionary<string, string> fromHashtable = NormalizeMetadata(hashtable);
+            Assert.Equal(2, fromHashtable.Count);
+            Assert.Equal("Production", fromHashtable["Environment"]);
+
+            OrderedDictionary ordered = new OrderedDictionary();
+            ordered.Add("Environment", "Production");
+            ordered.Add("Owner", "Platform");
+            Dictionary<string, string> fromOrdered = NormalizeMetadata(ordered);
+            Assert.Equal(2, fromOrdered.Count);
+            Assert.Equal("Platform", fromOrdered["Owner"]);
+        }
+
+        [Fact]
+        public void Non_String_Values_Are_Flattened_For_An_Api_That_Takes_Only_Strings()
+        {
+            Hashtable source = new Hashtable
+            {
+                { "Port", 443 },
+                { "Enabled", true },
+                { "Ratio", 1.5d },
+                { "Issued", new DateTime(2026, 7, 30, 0, 0, 0, DateTimeKind.Utc) }
+            };
+
+            Dictionary<string, string> result = NormalizeMetadata(source);
+
+            Assert.Equal("443", result["Port"]);
+            Assert.Equal("True", result["Enabled"]);
+            Assert.Equal("1.5", result["Ratio"]);
+            Assert.False(string.IsNullOrEmpty(result["Issued"]));
+        }
+
+        [Fact]
+        public void Null_Values_Become_Empty_Strings_And_Blank_Keys_Are_Dropped()
+        {
+            // The API models a valueless key as an empty string, and rejects an empty key outright.
+            Hashtable source = new Hashtable
+            {
+                { "Present", null },
+                { "   ", "orphan" },
+                { "  Padded  ", "trimmed" }
+            };
+
+            Dictionary<string, string> result = NormalizeMetadata(source);
+
+            Assert.Equal(string.Empty, result["Present"]);
+            Assert.False(result.ContainsKey("   "));
+            Assert.True(result.ContainsKey("Padded"));
+            Assert.Equal("trimmed", result["Padded"]);
+        }
+
+        [Fact]
+        public void Keys_Are_Case_Insensitive()
+        {
+            Hashtable source = new Hashtable { { "Environment", "Production" } };
+            Dictionary<string, string> result = NormalizeMetadata(source);
+            Assert.Equal("Production", result["ENVIRONMENT"]);
+            Assert.Equal("Production", result["environment"]);
+        }
+
+        [Fact]
+        public void A_Null_Or_Empty_Dictionary_Normalizes_To_Nothing()
+        {
+            Assert.Empty(NormalizeMetadata(null));
+            Assert.Empty(NormalizeMetadata(new Hashtable()));
+        }
+
+        [Fact]
+        public void Update_Request_Serializes_As_The_Key_Value_Array_The_Api_Expects()
+        {
+            Type requestType = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalUpdateCertificateMetadataRequestDto", true);
+            Type entryType = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateMetadataEntryDto", true);
+
+            object entry = Activator.CreateInstance(entryType);
+            entryType.GetProperty("Key").SetValue(entry, "Environment");
+            entryType.GetProperty("Value").SetValue(entry, "Production");
+
+            Type listType = typeof(List<>).MakeGenericType(entryType);
+            object list = Activator.CreateInstance(listType);
+            listType.GetMethod("Add").Invoke(list, new object[] { entry });
+
+            object request = Activator.CreateInstance(requestType);
+            requestType.GetProperty("Metadata").SetValue(request, list);
+
+            string json = JsonConvert.SerializeObject(request);
+            Assert.Equal("{\"metadata\":[{\"key\":\"Environment\",\"value\":\"Production\"}]}", json);
+        }
+
+        [Fact]
+        public void Response_Metadata_Maps_To_A_Case_Insensitive_Dictionary()
+        {
+            Type mapper = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateMapper", true);
+            MethodInfo map = mapper.GetMethod("MapMetadata", BindingFlags.Public | BindingFlags.Static);
+            Assert.NotNull(map);
+
+            Type entryType = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateSearchMetadataEntryDto", true);
+            Array entries = Array.CreateInstance(entryType, 2);
+
+            object first = Activator.CreateInstance(entryType);
+            entryType.GetProperty("Key").SetValue(first, "Environment");
+            entryType.GetProperty("Value").SetValue(first, "Production");
+            entries.SetValue(first, 0);
+
+            object second = Activator.CreateInstance(entryType);
+            entryType.GetProperty("Key").SetValue(second, "Owner");
+            entryType.GetProperty("Value").SetValue(second, null);
+            entries.SetValue(second, 1);
+
+            Dictionary<string, string> result = (Dictionary<string, string>)map.Invoke(null, new object[] { entries });
+
+            Assert.Equal(2, result.Count);
+            Assert.Equal("Production", result["ENVIRONMENT"]);
+            Assert.Equal(string.Empty, result["Owner"]);
+        }
+
+        [Fact]
+        public void Absent_Response_Metadata_Maps_To_An_Empty_Dictionary_Not_Null()
+        {
+            Type mapper = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateMapper", true);
+            MethodInfo map = mapper.GetMethod("MapMetadata", BindingFlags.Public | BindingFlags.Static);
+
+            Dictionary<string, string> result = (Dictionary<string, string>)map.Invoke(null, new object[] { null });
+            Assert.NotNull(result);
+            Assert.Empty(result);
+        }
+
+        [Theory]
+        // current                              supplied                       expected merged
+        [InlineData("a=1;b=2", "c=3", "a=1;b=2;c=3")]   // untouched keys survive a partial update
+        [InlineData("a=1;b=2", "b=9", "a=1;b=9")]       // supplied key wins
+        [InlineData("", "a=1", "a=1")]                  // first write onto a bare certificate
+        [InlineData("a=1", "A=2", "a=2")]               // case-insensitive key collision updates in place
+        [InlineData("a=1;b=2", "", "a=1;b=2")]          // nothing supplied changes nothing
+        public void Merge_Reconciles_Only_The_Supplied_Keys(string current, string supplied, string expected)
+        {
+            // Mirrors ReconcileCertificateMetadata's merge, which cannot be exercised directly without an
+            // HTTP round trip. The rule under test: start from current, overlay supplied, never remove.
+            Dictionary<string, string> merged = new Dictionary<string, string>(Parse(current), StringComparer.OrdinalIgnoreCase);
+            foreach (KeyValuePair<string, string> pair in Parse(supplied))
+            {
+                merged[pair.Key] = pair.Value;
+            }
+
+            Assert.Equal(Format(Parse(expected)), Format(merged));
+        }
+
+        private static Dictionary<string, string> Parse(string value)
+        {
+            Dictionary<string, string> result = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            if (string.IsNullOrEmpty(value)) { return result; }
+
+            foreach (string pair in value.Split(';'))
+            {
+                if (string.IsNullOrEmpty(pair)) { continue; }
+                string[] parts = pair.Split('=');
+                result[parts[0]] = parts.Length > 1 ? parts[1] : string.Empty;
+            }
+
+            return result;
+        }
+
+        private static string Format(Dictionary<string, string> value)
+        {
+            List<string> pairs = new List<string>();
+            foreach (KeyValuePair<string, string> entry in value)
+            {
+                pairs.Add(string.Concat(entry.Key.ToLowerInvariant(), "=", entry.Value));
+            }
+
+            pairs.Sort(StringComparer.Ordinal);
+            return string.Join(";", pairs.ToArray());
+        }
+
+        [Fact]
+        public void Result_Object_Carries_The_Reconciled_Metadata()
+        {
+            PSInfisicalAPI.Models.InfisicalCertificateResult result = new PSInfisicalAPI.Models.InfisicalCertificateResult();
+            Assert.Null(result.Metadata);
+
+            result.Metadata = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase) { { "Environment", "Production" } };
+            Assert.Equal("Production", result.Metadata["environment"]);
+        }
+
+        [Fact]
+        public void Metadata_Update_Endpoint_Is_Registered_For_Both_Route_Namespaces()
+        {
+            IReadOnlyList<PSInfisicalAPI.Endpoints.InfisicalEndpointDefinition> candidates =
+                PSInfisicalAPI.Endpoints.InfisicalEndpointRegistry.GetCandidates(
+                    PSInfisicalAPI.Endpoints.InfisicalEndpointNames.UpdateCertificateMetadata);
+
+            Assert.Contains(candidates, c => c.Template == "/api/v1/cert-manager/certificates/{certificateId}");
+            Assert.Contains(candidates, c => c.Template == "/api/v1/pki/certificates/{certificateId}");
+            Assert.All(candidates, c => Assert.Equal("PATCH", c.Method));
+            Assert.All(candidates, c => Assert.True(c.RequiresAuthorization));
+        }
+    }
+}

src/PSInfisicalAPI.Tests/CertificateReuseScopingTests.cs

@@ -0,0 +1,116 @@
+using System;
+using System.Reflection;
+using PSInfisicalAPI.Pki;
+using Xunit;
+
+namespace PSInfisicalAPI.Tests
+{
+    /// <summary>
+    /// Reuse must be scoped to the issuer being requested. Two profiles over the same CA issue certificates with
+    /// the same common name but different key usages (server authentication vs client authentication), so a
+    /// name-only match hands back a certificate that does not satisfy the request that was made.
+    /// </summary>
+    public class CertificateReuseScopingTests
+    {
+        private static readonly Assembly ModuleAssembly = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly;
+
+        private static string InvokeApplyIssuerScope(PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet, InfisicalCertificateSearchQuery query)
+        {
+            MethodInfo method = cmdlet.GetType().GetMethod("ApplyIssuerScope", BindingFlags.NonPublic | BindingFlags.Instance);
+            Assert.NotNull(method);
+            return (string)method.Invoke(cmdlet, new object[] { query });
+        }
+
+        [Fact]
+        public void Profile_Issuance_Scopes_The_Reuse_Search_To_That_Profile()
+        {
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                ProjectId = "proj-1",
+                CertificateProfileId = "profile-clientauth"
+            };
+
+            InfisicalCertificateSearchQuery query = new InfisicalCertificateSearchQuery();
+            string scope = InvokeApplyIssuerScope(cmdlet, query);
+
+            Assert.Equal(new[] { "profile-clientauth" }, query.ProfileIds);
+            Assert.Null(query.CaIds);
+            Assert.Contains("profile-clientauth", scope);
+        }
+
+        [Fact]
+        public void Ca_Issuance_Scopes_The_Reuse_Search_To_That_Ca()
+        {
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                ProjectId = "proj-1",
+                CertificateAuthorityId = "ca-1"
+            };
+
+            InfisicalCertificateSearchQuery query = new InfisicalCertificateSearchQuery();
+            string scope = InvokeApplyIssuerScope(cmdlet, query);
+
+            Assert.Equal(new[] { "ca-1" }, query.CaIds);
+            Assert.Null(query.ProfileIds);
+            Assert.Contains("ca-1", scope);
+        }
+
+        [Fact]
+        public void Subscriber_Issuance_Needs_No_Server_Side_Scope()
+        {
+            // A subscriber pins its own common name, so a name match is already a subscriber match.
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                ProjectId = "proj-1",
+                PkiSubscriberSlug = "web-tier"
+            };
+
+            InfisicalCertificateSearchQuery query = new InfisicalCertificateSearchQuery();
+            string scope = InvokeApplyIssuerScope(cmdlet, query);
+
+            Assert.Null(query.ProfileIds);
+            Assert.Null(query.CaIds);
+            Assert.Contains("web-tier", scope);
+        }
+
+        [Fact]
+        public void Two_Profiles_Produce_Distinct_Reuse_Scopes()
+        {
+            InfisicalCertificateSearchQuery serverQuery = new InfisicalCertificateSearchQuery();
+            InvokeApplyIssuerScope(new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet { CertificateProfileId = "profile-serverauth" }, serverQuery);
+
+            InfisicalCertificateSearchQuery clientQuery = new InfisicalCertificateSearchQuery();
+            InvokeApplyIssuerScope(new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet { CertificateProfileId = "profile-clientauth" }, clientQuery);
+
+            Assert.NotEqual(serverQuery.ProfileIds[0], clientQuery.ProfileIds[0]);
+        }
+
+        [Fact]
+        public void Issuer_Scope_Survives_Serialization_Into_The_Search_Request()
+        {
+            // The scope is only effective if it actually reaches the wire.
+            Type clientType = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalPkiClient", true);
+            MethodInfo build = clientType.GetMethod("BuildSearchRequest", BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Public);
+            Assert.NotNull(build);
+
+            InfisicalCertificateSearchQuery query = new InfisicalCertificateSearchQuery
+            {
+                ProjectId = "proj-1",
+                CommonName = "WEB01",
+                Status = "active",
+                ProfileIds = new[] { "profile-clientauth" }
+            };
+
+            object dto = build.Invoke(null, new object[] { query });
+            Assert.NotNull(dto);
+
+            PropertyInfo profileIds = dto.GetType().GetProperty("ProfileIds");
+            Assert.NotNull(profileIds);
+            Assert.Equal(new[] { "profile-clientauth" }, (string[])profileIds.GetValue(dto));
+
+            string json = Newtonsoft.Json.JsonConvert.SerializeObject(dto);
+            Assert.Contains("profileIds", json);
+            Assert.Contains("profile-clientauth", json);
+        }
+    }
+}

src/PSInfisicalAPI.Tests/CertificateSanCoverageTests.cs

@@ -0,0 +1,220 @@
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using PSInfisicalAPI.Pki;
+using Xunit;
+
+namespace PSInfisicalAPI.Tests
+{
+    /// <summary>
+    /// Reuse must not return a certificate that predates a newly requested SAN. These build real certificates
+    /// through the module's own CSR path so the SAN reader is exercised against genuine DER, not a hand-rolled
+    /// approximation of it.
+    /// </summary>
+    public class CertificateSanCoverageTests
+    {
+        private static readonly Assembly ModuleAssembly = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly;
+
+        /// <summary>
+        /// Produces a self-signed certificate carrying exactly the requested SANs, by round-tripping the module's
+        /// CSR builder output into a signed certificate.
+        /// </summary>
+        private static X509Certificate2 CreateCertificateWithSans(string commonName, string[] dnsNames, string[] ipAddresses)
+        {
+            InfisicalCsrSubject subject = new InfisicalCsrSubject { CommonName = commonName };
+            InfisicalCsrResult csr = InfisicalCsrBuilder.Build(subject, dnsNames, ipAddresses, new InfisicalCsrOptions());
+
+            Org.BouncyCastle.Pkcs.Pkcs10CertificationRequest request;
+            using (System.IO.StringReader reader = new System.IO.StringReader(csr.CsrPem))
+            {
+                Org.BouncyCastle.OpenSsl.PemReader pemReader = new Org.BouncyCastle.OpenSsl.PemReader(reader);
+                request = (Org.BouncyCastle.Pkcs.Pkcs10CertificationRequest)pemReader.ReadObject();
+            }
+
+            Org.BouncyCastle.Asn1.Pkcs.CertificationRequestInfo info = request.GetCertificationRequestInfo();
+            Org.BouncyCastle.Asn1.X509.X509Extensions extensions = null;
+            foreach (Org.BouncyCastle.Asn1.Asn1Encodable attributeEncodable in info.Attributes)
+            {
+                Org.BouncyCastle.Asn1.Cms.Attribute attribute = Org.BouncyCastle.Asn1.Cms.Attribute.GetInstance(attributeEncodable);
+                if (attribute.AttrType.Equals(Org.BouncyCastle.Asn1.Pkcs.PkcsObjectIdentifiers.Pkcs9AtExtensionRequest))
+                {
+                    extensions = Org.BouncyCastle.Asn1.X509.X509Extensions.GetInstance(attribute.AttrValues[0]);
+                }
+            }
+
+            Assert.NotNull(extensions);
+            Org.BouncyCastle.Asn1.X509.X509Extension sanExtension =
+                extensions.GetExtension(Org.BouncyCastle.Asn1.X509.X509Extensions.SubjectAlternativeName);
+            Assert.NotNull(sanExtension);
+
+            using (RSA rsa = RSA.Create(2048))
+            {
+                CertificateRequest netRequest = new CertificateRequest(
+                    string.Concat("CN=", commonName), rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+
+                netRequest.CertificateExtensions.Add(new X509Extension(
+                    new Oid("2.5.29.17"),
+                    sanExtension.Value.GetOctets(),
+                    false));
+
+                return netRequest.CreateSelfSigned(DateTimeOffset.UtcNow.AddMinutes(-5), DateTimeOffset.UtcNow.AddDays(30));
+            }
+        }
+
+        private static bool CoversRequestedNames(X509Certificate2 cert, string[] dns, string[] ips, out string missing)
+        {
+            Type reader = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateSanReader", true);
+            MethodInfo method = reader.GetMethod("CoversRequestedNames", BindingFlags.Public | BindingFlags.Static);
+            Assert.NotNull(method);
+
+            object[] args = new object[] { cert, dns, ips, null };
+            bool result = (bool)method.Invoke(null, args);
+            missing = (string)args[3];
+            return result;
+        }
+
+        private static (HashSet<string> Dns, HashSet<string> Ips) ReadSans(X509Certificate2 cert)
+        {
+            Type reader = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateSanReader", true);
+            MethodInfo read = reader.GetMethod("Read", BindingFlags.Public | BindingFlags.Static);
+            object sans = read.Invoke(null, new object[] { cert });
+
+            HashSet<string> dns = (HashSet<string>)sans.GetType().GetProperty("DnsNames").GetValue(sans);
+            HashSet<string> ips = (HashSet<string>)sans.GetType().GetProperty("IpAddresses").GetValue(sans);
+            return (dns, ips);
+        }
+
+        [Fact]
+        public void Reader_Recovers_Both_Dns_And_Ip_Sans()
+        {
+            using (X509Certificate2 cert = CreateCertificateWithSans(
+                "WEB01",
+                new[] { "WEB01", "WEB01.contoso.com" },
+                new[] { "10.20.30.40", "127.0.0.1", "::1" }))
+            {
+                (HashSet<string> dns, HashSet<string> ips) = ReadSans(cert);
+
+                Assert.Equal(2, dns.Count);
+                Assert.Contains("WEB01", dns);
+                Assert.Contains("WEB01.contoso.com", dns);
+
+                Assert.Equal(3, ips.Count);
+                Assert.Contains("10.20.30.40", ips);
+                Assert.Contains("127.0.0.1", ips);
+                Assert.Contains("::1", ips);
+            }
+        }
+
+        [Fact]
+        public void A_Certificate_Covering_Every_Requested_Name_Is_Reusable()
+        {
+            using (X509Certificate2 cert = CreateCertificateWithSans(
+                "WEB01", new[] { "WEB01", "WEB01.contoso.com" }, new[] { "10.20.30.40" }))
+            {
+                string missing;
+                Assert.True(CoversRequestedNames(cert, new[] { "WEB01", "WEB01.contoso.com" }, new[] { "10.20.30.40" }, out missing));
+                Assert.Null(missing);
+            }
+        }
+
+        [Fact]
+        public void A_Newly_Requested_Dns_Name_Disqualifies_The_Existing_Certificate()
+        {
+            // The reported gap: adding a name to -DnsName previously returned the old certificate.
+            using (X509Certificate2 cert = CreateCertificateWithSans(
+                "WEB01", new[] { "WEB01", "WEB01.contoso.com" }, null))
+            {
+                string missing;
+                bool covers = CoversRequestedNames(
+                    cert,
+                    new[] { "WEB01", "WEB01.contoso.com", "api.contoso.com" },
+                    null,
+                    out missing);
+
+                Assert.False(covers);
+                Assert.Equal("DNS:api.contoso.com", missing);
+            }
+        }
+
+        [Fact]
+        public void A_Newly_Requested_Ip_Disqualifies_The_Existing_Certificate()
+        {
+            using (X509Certificate2 cert = CreateCertificateWithSans("WEB01", new[] { "WEB01" }, new[] { "10.20.30.40" }))
+            {
+                string missing;
+                Assert.False(CoversRequestedNames(cert, new[] { "WEB01" }, new[] { "10.20.30.41" }, out missing));
+                Assert.Equal("IP:10.20.30.41", missing);
+            }
+        }
+
+        [Fact]
+        public void Extra_Names_On_The_Certificate_Do_Not_Disqualify_It()
+        {
+            // A superset still satisfies the request; only a missing name forces reissuance.
+            using (X509Certificate2 cert = CreateCertificateWithSans(
+                "WEB01", new[] { "WEB01", "WEB01.contoso.com", "legacy.contoso.com" }, new[] { "10.20.30.40", "127.0.0.1" }))
+            {
+                string missing;
+                Assert.True(CoversRequestedNames(cert, new[] { "WEB01" }, new[] { "127.0.0.1" }, out missing));
+                Assert.Null(missing);
+            }
+        }
+
+        [Fact]
+        public void Dns_Comparison_Is_Case_Insensitive()
+        {
+            using (X509Certificate2 cert = CreateCertificateWithSans("WEB01", new[] { "WEB01.Contoso.COM" }, null))
+            {
+                string missing;
+                Assert.True(CoversRequestedNames(cert, new[] { "web01.contoso.com" }, null, out missing));
+            }
+        }
+
+        [Theory]
+        [InlineData("::1", "0:0:0:0:0:0:0:1")]
+        [InlineData("0:0:0:0:0:0:0:1", "::1")]
+        [InlineData("10.20.30.40", "10.20.30.40")]
+        public void Ip_Comparison_Normalizes_Textual_Variations(string inCertificate, string requested)
+        {
+            using (X509Certificate2 cert = CreateCertificateWithSans("WEB01", new[] { "WEB01" }, new[] { inCertificate }))
+            {
+                string missing;
+                Assert.True(CoversRequestedNames(cert, null, new[] { requested }, out missing), string.Concat("missing: ", missing));
+            }
+        }
+
+        [Fact]
+        public void A_Certificate_Without_Any_San_Extension_Fails_A_San_Request()
+        {
+            using (RSA rsa = RSA.Create(2048))
+            {
+                CertificateRequest request = new CertificateRequest(
+                    "CN=NoSans", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+                using (X509Certificate2 cert = request.CreateSelfSigned(DateTimeOffset.UtcNow.AddMinutes(-5), DateTimeOffset.UtcNow.AddDays(1)))
+                {
+                    string missing;
+                    Assert.False(CoversRequestedNames(cert, new[] { "NoSans" }, null, out missing));
+                    Assert.Equal("DNS:NoSans", missing);
+
+                    // With nothing requested there is nothing to fail on.
+                    Assert.True(CoversRequestedNames(cert, null, null, out missing));
+                }
+            }
+        }
+
+        [Fact]
+        public void FindMatch_Keeps_Its_Original_Signature_For_Callers_Without_San_Requirements()
+        {
+            Type lookup = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalLocalCertificateLookup", true);
+            MethodInfo original = lookup.GetMethod(
+                "FindMatch",
+                BindingFlags.Public | BindingFlags.Static,
+                null,
+                new[] { typeof(StoreName), typeof(StoreLocation), typeof(string), typeof(IEnumerable<string>) },
+                null);
+            Assert.NotNull(original);
+        }
+    }
+}

src/PSInfisicalAPI.Tests/CertificateStoreTargetingTests.cs

@@ -0,0 +1,221 @@
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Security.Cryptography.X509Certificates;
+using PSInfisicalAPI.Logging;
+using Xunit;
+
+namespace PSInfisicalAPI.Tests
+{
+    public class CertificateStoreTargetingTests
+    {
+        private static readonly Assembly ModuleAssembly = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly;
+
+        private sealed class CapturingLogger : IInfisicalLogger
+        {
+            public List<string> Warnings { get; } = new List<string>();
+            public List<string> Information_ { get; } = new List<string>();
+
+            public void Information(string component, string message) { Information_.Add(message); }
+            public void Verbose(string component, string message) { }
+            public void Debug(string component, string message) { }
+            public void Warning(string component, string message) { Warnings.Add(message); }
+            public void Error(string component, string message) { }
+        }
+
+        private static X509Certificate2 CreateRoot(string name, out System.Security.Cryptography.RSA key)
+        {
+            key = System.Security.Cryptography.RSA.Create(2048);
+            CertificateRequest request = new CertificateRequest(
+                string.Concat("CN=", name), key,
+                System.Security.Cryptography.HashAlgorithmName.SHA256,
+                System.Security.Cryptography.RSASignaturePadding.Pkcs1);
+            request.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, true, 1, true));
+            return request.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(10));
+        }
+
+        [Fact]
+        public void ApplyFriendlyName_Sets_The_Windows_Friendly_Name()
+        {
+            Type helper = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateRequestHelpers", true);
+            MethodInfo apply = helper.GetMethod("ApplyFriendlyName", BindingFlags.Public | BindingFlags.Static);
+            Assert.NotNull(apply);
+
+            System.Security.Cryptography.RSA key;
+            using (X509Certificate2 cert = CreateRoot("FriendlyName.Probe", out key))
+            using (key)
+            {
+                apply.Invoke(null, new object[] { cert, "WEB01", NullInfisicalLogger.Instance, "Test" });
+                Assert.Equal("WEB01", cert.FriendlyName);
+
+                // A null or empty name must not clear a previously set value.
+                apply.Invoke(null, new object[] { cert, null, NullInfisicalLogger.Instance, "Test" });
+                apply.Invoke(null, new object[] { cert, string.Empty, NullInfisicalLogger.Instance, "Test" });
+                Assert.Equal("WEB01", cert.FriendlyName);
+            }
+        }
+
+        [Fact]
+        public void ApplyFriendlyName_Tolerates_Null_Certificate_And_Logger()
+        {
+            Type helper = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateRequestHelpers", true);
+            MethodInfo apply = helper.GetMethod("ApplyFriendlyName", BindingFlags.Public | BindingFlags.Static);
+            apply.Invoke(null, new object[] { null, "WEB01", null, "Test" });
+        }
+
+        [Fact]
+        public void VerifyInstalledChain_Names_The_Missing_Issuer_On_A_Partial_Chain()
+        {
+            // An intermediate whose root is not in any trusted store is exactly the state that surfaces in
+            // Windows as "The issuer of this certificate could not be found".
+            Type helper = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateRequestHelpers", true);
+            MethodInfo verify = helper.GetMethod("VerifyInstalledChain", BindingFlags.Public | BindingFlags.Static);
+            Assert.NotNull(verify);
+
+            System.Security.Cryptography.RSA rootKey;
+            using (X509Certificate2 root = CreateRoot("VerifyChain.Root", out rootKey))
+            using (rootKey)
+            using (System.Security.Cryptography.RSA interKey = System.Security.Cryptography.RSA.Create(2048))
+            {
+                CertificateRequest interRequest = new CertificateRequest(
+                    "CN=VerifyChain.Intermediate", interKey,
+                    System.Security.Cryptography.HashAlgorithmName.SHA256,
+                    System.Security.Cryptography.RSASignaturePadding.Pkcs1);
+                interRequest.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, false, 0, true));
+
+                using (X509Certificate2 intermediate = interRequest.Create(root, DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(9), new byte[] { 9, 8, 7, 6, 5, 4, 3, 2 }))
+                {
+                    CapturingLogger logger = new CapturingLogger();
+                    verify.Invoke(null, new object[] { intermediate, logger, "Test" });
+
+                    string warning = Assert.Single(logger.Warnings);
+                    Assert.Contains("issuer", warning, StringComparison.OrdinalIgnoreCase);
+                    Assert.Contains("VerifyChain.Root", warning);
+                }
+            }
+        }
+
+        [Fact]
+        public void VerifyInstalledChain_Tolerates_Null_Inputs()
+        {
+            Type helper = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateRequestHelpers", true);
+            MethodInfo verify = helper.GetMethod("VerifyInstalledChain", BindingFlags.Public | BindingFlags.Static);
+            verify.Invoke(null, new object[] { null, new CapturingLogger(), "Test" });
+
+            System.Security.Cryptography.RSA key;
+            using (X509Certificate2 cert = CreateRoot("VerifyChain.NullLogger", out key))
+            using (key)
+            {
+                verify.Invoke(null, new object[] { cert, null, "Test" });
+            }
+        }
+
+        [Fact]
+        public void FriendlyName_Is_Available_On_Every_Issuance_Parameter_Set()
+        {
+            // The Windows friendly name applies regardless of how the certificate was issued.
+            Type cmdletType = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet", true);
+            PropertyInfo friendlyName = cmdletType.GetProperty("FriendlyName");
+            Assert.NotNull(friendlyName);
+
+            foreach (CustomAttributeData attribute in friendlyName.GetCustomAttributesData())
+            {
+                if (attribute.AttributeType != typeof(System.Management.Automation.ParameterAttribute)) { continue; }
+                foreach (CustomAttributeNamedArgument named in attribute.NamedArguments)
+                {
+                    Assert.NotEqual("ParameterSetName", named.MemberName);
+                }
+            }
+        }
+
+        private static void InvokeTrustPromptWarning(StoreName storeName, StoreLocation storeLocation, IInfisicalLogger logger)
+        {
+            Type helper = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateRequestHelpers", true);
+            MethodInfo method = helper.GetMethod("WarnIfInteractiveTrustPromptExpected", BindingFlags.Public | BindingFlags.Static);
+            Assert.NotNull(method);
+            method.Invoke(null, new object[] { storeName, storeLocation, logger, "TestComponent" });
+        }
+
+        [Fact]
+        public void CurrentUser_Root_Install_Warns_About_The_Blocking_Trust_Dialog()
+        {
+            // X509Store.Add on CurrentUser\Root raises a modal Windows trust dialog and blocks until answered.
+            // Without this warning the caller sees an unexplained hang.
+            CapturingLogger logger = new CapturingLogger();
+            InvokeTrustPromptWarning(StoreName.Root, StoreLocation.CurrentUser, logger);
+
+            string warning = Assert.Single(logger.Warnings);
+            Assert.Contains("CurrentUser\\Root", warning);
+            Assert.Contains("security confirmation", warning);
+            Assert.Contains("LocalMachine", warning);
+        }
+
+        [Theory]
+        [InlineData(StoreName.Root, StoreLocation.LocalMachine)]
+        [InlineData(StoreName.My, StoreLocation.CurrentUser)]
+        [InlineData(StoreName.My, StoreLocation.LocalMachine)]
+        [InlineData(StoreName.CertificateAuthority, StoreLocation.CurrentUser)]
+        [InlineData(StoreName.CertificateAuthority, StoreLocation.LocalMachine)]
+        public void Non_Prompting_Store_Targets_Stay_Silent(StoreName storeName, StoreLocation storeLocation)
+        {
+            CapturingLogger logger = new CapturingLogger();
+            InvokeTrustPromptWarning(storeName, storeLocation, logger);
+            Assert.Empty(logger.Warnings);
+        }
+
+        [Fact]
+        public void WarnIfInteractiveTrustPromptExpected_Tolerates_A_Null_Logger()
+        {
+            InvokeTrustPromptWarning(StoreName.Root, StoreLocation.CurrentUser, null);
+        }
+
+        [Fact]
+        public void Base_Cmdlet_Exposes_Elevation_Aware_Store_Resolution()
+        {
+            Type baseType = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase);
+
+            MethodInfo resolve = baseType.GetMethod("ResolveStoreLocation", BindingFlags.NonPublic | BindingFlags.Instance);
+            Assert.NotNull(resolve);
+            Assert.Equal(typeof(StoreLocation), resolve.ReturnType);
+
+            MethodInfo elevated = baseType.GetMethod("IsElevated", BindingFlags.NonPublic | BindingFlags.Instance);
+            Assert.NotNull(elevated);
+            Assert.Equal(typeof(bool), elevated.ReturnType);
+        }
+
+        [Fact]
+        public void Chain_Certificates_Route_Root_And_Intermediate_To_Their_Own_Stores()
+        {
+            Type helper = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateRequestHelpers", true);
+            MethodInfo classify = helper.GetMethod("GetChainCertificateTargetStore", BindingFlags.Public | BindingFlags.Static);
+
+            using (System.Security.Cryptography.RSA rootRsa = System.Security.Cryptography.RSA.Create(2048))
+            using (System.Security.Cryptography.RSA leafRsa = System.Security.Cryptography.RSA.Create(2048))
+            {
+                DateTimeOffset notBefore = DateTimeOffset.UtcNow.AddMinutes(-5);
+                DateTimeOffset notAfter = DateTimeOffset.UtcNow.AddDays(1);
+
+                CertificateRequest rootRequest = new CertificateRequest(
+                    "CN=StoreTargeting.Root", rootRsa,
+                    System.Security.Cryptography.HashAlgorithmName.SHA256,
+                    System.Security.Cryptography.RSASignaturePadding.Pkcs1);
+                rootRequest.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, false, 0, true));
+
+                using (X509Certificate2 root = rootRequest.CreateSelfSigned(notBefore, notAfter))
+                {
+                    CertificateRequest interRequest = new CertificateRequest(
+                        "CN=StoreTargeting.Intermediate", leafRsa,
+                        System.Security.Cryptography.HashAlgorithmName.SHA256,
+                        System.Security.Cryptography.RSASignaturePadding.Pkcs1);
+                    interRequest.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, false, 0, true));
+
+                    using (X509Certificate2 intermediate = interRequest.Create(root, notBefore, notAfter, new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 }))
+                    {
+                        Assert.Equal(StoreName.Root, (StoreName)classify.Invoke(null, new object[] { root }));
+                        Assert.Equal(StoreName.CertificateAuthority, (StoreName)classify.Invoke(null, new object[] { intermediate }));
+                    }
+                }
+            }
+        }
+    }
+}

src/PSInfisicalAPI.Tests/CsrAndRequestCmdletTests.cs

@@ -114,6 +114,170 @@ namespace PSInfisicalAPI.Tests
             Assert.Equal("DE", countryProp.GetValue(result));
         }
 
+        [Theory]
+        [InlineData("CN=WEB01", "WEB01")]
+        [InlineData("cn=web01.contoso.local", "web01.contoso.local")]
+        [InlineData("CN=WEB01,OU=IT,O=Contoso", "WEB01")]
+        [InlineData("  CN=WEB01  ", "WEB01")]
+        [InlineData("WEB01.contoso.local", "WEB01.contoso.local")]
+        [InlineData(null, null)]
+        public void MergeSubject_Normalizes_Rdn_Style_CommonName(string supplied, string expected)
+        {
+            Type helperType = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateRequestHelpers", true);
+            MethodInfo merge = helperType.GetMethod("MergeSubject", BindingFlags.Public | BindingFlags.Static);
+
+            object result = merge.Invoke(null, new object[] { null, supplied, null, null, null, null, null, null });
+
+            Assert.Equal(expected, result.GetType().GetProperty("CommonName").GetValue(result));
+        }
+
+        [Fact]
+        public void MergeSubject_Normalizes_CommonName_Supplied_Through_Subject_Hashtable()
+        {
+            Type helperType = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalCertificateRequestHelpers", true);
+            MethodInfo merge = helperType.GetMethod("MergeSubject", BindingFlags.Public | BindingFlags.Static);
+
+            Hashtable subject = new Hashtable { { "CN", "CN=WEB01" } };
+            object result = merge.Invoke(null, new object[] { subject, null, null, null, null, null, null, null });
+
+            Assert.Equal("WEB01", result.GetType().GetProperty("CommonName").GetValue(result));
+        }
+
+        [Fact]
+        public void BuildDnsNames_Routes_Ip_Literals_From_DnsName_To_IpAddress_Sans()
+        {
+            // Get-InfisicalSANList emits host names and IP addresses in one list, and the documented usage
+            // splats that whole list into -DnsName.
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                DnsName = new[] { "WEB01", "172.16.32.24", "WEB01.contoso.local", "127.0.0.1", "::1" }
+            };
+
+            List<string> ipAddresses = new List<string>();
+            List<string> dnsNames = InvokeBuildDnsNames(cmdlet, new InfisicalCsrSubject { CommonName = "WEB01" }, ipAddresses);
+
+            Assert.Equal(new[] { "WEB01", "WEB01.contoso.local" }, dnsNames);
+            Assert.Equal(new[] { "172.16.32.24", "127.0.0.1", "::1" }, ipAddresses);
+        }
+
+        [Fact]
+        public void BuildDnsNames_Merges_Explicit_IpAddress_Parameter_And_Deduplicates()
+        {
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                DnsName = new[] { "WEB01", "10.0.0.5" },
+                IpAddress = new[] { "10.0.0.5", "10.0.0.6" }
+            };
+
+            List<string> ipAddresses = new List<string>();
+            List<string> dnsNames = InvokeBuildDnsNames(cmdlet, new InfisicalCsrSubject { CommonName = "WEB01" }, ipAddresses);
+
+            Assert.Equal(new[] { "WEB01" }, dnsNames);
+            Assert.Equal(new[] { "10.0.0.5", "10.0.0.6" }, ipAddresses);
+        }
+
+        [Fact]
+        public void BuildDnsNames_Mirrors_Ip_CommonName_Into_IpAddress_Sans_Not_Dns()
+        {
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                DnsName = new[] { "WEB01.contoso.local" }
+            };
+
+            List<string> ipAddresses = new List<string>();
+            List<string> dnsNames = InvokeBuildDnsNames(cmdlet, new InfisicalCsrSubject { CommonName = "10.0.0.5" }, ipAddresses);
+
+            Assert.Equal(new[] { "WEB01.contoso.local" }, dnsNames);
+            Assert.Equal(new[] { "10.0.0.5" }, ipAddresses);
+        }
+
+        [Fact]
+        public void BuildDnsNames_Ip_Only_Request_Does_Not_Pick_Up_Local_Fqdn()
+        {
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                IpAddress = new[] { "10.0.0.5" }
+            };
+
+            List<string> ipAddresses = new List<string>();
+            List<string> dnsNames = InvokeBuildDnsNames(cmdlet, new InfisicalCsrSubject { CommonName = "10.0.0.5" }, ipAddresses);
+
+            Assert.Empty(dnsNames);
+            Assert.Equal(new[] { "10.0.0.5" }, ipAddresses);
+        }
+
+        private static List<string> InvokeBuildDnsNames(PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet, InfisicalCsrSubject subject, List<string> ipAddresses)
+        {
+            MethodInfo build = cmdlet.GetType().GetMethod("BuildDnsNames", BindingFlags.NonPublic | BindingFlags.Instance);
+            Assert.NotNull(build);
+            return (List<string>)build.Invoke(cmdlet, new object[] { subject, ipAddresses });
+        }
+
+        [Fact]
+        public void DirectIssuance_Guidance_Names_The_Parameters_That_Resolve_It()
+        {
+            // Infisical exposes no certificate-template issuance route over REST, so the actionable alternatives
+            // are enabling direct issuance on the CA, a subscriber, or a profile.
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                CertificateAuthorityId = "ca-1234",
+                ProjectId = "proj-5678"
+            };
+
+            MethodInfo build = cmdlet.GetType().GetMethod("BuildDirectIssuanceGuidance", BindingFlags.NonPublic | BindingFlags.Instance);
+            Assert.NotNull(build);
+
+            string guidance = (string)build.Invoke(cmdlet, new object[] { null });
+
+            Assert.Contains("ca-1234", guidance);
+            Assert.Contains("proj-5678", guidance);
+            Assert.Contains("-PkiSubscriberSlug", guidance);
+            Assert.Contains("-CertificateProfileId", guidance);
+            Assert.Contains("Get-InfisicalPkiSubscriber", guidance);
+            Assert.Contains("Direct Issuance", guidance);
+        }
+
+        [Fact]
+        public void DirectIssuance_Guidance_Prefers_The_Ca_Name_When_Known()
+        {
+            PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet
+            {
+                CertificateAuthorityId = "ca-1234",
+                ProjectId = "proj-5678"
+            };
+
+            PSInfisicalAPI.Models.InfisicalCertificateAuthority ca = new PSInfisicalAPI.Models.InfisicalCertificateAuthority
+            {
+                Id = "ca-1234",
+                Name = "intermediate-ca",
+                EnableDirectIssuance = false
+            };
+
+            MethodInfo build = cmdlet.GetType().GetMethod("BuildDirectIssuanceGuidance", BindingFlags.NonPublic | BindingFlags.Instance);
+            string guidance = (string)build.Invoke(cmdlet, new object[] { ca });
+
+            Assert.Contains("intermediate-ca", guidance);
+            Assert.Contains("ca-1234", guidance);
+        }
+
+        [Theory]
+        [InlineData("WriteErrorForException")]
+        [InlineData("ThrowTerminatingForException")]
+        public void Failure_Handlers_Rethrow_Pipeline_Stops_Untouched(string handlerName)
+        {
+            // Select-Object -First makes WriteObject throw a PipelineStoppedException-derived type. Reporting it
+            // as an error surfaces spurious "The pipeline has been stopped." warnings on normal early exits.
+            PSInfisicalAPI.Cmdlets.GetInfisicalCertificateAuthorityCmdlet cmdlet = new PSInfisicalAPI.Cmdlets.GetInfisicalCertificateAuthorityCmdlet();
+            MethodInfo method = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase).GetMethod(handlerName, BindingFlags.NonPublic | BindingFlags.Instance);
+            Assert.NotNull(method);
+
+            PipelineStoppedException stop = new PipelineStoppedException();
+            TargetInvocationException wrapper = Assert.Throws<TargetInvocationException>(
+                () => method.Invoke(cmdlet, new object[] { "TestComponent", "TestOperation", stop }));
+
+            Assert.Same(stop, wrapper.InnerException);
+        }
+
         [Fact]
         public void SignCertificateBySubscriber_Uses_Pki_Subscribers_Template()
         {

src/PSInfisicalAPI.Tests/EndpointRegistryTests.cs

@@ -75,6 +75,16 @@ namespace PSInfisicalAPI.Tests
         [InlineData(InfisicalEndpointNames.BulkUpdateSecret, "PATCH", "/api/v4/secrets/batch")]
         [InlineData(InfisicalEndpointNames.BulkDeleteSecret, "DELETE", "/api/v4/secrets/batch")]
         [InlineData(InfisicalEndpointNames.DuplicateSecret, "POST", "/api/v4/secrets/duplicate")]
+        [InlineData(InfisicalEndpointNames.ListOrganizations, "GET", "/api/v2/organizations")]
+        [InlineData(InfisicalEndpointNames.RetrieveOrganization, "GET", "/api/v1/organization/{organizationId}")]
+        [InlineData(InfisicalEndpointNames.CreateOrganization, "POST", "/api/v2/organizations")]
+        [InlineData(InfisicalEndpointNames.UpdateOrganization, "PATCH", "/api/v1/organization/{organizationId}")]
+        [InlineData(InfisicalEndpointNames.DeleteOrganization, "DELETE", "/api/v1/organization/{organizationId}")]
+        [InlineData(InfisicalEndpointNames.ListSubOrganizations, "GET", "/api/v1/sub-organizations")]
+        [InlineData(InfisicalEndpointNames.RetrieveSubOrganization, "GET", "/api/v1/sub-organizations/{subOrgId}")]
+        [InlineData(InfisicalEndpointNames.CreateSubOrganization, "POST", "/api/v1/sub-organizations")]
+        [InlineData(InfisicalEndpointNames.UpdateSubOrganization, "PATCH", "/api/v1/sub-organizations/{subOrgId}")]
+        [InlineData(InfisicalEndpointNames.DeleteSubOrganization, "DELETE", "/api/v1/sub-organizations/{subOrgId}")]
         public void Registered_Endpoints_Have_Expected_Shape(string name, string method, string template)
         {
             InfisicalEndpointDefinition definition = InfisicalEndpointRegistry.Get(name);

src/PSInfisicalAPI.Tests/InfisicalProcessRunnerHelpersTests.cs

@@ -0,0 +1,75 @@
+using System;
+using PSInfisicalAPI.Process;
+using Xunit;
+
+namespace PSInfisicalAPI.Tests
+{
+    public class InfisicalProcessRunnerHelpersTests
+    {
+        [Fact]
+        public void FormatFriendly_Zero_Returns_NotAvailable()
+        {
+            Assert.Equal("N/A", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.Zero));
+        }
+
+        [Fact]
+        public void FormatFriendly_Single_Unit_Plural()
+        {
+            Assert.Equal("30 seconds", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.FromSeconds(30)));
+            Assert.Equal("5 minutes", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.FromMinutes(5)));
+            Assert.Equal("250 milliseconds", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.FromMilliseconds(250)));
+        }
+
+        [Fact]
+        public void FormatFriendly_Single_Unit_Singular()
+        {
+            Assert.Equal("1 second", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.FromSeconds(1)));
+            Assert.Equal("1 minute", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.FromMinutes(1)));
+            Assert.Equal("1 hour", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.FromHours(1)));
+            Assert.Equal("1 day", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.FromDays(1)));
+            Assert.Equal("1 millisecond", InfisicalProcessRunnerHelpers.FormatFriendly(TimeSpan.FromMilliseconds(1)));
+        }
+
+        [Fact]
+        public void FormatFriendly_Two_Units_Uses_And_Join()
+        {
+            TimeSpan value = TimeSpan.FromSeconds(7) + TimeSpan.FromMilliseconds(364);
+            Assert.Equal("7 seconds, and 364 milliseconds", InfisicalProcessRunnerHelpers.FormatFriendly(value));
+        }
+
+        [Fact]
+        public void FormatFriendly_Multiple_Units_Uses_Comma_And_Trailing_And()
+        {
+            TimeSpan value = TimeSpan.FromHours(1) + TimeSpan.FromMinutes(2) + TimeSpan.FromSeconds(3) + TimeSpan.FromMilliseconds(45);
+            Assert.Equal("1 hour, 2 minutes, 3 seconds, and 45 milliseconds", InfisicalProcessRunnerHelpers.FormatFriendly(value));
+        }
+
+        [Fact]
+        public void FormatFriendly_Skips_Zero_Components()
+        {
+            TimeSpan value = TimeSpan.FromHours(2) + TimeSpan.FromMilliseconds(500);
+            Assert.Equal("2 hours, and 500 milliseconds", InfisicalProcessRunnerHelpers.FormatFriendly(value));
+        }
+
+        [Fact]
+        public void FormatFriendly_Mixed_Singular_And_Plural()
+        {
+            TimeSpan value = TimeSpan.FromMinutes(1) + TimeSpan.FromSeconds(30);
+            Assert.Equal("1 minute, and 30 seconds", InfisicalProcessRunnerHelpers.FormatFriendly(value));
+        }
+
+        [Fact]
+        public void FormatFriendly_Days_Component()
+        {
+            TimeSpan value = TimeSpan.FromDays(2) + TimeSpan.FromHours(3);
+            Assert.Equal("2 days, and 3 hours", InfisicalProcessRunnerHelpers.FormatFriendly(value));
+        }
+
+        [Fact]
+        public void FormatFriendly_SubMillisecond_Returns_NotAvailable()
+        {
+            TimeSpan value = TimeSpan.FromTicks(100);
+            Assert.Equal("N/A", InfisicalProcessRunnerHelpers.FormatFriendly(value));
+        }
+    }
+}

src/PSInfisicalAPI.Tests/LoggerStreamRoutingTests.cs

@@ -0,0 +1,115 @@
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using PSInfisicalAPI.Logging;
+using Xunit;
+
+namespace PSInfisicalAPI.Tests
+{
+    /// <summary>
+    /// The test project references PowerShellStandard.Library, which cannot host a runspace, so the logger's
+    /// stream choice is asserted structurally: which Cmdlet.Write* method each level compiles down to.
+    /// </summary>
+    public class LoggerStreamRoutingTests
+    {
+        [Theory]
+        [InlineData("Error", "WriteVerbose")]
+        [InlineData("Warning", "WriteWarning")]
+        [InlineData("Information", "WriteVerbose")]
+        [InlineData("Verbose", "WriteVerbose")]
+        [InlineData("Debug", "WriteDebug")]
+        public void PSCmdletLogger_Routes_Level_To_Expected_Stream(string levelMethod, string expectedWriteMethod)
+        {
+            MethodInfo method = typeof(PSCmdletLogger).GetMethod(levelMethod, BindingFlags.Public | BindingFlags.Instance);
+            Assert.NotNull(method);
+
+            List<string> called = GetCalledMethodNames(method);
+            Assert.Contains(expectedWriteMethod, called);
+        }
+
+        [Fact]
+        public void PSCmdletLogger_Error_Does_Not_Write_To_Warning_Stream()
+        {
+            // Every Logger.Error call site in this module logs and then throws, so the failure already reaches the
+            // caller as an ErrorRecord. Duplicating it on the warning stream put failures under -WarningAction
+            // instead of -ErrorAction and buried the real error under eight lines of noise.
+            MethodInfo error = typeof(PSCmdletLogger).GetMethod("Error", BindingFlags.Public | BindingFlags.Instance);
+            List<string> called = GetCalledMethodNames(error);
+
+            Assert.DoesNotContain("WriteWarning", called);
+            Assert.DoesNotContain("WriteError", called);
+        }
+
+        [Fact]
+        public void No_Cmdlet_Reports_Operation_Failures_As_Terminating_Errors()
+        {
+            // Operation failures go through WriteErrorForException so -ErrorAction decides the outcome.
+            // ThrowTerminatingForException remains available for aborts that ignore -ErrorAction, but no cmdlet
+            // should be using it for ordinary failures; this pins the convention against drift.
+            Assembly assembly = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase).Assembly;
+            List<string> offenders = new List<string>();
+            int inspected = 0;
+
+            foreach (Type type in assembly.GetTypes())
+            {
+                if (!typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase).IsAssignableFrom(type)) { continue; }
+                if (type == typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase)) { continue; }
+
+                inspected++;
+                foreach (MethodInfo method in type.GetMethods(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.DeclaredOnly))
+                {
+                    if (method.GetMethodBody() == null) { continue; }
+                    if (GetCalledMethodNames(method).Contains("ThrowTerminatingForException"))
+                    {
+                        offenders.Add(string.Concat(type.Name, ".", method.Name));
+                    }
+                }
+            }
+
+            Assert.True(inspected > 40, string.Concat("Expected to inspect the cmdlet set, saw ", inspected.ToString()));
+            Assert.Empty(offenders);
+        }
+
+        [Fact]
+        public void Cmdlets_Route_Failures_Through_WriteErrorForException()
+        {
+            Assembly assembly = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase).Assembly;
+            Type cmdletType = assembly.GetType("PSInfisicalAPI.Cmdlets.GetInfisicalCertificateAuthorityCmdlet", true);
+            MethodInfo processRecord = cmdletType.GetMethod("ProcessRecord", BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.DeclaredOnly);
+            Assert.NotNull(processRecord);
+
+            Assert.Contains("WriteErrorForException", GetCalledMethodNames(processRecord));
+        }
+
+        private static List<string> GetCalledMethodNames(MethodInfo method)
+        {
+            List<string> names = new List<string>();
+            MethodBody body = method.GetMethodBody();
+            Assert.NotNull(body);
+
+            byte[] il = body.GetILAsByteArray();
+            Assert.NotNull(il);
+
+            const byte Call = 0x28;
+            const byte CallVirt = 0x6F;
+
+            for (int i = 0; i + 4 < il.Length; i++)
+            {
+                if (il[i] != Call && il[i] != CallVirt) { continue; }
+
+                int token = BitConverter.ToInt32(il, i + 1);
+                try
+                {
+                    MethodBase resolved = method.Module.ResolveMethod(token);
+                    if (resolved != null) { names.Add(resolved.Name); }
+                }
+                catch (ArgumentException)
+                {
+                    // Byte sequence was operand data rather than an opcode; ignore.
+                }
+            }
+
+            return names;
+        }
+    }
+}

src/PSInfisicalAPI.Tests/OrganizationMapperTests.cs

@@ -0,0 +1,72 @@
+using System.Reflection;
+using PSInfisicalAPI.Models;
+using Xunit;
+
+namespace PSInfisicalAPI.Tests
+{
+    public class OrganizationMapperTests
+    {
+        private static readonly System.Type MapperType = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly
+            .GetType("PSInfisicalAPI.Organizations.InfisicalOrganizationMapper", true);
+
+        private static readonly System.Type DtoType = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly
+            .GetType("PSInfisicalAPI.Organizations.InfisicalOrganizationResponseDto", true);
+
+        private static InfisicalOrganization InvokeMap(object dto)
+        {
+            MethodInfo map = MapperType.GetMethod("Map", BindingFlags.Public | BindingFlags.Static);
+            return (InfisicalOrganization)map.Invoke(null, new[] { dto });
+        }
+
+        [Fact]
+        public void Map_Null_Dto_Returns_Null()
+        {
+            Assert.Null(InvokeMap(null));
+        }
+
+        [Fact]
+        public void Map_Populates_Core_Fields()
+        {
+            object dto = System.Activator.CreateInstance(DtoType);
+            DtoType.GetProperty("Id").SetValue(dto, "org-001");
+            DtoType.GetProperty("Name").SetValue(dto, "Acme");
+            DtoType.GetProperty("Slug").SetValue(dto, "acme");
+            DtoType.GetProperty("CustomerId").SetValue(dto, "cust-9");
+            DtoType.GetProperty("AuthEnforced").SetValue(dto, true);
+            DtoType.GetProperty("ScimEnabled").SetValue(dto, true);
+            DtoType.GetProperty("CreatedAt").SetValue(dto, "2026-01-15T12:34:56Z");
+            DtoType.GetProperty("UpdatedAt").SetValue(dto, "2026-02-20T09:00:00Z");
+
+            InfisicalOrganization organization = InvokeMap(dto);
+
+            Assert.Equal("org-001", organization.Id);
+            Assert.Equal("Acme", organization.Name);
+            Assert.Equal("acme", organization.Slug);
+            Assert.Equal("cust-9", organization.CustomerId);
+            Assert.True(organization.AuthEnforced);
+            Assert.True(organization.ScimEnabled);
+            Assert.NotNull(organization.CreatedAtUtc);
+            Assert.NotNull(organization.UpdatedAtUtc);
+        }
+
+        [Fact]
+        public void Map_Falls_Back_To_InternalId()
+        {
+            object dto = System.Activator.CreateInstance(DtoType);
+            DtoType.GetProperty("InternalId").SetValue(dto, "internal-id-1");
+
+            InfisicalOrganization organization = InvokeMap(dto);
+
+            Assert.Equal("internal-id-1", organization.Id);
+        }
+
+        [Fact]
+        public void MapMany_Null_Returns_Empty()
+        {
+            MethodInfo mapMany = MapperType.GetMethod("MapMany", BindingFlags.Public | BindingFlags.Static);
+            InfisicalOrganization[] result = (InfisicalOrganization[])mapMany.Invoke(null, new object[] { null });
+            Assert.NotNull(result);
+            Assert.Empty(result);
+        }
+    }
+}

src/PSInfisicalAPI.Tests/SubOrganizationMapperTests.cs

@@ -0,0 +1,72 @@
+using System.Reflection;
+using PSInfisicalAPI.Models;
+using Xunit;
+
+namespace PSInfisicalAPI.Tests
+{
+    public class SubOrganizationMapperTests
+    {
+        private static readonly System.Type MapperType = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly
+            .GetType("PSInfisicalAPI.SubOrganizations.InfisicalSubOrganizationMapper", true);
+
+        private static readonly System.Type DtoType = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly
+            .GetType("PSInfisicalAPI.SubOrganizations.InfisicalSubOrganizationResponseDto", true);
+
+        private static InfisicalSubOrganization InvokeMap(object dto)
+        {
+            MethodInfo map = MapperType.GetMethod("Map", BindingFlags.Public | BindingFlags.Static);
+            return (InfisicalSubOrganization)map.Invoke(null, new[] { dto });
+        }
+
+        [Fact]
+        public void Map_Null_Dto_Returns_Null()
+        {
+            Assert.Null(InvokeMap(null));
+        }
+
+        [Fact]
+        public void Map_Populates_Core_Fields()
+        {
+            object dto = System.Activator.CreateInstance(DtoType);
+            DtoType.GetProperty("Id").SetValue(dto, "sub-001");
+            DtoType.GetProperty("Name").SetValue(dto, "Platform Engineering");
+            DtoType.GetProperty("Slug").SetValue(dto, "platform-eng");
+            DtoType.GetProperty("OrganizationId").SetValue(dto, "org-001");
+            DtoType.GetProperty("IsAccessible").SetValue(dto, true);
+            DtoType.GetProperty("CreatedAt").SetValue(dto, "2026-01-15T12:34:56Z");
+            DtoType.GetProperty("UpdatedAt").SetValue(dto, "2026-02-20T09:00:00Z");
+
+            InfisicalSubOrganization subOrganization = InvokeMap(dto);
+
+            Assert.Equal("sub-001", subOrganization.Id);
+            Assert.Equal("Platform Engineering", subOrganization.Name);
+            Assert.Equal("platform-eng", subOrganization.Slug);
+            Assert.Equal("org-001", subOrganization.OrganizationId);
+            Assert.True(subOrganization.IsAccessible);
+            Assert.NotNull(subOrganization.CreatedAtUtc);
+            Assert.NotNull(subOrganization.UpdatedAtUtc);
+        }
+
+        [Fact]
+        public void Map_Falls_Back_To_InternalId_And_OrgId()
+        {
+            object dto = System.Activator.CreateInstance(DtoType);
+            DtoType.GetProperty("InternalId").SetValue(dto, "internal-id-1");
+            DtoType.GetProperty("OrgId").SetValue(dto, "org-fallback");
+
+            InfisicalSubOrganization subOrganization = InvokeMap(dto);
+
+            Assert.Equal("internal-id-1", subOrganization.Id);
+            Assert.Equal("org-fallback", subOrganization.OrganizationId);
+        }
+
+        [Fact]
+        public void MapMany_Null_Returns_Empty()
+        {
+            MethodInfo mapMany = MapperType.GetMethod("MapMany", BindingFlags.Public | BindingFlags.Static);
+            InfisicalSubOrganization[] result = (InfisicalSubOrganization[])mapMany.Invoke(null, new object[] { null });
+            Assert.NotNull(result);
+            Assert.Empty(result);
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/ConnectInfisicalCmdlet.cs

@@ -205,7 +205,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException(Component, "Connect", exception);
+                WriteErrorForException(Component, "Connect", exception);
             }
         }
 

src/PSInfisicalAPI/Cmdlets/ConvertToInfisicalCertificateCmdlet.cs

@@ -50,7 +50,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("ConvertToInfisicalCertificateCmdlet", "ConvertToCertificate", exception);
+                WriteErrorForException("ConvertToInfisicalCertificateCmdlet", "ConvertToCertificate", exception);
             }
         }
 

src/PSInfisicalAPI/Cmdlets/ConvertToInfisicalSecretDictionaryCmdlet.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Management.Automation;
 using System.Security;
+using PSInfisicalAPI.Common;
 using PSInfisicalAPI.Errors;
 using PSInfisicalAPI.Models;
 
@@ -21,6 +22,14 @@ namespace PSInfisicalAPI.Cmdlets
         [Parameter]
         public SwitchParameter AsPlainText { get; set; }
 
+        [Parameter]
+        [Alias("Prefix")]
+        public string SecretsPrefix { get; set; }
+
+        [Parameter]
+        [Alias("ForcePrefix")]
+        public SwitchParameter ForceSecretsPrefix { get; set; }
+
         private readonly List<InfisicalSecret> _buffer = new List<InfisicalSecret>();
 
         protected override void ProcessRecord()
@@ -40,20 +49,24 @@ namespace PSInfisicalAPI.Cmdlets
         {
             try
             {
+                Logger.Information("ConvertTo-InfisicalSecretDictionary", string.Concat("Processing ", _buffer.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " input secret(s)."));
+
                 if (AsPlainText.IsPresent)
                 {
                     Dictionary<string, string> plain = BuildDictionary<string>(secret => secret.GetPlainTextValue());
+                    Logger.Information("ConvertTo-InfisicalSecretDictionary", string.Concat("Built plain-text dictionary with ", plain.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " entry/entries."));
                     WriteObject(plain);
                 }
                 else
                 {
                     Dictionary<string, SecureString> secure = BuildDictionary<SecureString>(secret => secret.SecretValue);
+                    Logger.Information("ConvertTo-InfisicalSecretDictionary", string.Concat("Built SecureString dictionary with ", secure.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " entry/entries."));
                     WriteObject(secure);
                 }
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("ConvertToInfisicalSecretDictionaryCmdlet", "ConvertToDictionary", exception);
+                WriteErrorForException("ConvertToInfisicalSecretDictionaryCmdlet", "ConvertToDictionary", exception);
             }
         }
 
@@ -63,7 +76,7 @@ namespace PSInfisicalAPI.Cmdlets
 
             foreach (InfisicalSecret secret in _buffer)
             {
-                string key = secret.SecretName ?? string.Empty;
+                string key = InfisicalPrefix.Apply(secret.SecretName ?? string.Empty, SecretsPrefix, ForceSecretsPrefix.IsPresent);
 
                 if (dictionary.ContainsKey(key))
                 {

src/PSInfisicalAPI/Cmdlets/CopyInfisicalSecretCmdlet.cs

@@ -65,7 +65,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("CopyInfisicalSecretCmdlet", "DuplicateSecrets", exception);
+                WriteErrorForException("CopyInfisicalSecretCmdlet", "DuplicateSecrets", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/DisconnectInfisicalCmdlet.cs

@@ -27,7 +27,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("DisconnectInfisicalCmdlet", "Disconnect", exception);
+                WriteErrorForException("DisconnectInfisicalCmdlet", "Disconnect", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/ExportInfisicalCertificateCmdlet.cs

@@ -85,7 +85,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("ExportInfisicalCertificateCmdlet", "ExportCertificate", exception);
+                WriteErrorForException("ExportInfisicalCertificateCmdlet", "ExportCertificate", exception);
             }
         }
 

src/PSInfisicalAPI/Cmdlets/ExportInfisicalScepMdmProfileCmdlet.cs

@@ -58,7 +58,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException(Component, "ExportScepMdmProfile", exception);
+                WriteErrorForException(Component, "ExportScepMdmProfile", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/ExportInfisicalSecretsCmdlet.cs

@@ -3,6 +3,7 @@ using System.Collections.Generic;
 using System.IO;
 using System.Management.Automation;
 using System.Text;
+using PSInfisicalAPI.Common;
 using PSInfisicalAPI.Errors;
 using PSInfisicalAPI.Exports;
 using PSInfisicalAPI.Models;
@@ -37,6 +38,14 @@ namespace PSInfisicalAPI.Cmdlets
         [Parameter]
         public InfisicalExportEncoding Encoding { get; set; } = InfisicalExportEncoding.UTF8;
 
+        [Parameter]
+        [Alias("Prefix")]
+        public string SecretsPrefix { get; set; }
+
+        [Parameter]
+        [Alias("ForcePrefix")]
+        public SwitchParameter ForceSecretsPrefix { get; set; }
+
         private readonly List<InfisicalSecret> _buffer = new List<InfisicalSecret>();
 
         protected override void ProcessRecord()
@@ -66,9 +75,11 @@ namespace PSInfisicalAPI.Cmdlets
                 {
                 }
 
+                Logger.Information("Export-InfisicalSecrets", string.Concat("Exporting ", _buffer.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " secret(s) as ", Format.ToString(), (Path != null ? string.Concat(" to '", Path.FullName, "'") : string.Empty), "."));
+
                 InfisicalExportRequest request = new InfisicalExportRequest
                 {
-                    Secrets = _buffer.ToArray(),
+                    Secrets = ApplySecretsPrefix(_buffer, SecretsPrefix, ForceSecretsPrefix.IsPresent),
                     Format = Format,
                     Path = Path,
                     Scope = Scope,
@@ -81,10 +92,42 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("ExportInfisicalSecretsCmdlet", string.Concat("Export-", Format.ToString()), exception);
+                WriteErrorForException("ExportInfisicalSecretsCmdlet", string.Concat("Export-", Format.ToString()), exception);
             }
         }
 
+        private static InfisicalSecret[] ApplySecretsPrefix(List<InfisicalSecret> source, string prefix, bool force)
+        {
+            if (string.IsNullOrEmpty(prefix)) { return source.ToArray(); }
+
+            InfisicalSecret[] result = new InfisicalSecret[source.Count];
+            for (int i = 0; i < source.Count; i++)
+            {
+                InfisicalSecret original = source[i];
+                result[i] = new InfisicalSecret
+                {
+                    Id = original.Id,
+                    InternalId = original.InternalId,
+                    Workspace = original.Workspace,
+                    Environment = original.Environment,
+                    Version = original.Version,
+                    Type = original.Type,
+                    SecretName = InfisicalPrefix.Apply(original.SecretName, prefix, force),
+                    SecretValue = original.SecretValue,
+                    SecretValueHidden = original.SecretValueHidden,
+                    SecretPath = original.SecretPath,
+                    SecretComment = original.SecretComment,
+                    CreatedAtUtc = original.CreatedAtUtc,
+                    UpdatedAtUtc = original.UpdatedAtUtc,
+                    IsRotatedSecret = original.IsRotatedSecret,
+                    RotationId = original.RotationId,
+                    Tags = original.Tags,
+                    SecretMetadata = original.SecretMetadata
+                };
+            }
+            return result;
+        }
+
         private static Encoding ResolveEncoding(InfisicalExportEncoding encoding)
         {
             switch (encoding)

src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateApplicationCmdlet.cs

@@ -46,6 +46,7 @@ namespace PSInfisicalAPI.Cmdlets
                 }
 
                 InfisicalCertificateApplication[] all = client.ListCertificateApplications(connection, ProjectId, Limit, Offset);
+                Logger.Information("Get-InfisicalCertificateApplication", string.Concat("Returned ", all.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " certificate application(s)."));
                 foreach (InfisicalCertificateApplication app in all)
                 {
                     WriteObject(app);
@@ -53,7 +54,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalCertificateApplicationCmdlet", "GetCertificateApplication", exception);
+                WriteErrorForException("GetInfisicalCertificateApplicationCmdlet", "GetCertificateApplication", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateApplicationEnrollmentCmdlet.cs

@@ -35,7 +35,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalCertificateApplicationEnrollmentCmdlet", "GetCertificateApplicationEnrollment", exception);
+                WriteErrorForException("GetInfisicalCertificateApplicationEnrollmentCmdlet", "GetCertificateApplicationEnrollment", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateAuthorityCmdlet.cs

@@ -52,6 +52,7 @@ namespace PSInfisicalAPI.Cmdlets
                     }
                 }
 
+                Logger.Information("Get-InfisicalCertificateAuthority", string.Concat("Returned ", all.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " certificate authority/authorities (kind=", Kind, ")."));
                 foreach (InfisicalCertificateAuthority ca in all)
                 {
                     WriteObject(ca);
@@ -59,7 +60,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalCertificateAuthorityCmdlet", "GetCertificateAuthority", exception);
+                WriteErrorForException("GetInfisicalCertificateAuthorityCmdlet", "GetCertificateAuthority", exception);
             }
         }
 

src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateCmdlet.cs

@@ -129,10 +129,12 @@ namespace PSInfisicalAPI.Cmdlets
 
                     query.Offset = (query.Offset ?? 0) + page.Certificates.Length;
                 }
+
+                Logger.Information("Get-InfisicalCertificate", string.Concat("Returned ", emitted.ToString(System.Globalization.CultureInfo.InvariantCulture), " certificate(s)."));
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalCertificateCmdlet", "GetCertificate", exception);
+                WriteErrorForException("GetInfisicalCertificateCmdlet", "GetCertificate", exception);
             }
         }
 

src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificatePolicyCmdlet.cs

@@ -39,6 +39,7 @@ namespace PSInfisicalAPI.Cmdlets
                 }
 
                 InfisicalCertificatePolicy[] all = client.ListCertificatePolicies(connection, ProjectId, Limit, Offset);
+                Logger.Information("Get-InfisicalCertificatePolicy", string.Concat("Returned ", all.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " certificate policy/policies."));
                 foreach (InfisicalCertificatePolicy policy in all)
                 {
                     WriteObject(policy);
@@ -46,7 +47,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalCertificatePolicyCmdlet", "GetCertificatePolicy", exception);
+                WriteErrorForException("GetInfisicalCertificatePolicyCmdlet", "GetCertificatePolicy", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateProfileCmdlet.cs

@@ -42,6 +42,7 @@ namespace PSInfisicalAPI.Cmdlets
 
                 bool? includeConfigs = MyInvocation.BoundParameters.ContainsKey("IncludeConfigs") ? (bool?)IncludeConfigs.IsPresent : null;
                 InfisicalCertificateProfile[] all = client.ListCertificateProfiles(connection, ProjectId, Limit, Offset, includeConfigs);
+                Logger.Information("Get-InfisicalCertificateProfile", string.Concat("Returned ", all.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " certificate profile(s)."));
                 foreach (InfisicalCertificateProfile profile in all)
                 {
                     WriteObject(profile);
@@ -49,7 +50,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalCertificateProfileCmdlet", "GetCertificateProfile", exception);
+                WriteErrorForException("GetInfisicalCertificateProfileCmdlet", "GetCertificateProfile", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/GetInfisicalEnvironmentCmdlet.cs

@@ -35,6 +35,7 @@ namespace PSInfisicalAPI.Cmdlets
                 }
 
                 InfisicalEnvironment[] envs = client.List(connection, ProjectId);
+                Logger.Information("Get-InfisicalEnvironment", string.Concat("Returned ", envs.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " environment(s)."));
                 foreach (InfisicalEnvironment env in envs)
                 {
                     WriteObject(env);
@@ -42,7 +43,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalEnvironmentCmdlet", "GetEnvironment", exception);
+                WriteErrorForException("GetInfisicalEnvironmentCmdlet", "GetEnvironment", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/GetInfisicalEnvironmentVariableCmdlet.cs

@@ -0,0 +1,57 @@
+using System;
+using System.Management.Automation;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsCommon.Get, "InfisicalEnvironmentVariable")]
+    [OutputType(typeof(string))]
+    public sealed class GetInfisicalEnvironmentVariableCmdlet : InfisicalCmdletBase
+    {
+        private const string Component = "Get-InfisicalEnvironmentVariable";
+
+        private static readonly EnvironmentVariableTarget[] TargetOrder = new[]
+        {
+            EnvironmentVariableTarget.Process,
+            EnvironmentVariableTarget.User,
+            EnvironmentVariableTarget.Machine
+        };
+
+        [Parameter(Mandatory = true, Position = 0, ValueFromPipeline = true, ValueFromPipelineByPropertyName = true)]
+        [ValidateNotNullOrEmpty]
+        public string Name { get; set; }
+
+        [Parameter(Position = 1)]
+        public EnvironmentVariableTarget? Scope { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            EnvironmentVariableTarget[] targets = Scope.HasValue ? new[] { Scope.Value } : TargetOrder;
+
+            foreach (EnvironmentVariableTarget target in targets)
+            {
+                Logger.Verbose(Component, string.Concat("Searching ", target.ToString(), " scope for environment variable '", Name, "'."));
+
+                string value;
+                try
+                {
+                    value = Environment.GetEnvironmentVariable(Name, target);
+                }
+                catch (Exception exception)
+                {
+                    Logger.Verbose(Component, string.Concat("Failed to read ", target.ToString(), " scope for environment variable '", Name, "': ", exception.Message));
+                    continue;
+                }
+
+                if (!string.IsNullOrEmpty(value))
+                {
+                    Logger.Information(Component, string.Concat("Found environment variable '", Name, "' in ", target.ToString(), " scope."));
+                    WriteObject(value);
+                    return;
+                }
+            }
+
+            string scopeDescription = Scope.HasValue ? string.Concat(Scope.Value.ToString(), " scope") : "Process, User, or Machine scope";
+            Logger.Information(Component, string.Concat("Environment variable '", Name, "' was not found in ", scopeDescription, "."));
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/GetInfisicalFolderCmdlet.cs

@@ -37,6 +37,7 @@ namespace PSInfisicalAPI.Cmdlets
                 }
 
                 InfisicalFolder[] folders = client.List(connection, ProjectId, Environment, Path);
+                Logger.Information("Get-InfisicalFolder", string.Concat("Returned ", folders.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " folder(s) from '", Path ?? "/", "'."));
                 foreach (InfisicalFolder folder in folders)
                 {
                     WriteObject(folder);
@@ -44,7 +45,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalFolderCmdlet", "GetFolder", exception);
+                WriteErrorForException("GetInfisicalFolderCmdlet", "GetFolder", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/GetInfisicalOrganizationCmdlet.cs

@@ -0,0 +1,48 @@
+using System;
+using System.Management.Automation;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.Organizations;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsCommon.Get, "InfisicalOrganization", DefaultParameterSetName = "List")]
+    [OutputType(typeof(InfisicalOrganization))]
+    public sealed class GetInfisicalOrganizationCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(ParameterSetName = "Single", Mandatory = true, ValueFromPipelineByPropertyName = true, Position = 0)]
+        [Alias("Id")]
+        public string OrganizationId { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
+                InfisicalOrganizationClient client = new InfisicalOrganizationClient(HttpClient, Logger);
+
+                if (string.Equals(ParameterSetName, "Single", StringComparison.Ordinal))
+                {
+                    InfisicalOrganization organization = client.Retrieve(connection, OrganizationId);
+                    if (organization != null)
+                    {
+                        WriteObject(organization);
+                    }
+
+                    return;
+                }
+
+                InfisicalOrganization[] organizations = client.List(connection);
+                Logger.Information("Get-InfisicalOrganization", string.Concat("Returned ", organizations.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " organization(s)."));
+                foreach (InfisicalOrganization organization in organizations)
+                {
+                    WriteObject(organization);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("GetInfisicalOrganizationCmdlet", "GetOrganization", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/GetInfisicalPkiSubscriberCmdlet.cs

@@ -35,6 +35,7 @@ namespace PSInfisicalAPI.Cmdlets
                 }
 
                 InfisicalPkiSubscriber[] all = client.ListPkiSubscribers(connection, ProjectId);
+                Logger.Information("Get-InfisicalPkiSubscriber", string.Concat("Returned ", all.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " PKI subscriber(s)."));
                 foreach (InfisicalPkiSubscriber subscriber in all)
                 {
                     WriteObject(subscriber);
@@ -42,7 +43,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalPkiSubscriberCmdlet", "GetPkiSubscriber", exception);
+                WriteErrorForException("GetInfisicalPkiSubscriberCmdlet", "GetPkiSubscriber", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/GetInfisicalProjectCmdlet.cs

@@ -39,6 +39,7 @@ namespace PSInfisicalAPI.Cmdlets
                 }
 
                 InfisicalProject[] projects = client.List(connection, Type, IncludeRoles.IsPresent);
+                Logger.Information("Get-InfisicalProject", string.Concat("Returned ", projects.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " project(s)."));
                 foreach (InfisicalProject project in projects)
                 {
                     WriteObject(project);
@@ -46,7 +47,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalProjectCmdlet", "GetProject", exception);
+                WriteErrorForException("GetInfisicalProjectCmdlet", "GetProject", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/GetInfisicalSANListCmdlet.cs

@@ -0,0 +1,108 @@
+using System;
+using System.Collections.Generic;
+using System.Management.Automation;
+using System.Net;
+using System.Net.NetworkInformation;
+using System.Net.Sockets;
+using System.Text.RegularExpressions;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsCommon.Get, "InfisicalSANList")]
+    [OutputType(typeof(string[]))]
+    public sealed class GetInfisicalSANListCmdlet : InfisicalCmdletBase
+    {
+        private const string Component = "GetInfisicalSANListCmdlet";
+
+        [Parameter]
+        [ValidateNotNullOrEmpty]
+        public string InclusionExpression { get; set; }
+
+        [Parameter]
+        [ValidateNotNullOrEmpty]
+        public string ExclusionExpression { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                Regex includeRegex = !string.IsNullOrEmpty(InclusionExpression) ? new Regex(InclusionExpression, RegexOptions.IgnoreCase | RegexOptions.CultureInvariant) : null;
+                Regex excludeRegex = !string.IsNullOrEmpty(ExclusionExpression) ? new Regex(ExclusionExpression, RegexOptions.IgnoreCase | RegexOptions.CultureInvariant) : null;
+
+                List<string> sans = new List<string>();
+                HashSet<string> seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+                string deviceName = Dns.GetHostName();
+                AddUnique(sans, seen, deviceName);
+
+                HashSet<string> suffixes = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+                string globalDomain = IPGlobalProperties.GetIPGlobalProperties().DomainName;
+                if (!string.IsNullOrEmpty(globalDomain)) { suffixes.Add(globalDomain); }
+
+                NetworkInterface[] adapters = NetworkInterface.GetAllNetworkInterfaces();
+                foreach (NetworkInterface adapter in adapters)
+                {
+                    if (adapter.OperationalStatus != OperationalStatus.Up) { continue; }
+                    if (adapter.NetworkInterfaceType == NetworkInterfaceType.Loopback) { continue; }
+
+                    IPInterfaceProperties props = adapter.GetIPProperties();
+                    if (!string.IsNullOrEmpty(props.DnsSuffix)) { suffixes.Add(props.DnsSuffix); }
+
+                    foreach (UnicastIPAddressInformation unicast in props.UnicastAddresses)
+                    {
+                        IPAddress ip = unicast.Address;
+                        if (ip.AddressFamily == AddressFamily.InterNetwork && IsRfc1918OrCgnat(ip))
+                        {
+                            AddUnique(sans, seen, ip.ToString());
+                        }
+                    }
+                }
+
+                foreach (string suffix in suffixes)
+                {
+                    string trimmed = suffix.Trim().TrimStart('.');
+                    if (!string.IsNullOrEmpty(trimmed))
+                    {
+                        AddUnique(sans, seen, string.Concat(deviceName, ".", trimmed));
+                    }
+                }
+
+                AddUnique(sans, seen, "127.0.0.1");
+                AddUnique(sans, seen, "::1");
+
+                List<string> filtered = new List<string>(sans.Count);
+                foreach (string san in sans)
+                {
+                    if (includeRegex != null && !includeRegex.IsMatch(san)) { continue; }
+                    if (excludeRegex != null && excludeRegex.IsMatch(san)) { continue; }
+                    filtered.Add(san);
+                }
+
+                WriteObject(filtered.ToArray(), false);
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException(Component, "GetSANList", exception);
+            }
+        }
+
+        private static bool IsRfc1918OrCgnat(IPAddress ip)
+        {
+            byte[] bytes = ip.GetAddressBytes();
+            if (bytes.Length != 4) { return false; }
+
+            if (bytes[0] == 10) { return true; }
+            if (bytes[0] == 172 && bytes[1] >= 16 && bytes[1] <= 31) { return true; }
+            if (bytes[0] == 192 && bytes[1] == 168) { return true; }
+            if (bytes[0] == 100 && bytes[1] >= 64 && bytes[1] <= 127) { return true; }
+
+            return false;
+        }
+
+        private static void AddUnique(List<string> list, HashSet<string> seen, string value)
+        {
+            if (string.IsNullOrEmpty(value)) { return; }
+            if (seen.Add(value)) { list.Add(value); }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/GetInfisicalScepMdmProfileCmdlet.cs

@@ -86,7 +86,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException(Component, "GetScepMdmProfile", exception);
+                WriteErrorForException(Component, "GetScepMdmProfile", exception);
             }
         }
 

src/PSInfisicalAPI/Cmdlets/GetInfisicalSecretCmdlet.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Management.Automation;
 using PSInfisicalAPI.Connections;
 using PSInfisicalAPI.Models;
@@ -57,8 +58,13 @@ namespace PSInfisicalAPI.Cmdlets
                     InfisicalSecret secret = client.Retrieve(connection, query);
                     if (secret != null)
                     {
+                        Logger.Information("Get-InfisicalSecret", string.Concat("Returned 1 secret for '", SecretName, "'."));
                         WriteObject(secret);
                     }
+                    else
+                    {
+                        Logger.Information("Get-InfisicalSecret", string.Concat("No secret returned for '", SecretName, "'."));
+                    }
 
                     return;
                 }
@@ -79,6 +85,7 @@ namespace PSInfisicalAPI.Cmdlets
                 };
 
                 InfisicalSecret[] secrets = client.List(connection, listQuery);
+                Logger.Information("Get-InfisicalSecret", string.Concat("Returned ", secrets.Length.ToString(CultureInfo.InvariantCulture), " secret(s) from '", SecretPath ?? "/", "' (recursive=", Recursive.IsPresent ? "true" : "false", ", includeImports=", IncludeImports.IsPresent ? "true" : "false", ")."));
                 foreach (InfisicalSecret secret in secrets)
                 {
                     WriteObject(secret);
@@ -86,7 +93,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalSecretCmdlet", "GetSecret", exception);
+                WriteErrorForException("GetInfisicalSecretCmdlet", "GetSecret", exception);
             }
         }
 

src/PSInfisicalAPI/Cmdlets/GetInfisicalSubOrganizationCmdlet.cs

@@ -0,0 +1,60 @@
+using System;
+using System.Management.Automation;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.SubOrganizations;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsCommon.Get, "InfisicalSubOrganization", DefaultParameterSetName = "List")]
+    [OutputType(typeof(InfisicalSubOrganization))]
+    public sealed class GetInfisicalSubOrganizationCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(ParameterSetName = "Single", Mandatory = true, ValueFromPipelineByPropertyName = true, Position = 0)]
+        [Alias("Id")]
+        public string SubOrganizationId { get; set; }
+
+        [Parameter(ParameterSetName = "List")] public int? Limit { get; set; }
+        [Parameter(ParameterSetName = "List")] public int? Offset { get; set; }
+        [Parameter(ParameterSetName = "List")] public string Search { get; set; }
+        [Parameter(ParameterSetName = "List")] public string OrderBy { get; set; }
+
+        [Parameter(ParameterSetName = "List")]
+        [ValidateSet("asc", "desc")]
+        public string OrderDirection { get; set; }
+
+        [Parameter(ParameterSetName = "List")] public SwitchParameter IsAccessible { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
+                InfisicalSubOrganizationClient client = new InfisicalSubOrganizationClient(HttpClient, Logger);
+
+                if (string.Equals(ParameterSetName, "Single", StringComparison.Ordinal))
+                {
+                    InfisicalSubOrganization subOrganization = client.Retrieve(connection, SubOrganizationId);
+                    if (subOrganization != null)
+                    {
+                        WriteObject(subOrganization);
+                    }
+
+                    return;
+                }
+
+                bool? isAccessible = MyInvocation.BoundParameters.ContainsKey("IsAccessible") ? (bool?)IsAccessible.IsPresent : null;
+                InfisicalSubOrganization[] subOrganizations = client.List(connection, Limit, Offset, Search, OrderBy, OrderDirection, isAccessible);
+                Logger.Information("Get-InfisicalSubOrganization", string.Concat("Returned ", subOrganizations.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " sub-organization(s)."));
+                foreach (InfisicalSubOrganization subOrganization in subOrganizations)
+                {
+                    WriteObject(subOrganization);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("GetInfisicalSubOrganizationCmdlet", "GetSubOrganization", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/GetInfisicalTagCmdlet.cs

@@ -35,6 +35,7 @@ namespace PSInfisicalAPI.Cmdlets
                 }
 
                 InfisicalTag[] tags = client.List(connection, ProjectId);
+                Logger.Information("Get-InfisicalTag", string.Concat("Returned ", tags.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " tag(s)."));
                 foreach (InfisicalTag tag in tags)
                 {
                     WriteObject(tag);
@@ -42,7 +43,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("GetInfisicalTagCmdlet", "GetTag", exception);
+                WriteErrorForException("GetInfisicalTagCmdlet", "GetTag", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/ImportInfisicalSecretCmdlet.cs

@@ -0,0 +1,105 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Management.Automation;
+using System.Security;
+using PSInfisicalAPI.Common;
+using PSInfisicalAPI.Errors;
+using PSInfisicalAPI.Imports;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.Security;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsData.Import, "InfisicalSecret")]
+    [OutputType(typeof(Dictionary<string, SecureString>))]
+    [OutputType(typeof(Dictionary<string, string>))]
+    public sealed class ImportInfisicalSecretCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(Mandatory = true, Position = 0)]
+        [ValidateNotNull]
+        public FileInfo Path { get; set; }
+
+        [Parameter(Mandatory = true)]
+        public InfisicalImportFormat Format { get; set; }
+
+        [Parameter]
+        public InfisicalDuplicateKeyBehavior DuplicateKeyBehavior { get; set; } = InfisicalDuplicateKeyBehavior.Error;
+
+        [Parameter]
+        public SwitchParameter AsPlainText { get; set; }
+
+        [Parameter]
+        [Alias("Prefix")]
+        public string SecretsPrefix { get; set; }
+
+        [Parameter]
+        [Alias("ForcePrefix")]
+        public SwitchParameter ForceSecretsPrefix { get; set; }
+
+        protected override void EndProcessing()
+        {
+            try
+            {
+                Path.Refresh();
+                if (!Path.Exists)
+                {
+                    throw new InfisicalImportException(string.Concat("Import path does not exist: ", Path.FullName));
+                }
+
+                IInfisicalImporter importer = InfisicalImporterFactory.Create(Format);
+                IList<KeyValuePair<string, string>> pairs = importer.Import(Path);
+                Logger.Information("Import-InfisicalSecret", string.Concat("Parsed ", pairs.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " secret pair(s) from '", Path.FullName, "' (format=", Format.ToString(), ")."));
+
+                if (AsPlainText.IsPresent)
+                {
+                    Dictionary<string, string> plain = BuildDictionary<string>(pairs, value => value ?? string.Empty);
+                    Logger.Information("Import-InfisicalSecret", string.Concat("Built plain-text dictionary with ", plain.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " entry/entries."));
+                    WriteObject(plain);
+                }
+                else
+                {
+                    Dictionary<string, SecureString> secure = BuildDictionary<SecureString>(pairs, value => SecureStringUtility.ToReadOnlySecureString(value ?? string.Empty));
+                    Logger.Information("Import-InfisicalSecret", string.Concat("Built SecureString dictionary with ", secure.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " entry/entries."));
+                    WriteObject(secure);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("ImportInfisicalSecretCmdlet", "ImportSecret", exception);
+            }
+        }
+
+        private Dictionary<string, TValue> BuildDictionary<TValue>(
+            IList<KeyValuePair<string, string>> pairs,
+            Func<string, TValue> valueSelector)
+        {
+            Dictionary<string, TValue> dictionary = new Dictionary<string, TValue>(StringComparer.OrdinalIgnoreCase);
+
+            foreach (KeyValuePair<string, string> pair in pairs)
+            {
+                if (pair.Key == null) { continue; }
+                string key = InfisicalPrefix.Apply(pair.Key, SecretsPrefix, ForceSecretsPrefix.IsPresent);
+
+                if (dictionary.ContainsKey(key))
+                {
+                    if (DuplicateKeyBehavior == InfisicalDuplicateKeyBehavior.Error)
+                    {
+                        throw new InfisicalConfigurationException(string.Concat("Duplicate secret name encountered: ", key));
+                    }
+
+                    if (DuplicateKeyBehavior == InfisicalDuplicateKeyBehavior.LastWins)
+                    {
+                        dictionary[key] = valueSelector(pair.Value);
+                    }
+
+                    continue;
+                }
+
+                dictionary[key] = valueSelector(pair.Value);
+            }
+
+            return dictionary;
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/InfisicalCmdletBase.cs

@@ -1,5 +1,9 @@
 using System;
+using System.Collections.ObjectModel;
+using System.Globalization;
 using System.Management.Automation;
+using System.Runtime.ExceptionServices;
+using System.Security.Cryptography.X509Certificates;
 using PSInfisicalAPI.Connections;
 using PSInfisicalAPI.Errors;
 using PSInfisicalAPI.Http;
@@ -11,6 +15,7 @@ namespace PSInfisicalAPI.Cmdlets
     {
         private IInfisicalLogger _logger;
         private IInfisicalHttpClient _httpClient;
+        private bool? _isElevated;
 
         protected IInfisicalLogger Logger
         {
@@ -44,12 +49,104 @@ namespace PSInfisicalAPI.Cmdlets
             return current != null && current.SkipCertificateCheck;
         }
 
+        /// <summary>
+        /// Reports whether the host process is running elevated. Evaluated through the PowerShell engine rather
+        /// than WindowsIdentity directly, because the module targets netstandard2.0 and does not carry a
+        /// System.Security.Principal.Windows reference. Cached for the lifetime of the cmdlet instance.
+        /// </summary>
+        protected bool IsElevated()
+        {
+            if (_isElevated.HasValue) { return _isElevated.Value; }
+
+            try
+            {
+                Collection<PSObject> results = InvokeCommand.InvokeScript(
+                    "[bool]([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)");
+                _isElevated = results != null
+                    && results.Count > 0
+                    && results[0] != null
+                    && results[0].BaseObject != null
+                    && Convert.ToBoolean(results[0].BaseObject, CultureInfo.InvariantCulture);
+            }
+            catch (Exception exception)
+            {
+                Logger.Verbose(GetType().Name, string.Concat("Elevation check failed; assuming non-elevated. ", exception.Message));
+                _isElevated = false;
+            }
+
+            return _isElevated.Value;
+        }
+
+        /// <summary>
+        /// Picks the certificate store location when the caller did not bind -StoreLocation. An elevated process
+        /// installs machine-wide so services and other users can use the certificate; a non-elevated one has no
+        /// write access to LocalMachine and falls back to the user's own stores.
+        /// </summary>
+        protected StoreLocation ResolveStoreLocation(StoreLocation boundValue)
+        {
+            if (MyInvocation != null && MyInvocation.BoundParameters.ContainsKey("StoreLocation"))
+            {
+                return boundValue;
+            }
+
+            bool elevated = IsElevated();
+            StoreLocation resolved = elevated ? StoreLocation.LocalMachine : StoreLocation.CurrentUser;
+            Logger.Information(GetType().Name, string.Concat(
+                "Process is ", elevated ? "elevated" : "not elevated",
+                "; defaulting -StoreLocation to ", resolved.ToString(),
+                ". Pass -StoreLocation explicitly to override."));
+
+            return resolved;
+        }
+
+        /// <summary>
+        /// Reports an operation failure as a non-terminating error, which is what lets -ErrorAction decide the
+        /// outcome: Continue prints and carries on, SilentlyContinue and Ignore suppress, Inquire prompts, and
+        /// Stop is promoted by the engine into a terminating error that try/catch sees. Scripts that want to
+        /// catch these must ask for it with -ErrorAction Stop or $ErrorActionPreference = 'Stop'.
+        /// </summary>
+        protected void WriteErrorForException(string component, string operation, Exception exception)
+        {
+            ErrorRecord record = BuildFailureRecord(component, operation, exception);
+            WriteError(record);
+        }
+
+        /// <summary>
+        /// Reports a failure the cmdlet cannot continue past regardless of -ErrorAction. Reserved for aborts that
+        /// are not per-item failures; ordinary operation failures belong on <see cref="WriteErrorForException"/>.
+        /// </summary>
         protected void ThrowTerminatingForException(string component, string operation, Exception exception)
         {
+            ErrorRecord record = BuildFailureRecord(component, operation, exception);
+            ThrowTerminatingError(record);
+        }
+
+        private ErrorRecord BuildFailureRecord(string component, string operation, Exception exception)
+        {
+            if (IsPipelineControlException(exception))
+            {
+                ExceptionDispatchInfo.Capture(exception).Throw();
+            }
+
             InfisicalErrorDetails details = InfisicalErrorHandler.BuildDetails(component, operation, exception);
             InfisicalErrorHandler.LogFailure(Logger, details);
-            ErrorRecord record = InfisicalErrorHandler.ToErrorRecord(exception, details);
-            ThrowTerminatingError(record);
+            return InfisicalErrorHandler.ToErrorRecord(exception, details);
+        }
+
+        /// <summary>
+        /// Identifies exceptions the PowerShell engine uses to unwind a pipeline rather than to report a fault.
+        /// Downstream cmdlets that stop early (<c>Select-Object -First</c>, <c>Where-Object</c> feeding such a
+        /// cmdlet, Ctrl+C) make <see cref="System.Management.Automation.Cmdlet.WriteObject(object)"/> throw one of
+        /// these. Reporting them as errors turns a normal early exit into spurious "The pipeline has been stopped."
+        /// output, so they must propagate untouched.
+        /// </summary>
+        protected static bool IsPipelineControlException(Exception exception)
+        {
+            // StopUpstreamCommandsException (internal, thrown by Select-Object -First) derives from
+            // PipelineStoppedException, so the base type covers it.
+            return exception is PipelineStoppedException
+                || exception is PipelineClosedException
+                || exception is HaltCommandException;
         }
 
         protected string ResolveApiVersion(InfisicalConnection connection, string explicitValue)

src/PSInfisicalAPI/Cmdlets/InstallInfisicalCertificateCmdlet.cs

@@ -32,20 +32,22 @@ namespace PSInfisicalAPI.Cmdlets
         {
             try
             {
+                StoreLocation resolvedStoreLocation = ResolveStoreLocation(StoreLocation);
+
                 X509Certificate2 cert = ResolveCertificate();
                 if (cert == null)
                 {
                     return;
                 }
 
-                InstallCertificate(cert, StoreName, StoreLocation);
+                InstallCertificate(cert, StoreName, resolvedStoreLocation);
 
                 if (IncludeChain.IsPresent && string.Equals(ParameterSetName, "FromCertificate", StringComparison.Ordinal) == false)
                 {
                     foreach (X509Certificate2 chainCert in ResolveChain())
                     {
                         StoreName chainStore = InfisicalCertificateRequestHelpers.GetChainCertificateTargetStore(chainCert);
-                        InstallCertificate(chainCert, chainStore, StoreLocation);
+                        InstallCertificate(chainCert, chainStore, resolvedStoreLocation);
                     }
                 }
 
@@ -56,7 +58,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("InstallInfisicalCertificateCmdlet", "InstallCertificate", exception);
+                WriteErrorForException("InstallInfisicalCertificateCmdlet", "InstallCertificate", exception);
             }
         }
 
@@ -88,6 +90,7 @@ namespace PSInfisicalAPI.Cmdlets
                     return;
                 }
 
+                InfisicalCertificateRequestHelpers.WarnIfInteractiveTrustPromptExpected(storeName, storeLocation, Logger, "InstallInfisicalCertificateCmdlet");
                 store.Add(cert);
                 Logger.Information("InstallInfisicalCertificateCmdlet", string.Concat("Installed certificate to ", target, "."));
             }

src/PSInfisicalAPI/Cmdlets/NewInfisicalEnvironmentCmdlet.cs

@@ -34,7 +34,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("NewInfisicalEnvironmentCmdlet", "CreateEnvironment", exception);
+                WriteErrorForException("NewInfisicalEnvironmentCmdlet", "CreateEnvironment", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/NewInfisicalFolderCmdlet.cs

@@ -34,7 +34,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("NewInfisicalFolderCmdlet", "CreateFolder", exception);
+                WriteErrorForException("NewInfisicalFolderCmdlet", "CreateFolder", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/NewInfisicalOrganizationCmdlet.cs

@@ -0,0 +1,39 @@
+using System;
+using System.Management.Automation;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.Organizations;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsCommon.New, "InfisicalOrganization", SupportsShouldProcess = true)]
+    [OutputType(typeof(InfisicalOrganization))]
+    public sealed class NewInfisicalOrganizationCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(Mandatory = true, Position = 0)] public string Name { get; set; }
+        [Parameter] public string Slug { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                if (!ShouldProcess(Name, "Create Infisical organization"))
+                {
+                    return;
+                }
+
+                InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
+                InfisicalOrganizationClient client = new InfisicalOrganizationClient(HttpClient, Logger);
+                InfisicalOrganization organization = client.Create(connection, Name, Slug);
+                if (organization != null)
+                {
+                    WriteObject(organization);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("NewInfisicalOrganizationCmdlet", "CreateOrganization", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/NewInfisicalProjectCmdlet.cs

@@ -40,7 +40,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("NewInfisicalProjectCmdlet", "CreateProject", exception);
+                WriteErrorForException("NewInfisicalProjectCmdlet", "CreateProject", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/NewInfisicalScepDynamicChallengeCmdlet.cs

@@ -42,7 +42,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("NewInfisicalScepDynamicChallengeCmdlet", "GenerateScepDynamicChallenge", exception);
+                WriteErrorForException("NewInfisicalScepDynamicChallengeCmdlet", "GenerateScepDynamicChallenge", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/NewInfisicalSecretCmdlet.cs

@@ -58,10 +58,12 @@ namespace PSInfisicalAPI.Cmdlets
                         Secrets = InfisicalBulkSecretConverter.ToCreateItems(Secrets)
                     };
 
+                    Logger.Information("New-InfisicalSecret", string.Concat("Bulk-creating ", Secrets.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " secret(s)."));
                     InfisicalSecretsClient bulkClient = new InfisicalSecretsClient(HttpClient, Logger);
                     InfisicalSecret[] created = bulkClient.CreateBatch(connection, bulk);
                     if (created != null)
                     {
+                        Logger.Information("New-InfisicalSecret", string.Concat("Server returned ", created.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " created secret(s)."));
                         foreach (InfisicalSecret secret in created) { WriteObject(secret); }
                     }
 
@@ -97,7 +99,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("NewInfisicalSecretCmdlet", "CreateSecret", exception);
+                WriteErrorForException("NewInfisicalSecretCmdlet", "CreateSecret", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/NewInfisicalSubOrganizationCmdlet.cs

@@ -0,0 +1,39 @@
+using System;
+using System.Management.Automation;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.SubOrganizations;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsCommon.New, "InfisicalSubOrganization", SupportsShouldProcess = true)]
+    [OutputType(typeof(InfisicalSubOrganization))]
+    public sealed class NewInfisicalSubOrganizationCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(Mandatory = true, Position = 0)] public string Name { get; set; }
+        [Parameter(Mandatory = true, Position = 1)] public string Slug { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                if (!ShouldProcess(Name, "Create Infisical sub-organization"))
+                {
+                    return;
+                }
+
+                InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
+                InfisicalSubOrganizationClient client = new InfisicalSubOrganizationClient(HttpClient, Logger);
+                InfisicalSubOrganization subOrganization = client.Create(connection, Name, Slug);
+                if (subOrganization != null)
+                {
+                    WriteObject(subOrganization);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("NewInfisicalSubOrganizationCmdlet", "CreateSubOrganization", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/NewInfisicalTagCmdlet.cs

@@ -34,7 +34,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("NewInfisicalTagCmdlet", "CreateTag", exception);
+                WriteErrorForException("NewInfisicalTagCmdlet", "CreateTag", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/RemoveInfisicalEnvironmentCmdlet.cs

@@ -35,7 +35,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("RemoveInfisicalEnvironmentCmdlet", "DeleteEnvironment", exception);
+                WriteErrorForException("RemoveInfisicalEnvironmentCmdlet", "DeleteEnvironment", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/RemoveInfisicalFolderCmdlet.cs

@@ -37,7 +37,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("RemoveInfisicalFolderCmdlet", "DeleteFolder", exception);
+                WriteErrorForException("RemoveInfisicalFolderCmdlet", "DeleteFolder", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/RemoveInfisicalOrganizationCmdlet.cs

@@ -0,0 +1,42 @@
+using System;
+using System.Management.Automation;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Organizations;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsCommon.Remove, "InfisicalOrganization", SupportsShouldProcess = true, ConfirmImpact = ConfirmImpact.High)]
+    public sealed class RemoveInfisicalOrganizationCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(Mandatory = true, ValueFromPipelineByPropertyName = true, Position = 0)]
+        [Alias("Id")]
+        public string OrganizationId { get; set; }
+
+        [Parameter] public SwitchParameter PassThru { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
+
+                if (!ShouldProcess(OrganizationId, "Remove Infisical organization"))
+                {
+                    return;
+                }
+
+                InfisicalOrganizationClient client = new InfisicalOrganizationClient(HttpClient, Logger);
+                client.Delete(connection, OrganizationId);
+
+                if (PassThru.IsPresent)
+                {
+                    WriteObject(OrganizationId);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("RemoveInfisicalOrganizationCmdlet", "DeleteOrganization", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/RemoveInfisicalProjectCmdlet.cs

@@ -35,7 +35,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("RemoveInfisicalProjectCmdlet", "DeleteProject", exception);
+                WriteErrorForException("RemoveInfisicalProjectCmdlet", "DeleteProject", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/RemoveInfisicalSecretCmdlet.cs

@@ -47,6 +47,7 @@ namespace PSInfisicalAPI.Cmdlets
                         SecretNames = SecretNames
                     };
 
+                    Logger.Information("Remove-InfisicalSecret", string.Concat("Bulk-removing ", SecretNames.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " secret(s)."));
                     client.DeleteBatch(connection, bulk);
 
                     if (PassThru.IsPresent)
@@ -78,7 +79,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("RemoveInfisicalSecretCmdlet", "DeleteSecret", exception);
+                WriteErrorForException("RemoveInfisicalSecretCmdlet", "DeleteSecret", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/RemoveInfisicalSubOrganizationCmdlet.cs

@@ -0,0 +1,42 @@
+using System;
+using System.Management.Automation;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.SubOrganizations;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsCommon.Remove, "InfisicalSubOrganization", SupportsShouldProcess = true, ConfirmImpact = ConfirmImpact.High)]
+    public sealed class RemoveInfisicalSubOrganizationCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(Mandatory = true, ValueFromPipelineByPropertyName = true, Position = 0)]
+        [Alias("Id")]
+        public string SubOrganizationId { get; set; }
+
+        [Parameter] public SwitchParameter PassThru { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
+
+                if (!ShouldProcess(SubOrganizationId, "Remove Infisical sub-organization"))
+                {
+                    return;
+                }
+
+                InfisicalSubOrganizationClient client = new InfisicalSubOrganizationClient(HttpClient, Logger);
+                client.Delete(connection, SubOrganizationId);
+
+                if (PassThru.IsPresent)
+                {
+                    WriteObject(SubOrganizationId);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("RemoveInfisicalSubOrganizationCmdlet", "DeleteSubOrganization", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/RemoveInfisicalTagCmdlet.cs

@@ -35,7 +35,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("RemoveInfisicalTagCmdlet", "DeleteTag", exception);
+                WriteErrorForException("RemoveInfisicalTagCmdlet", "DeleteTag", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/RequestInfisicalCertificateCmdlet.cs

@@ -4,6 +4,7 @@ using System.Collections.Generic;
 using System.Management.Automation;
 using System.Security.Cryptography.X509Certificates;
 using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Errors;
 using PSInfisicalAPI.Models;
 using PSInfisicalAPI.Pki;
 
@@ -48,7 +49,15 @@ namespace PSInfisicalAPI.Cmdlets
         [Parameter(ParameterSetName = "ByProfile")] public string NotBefore { get; set; }
         [Parameter(ParameterSetName = "ByCa")]
         [Parameter(ParameterSetName = "ByProfile")] public string NotAfter { get; set; }
-        [Parameter(ParameterSetName = "ByCa")] public string FriendlyName { get; set; }
+        // Available on every parameter set: it names the installed certificate in the Windows store. The CA path
+        // additionally forwards it to Infisical as the issued certificate's friendlyName.
+        [Parameter] public string FriendlyName { get; set; }
+
+        /// <summary>
+        /// Metadata to attach to the issued or reused certificate. Only the supplied keys are reconciled;
+        /// any other metadata already on the certificate is left alone.
+        /// </summary>
+        [Parameter] public IDictionary Metadata { get; set; }
         [Parameter(ParameterSetName = "ByCa")] public string PkiCollectionId { get; set; }
         [Parameter(ParameterSetName = "ByCa")]
         [Parameter(ParameterSetName = "ByProfile")] public string[] KeyUsage { get; set; }
@@ -78,12 +87,16 @@ namespace PSInfisicalAPI.Cmdlets
                 InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
                 InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
 
+                // Resolved once so reuse detection looks in the same stores the install will write to.
+                StoreLocation resolvedStoreLocation = ResolveStoreLocation(StoreLocation);
+
                 InfisicalCsrSubject csrSubject = InfisicalCertificateRequestHelpers.MergeSubject(Subject, CommonName, Country, State, Locality, Organization, OrganizationalUnit, EmailAddress);
-                List<string> dnsNames = BuildDnsNames(csrSubject);
+                List<string> ipAddresses = new List<string>();
+                List<string> dnsNames = BuildDnsNames(csrSubject, ipAddresses);
                 if (string.IsNullOrEmpty(csrSubject.CommonName) && dnsNames.Count > 0) { csrSubject.CommonName = dnsNames[0]; }
                 if (string.IsNullOrEmpty(csrSubject.CommonName)) { throw new InvalidOperationException("Subject CommonName could not be determined and no DnsName was provided."); }
 
-                X509Certificate2 existing = TryFindExisting(client, connection, ProjectId, csrSubject.CommonName);
+                X509Certificate2 existing = TryFindExisting(client, connection, ProjectId, csrSubject.CommonName, resolvedStoreLocation, dnsNames, ipAddresses);
                 if (existing != null && !Force.IsPresent && !(AllowRenewal.IsPresent && InfisicalLocalCertificateLookup.IsRenewable(existing, RenewalThresholdDays)))
                 {
                     Logger.Information(Component, string.Concat("Reusing existing certificate (Thumbprint=", existing.Thumbprint, ", NotAfter=", existing.NotAfter.ToString("u"), ")."));
@@ -104,20 +117,26 @@ namespace PSInfisicalAPI.Cmdlets
                         }
                         catch (Exception bundleException)
                         {
+                            if (IsPipelineControlException(bundleException)) { throw; }
                             Logger.Verbose(Component, string.Concat("Infisical bundle fetch for reuse path failed (continuing with local-only chain): ", bundleException.Message));
                         }
                     }
 
+                    // Reconciled on the reuse path too, so a metadata change lands without forcing reissuance.
+                    reuseResult.Metadata = ApplyMetadata(client, connection, existing.SerialNumber);
+
                     WriteObject(reuseResult);
                     return;
                 }
 
-                string target = string.Concat("PKI subscriber '", PkiSubscriberSlug ?? "(n/a)", "', CA '", CertificateAuthorityId ?? "(n/a)", "', or profile '", CertificateProfileId ?? "(n/a)", "' for CN=", csrSubject.CommonName);
+                string issuer = ResolveIssuancePath(client, connection);
+
+                string target = string.Concat(issuer, " for CN=", csrSubject.CommonName);
                 if (!ShouldProcess(target, "Request new certificate")) { return; }
 
                 InfisicalCsrOptions csrOptions = new InfisicalCsrOptions { KeyAlgorithm = KeyAlgorithm, RsaKeySize = KeySize, EcCurve = Curve };
-                InfisicalCsrResult csr = InfisicalCsrBuilder.Build(csrSubject, dnsNames, IpAddress, csrOptions);
-                InfisicalSignedCertificate signed = SignCertificate(client, connection, ProjectId, csr.CsrPem);
+                InfisicalCsrResult csr = InfisicalCsrBuilder.Build(csrSubject, dnsNames, ipAddresses, csrOptions);
+                InfisicalSignedCertificate signed = SignCertificate(client, connection, ProjectId, csr.CsrPem, csrSubject);
                 signed.PrivateKeyPem = csr.PrivateKeyPem;
 
                 if (string.IsNullOrEmpty(signed.CertificatePem))
@@ -129,19 +148,29 @@ namespace PSInfisicalAPI.Cmdlets
                     return;
                 }
 
-                X509KeyStorageFlags resolvedFlags = ResolveEffectiveKeyStorageFlags();
+                X509KeyStorageFlags resolvedFlags = ResolveEffectiveKeyStorageFlags(resolvedStoreLocation);
                 X509Certificate2 cert = PemCertificateBuilder.Build(signed.CertificatePem, signed.PrivateKeyPem, signed.CertificateChainPem, resolvedFlags);
 
+                InfisicalCertificateRequestHelpers.ApplyFriendlyName(cert, ResolveLocalFriendlyName(csrSubject), Logger, Component);
+
                 if (Install.IsPresent)
                 {
-                    InfisicalCertificateRequestHelpers.InstallToStore(cert, StoreName, StoreLocation, Force.IsPresent, Logger, Component);
+                    // Issuers first, so the leaf is already chainable the moment it lands in the store.
                     if (InstallChain.IsPresent)
                     {
-                        InfisicalCertificateRequestHelpers.InstallChain(signed, StoreLocation, Force.IsPresent, Logger, Component);
+                        InfisicalCertificateRequestHelpers.InstallChain(signed, resolvedStoreLocation, Force.IsPresent, Logger, Component);
+                    }
+
+                    InfisicalCertificateRequestHelpers.InstallToStore(cert, StoreName, resolvedStoreLocation, Force.IsPresent, Logger, Component);
+
+                    if (InstallChain.IsPresent)
+                    {
+                        InfisicalCertificateRequestHelpers.VerifyInstalledChain(cert, Logger, Component);
                     }
                 }
 
                 InfisicalCertificateResult resultObj = InfisicalCertificateRequestHelpers.BuildResult(cert, signed);
+                resultObj.Metadata = ApplyMetadata(client, connection, signed.SerialNumber);
 
                 bool hasExplicitPath = !string.IsNullOrEmpty(PrivateKeyPath);
                 if (hasExplicitPath && !string.IsNullOrEmpty(resultObj.PrivateKeyPem))
@@ -160,55 +189,324 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException(Component, "RequestCertificate", exception);
+                WriteErrorForException(Component, "RequestCertificate", exception);
             }
         }
 
-        private List<string> BuildDnsNames(InfisicalCsrSubject subject)
+        /// <summary>
+        /// Reconciles -Metadata onto the certificate identified by <paramref name="serialNumber"/> and returns
+        /// the certificate's resulting metadata. Only the supplied keys are touched, so a certificate can carry
+        /// metadata from several sources without them overwriting each other.
+        /// <para>
+        /// Metadata never fails an issuance that otherwise succeeded: by the time this runs the certificate
+        /// exists and may already be installed, so a failure here is reported as a warning and the certificate
+        /// is still emitted.
+        /// </para>
+        /// </summary>
+        private Dictionary<string, string> ApplyMetadata(InfisicalPkiClient client, InfisicalConnection connection, string serialNumber)
+        {
+            Dictionary<string, string> desired = NormalizeMetadata(Metadata);
+            if (desired.Count == 0) { return null; }
+
+            if (string.IsNullOrEmpty(serialNumber))
+            {
+                Logger.Warning(Component, "-Metadata was supplied but the certificate has no serial number to identify it by; metadata was not applied.");
+                return null;
+            }
+
+            try
+            {
+                InfisicalCertificate record = client.RetrieveCertificate(connection, serialNumber);
+                if (record == null || string.IsNullOrEmpty(record.Id))
+                {
+                    Logger.Warning(Component, string.Concat("-Metadata was supplied but certificate '", serialNumber, "' could not be resolved in Infisical; metadata was not applied."));
+                    return null;
+                }
+
+                Dictionary<string, string> result = client.ReconcileCertificateMetadata(connection, record.Id, desired);
+                Logger.Information(Component, string.Concat(
+                    "Reconciled ", desired.Count.ToString(System.Globalization.CultureInfo.InvariantCulture),
+                    " metadata key(s) onto certificate '", record.Id, "'; it now carries ",
+                    (result != null ? result.Count : 0).ToString(System.Globalization.CultureInfo.InvariantCulture), " key(s)."));
+
+                return result;
+            }
+            catch (Exception metadataException)
+            {
+                if (IsPipelineControlException(metadataException)) { throw; }
+                Logger.Warning(Component, string.Concat("The certificate was issued but its metadata could not be applied: ", metadataException.Message));
+                return null;
+            }
+        }
+
+        /// <summary>
+        /// Flattens the caller's dictionary into string key/value pairs. PowerShell hands over hashtables whose
+        /// keys and values are arbitrary objects, and the API accepts only strings.
+        /// </summary>
+        internal static Dictionary<string, string> NormalizeMetadata(IDictionary source)
+        {
+            Dictionary<string, string> result = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            if (source == null) { return result; }
+
+            foreach (DictionaryEntry entry in source)
+            {
+                if (entry.Key == null) { continue; }
+
+                string key = Convert.ToString(entry.Key, System.Globalization.CultureInfo.InvariantCulture);
+                if (string.IsNullOrWhiteSpace(key)) { continue; }
+                key = key.Trim();
+
+                string value = entry.Value != null
+                    ? Convert.ToString(entry.Value, System.Globalization.CultureInfo.InvariantCulture)
+                    : string.Empty;
+
+                result[key] = value ?? string.Empty;
+            }
+
+            return result;
+        }
+
+        /// <summary>
+        /// The Windows friendly name shown in certmgr. Defaults to the common name in upper case, which is the
+        /// host identity operators look for; -FriendlyName overrides it.
+        /// </summary>
+        private string ResolveLocalFriendlyName(InfisicalCsrSubject subject)
+        {
+            if (!string.IsNullOrEmpty(FriendlyName)) { return FriendlyName; }
+            if (subject == null || string.IsNullOrEmpty(subject.CommonName)) { return null; }
+            return subject.CommonName.ToUpperInvariant();
+        }
+
+        /// <summary>
+        /// States which issuer will sign this request, and rejects an unusable one before a keypair is generated.
+        /// Direct CA signing is only permitted when the CA has direct issuance enabled; without this check the
+        /// cmdlet builds a CSR and learns that from a 400 at the very end.
+        /// </summary>
+        private string ResolveIssuancePath(InfisicalPkiClient client, InfisicalConnection connection)
+        {
+            if (string.Equals(ParameterSetName, "BySubscriber", StringComparison.Ordinal))
+            {
+                Logger.Information(Component, string.Concat("Issuing via PKI subscriber '", PkiSubscriberSlug, "' in project '", ProjectId, "'."));
+                return string.Concat("PKI subscriber '", PkiSubscriberSlug, "'");
+            }
+
+            if (string.Equals(ParameterSetName, "ByProfile", StringComparison.Ordinal))
+            {
+                Logger.Information(Component, string.Concat("Issuing via certificate profile '", CertificateProfileId, "' in project '", ProjectId, "'."));
+                return string.Concat("certificate profile '", CertificateProfileId, "'");
+            }
+
+            InfisicalCertificateAuthority ca = null;
+            try
+            {
+                ca = client.GetInternalCertificateAuthority(connection, CertificateAuthorityId, ProjectId);
+            }
+            catch (Exception lookupException)
+            {
+                if (IsPipelineControlException(lookupException)) { throw; }
+
+                // A caller may be able to sign without permission to read the CA record. Defer to the API.
+                Logger.Verbose(Component, string.Concat("Could not read certificate authority '", CertificateAuthorityId, "' for preflight (continuing): ", lookupException.Message));
+                return string.Concat("certificate authority '", CertificateAuthorityId, "'");
+            }
+
+            if (ca != null && ca.EnableDirectIssuance.HasValue && !ca.EnableDirectIssuance.Value)
+            {
+                throw new InfisicalConfigurationException(BuildDirectIssuanceGuidance(ca));
+            }
+
+            string caLabel = ca != null ? (ca.Name ?? ca.FriendlyName ?? CertificateAuthorityId) : CertificateAuthorityId;
+            Logger.Information(Component, string.Concat("Issuing directly via certificate authority '", caLabel, "' (", CertificateAuthorityId, "); direct issuance is enabled."));
+            return string.Concat("certificate authority '", caLabel, "'");
+        }
+
+        /// <summary>
+        /// Restates the direct-issuance restriction in terms of the parameters that resolve it. Infisical's REST
+        /// API exposes no certificate-template issuance route, so the alternatives are a subscriber or a profile.
+        /// </summary>
+        private string BuildDirectIssuanceGuidance(InfisicalCertificateAuthority ca)
+        {
+            string caLabel = ca != null ? (ca.Name ?? ca.FriendlyName ?? CertificateAuthorityId) : CertificateAuthorityId;
+            return string.Concat(
+                "Certificate authority '", caLabel, "' (", CertificateAuthorityId, ") has direct issuance disabled, so it cannot sign a CSR on its own. ",
+                "Either enable direct issuance on the CA in Infisical (Certificate Authorities > the CA > Enable Direct Issuance), ",
+                "or issue through a subscriber or profile instead: Request-InfisicalCertificate -PkiSubscriberSlug <name> (see Get-InfisicalPkiSubscriber -ProjectId '", ProjectId ?? "<projectId>", "') ",
+                "or -CertificateProfileId <id> (see Get-InfisicalCertificateProfile).");
+        }
+
+        /// <summary>
+        /// Splits the requested SAN values into DNS names and IP addresses. Get-InfisicalSANList emits both kinds
+        /// in one list, so IP literals arriving through -DnsName are routed to the IP SAN bucket rather than
+        /// emitted as malformed dNSName entries.
+        /// </summary>
+        private List<string> BuildDnsNames(InfisicalCsrSubject subject, List<string> ipAddresses)
         {
             List<string> result = new List<string>();
-            if (DnsName != null) { foreach (string dns in DnsName) { if (!string.IsNullOrEmpty(dns)) { result.Add(dns); } } }
-            if (result.Count == 0)
+            AddSanCandidates(DnsName, result, ipAddresses);
+            AddSanCandidates(IpAddress, null, ipAddresses);
+
+            // Fall back to the local FQDN only when no SAN of either kind was requested; an explicit IP-only
+            // request must not silently pick up this machine's name.
+            if (result.Count == 0 && ipAddresses.Count == 0)
             {
                 string fqdn = InfisicalCertificateRequestHelpers.ResolveLocalFqdn();
                 if (!string.IsNullOrEmpty(fqdn)) { result.Add(fqdn); }
             }
 
-            if (!string.IsNullOrEmpty(subject.CommonName) && !result.Contains(subject.CommonName)) { result.Insert(0, subject.CommonName); }
+            // The common name is mirrored into the SAN list because most validators ignore a CN that has no
+            // matching SAN entry. An IP common name belongs in the iPAddress bucket, not the dNSName one.
+            if (!string.IsNullOrEmpty(subject.CommonName))
+            {
+                if (IsIpLiteral(subject.CommonName))
+                {
+                    if (!ipAddresses.Contains(subject.CommonName)) { ipAddresses.Insert(0, subject.CommonName); }
+                }
+                else if (!result.Contains(subject.CommonName))
+                {
+                    result.Insert(0, subject.CommonName);
+                }
+            }
+
             return result;
         }
 
-        private X509Certificate2 TryFindExisting(InfisicalPkiClient client, InfisicalConnection connection, string projectId, string commonName)
+        private static void AddSanCandidates(IEnumerable<string> candidates, List<string> dnsNames, List<string> ipAddresses)
+        {
+            if (candidates == null) { return; }
+            foreach (string candidate in candidates)
+            {
+                if (string.IsNullOrEmpty(candidate)) { continue; }
+                string value = candidate.Trim();
+                if (value.Length == 0) { continue; }
+
+                List<string> bucket = IsIpLiteral(value) ? ipAddresses : dnsNames;
+                if (bucket != null && !bucket.Contains(value)) { bucket.Add(value); }
+            }
+        }
+
+        private static bool IsIpLiteral(string value)
+        {
+            System.Net.IPAddress parsed;
+            return System.Net.IPAddress.TryParse(value, out parsed);
+        }
+
+        /// <summary>
+        /// Finds a still-valid local certificate that this same request would have produced. The match is scoped
+        /// to the issuer being asked for: a certificate issued by a different profile or CA carries different key
+        /// usages and policy, so reusing one across issuers hands back a certificate that does not satisfy the
+        /// request that was actually made.
+        /// </summary>
+        private X509Certificate2 TryFindExisting(InfisicalPkiClient client, InfisicalConnection connection, string projectId, string commonName, StoreLocation storeLocation, List<string> requestedDnsNames, List<string> requestedIpAddresses)
         {
             List<string> candidateSerials = new List<string>();
+            bool searchCompleted = false;
+
             try
             {
-                InfisicalCertificateSearchQuery query = new InfisicalCertificateSearchQuery { ProjectId = projectId, CommonName = commonName, Status = "active", Limit = 50 };
+                InfisicalCertificateSearchQuery query = new InfisicalCertificateSearchQuery
+                {
+                    ProjectId = projectId,
+                    CommonName = commonName,
+                    Status = "active",
+                    Limit = 50
+                };
+
+                string scope = ApplyIssuerScope(query);
+
                 InfisicalCertificateSearchResult page = client.SearchCertificates(connection, query);
+                searchCompleted = true;
                 if (page != null && page.Certificates != null)
                 {
                     foreach (InfisicalCertificate hit in page.Certificates) { if (!string.IsNullOrEmpty(hit.SerialNumber)) { candidateSerials.Add(hit.SerialNumber); } }
                 }
+
+                Logger.Verbose(Component, string.Concat(
+                    "Reuse search for CN=", commonName, " scoped to ", scope, " returned ",
+                    candidateSerials.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " active certificate(s)."));
             }
             catch (Exception searchException)
             {
+                if (IsPipelineControlException(searchException)) { throw; }
                 Logger.Verbose(Component, string.Concat("Infisical search for idempotency check failed: ", searchException.Message));
             }
 
-            return InfisicalLocalCertificateLookup.FindMatch(StoreName, StoreLocation, commonName, candidateSerials);
+            // A completed search that found nothing is a definite answer: this issuer has never issued for this
+            // common name, so there is nothing to reuse. Falling through to a name-only local match here is what
+            // let a certificate from another profile be handed back.
+            if (searchCompleted && candidateSerials.Count == 0)
+            {
+                return null;
+            }
+
+            if (!searchCompleted)
+            {
+                Logger.Warning(Component, string.Concat(
+                    "Could not confirm with Infisical which certificates belong to this issuer, so reuse falls back to ",
+                    "matching on the common name alone. That can return a certificate issued by a different profile or CA; ",
+                    "pass -Force to issue unconditionally."));
+            }
+
+            string missingName;
+            X509Certificate2 match = InfisicalLocalCertificateLookup.FindMatch(
+                StoreName, storeLocation, commonName, candidateSerials, requestedDnsNames, requestedIpAddresses, out missingName);
+
+            if (match == null && missingName != null)
+            {
+                Logger.Information(Component, string.Concat(
+                    "An existing certificate for CN=", commonName, " does not carry the requested name ", missingName,
+                    "; requesting a new certificate rather than reusing one that would fail validation for it."));
+            }
+
+            return match;
         }
 
-        private X509KeyStorageFlags ResolveEffectiveKeyStorageFlags()
+        /// <summary>
+        /// Narrows a certificate search to the issuer this invocation targets, and names that scope for logging.
+        /// The subscriber path has no server-side filter, but a subscriber pins its own common name, so matching
+        /// on the name is already equivalent to matching on the subscriber.
+        /// </summary>
+        private string ApplyIssuerScope(InfisicalCertificateSearchQuery query)
+        {
+            if (!string.IsNullOrEmpty(CertificateProfileId))
+            {
+                query.ProfileIds = new[] { CertificateProfileId };
+                return string.Concat("certificate profile '", CertificateProfileId, "'");
+            }
+
+            if (!string.IsNullOrEmpty(CertificateAuthorityId))
+            {
+                query.CaIds = new[] { CertificateAuthorityId };
+                return string.Concat("certificate authority '", CertificateAuthorityId, "'");
+            }
+
+            if (!string.IsNullOrEmpty(PkiSubscriberSlug))
+            {
+                return string.Concat("PKI subscriber '", PkiSubscriberSlug, "'");
+            }
+
+            return "this project";
+        }
+
+        private X509KeyStorageFlags ResolveEffectiveKeyStorageFlags(StoreLocation storeLocation)
         {
             if (MyInvocation.BoundParameters.ContainsKey("KeyStorageFlags"))
             {
                 return KeyStorageFlags;
             }
 
-            return InfisicalCertificateRequestHelpers.ResolveKeyStorageFlags(PrivateKeyProtection, PersistKey.IsPresent, MachineKey.IsPresent);
+            // A certificate installed into LocalMachine needs its private key in the machine key store, otherwise
+            // the key lands in the calling user's profile and the installed certificate has no usable key for
+            // services or other users.
+            bool machineKey = MachineKey.IsPresent || (Install.IsPresent && storeLocation == StoreLocation.LocalMachine);
+            if (machineKey && !MachineKey.IsPresent)
+            {
+                Logger.Verbose(Component, "Installing to LocalMachine; using a machine key store so the private key is usable outside this user profile.");
+            }
+
+            return InfisicalCertificateRequestHelpers.ResolveKeyStorageFlags(PrivateKeyProtection, PersistKey.IsPresent, machineKey);
         }
 
-        private InfisicalSignedCertificate SignCertificate(InfisicalPkiClient client, InfisicalConnection connection, string projectId, string csrPem)
+        private InfisicalSignedCertificate SignCertificate(InfisicalPkiClient client, InfisicalConnection connection, string projectId, string csrPem, InfisicalCsrSubject subject)
         {
             if (string.Equals(ParameterSetName, "BySubscriber", StringComparison.Ordinal))
             {
@@ -217,11 +515,49 @@ namespace PSInfisicalAPI.Cmdlets
 
             if (string.Equals(ParameterSetName, "ByProfile", StringComparison.Ordinal))
             {
-                InfisicalCsrSubject subject = InfisicalCertificateRequestHelpers.MergeSubject(Subject, CommonName, Country, State, Locality, Organization, OrganizationalUnit, EmailAddress);
                 return client.IssueCertificateByProfile(connection, CertificateProfileId, csrPem, subject.CommonName, subject.Organization, subject.OrganizationalUnit, subject.Country, subject.State, subject.Locality, Ttl, NotBefore, NotAfter, KeyUsage, ExtendedKeyUsage);
             }
 
-            return client.SignCertificateByCa(connection, CertificateAuthorityId, csrPem, CommonName, null, Ttl, NotBefore, NotAfter, FriendlyName, PkiCollectionId, KeyUsage, ExtendedKeyUsage);
+            try
+            {
+                return client.SignCertificateByCa(connection, CertificateAuthorityId, csrPem, subject.CommonName, null, Ttl, NotBefore, NotAfter, FriendlyName, PkiCollectionId, KeyUsage, ExtendedKeyUsage);
+            }
+            catch (InfisicalApiException apiException)
+            {
+                throw EnrichDirectIssuanceFailure(apiException);
+            }
+        }
+
+        /// <summary>
+        /// Backstop for when the preflight in <see cref="ResolveIssuancePath"/> could not read the CA record and
+        /// the API rejects the signing request instead. The raw 400 does not say which cmdlet parameter to reach
+        /// for, so restate it in the module's own terms.
+        /// </summary>
+        private InfisicalApiException EnrichDirectIssuanceFailure(InfisicalApiException apiException)
+        {
+            if (apiException == null || apiException.StatusCode != 400) { return apiException; }
+
+            string apiMessage = apiException.ApiErrorMessage ?? apiException.Message ?? string.Empty;
+            if (apiMessage.IndexOf("template or subscriber", StringComparison.OrdinalIgnoreCase) < 0)
+            {
+                return apiException;
+            }
+
+            string guidance = string.Concat(BuildDirectIssuanceGuidance(null), " Original API error: ", apiMessage);
+
+            return new InfisicalApiException(guidance, apiException)
+            {
+                StatusCode = apiException.StatusCode,
+                ReasonPhrase = apiException.ReasonPhrase,
+                ApiErrorCode = apiException.ApiErrorCode,
+                ApiErrorMessage = apiException.ApiErrorMessage,
+                ApiRequestId = apiException.ApiRequestId,
+                SanitizedBody = apiException.SanitizedBody,
+                EndpointName = apiException.EndpointName,
+                RequestMethod = apiException.RequestMethod,
+                Component = apiException.Component,
+                Operation = apiException.Operation
+            };
         }
     }
 }

src/PSInfisicalAPI/Cmdlets/StartInfisicalProcessCmdlet.cs

@@ -0,0 +1,168 @@
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.IO;
+using System.Management.Automation;
+using System.Text.RegularExpressions;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.Process;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsLifecycle.Start, "InfisicalProcess", DefaultParameterSetName = WindowStyleSet, SupportsShouldProcess = true)]
+    [OutputType(typeof(InfisicalProcessResult))]
+    public sealed class StartInfisicalProcessCmdlet : InfisicalCmdletBase
+    {
+        private const string Component = "StartInfisicalProcessCmdlet";
+        private const string WindowStyleSet = "WindowStyle";
+        private const string CreateNoWindowSet = "CreateNoWindow";
+
+        [Parameter(Mandatory = true, Position = 0)]
+        [ValidateNotNullOrEmpty]
+        [Alias("FP")]
+        public string FilePath { get; set; }
+
+        [Parameter]
+        [Alias("WD")]
+        public DirectoryInfo WorkingDirectory { get; set; }
+
+        [Parameter]
+        [AllowEmptyCollection]
+        [AllowNull]
+        [Alias("AL")]
+        public string[] ArgumentList { get; set; }
+
+        [Parameter]
+        [AllowEmptyCollection]
+        [AllowNull]
+        [Alias("AECL")]
+        public string[] AcceptableExitCodeList { get; set; }
+
+        [Parameter(ParameterSetName = WindowStyleSet)]
+        [ValidateSet("Normal", "Hidden", "Minimized", "Maximized")]
+        [Alias("WS")]
+        public string WindowStyle { get; set; } = "Hidden";
+
+        [Parameter(ParameterSetName = CreateNoWindowSet)]
+        [Alias("CNW")]
+        public SwitchParameter CreateNoWindow { get; set; }
+
+        [Parameter]
+        [Alias("NW")]
+        public SwitchParameter NoWait { get; set; }
+
+        [Parameter]
+        [ValidateSet("AboveNormal", "BelowNormal", "High", "Idle", "Normal", "RealTime")]
+        [Alias("P")]
+        public string Priority { get; set; } = "Normal";
+
+        [Parameter]
+        [Alias("ET")]
+        public TimeSpan ExecutionTimeout { get; set; }
+
+        [Parameter]
+        [Alias("ETI")]
+        public TimeSpan ExecutionTimeoutInterval { get; set; } = TimeSpan.FromSeconds(15);
+
+        [Parameter]
+        [Alias("SIO")]
+        public object[] StandardInputObjectList { get; set; }
+
+        [Parameter]
+        [Alias("ENV")]
+        public IDictionary EnvironmentVariables { get; set; }
+
+        [Parameter]
+        [Alias("StandardOutputParsingExpression", "SOPE", "PE")]
+        public Regex ParsingExpression { get; set; }
+
+        [Parameter]
+        [Alias("SAL")]
+        public SwitchParameter SecureArgumentList { get; set; }
+
+        [Parameter]
+        [Alias("LO")]
+        public SwitchParameter LogOutput { get; set; }
+
+        [Parameter]
+        [Alias("COE")]
+        public SwitchParameter ContinueOnError { get; set; }
+
+        [Parameter(ValueFromPipeline = true)]
+        [Alias("Secret", "InputObject")]
+        public InfisicalSecret[] Secrets { get; set; }
+
+        [Parameter]
+        [Alias("Prefix")]
+        public string SecretsPrefix { get; set; }
+
+        [Parameter]
+        [Alias("ForcePrefix")]
+        public SwitchParameter ForceSecretsPrefix { get; set; }
+
+        private readonly List<InfisicalSecret> _secretBuffer = new List<InfisicalSecret>();
+
+        protected override void ProcessRecord()
+        {
+            if (Secrets == null) { return; }
+            foreach (InfisicalSecret secret in Secrets)
+            {
+                if (secret != null) { _secretBuffer.Add(secret); }
+            }
+        }
+
+        protected override void EndProcessing()
+        {
+            try
+            {
+                string target = string.IsNullOrEmpty(WorkingDirectory != null ? WorkingDirectory.FullName : null)
+                    ? FilePath
+                    : string.Concat(FilePath, " (in ", WorkingDirectory.FullName, ")");
+
+                if (!ShouldProcess(target, "Start process with Infisical secrets")) { return; }
+
+                int envVarCount = EnvironmentVariables != null ? EnvironmentVariables.Count : 0;
+                Logger.Information("Start-InfisicalProcess", string.Concat("Injecting ", _secretBuffer.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " secret(s) and ", envVarCount.ToString(System.Globalization.CultureInfo.InvariantCulture), " explicit environment variable(s) into process environment."));
+
+                InfisicalProcessOptions options = new InfisicalProcessOptions
+                {
+                    FilePath = FilePath,
+                    WorkingDirectory = WorkingDirectory,
+                    ArgumentList = ArgumentList,
+                    AcceptableExitCodeList = AcceptableExitCodeList,
+                    WindowStyle = WindowStyle,
+                    CreateNoWindow = CreateNoWindow.IsPresent,
+                    NoWait = NoWait.IsPresent,
+                    Priority = Priority,
+                    ExecutionTimeout = MyInvocation.BoundParameters.ContainsKey("ExecutionTimeout") ? (TimeSpan?)ExecutionTimeout : null,
+                    ExecutionTimeoutInterval = ExecutionTimeoutInterval,
+                    StandardInputObjectList = StandardInputObjectList,
+                    EnvironmentVariables = EnvironmentVariables,
+                    ParsingExpression = ParsingExpression,
+                    SecureArgumentList = SecureArgumentList.IsPresent,
+                    LogOutput = LogOutput.IsPresent,
+                    ContinueOnError = ContinueOnError.IsPresent,
+                    Secrets = _secretBuffer.ToArray(),
+                    SecretsPrefix = SecretsPrefix,
+                    ForceSecretsPrefix = ForceSecretsPrefix.IsPresent
+                };
+
+                InfisicalProcessResult result = InfisicalProcessRunner.Run(options, Logger);
+                WriteObject(result);
+
+                if (!result.Succeeded && !NoWait.IsPresent && !ContinueOnError.IsPresent)
+                {
+                    string message = string.Concat("Process '", FilePath, "' exited with code ", result.ExitCode.HasValue ? result.ExitCode.Value.ToString() : "<null>", " which is not in the acceptable exit code list.");
+                    InvalidOperationException exception = new InvalidOperationException(message);
+                    ErrorRecord error = new ErrorRecord(exception, "StartInfisicalProcess.UnacceptableExitCode", ErrorCategory.InvalidResult, result);
+                    WriteError(error);
+                }
+            }
+            catch (PipelineStoppedException) { throw; }
+            catch (Exception exception)
+            {
+                WriteErrorForException(Component, "StartProcess", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/UninstallInfisicalCertificateCmdlet.cs

@@ -74,7 +74,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("UninstallInfisicalCertificateCmdlet", "UninstallCertificate", exception);
+                WriteErrorForException("UninstallInfisicalCertificateCmdlet", "UninstallCertificate", exception);
             }
         }
 

src/PSInfisicalAPI/Cmdlets/UpdateInfisicalEnvironmentCmdlet.cs

@@ -38,7 +38,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("UpdateInfisicalEnvironmentCmdlet", "UpdateEnvironment", exception);
+                WriteErrorForException("UpdateInfisicalEnvironmentCmdlet", "UpdateEnvironment", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/UpdateInfisicalFolderCmdlet.cs

@@ -38,7 +38,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("UpdateInfisicalFolderCmdlet", "UpdateFolder", exception);
+                WriteErrorForException("UpdateInfisicalFolderCmdlet", "UpdateFolder", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/UpdateInfisicalOrganizationCmdlet.cs

@@ -0,0 +1,44 @@
+using System;
+using System.Management.Automation;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.Organizations;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsData.Update, "InfisicalOrganization", SupportsShouldProcess = true)]
+    [OutputType(typeof(InfisicalOrganization))]
+    public sealed class UpdateInfisicalOrganizationCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(Mandatory = true, ValueFromPipelineByPropertyName = true, Position = 0)]
+        [Alias("Id")]
+        public string OrganizationId { get; set; }
+
+        [Parameter] public string Name { get; set; }
+        [Parameter] public string Slug { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
+
+                if (!ShouldProcess(OrganizationId, "Update Infisical organization"))
+                {
+                    return;
+                }
+
+                InfisicalOrganizationClient client = new InfisicalOrganizationClient(HttpClient, Logger);
+                InfisicalOrganization organization = client.Update(connection, OrganizationId, Name, Slug);
+                if (organization != null)
+                {
+                    WriteObject(organization);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("UpdateInfisicalOrganizationCmdlet", "UpdateOrganization", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/UpdateInfisicalProjectCmdlet.cs

@@ -38,7 +38,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("UpdateInfisicalProjectCmdlet", "UpdateProject", exception);
+                WriteErrorForException("UpdateInfisicalProjectCmdlet", "UpdateProject", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/UpdateInfisicalSecretCmdlet.cs

@@ -56,10 +56,12 @@ namespace PSInfisicalAPI.Cmdlets
                         Secrets = InfisicalBulkSecretConverter.ToUpdateItems(Secrets)
                     };
 
+                    Logger.Information("Update-InfisicalSecret", string.Concat("Bulk-updating ", Secrets.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " secret(s)."));
                     InfisicalSecretsClient bulkClient = new InfisicalSecretsClient(HttpClient, Logger);
                     InfisicalSecret[] updated = bulkClient.UpdateBatch(connection, bulk);
                     if (updated != null)
                     {
+                        Logger.Information("Update-InfisicalSecret", string.Concat("Server returned ", updated.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " updated secret(s)."));
                         foreach (InfisicalSecret secret in updated) { WriteObject(secret); }
                     }
 
@@ -96,7 +98,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("UpdateInfisicalSecretCmdlet", "UpdateSecret", exception);
+                WriteErrorForException("UpdateInfisicalSecretCmdlet", "UpdateSecret", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/UpdateInfisicalSubOrganizationCmdlet.cs

@@ -0,0 +1,44 @@
+using System;
+using System.Management.Automation;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.SubOrganizations;
+
+namespace PSInfisicalAPI.Cmdlets
+{
+    [Cmdlet(VerbsData.Update, "InfisicalSubOrganization", SupportsShouldProcess = true)]
+    [OutputType(typeof(InfisicalSubOrganization))]
+    public sealed class UpdateInfisicalSubOrganizationCmdlet : InfisicalCmdletBase
+    {
+        [Parameter(Mandatory = true, ValueFromPipelineByPropertyName = true, Position = 0)]
+        [Alias("Id")]
+        public string SubOrganizationId { get; set; }
+
+        [Parameter] public string Name { get; set; }
+        [Parameter] public string Slug { get; set; }
+
+        protected override void ProcessRecord()
+        {
+            try
+            {
+                InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
+
+                if (!ShouldProcess(SubOrganizationId, "Update Infisical sub-organization"))
+                {
+                    return;
+                }
+
+                InfisicalSubOrganizationClient client = new InfisicalSubOrganizationClient(HttpClient, Logger);
+                InfisicalSubOrganization subOrganization = client.Update(connection, SubOrganizationId, Name, Slug);
+                if (subOrganization != null)
+                {
+                    WriteObject(subOrganization);
+                }
+            }
+            catch (Exception exception)
+            {
+                WriteErrorForException("UpdateInfisicalSubOrganizationCmdlet", "UpdateSubOrganization", exception);
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Cmdlets/UpdateInfisicalTagCmdlet.cs

@@ -38,7 +38,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException("UpdateInfisicalTagCmdlet", "UpdateTag", exception);
+                WriteErrorForException("UpdateInfisicalTagCmdlet", "UpdateTag", exception);
             }
         }
     }

src/PSInfisicalAPI/Cmdlets/WriteInfisicalScepMdmProfileToWmiCmdlet.cs

@@ -62,22 +62,7 @@ namespace PSInfisicalAPI.Cmdlets
             }
             catch (Exception exception)
             {
-                ThrowTerminatingForException(Component, "WriteScepMdmProfileToWmi", exception);
-            }
-        }
-
-        private bool IsElevated()
-        {
-            try
-            {
-                Collection<PSObject> results = InvokeCommand.InvokeScript("[bool]([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)");
-                if (results == null || results.Count == 0 || results[0] == null || results[0].BaseObject == null) { return false; }
-                return Convert.ToBoolean(results[0].BaseObject, CultureInfo.InvariantCulture);
-            }
-            catch (Exception ex)
-            {
-                Logger.Verbose(Component, string.Concat("Elevation check failed; assuming non-elevated. ", ex.Message));
-                return false;
+                WriteErrorForException(Component, "WriteScepMdmProfileToWmi", exception);
             }
         }
 

src/PSInfisicalAPI/Common/InfisicalPrefix.cs

@@ -0,0 +1,15 @@
+using System;
+
+namespace PSInfisicalAPI.Common
+{
+    public static class InfisicalPrefix
+    {
+        public static string Apply(string original, string prefix, bool force)
+        {
+            if (string.IsNullOrEmpty(prefix)) { return original ?? string.Empty; }
+            if (original == null) { return prefix; }
+            if (!force && original.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) { return original; }
+            return string.Concat(prefix, original);
+        }
+    }
+}

src/PSInfisicalAPI/Endpoints/InfisicalEndpointNames.cs

@@ -44,11 +44,24 @@ namespace PSInfisicalAPI.Endpoints
         public const string UpdateTag = "UpdateTag";
         public const string DeleteTag = "DeleteTag";
 
+        public const string ListOrganizations = "ListOrganizations";
+        public const string RetrieveOrganization = "RetrieveOrganization";
+        public const string CreateOrganization = "CreateOrganization";
+        public const string UpdateOrganization = "UpdateOrganization";
+        public const string DeleteOrganization = "DeleteOrganization";
+
+        public const string ListSubOrganizations = "ListSubOrganizations";
+        public const string RetrieveSubOrganization = "RetrieveSubOrganization";
+        public const string CreateSubOrganization = "CreateSubOrganization";
+        public const string UpdateSubOrganization = "UpdateSubOrganization";
+        public const string DeleteSubOrganization = "DeleteSubOrganization";
+
         public const string ListInternalCertificateAuthorities = "ListInternalCertificateAuthorities";
         public const string RetrieveInternalCertificateAuthority = "RetrieveInternalCertificateAuthority";
         public const string SearchCertificates = "SearchCertificates";
         public const string RetrieveCertificate = "RetrieveCertificate";
         public const string GetCertificateBundle = "GetCertificateBundle";
+        public const string UpdateCertificateMetadata = "UpdateCertificateMetadata";
         public const string SignCertificateBySubscriber = "SignCertificateBySubscriber";
         public const string SignCertificateByCa = "SignCertificateByCa";
         public const string IssueCertificateByProfile = "IssueCertificateByProfile";

src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs

@@ -16,6 +16,8 @@ namespace PSInfisicalAPI.Endpoints
             RegisterEnvironments(Candidates);
             RegisterFolders(Candidates);
             RegisterTags(Candidates);
+            RegisterOrganizations(Candidates);
+            RegisterSubOrganizations(Candidates);
             RegisterPki(Candidates);
         }
 
@@ -496,6 +498,112 @@ namespace PSInfisicalAPI.Endpoints
             });
         }
 
+        private static void RegisterOrganizations(Dictionary<string, List<InfisicalEndpointDefinition>> map)
+        {
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.ListOrganizations,
+                Resource = "Organizations",
+                Version = "v2",
+                Method = "GET",
+                Template = "/api/v2/organizations",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.RetrieveOrganization,
+                Resource = "Organizations",
+                Version = "v1",
+                Method = "GET",
+                Template = "/api/v1/organization/{organizationId}",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.CreateOrganization,
+                Resource = "Organizations",
+                Version = "v2",
+                Method = "POST",
+                Template = "/api/v2/organizations",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.UpdateOrganization,
+                Resource = "Organizations",
+                Version = "v1",
+                Method = "PATCH",
+                Template = "/api/v1/organization/{organizationId}",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.DeleteOrganization,
+                Resource = "Organizations",
+                Version = "v1",
+                Method = "DELETE",
+                Template = "/api/v1/organization/{organizationId}",
+                RequiresAuthorization = true
+            });
+        }
+
+        private static void RegisterSubOrganizations(Dictionary<string, List<InfisicalEndpointDefinition>> map)
+        {
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.ListSubOrganizations,
+                Resource = "SubOrganizations",
+                Version = "v1",
+                Method = "GET",
+                Template = "/api/v1/sub-organizations",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.RetrieveSubOrganization,
+                Resource = "SubOrganizations",
+                Version = "v1",
+                Method = "GET",
+                Template = "/api/v1/sub-organizations/{subOrgId}",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.CreateSubOrganization,
+                Resource = "SubOrganizations",
+                Version = "v1",
+                Method = "POST",
+                Template = "/api/v1/sub-organizations",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.UpdateSubOrganization,
+                Resource = "SubOrganizations",
+                Version = "v1",
+                Method = "PATCH",
+                Template = "/api/v1/sub-organizations/{subOrgId}",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.DeleteSubOrganization,
+                Resource = "SubOrganizations",
+                Version = "v1",
+                Method = "DELETE",
+                Template = "/api/v1/sub-organizations/{subOrgId}",
+                RequiresAuthorization = true
+            });
+        }
+
         private static void RegisterPki(Dictionary<string, List<InfisicalEndpointDefinition>> map)
         {
             Add(map, new InfisicalEndpointDefinition
@@ -590,6 +698,26 @@ namespace PSInfisicalAPI.Endpoints
                 ContainsSecretMaterialInResponse = true
             });
 
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.UpdateCertificateMetadata,
+                Resource = "Pki",
+                Version = "v1",
+                Method = "PATCH",
+                Template = "/api/v1/cert-manager/certificates/{certificateId}",
+                RequiresAuthorization = true
+            });
+
+            Add(map, new InfisicalEndpointDefinition
+            {
+                Name = InfisicalEndpointNames.UpdateCertificateMetadata,
+                Resource = "Pki",
+                Version = "v1",
+                Method = "PATCH",
+                Template = "/api/v1/pki/certificates/{certificateId}",
+                RequiresAuthorization = true
+            });
+
             Add(map, new InfisicalEndpointDefinition
             {
                 Name = InfisicalEndpointNames.SignCertificateBySubscriber,

src/PSInfisicalAPI/Errors/InfisicalException.cs

@@ -75,6 +75,13 @@ namespace PSInfisicalAPI.Errors
         public InfisicalExportException(string message, Exception innerException) : base(message, innerException) { }
     }
 
+    public class InfisicalImportException : InfisicalException
+    {
+        public InfisicalImportException() { }
+        public InfisicalImportException(string message) : base(message) { }
+        public InfisicalImportException(string message, Exception innerException) : base(message, innerException) { }
+    }
+
     public class InfisicalConfigurationException : InfisicalException
     {
         public InfisicalConfigurationException() { }

src/PSInfisicalAPI/Imports/EnvInfisicalImporter.cs

@@ -0,0 +1,36 @@
+using System.Collections.Generic;
+using System.IO;
+using PSInfisicalAPI.Errors;
+
+namespace PSInfisicalAPI.Imports
+{
+    public sealed class EnvInfisicalImporter : IInfisicalImporter
+    {
+        public IList<KeyValuePair<string, string>> Import(FileInfo path)
+        {
+            if (path == null) { throw new InfisicalImportException("Path is required for ENV import."); }
+
+            List<KeyValuePair<string, string>> result = new List<KeyValuePair<string, string>>();
+            string[] lines = File.ReadAllLines(path.FullName);
+
+            foreach (string raw in lines)
+            {
+                if (raw == null) { continue; }
+                string line = raw.Trim();
+                if (line.Length == 0) { continue; }
+                if (line[0] == '#') { continue; }
+
+                int idx = line.IndexOf('=');
+                if (idx <= 0) { continue; }
+
+                string key = line.Substring(0, idx).Trim();
+                string value = line.Substring(idx + 1);
+                if (key.Length == 0) { continue; }
+
+                result.Add(new KeyValuePair<string, string>(key, value));
+            }
+
+            return result;
+        }
+    }
+}

src/PSInfisicalAPI/Imports/IInfisicalImporter.cs

@@ -0,0 +1,10 @@
+using System.Collections.Generic;
+using System.IO;
+
+namespace PSInfisicalAPI.Imports
+{
+    public interface IInfisicalImporter
+    {
+        IList<KeyValuePair<string, string>> Import(FileInfo path);
+    }
+}

src/PSInfisicalAPI/Imports/InfisicalImporterFactory.cs

@@ -0,0 +1,20 @@
+using PSInfisicalAPI.Errors;
+using PSInfisicalAPI.Models;
+
+namespace PSInfisicalAPI.Imports
+{
+    public static class InfisicalImporterFactory
+    {
+        public static IInfisicalImporter Create(InfisicalImportFormat format)
+        {
+            switch (format)
+            {
+                case InfisicalImportFormat.Json: return new JsonInfisicalImporter();
+                case InfisicalImportFormat.Yaml: return new YamlInfisicalImporter();
+                case InfisicalImportFormat.Env: return new EnvInfisicalImporter();
+                case InfisicalImportFormat.Xml: return new XmlInfisicalImporter();
+                default: throw new InfisicalImportException(string.Concat("Unsupported import format: ", format.ToString()));
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Imports/JsonInfisicalImporter.cs

@@ -0,0 +1,53 @@
+using System.Collections.Generic;
+using System.IO;
+using Newtonsoft.Json.Linq;
+using PSInfisicalAPI.Errors;
+
+namespace PSInfisicalAPI.Imports
+{
+    public sealed class JsonInfisicalImporter : IInfisicalImporter
+    {
+        public IList<KeyValuePair<string, string>> Import(FileInfo path)
+        {
+            if (path == null) { throw new InfisicalImportException("Path is required for JSON import."); }
+
+            List<KeyValuePair<string, string>> result = new List<KeyValuePair<string, string>>();
+            string text = File.ReadAllText(path.FullName);
+            JToken root = JToken.Parse(text);
+
+            if (root.Type == JTokenType.Array)
+            {
+                foreach (JToken item in (JArray)root)
+                {
+                    if (item == null || item.Type != JTokenType.Object) { continue; }
+                    string key = ReadString((JObject)item, "SecretName") ?? ReadString((JObject)item, "secretName");
+                    string value = ReadString((JObject)item, "SecretValue") ?? ReadString((JObject)item, "secretValue");
+                    if (string.IsNullOrEmpty(key)) { continue; }
+                    result.Add(new KeyValuePair<string, string>(key, value ?? string.Empty));
+                }
+            }
+            else if (root.Type == JTokenType.Object)
+            {
+                foreach (JProperty prop in ((JObject)root).Properties())
+                {
+                    if (prop == null || string.IsNullOrEmpty(prop.Name)) { continue; }
+                    string value = prop.Value != null && prop.Value.Type != JTokenType.Null ? prop.Value.ToString() : string.Empty;
+                    result.Add(new KeyValuePair<string, string>(prop.Name, value));
+                }
+            }
+            else
+            {
+                throw new InfisicalImportException("JSON import expects an array of secret objects or a flat key/value object.");
+            }
+
+            return result;
+        }
+
+        private static string ReadString(JObject obj, string name)
+        {
+            JToken token;
+            if (!obj.TryGetValue(name, out token) || token == null || token.Type == JTokenType.Null) { return null; }
+            return token.ToString();
+        }
+    }
+}

src/PSInfisicalAPI/Imports/XmlInfisicalImporter.cs

@@ -0,0 +1,51 @@
+using System.Collections.Generic;
+using System.IO;
+using System.Xml;
+using PSInfisicalAPI.Errors;
+
+namespace PSInfisicalAPI.Imports
+{
+    public sealed class XmlInfisicalImporter : IInfisicalImporter
+    {
+        public IList<KeyValuePair<string, string>> Import(FileInfo path)
+        {
+            if (path == null) { throw new InfisicalImportException("Path is required for XML import."); }
+
+            List<KeyValuePair<string, string>> result = new List<KeyValuePair<string, string>>();
+            XmlDocument document = new XmlDocument();
+            document.Load(path.FullName);
+
+            XmlNode root = document.DocumentElement;
+            if (root == null || !string.Equals(root.LocalName, "Secrets", System.StringComparison.Ordinal))
+            {
+                throw new InfisicalImportException("XML import expects a root <Secrets> element.");
+            }
+
+            foreach (XmlNode node in root.ChildNodes)
+            {
+                if (node == null || node.NodeType != XmlNodeType.Element) { continue; }
+                if (!string.Equals(node.LocalName, "Secret", System.StringComparison.Ordinal)) { continue; }
+
+                string key = ReadChild(node, "SecretName");
+                string value = ReadChild(node, "SecretValue");
+                if (string.IsNullOrEmpty(key)) { continue; }
+                result.Add(new KeyValuePair<string, string>(key, value ?? string.Empty));
+            }
+
+            return result;
+        }
+
+        private static string ReadChild(XmlNode parent, string name)
+        {
+            foreach (XmlNode child in parent.ChildNodes)
+            {
+                if (child == null || child.NodeType != XmlNodeType.Element) { continue; }
+                if (string.Equals(child.LocalName, name, System.StringComparison.Ordinal))
+                {
+                    return child.InnerText;
+                }
+            }
+            return null;
+        }
+    }
+}

src/PSInfisicalAPI/Imports/YamlInfisicalImporter.cs

@@ -0,0 +1,61 @@
+using System.Collections;
+using System.Collections.Generic;
+using System.IO;
+using PSInfisicalAPI.Errors;
+using YamlDotNet.Serialization;
+
+namespace PSInfisicalAPI.Imports
+{
+    public sealed class YamlInfisicalImporter : IInfisicalImporter
+    {
+        public IList<KeyValuePair<string, string>> Import(FileInfo path)
+        {
+            if (path == null) { throw new InfisicalImportException("Path is required for YAML import."); }
+
+            List<KeyValuePair<string, string>> result = new List<KeyValuePair<string, string>>();
+            string text = File.ReadAllText(path.FullName);
+
+            IDeserializer deserializer = new DeserializerBuilder().Build();
+            object root = deserializer.Deserialize<object>(text);
+            if (root == null) { return result; }
+
+            IDictionary rootMap = root as IDictionary;
+            if (rootMap != null && rootMap.Contains("Secrets"))
+            {
+                IList entries = rootMap["Secrets"] as IList;
+                if (entries != null)
+                {
+                    foreach (object entry in entries)
+                    {
+                        IDictionary map = entry as IDictionary;
+                        if (map == null) { continue; }
+                        string key = AsString(map["SecretName"]);
+                        string value = AsString(map["SecretValue"]);
+                        if (string.IsNullOrEmpty(key)) { continue; }
+                        result.Add(new KeyValuePair<string, string>(key, value ?? string.Empty));
+                    }
+                    return result;
+                }
+            }
+
+            if (rootMap != null)
+            {
+                foreach (DictionaryEntry kvp in rootMap)
+                {
+                    string key = AsString(kvp.Key);
+                    if (string.IsNullOrEmpty(key)) { continue; }
+                    result.Add(new KeyValuePair<string, string>(key, AsString(kvp.Value) ?? string.Empty));
+                }
+                return result;
+            }
+
+            throw new InfisicalImportException("YAML import expects a 'Secrets' root list or a flat key/value mapping.");
+        }
+
+        private static string AsString(object value)
+        {
+            if (value == null) { return null; }
+            return value.ToString();
+        }
+    }
+}

src/PSInfisicalAPI/Logging/PSCmdletLogger.cs

@@ -36,10 +36,17 @@ namespace PSInfisicalAPI.Logging
             _cmdlet.WriteWarning(line);
         }
 
+        /// <summary>
+        /// Error-level lines are diagnostic breadcrumbs: every call site in this module logs one and then throws,
+        /// so the failure itself always reaches the caller as an ErrorRecord carrying the same detail. Emitting
+        /// them on the warning stream duplicated that failure eight lines deep and put it under -WarningAction
+        /// instead of -ErrorAction. They belong on the verbose stream, where -Verbose opts into the trail and the
+        /// ErrorRecord remains the single authority on what failed.
+        /// </summary>
         public void Error(string component, string message)
         {
             string line = InfisicalLogFormatter.FormatNow(InfisicalLogLevel.Error, component, message);
-            _cmdlet.WriteWarning(line);
+            _cmdlet.WriteVerbose(line);
         }
     }
 }

src/PSInfisicalAPI/Models/InfisicalCertificate.cs

@@ -36,6 +36,12 @@ namespace PSInfisicalAPI.Models
         public string Source { get; set; }
         public string EnrollmentType { get; set; }
         public bool HasPrivateKey { get; set; }
+
+        /// <summary>
+        /// Metadata key/value pairs attached to the certificate. Case-insensitive on key, matching how the
+        /// API treats them and how callers supply them from PowerShell.
+        /// </summary>
+        public System.Collections.Generic.Dictionary<string, string> Metadata { get; set; }
         public int? RevocationReason { get; set; }
         public string RenewalError { get; set; }
         public int? RenewBeforeDays { get; set; }

src/PSInfisicalAPI/Models/InfisicalCertificateResult.cs

@@ -17,6 +17,11 @@ namespace PSInfisicalAPI.Models
         public string StatusMessage { get; set; }
         public string CertificateRequestId { get; set; }
 
+        /// <summary>
+        /// The certificate's metadata in Infisical after reconciliation, or null when -Metadata was not used.
+        /// </summary>
+        public System.Collections.Generic.Dictionary<string, string> Metadata { get; set; }
+
         public override string ToString()
         {
             if (Leaf != null) { return Leaf.Subject; }

src/PSInfisicalAPI/Models/InfisicalImportFormat.cs

@@ -0,0 +1,10 @@
+namespace PSInfisicalAPI.Models
+{
+    public enum InfisicalImportFormat
+    {
+        Json,
+        Yaml,
+        Env,
+        Xml
+    }
+}

src/PSInfisicalAPI/Models/InfisicalOrganization.cs

@@ -0,0 +1,21 @@
+using System;
+
+namespace PSInfisicalAPI.Models
+{
+    public sealed class InfisicalOrganization
+    {
+        public string Id { get; set; }
+        public string Name { get; set; }
+        public string Slug { get; set; }
+        public string CustomerId { get; set; }
+        public bool AuthEnforced { get; set; }
+        public bool ScimEnabled { get; set; }
+        public DateTimeOffset? CreatedAtUtc { get; set; }
+        public DateTimeOffset? UpdatedAtUtc { get; set; }
+
+        public override string ToString()
+        {
+            return string.IsNullOrEmpty(Slug) ? (Name ?? Id) : Slug;
+        }
+    }
+}

src/PSInfisicalAPI/Models/InfisicalProcessResult.cs

@@ -0,0 +1,26 @@
+using System;
+using System.Text.RegularExpressions;
+
+namespace PSInfisicalAPI.Models
+{
+    public sealed class InfisicalProcessResult
+    {
+        public string FilePath { get; set; }
+        public int? ProcessId { get; set; }
+        public int? ExitCode { get; set; }
+        public string ExitCodeAsHex { get; set; }
+        public int? ExitCodeAsInteger { get; set; }
+        public string ExitCodeAsDecimal { get; set; }
+        public DateTime? StartTime { get; set; }
+        public DateTime? ExitTime { get; set; }
+        public TimeSpan? Duration { get; set; }
+        public string DurationFriendly { get; set; }
+        public string StandardOutput { get; set; }
+        public string StandardError { get; set; }
+        public Match[] StandardOutputObject { get; set; }
+        public Match[] StandardErrorObject { get; set; }
+        public bool TimedOut { get; set; }
+        public bool Succeeded { get; set; }
+        public int SecretCount { get; set; }
+    }
+}

src/PSInfisicalAPI/Models/InfisicalSubOrganization.cs

@@ -0,0 +1,20 @@
+using System;
+
+namespace PSInfisicalAPI.Models
+{
+    public sealed class InfisicalSubOrganization
+    {
+        public string Id { get; set; }
+        public string Name { get; set; }
+        public string Slug { get; set; }
+        public string OrganizationId { get; set; }
+        public bool IsAccessible { get; set; }
+        public DateTimeOffset? CreatedAtUtc { get; set; }
+        public DateTimeOffset? UpdatedAtUtc { get; set; }
+
+        public override string ToString()
+        {
+            return string.IsNullOrEmpty(Slug) ? (Name ?? Id) : Slug;
+        }
+    }
+}

src/PSInfisicalAPI/Organizations/InfisicalOrganizationClient.cs

@@ -0,0 +1,150 @@
+using System;
+using System.Collections.Generic;
+using PSInfisicalAPI.Connections;
+using PSInfisicalAPI.Endpoints;
+using PSInfisicalAPI.Errors;
+using PSInfisicalAPI.Http;
+using PSInfisicalAPI.Logging;
+using PSInfisicalAPI.Models;
+using PSInfisicalAPI.Serialization;
+
+namespace PSInfisicalAPI.Organizations
+{
+    public sealed class InfisicalOrganizationClient
+    {
+        private const string Component = "OrganizationClient";
+
+        private readonly IInfisicalLogger _logger;
+        private readonly JsonInfisicalSerializer _serializer;
+        private readonly InfisicalApiInvoker _invoker;
+
+        public InfisicalOrganizationClient(IInfisicalHttpClient httpClient, IInfisicalLogger logger)
+        {
+            if (httpClient == null) { throw new ArgumentNullException(nameof(httpClient)); }
+            _logger = logger ?? NullInfisicalLogger.Instance;
+            _serializer = new JsonInfisicalSerializer();
+            _invoker = new InfisicalApiInvoker(httpClient);
+        }
+
+        public InfisicalOrganization[] List(InfisicalConnection connection)
+        {
+            if (connection == null) { throw new ArgumentNullException(nameof(connection)); }
+
+            try
+            {
+                _logger.Information(Component, "Attempting to list Infisical organizations. Please Wait...");
+                InfisicalHttpResponse response = _invoker.Invoke(connection, InfisicalEndpointNames.ListOrganizations, "ListOrganizations", null, null, null);
+                InfisicalOrganizationListResponseDto dto = _serializer.Deserialize<InfisicalOrganizationListResponseDto>(response.Body);
+                response.Clear();
+
+                InfisicalOrganization[] mapped = InfisicalOrganizationMapper.MapMany(dto != null ? dto.Organizations : null);
+                _logger.Information(Component, "Infisical organization list retrieval was successful.");
+                return mapped;
+            }
+            catch (Exception)
+            {
+                _logger.Error(Component, "Infisical organization list retrieval failed.");
+                throw;
+            }
+        }
+
+        public InfisicalOrganization Retrieve(InfisicalConnection connection, string organizationId)
+        {
+            if (connection == null) { throw new ArgumentNullException(nameof(connection)); }
+            if (string.IsNullOrEmpty(organizationId)) { throw new InfisicalConfigurationException("OrganizationId is required."); }
+
+            Dictionary<string, string> pathParameters = new Dictionary<string, string> { { "organizationId", organizationId } };
+
+            try
+            {
+                _logger.Information(Component, string.Concat("Attempting to retrieve Infisical organization '", organizationId, "'. Please Wait..."));
+                InfisicalHttpResponse response = _invoker.Invoke(connection, InfisicalEndpointNames.RetrieveOrganization, "RetrieveOrganization", pathParameters, null, null);
+                InfisicalOrganizationSingleResponseDto dto = _serializer.Deserialize<InfisicalOrganizationSingleResponseDto>(response.Body);
+                response.Clear();
+
+                InfisicalOrganization mapped = InfisicalOrganizationMapper.Map(dto != null ? dto.Organization : null);
+                _logger.Information(Component, "Infisical organization retrieval was successful.");
+                return mapped;
+            }
+            catch (Exception)
+            {
+                _logger.Error(Component, "Infisical organization retrieval failed.");
+                throw;
+            }
+        }
+
+        public InfisicalOrganization Create(InfisicalConnection connection, string name, string slug)
+        {
+            if (connection == null) { throw new ArgumentNullException(nameof(connection)); }
+            if (string.IsNullOrEmpty(name)) { throw new InfisicalConfigurationException("Name is required."); }
+
+            InfisicalOrganizationCreateRequestDto request = new InfisicalOrganizationCreateRequestDto { Name = name, Slug = slug };
+            string body = _serializer.Serialize(request);
+
+            try
+            {
+                _logger.Information(Component, string.Concat("Attempting to create Infisical organization '", name, "'. Please Wait..."));
+                InfisicalHttpResponse response = _invoker.Invoke(connection, InfisicalEndpointNames.CreateOrganization, "CreateOrganization", null, null, body);
+                InfisicalOrganizationSingleResponseDto dto = _serializer.Deserialize<InfisicalOrganizationSingleResponseDto>(response.Body);
+                response.Clear();
+
+                InfisicalOrganization mapped = InfisicalOrganizationMapper.Map(dto != null ? dto.Organization : null);
+                _logger.Information(Component, "Infisical organization creation was successful.");
+                return mapped;
+            }
+            catch (Exception)
+            {
+                _logger.Error(Component, "Infisical organization creation failed.");
+                throw;
+            }
+        }
+
+        public InfisicalOrganization Update(InfisicalConnection connection, string organizationId, string name, string slug)
+        {
+            if (connection == null) { throw new ArgumentNullException(nameof(connection)); }
+            if (string.IsNullOrEmpty(organizationId)) { throw new InfisicalConfigurationException("OrganizationId is required."); }
+
+            Dictionary<string, string> pathParameters = new Dictionary<string, string> { { "organizationId", organizationId } };
+            InfisicalOrganizationUpdateRequestDto request = new InfisicalOrganizationUpdateRequestDto { Name = name, Slug = slug };
+            string body = _serializer.Serialize(request);
+
+            try
+            {
+                _logger.Information(Component, string.Concat("Attempting to update Infisical organization '", organizationId, "'. Please Wait..."));
+                InfisicalHttpResponse response = _invoker.Invoke(connection, InfisicalEndpointNames.UpdateOrganization, "UpdateOrganization", pathParameters, null, body);
+                InfisicalOrganizationSingleResponseDto dto = _serializer.Deserialize<InfisicalOrganizationSingleResponseDto>(response.Body);
+                response.Clear();
+
+                InfisicalOrganization mapped = InfisicalOrganizationMapper.Map(dto != null ? dto.Organization : null);
+                _logger.Information(Component, "Infisical organization update was successful.");
+                return mapped;
+            }
+            catch (Exception)
+            {
+                _logger.Error(Component, "Infisical organization update failed.");
+                throw;
+            }
+        }
+
+        public void Delete(InfisicalConnection connection, string organizationId)
+        {
+            if (connection == null) { throw new ArgumentNullException(nameof(connection)); }
+            if (string.IsNullOrEmpty(organizationId)) { throw new InfisicalConfigurationException("OrganizationId is required."); }
+
+            Dictionary<string, string> pathParameters = new Dictionary<string, string> { { "organizationId", organizationId } };
+
+            try
+            {
+                _logger.Information(Component, string.Concat("Attempting to delete Infisical organization '", organizationId, "'. Please Wait..."));
+                InfisicalHttpResponse response = _invoker.Invoke(connection, InfisicalEndpointNames.DeleteOrganization, "DeleteOrganization", pathParameters, null, null);
+                response.Clear();
+                _logger.Information(Component, "Infisical organization deletion was successful.");
+            }
+            catch (Exception)
+            {
+                _logger.Error(Component, "Infisical organization deletion failed.");
+                throw;
+            }
+        }
+    }
+}

src/PSInfisicalAPI/Organizations/InfisicalOrganizationDtos.cs

@@ -0,0 +1,40 @@
+using System.Collections.Generic;
+using Newtonsoft.Json;
+
+namespace PSInfisicalAPI.Organizations
+{
+    internal sealed class InfisicalOrganizationResponseDto
+    {
+        [JsonProperty("id")] public string Id { get; set; }
+        [JsonProperty("_id")] public string InternalId { get; set; }
+        [JsonProperty("name")] public string Name { get; set; }
+        [JsonProperty("slug")] public string Slug { get; set; }
+        [JsonProperty("customerId")] public string CustomerId { get; set; }
+        [JsonProperty("authEnforced")] public bool AuthEnforced { get; set; }
+        [JsonProperty("scimEnabled")] public bool ScimEnabled { get; set; }
+        [JsonProperty("createdAt")] public string CreatedAt { get; set; }
+        [JsonProperty("updatedAt")] public string UpdatedAt { get; set; }
+    }
+
+    internal sealed class InfisicalOrganizationListResponseDto
+    {
+        [JsonProperty("organizations")] public List<InfisicalOrganizationResponseDto> Organizations { get; set; }
+    }
+
+    internal sealed class InfisicalOrganizationSingleResponseDto
+    {
+        [JsonProperty("organization")] public InfisicalOrganizationResponseDto Organization { get; set; }
+    }
+
+    internal sealed class InfisicalOrganizationCreateRequestDto
+    {
+        [JsonProperty("name")] public string Name { get; set; }
+        [JsonProperty("slug", NullValueHandling = NullValueHandling.Ignore)] public string Slug { get; set; }
+    }
+
+    internal sealed class InfisicalOrganizationUpdateRequestDto
+    {
+        [JsonProperty("name", NullValueHandling = NullValueHandling.Ignore)] public string Name { get; set; }
+        [JsonProperty("slug", NullValueHandling = NullValueHandling.Ignore)] public string Slug { get; set; }
+    }
+}

src/PSInfisicalAPI/Organizations/InfisicalOrganizationMapper.cs

@@ -0,0 +1,66 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using PSInfisicalAPI.Models;
+
+namespace PSInfisicalAPI.Organizations
+{
+    internal static class InfisicalOrganizationMapper
+    {
+        public static InfisicalOrganization Map(InfisicalOrganizationResponseDto dto)
+        {
+            if (dto == null)
+            {
+                return null;
+            }
+
+            return new InfisicalOrganization
+            {
+                Id = !string.IsNullOrEmpty(dto.Id) ? dto.Id : dto.InternalId,
+                Name = dto.Name,
+                Slug = dto.Slug,
+                CustomerId = dto.CustomerId,
+                AuthEnforced = dto.AuthEnforced,
+                ScimEnabled = dto.ScimEnabled,
+                CreatedAtUtc = ParseTimestamp(dto.CreatedAt),
+                UpdatedAtUtc = ParseTimestamp(dto.UpdatedAt)
+            };
+        }
+
+        public static InfisicalOrganization[] MapMany(IEnumerable<InfisicalOrganizationResponseDto> items)
+        {
+            if (items == null)
+            {
+                return Array.Empty<InfisicalOrganization>();
+            }
+
+            List<InfisicalOrganization> results = new List<InfisicalOrganization>();
+            foreach (InfisicalOrganizationResponseDto dto in items)
+            {
+                InfisicalOrganization mapped = Map(dto);
+                if (mapped != null)
+                {
+                    results.Add(mapped);
+                }
+            }
+
+            return results.ToArray();
+        }
+
+        private static DateTimeOffset? ParseTimestamp(string value)
+        {
+            if (string.IsNullOrEmpty(value))
+            {
+                return null;
+            }
+
+            DateTimeOffset parsed;
+            if (DateTimeOffset.TryParse(value, CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal, out parsed))
+            {
+                return parsed;
+            }
+
+            return null;
+        }
+    }
+}

src/PSInfisicalAPI/Pki/InfisicalCertificateDtos.cs

@@ -37,6 +37,7 @@ namespace PSInfisicalAPI.Pki
         [JsonProperty("source")] public string Source { get; set; }
         [JsonProperty("enrollmentType")] public string EnrollmentType { get; set; }
         [JsonProperty("hasPrivateKey")] public bool HasPrivateKey { get; set; }
+        [JsonProperty("metadata", NullValueHandling = NullValueHandling.Ignore)] public InfisicalCertificateSearchMetadataEntryDto[] Metadata { get; set; }
         [JsonProperty("revocationReason")] public int? RevocationReason { get; set; }
         [JsonProperty("renewalError")] public string RenewalError { get; set; }
         [JsonProperty("renewBeforeDays")] public int? RenewBeforeDays { get; set; }
@@ -96,6 +97,26 @@ namespace PSInfisicalAPI.Pki
         [JsonProperty("value", NullValueHandling = NullValueHandling.Ignore)] public string Value { get; set; }
     }
 
+    /// <summary>
+    /// Body for PATCH /certificates/{id}. The API replaces the certificate's entire metadata set with what
+    /// is sent, so this must always carry the full desired set rather than a delta.
+    /// </summary>
+    internal sealed class InfisicalUpdateCertificateMetadataRequestDto
+    {
+        [JsonProperty("metadata")] public List<InfisicalCertificateMetadataEntryDto> Metadata { get; set; }
+    }
+
+    internal sealed class InfisicalCertificateMetadataEntryDto
+    {
+        [JsonProperty("key")] public string Key { get; set; }
+        [JsonProperty("value")] public string Value { get; set; }
+    }
+
+    internal sealed class InfisicalUpdateCertificateMetadataResponseDto
+    {
+        [JsonProperty("metadata")] public List<InfisicalCertificateMetadataEntryDto> Metadata { get; set; }
+    }
+
     internal sealed class InfisicalCertificateBundleResponseDto
     {
         [JsonProperty("serialNumber")] public string SerialNumber { get; set; }

src/PSInfisicalAPI/Pki/InfisicalCertificateMapper.cs

@@ -7,6 +7,24 @@ namespace PSInfisicalAPI.Pki
 {
     internal static class InfisicalCertificateMapper
     {
+        /// <summary>
+        /// Projects the API's metadata array into a case-insensitive dictionary. A certificate with no
+        /// metadata maps to an empty dictionary rather than null, so callers can index it unconditionally.
+        /// </summary>
+        public static Dictionary<string, string> MapMetadata(InfisicalCertificateSearchMetadataEntryDto[] entries)
+        {
+            Dictionary<string, string> result = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            if (entries == null) { return result; }
+
+            foreach (InfisicalCertificateSearchMetadataEntryDto entry in entries)
+            {
+                if (entry == null || string.IsNullOrEmpty(entry.Key)) { continue; }
+                result[entry.Key] = entry.Value ?? string.Empty;
+            }
+
+            return result;
+        }
+
         public static InfisicalCertificate Map(InfisicalCertificateResponseDto dto, string fallbackProjectId)
         {
             if (dto == null)
@@ -17,6 +35,7 @@ namespace PSInfisicalAPI.Pki
             return new InfisicalCertificate
             {
                 Id = dto.Id,
+                Metadata = MapMetadata(dto.Metadata),
                 ProjectId = !string.IsNullOrEmpty(dto.ProjectId) ? dto.ProjectId : fallbackProjectId,
                 CaId = dto.CaId,
                 CaName = dto.CaName,

src/PSInfisicalAPI/Pki/InfisicalCertificateRequestHelpers.cs

@@ -32,9 +32,29 @@ namespace PSInfisicalAPI.Pki
             if (!string.IsNullOrEmpty(organizationalUnit)) { result.OrganizationalUnit = organizationalUnit; }
             if (!string.IsNullOrEmpty(emailAddress)) { result.EmailAddress = emailAddress; }
 
+            result.CommonName = NormalizeCommonName(result.CommonName);
             return result;
         }
 
+        /// <summary>
+        /// Reduces a caller-supplied common name to the bare CN value. Callers commonly pass the RDN form
+        /// ("CN=HOST") or a full DN ("CN=HOST,OU=IT"); using either verbatim produces a doubled "CN=CN=HOST"
+        /// subject and a bogus "CN=HOST" DNS SAN, since the CSR builder adds the CN= prefix itself.
+        /// </summary>
+        public static string NormalizeCommonName(string commonName)
+        {
+            if (string.IsNullOrEmpty(commonName)) { return commonName; }
+
+            string value = commonName.Trim();
+            if (!value.StartsWith("CN=", StringComparison.OrdinalIgnoreCase)) { return value; }
+
+            value = value.Substring(3);
+            int separator = value.IndexOf(',');
+            if (separator >= 0) { value = value.Substring(0, separator); }
+
+            return value.Trim();
+        }
+
         public static string ResolveLocalFqdn()
         {
             try
@@ -76,6 +96,7 @@ namespace PSInfisicalAPI.Pki
                     store.RemoveRange(existing);
                 }
 
+                WarnIfInteractiveTrustPromptExpected(storeName, storeLocation, logger, component);
                 store.Add(cert);
                 logger.Information(component, string.Concat("Installed certificate to ", target, "."));
             }
@@ -85,6 +106,24 @@ namespace PSInfisicalAPI.Pki
             }
         }
 
+        /// <summary>
+        /// Adding to the per-user Root store makes Windows raise a modal trust confirmation dialog, and
+        /// X509Store.Add blocks until it is answered. When that dialog is hidden or the session is
+        /// non-interactive the caller just sees an unexplained hang, so say so before blocking. LocalMachine\Root
+        /// does not prompt, because writing it already required elevation.
+        /// </summary>
+        public static void WarnIfInteractiveTrustPromptExpected(StoreName storeName, StoreLocation storeLocation, IInfisicalLogger logger, string component)
+        {
+            if (storeName != StoreName.Root || storeLocation != StoreLocation.CurrentUser) { return; }
+            if (logger == null) { return; }
+
+            logger.Warning(component, string.Concat(
+                "Installing a root certificate into CurrentUser\\Root. Windows will display a security confirmation ",
+                "dialog and this call cannot continue until it is answered - if no dialog is visible, check for it ",
+                "behind the console window or on another desktop. Run elevated (or pass ",
+                "-StoreLocation LocalMachine) to install machine-wide without a prompt."));
+        }
+
         public static void InstallChain(InfisicalSignedCertificate signed, StoreLocation storeLocation, bool force, IInfisicalLogger logger, string component)
         {
             List<X509Certificate2> chainCerts = CollectChainCertificates(signed);
@@ -102,11 +141,93 @@ namespace PSInfisicalAPI.Pki
             }
         }
 
+        /// <summary>
+        /// Routes a chain member by what it is rather than by any caller preference: a self-signed certificate is
+        /// a root and belongs in the trusted-root store, anything else is a subordinate CA and belongs in the
+        /// intermediate store. Only the leaf honours -StoreName.
+        /// </summary>
         public static StoreName GetChainCertificateTargetStore(X509Certificate2 cert)
         {
             return IsSelfSigned(cert) ? StoreName.Root : StoreName.CertificateAuthority;
         }
 
+        /// <summary>
+        /// Sets the Windows friendly name shown in certmgr. Not available on every platform, and never important
+        /// enough to fail an otherwise successful issuance.
+        /// </summary>
+        public static void ApplyFriendlyName(X509Certificate2 cert, string friendlyName, IInfisicalLogger logger, string component)
+        {
+            if (cert == null || string.IsNullOrEmpty(friendlyName)) { return; }
+
+            try
+            {
+                cert.FriendlyName = friendlyName;
+                if (logger != null) { logger.Verbose(component, string.Concat("Set certificate friendly name to '", friendlyName, "'.")); }
+            }
+            catch (Exception exception)
+            {
+                if (logger != null) { logger.Verbose(component, string.Concat("Could not set the certificate friendly name (continuing): ", exception.Message)); }
+            }
+        }
+
+        /// <summary>
+        /// Confirms the freshly installed certificate actually chains to a trusted root using the machine's own
+        /// stores. A chain that stops short is what surfaces in Windows as "The issuer of this certificate could
+        /// not be found", so name the missing issuer rather than letting it be discovered later.
+        /// </summary>
+        public static void VerifyInstalledChain(X509Certificate2 leaf, IInfisicalLogger logger, string component)
+        {
+            if (leaf == null || logger == null) { return; }
+
+            try
+            {
+                using (X509Chain chain = new X509Chain())
+                {
+                    chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+                    if (chain.Build(leaf))
+                    {
+                        logger.Information(component, string.Concat("Certificate chain verified to a trusted root (", chain.ChainElements.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " elements)."));
+                        return;
+                    }
+
+                    bool partialChain = false;
+                    List<string> problems = new List<string>();
+                    foreach (X509ChainStatus status in chain.ChainStatus)
+                    {
+                        if (status.Status == X509ChainStatusFlags.NoError) { continue; }
+                        if (status.Status == X509ChainStatusFlags.PartialChain || status.Status == X509ChainStatusFlags.UntrustedRoot) { partialChain = true; }
+                        problems.Add(status.Status.ToString());
+                    }
+
+                    string topSubject = leaf.Subject;
+                    string missingIssuer = leaf.Issuer;
+                    if (chain.ChainElements.Count > 0)
+                    {
+                        X509Certificate2 top = chain.ChainElements[chain.ChainElements.Count - 1].Certificate;
+                        topSubject = top.Subject;
+                        missingIssuer = top.Issuer;
+                    }
+
+                    string detail = problems.Count > 0 ? string.Join(", ", problems.ToArray()) : "unknown";
+                    if (partialChain)
+                    {
+                        logger.Warning(component, string.Concat(
+                            "Certificate chain is incomplete (", detail, "). The highest certificate installed is '", topSubject,
+                            "', whose issuer '", missingIssuer, "' is not present in the trusted stores. Windows will report ",
+                            "\"The issuer of this certificate could not be found\" until that issuer is installed."));
+                    }
+                    else
+                    {
+                        logger.Warning(component, string.Concat("Certificate chain did not validate (", detail, ")."));
+                    }
+                }
+            }
+            catch (Exception exception)
+            {
+                logger.Verbose(component, string.Concat("Chain verification could not run (continuing): ", exception.Message));
+            }
+        }
+
         public static X509KeyStorageFlags ResolveKeyStorageFlags(InfisicalPrivateKeyProtection protection, bool persistKey, bool machineKey)
         {
             X509KeyStorageFlags flags = X509KeyStorageFlags.DefaultKeySet;

src/PSInfisicalAPI/Pki/InfisicalCertificateSanReader.cs

@@ -0,0 +1,164 @@
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Security.Cryptography.X509Certificates;
+using Org.BouncyCastle.Asn1;
+using Org.BouncyCastle.Asn1.X509;
+using NetX509Extension = System.Security.Cryptography.X509Certificates.X509Extension;
+
+namespace PSInfisicalAPI.Pki
+{
+    /// <summary>
+    /// The subject alternative names carried by a certificate, split the way a request specifies them.
+    /// </summary>
+    internal sealed class InfisicalCertificateSans
+    {
+        public HashSet<string> DnsNames { get; } = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        public HashSet<string> IpAddresses { get; } = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+    }
+
+    /// <summary>
+    /// Reads the subject alternative name extension from an installed certificate.
+    /// <para>
+    /// netstandard2.0 has no X509SubjectAlternativeNameExtension, and the string form produced by
+    /// X509Extension.Format is localized and therefore unusable for comparison, so the extension is decoded from
+    /// its DER bytes with BouncyCastle, which the module already carries for CSR generation.
+    /// </para>
+    /// </summary>
+    internal static class InfisicalCertificateSanReader
+    {
+        private const string SubjectAlternativeNameOid = "2.5.29.17";
+
+        public static InfisicalCertificateSans Read(X509Certificate2 cert)
+        {
+            InfisicalCertificateSans result = new InfisicalCertificateSans();
+            if (cert == null) { return result; }
+
+            foreach (NetX509Extension extension in cert.Extensions)
+            {
+                if (extension == null || extension.Oid == null) { continue; }
+                if (!string.Equals(extension.Oid.Value, SubjectAlternativeNameOid, StringComparison.Ordinal)) { continue; }
+
+                try
+                {
+                    // X509Extension.RawData is the content of the extnValue OCTET STRING, so it decodes straight
+                    // into the GeneralNames SEQUENCE.
+                    Asn1Object decoded = Asn1Object.FromByteArray(extension.RawData);
+                    GeneralNames names = GeneralNames.GetInstance(decoded);
+                    if (names == null) { continue; }
+
+                    foreach (GeneralName name in names.GetNames())
+                    {
+                        if (name == null) { continue; }
+                        AddName(result, name);
+                    }
+                }
+                catch (Exception)
+                {
+                    // A certificate this malformed cannot be matched against a request; treat it as carrying no
+                    // usable SANs rather than failing the caller's issuance.
+                }
+            }
+
+            return result;
+        }
+
+        private static void AddName(InfisicalCertificateSans target, GeneralName name)
+        {
+            switch (name.TagNo)
+            {
+                case GeneralName.DnsName:
+                {
+                    string value = name.Name != null ? name.Name.ToString() : null;
+                    if (!string.IsNullOrEmpty(value)) { target.DnsNames.Add(value.Trim()); }
+                    break;
+                }
+                case GeneralName.IPAddress:
+                {
+                    string value = FormatIpAddress(name);
+                    if (!string.IsNullOrEmpty(value)) { target.IpAddresses.Add(value); }
+                    break;
+                }
+            }
+        }
+
+        /// <summary>
+        /// An iPAddress general name holds raw address octets, four for IPv4 and sixteen for IPv6.
+        /// </summary>
+        private static string FormatIpAddress(GeneralName name)
+        {
+            try
+            {
+                Asn1OctetString octets = Asn1OctetString.GetInstance(name.Name);
+                if (octets == null) { return null; }
+
+                byte[] bytes = octets.GetOctets();
+                if (bytes == null) { return null; }
+                if (bytes.Length != 4 && bytes.Length != 16) { return null; }
+
+                return NormalizeIpAddress(new IPAddress(bytes).ToString());
+            }
+            catch (Exception)
+            {
+                return null;
+            }
+        }
+
+        /// <summary>
+        /// Collapses the textual variations of one address so "::1" and "0:0:0:0:0:0:0:1" compare equal.
+        /// </summary>
+        public static string NormalizeIpAddress(string value)
+        {
+            if (string.IsNullOrEmpty(value)) { return value; }
+
+            IPAddress parsed;
+            if (IPAddress.TryParse(value.Trim(), out parsed))
+            {
+                return parsed.ToString();
+            }
+
+            return value.Trim();
+        }
+
+        /// <summary>
+        /// Reports whether a candidate certificate carries every name the caller asked for. A certificate with
+        /// extra names still satisfies the request; one missing a requested name does not, and reusing it would
+        /// hand back a certificate that fails validation for the name that was added.
+        /// </summary>
+        public static bool CoversRequestedNames(X509Certificate2 candidate, IEnumerable<string> dnsNames, IEnumerable<string> ipAddresses, out string missingName)
+        {
+            missingName = null;
+            if (candidate == null) { return false; }
+
+            InfisicalCertificateSans present = Read(candidate);
+
+            if (dnsNames != null)
+            {
+                foreach (string dns in dnsNames)
+                {
+                    if (string.IsNullOrEmpty(dns)) { continue; }
+                    if (!present.DnsNames.Contains(dns.Trim()))
+                    {
+                        missingName = string.Concat("DNS:", dns.Trim());
+                        return false;
+                    }
+                }
+            }
+
+            if (ipAddresses != null)
+            {
+                foreach (string ip in ipAddresses)
+                {
+                    if (string.IsNullOrEmpty(ip)) { continue; }
+                    if (!present.IpAddresses.Contains(NormalizeIpAddress(ip)))
+                    {
+                        missingName = string.Concat("IP:", NormalizeIpAddress(ip));
+                        return false;
+                    }
+                }
+            }
+
+            return true;
+        }
+    }
+}